Privacy Policy

Information We Collect

Types of Information

We collect various kinds of information that you provide to us as well as information we obtain from your use of the Services. Some of the types of information that we collect include:

Personal Information. Information associated with or used to identify or contact a specific person. Personal Information includes: (1) contact data (such as email address, telephone number and employer); (2) demographic data (such as gender, date of birth and zip code); (3) certain Usage Data (defined below), such as IP address; and (4) course responses, survey answers, reflections, and other content you submit through our educational programs, as well as purchase history if you purchase a Course through the Services.

Certain Personal Information, such as information about personal health or finances, is characterized as Sensitive and subject to stricter regulation than other personal information. Before providing it to us, we urge you to carefully consider whether to disclose your Sensitive Personal Information to us. If you do provide Sensitive Personal Information to us, you consent to its use and disclosure for the purposes and in the manner described in this Privacy Policy.

Account Information (via Teachable). When you register for the Course through Teachable, Inc. (a Hotmart B.V., Amsterdam Company), the Platform collects your name and email address. This information is governed by the Teachable Privacy Policy. Liby Health, Inc. can access this information through the Teachable instructor dashboard to administer the Course and communicate with enrolled users.

Unlinked Survey Responses (via Tally). The Course includes a series of self-assessment check-ins and reflective surveys powered by Tally (tally.so), a third-party survey platform. Health-related information is processed as unlinked individual responses. This means your data is not connected to your account, name, or email address. Because these responses are not linked back to you, we do not perform individual tracking of progress over time during this period. Survey data is analyzed to improve Course content and community resources.

Surveys collect. Predefined multiple-choice responses (e.g., symptom patterns, experience ratings) and limited open-text reflections. Please do not include your name or specific personal details in open-text fields.

Course Completion Data (via Teachable). Teachable tracks which lessons you have completed and your progress through the Course. This is standard Platform functionality and is governed by the Teachable Privacy Policy.

Support and Educational Content. We collect information you submit, such as responses to non-clinical background questions regarding your recovery or caregiving experience and current support needs.

Usage Data. Information about an individual's online activity that, by itself, does not identify the individual, such as:

• technical information, including your browser type, service provider, IP address, operating system and webpages visited;
• information about what you've searched for and looked at while using the Services;
• metadata, which means information related to items you made available through the Services, such as the date, time or location that a shared photograph or video was taken or posted.

Location Data. A category of Personal Information collected about the location of a mobile device or computer, including:

• the location of the mobile device or computer used to access the Services derived from GPS or WiFi use;
• the IP address of the mobile device or computer or internet service used to access the Services.

No Third-Party Tracking. We are not running Google Analytics, the Meta Pixel (formerly Facebook Pixel), or any other third-party tracking technologies for the purpose of targeted advertising or behavioral profiling. We do not monitor your activity for the purpose of selling or sharing your interests with advertising networks.

How We Collect Information

Whether we collect certain types of information and how we process it depends on how you use and access the Services. Some information is collected automatically through use of cookies and similar data collection tools. We collect information about you in the following ways:

From You. We collect information from you when you:

• Use the Services. We collect Personal Information from you when you create an account to use one of the Services, contact us for help or information or otherwise voluntarily provide your Personal Information. We collect the information and content that you submit to us, such as when you respond to non-clinical background questions regarding your recovery or caregiving experience and current support needs.
• Complete a course survey, check-in, or reflection. When you respond to optional surveys, lesson check-ins, or reflection prompts within the Services, we may collect your responses. These surveys do not collect your name or email address, and responses are not linked to your account. Because responses are unlinked, we do not track individual progress over time during this period.
• Purchase or access materials through our platform. When you enroll in a Course or access a digital download through the Services, our Course platform provider (Teachable) and, for paid transactions, our payment processor, may collect your name, email address, and transaction details.

From Our Business Partners and Service Providers. Third parties that assist us with our business operations also collect information (including Personal Information and Usage Data) about you through the Services and share it with us. For example, our vendors collect and share information with us to help us detect and prevent fraud.

We may combine the information we collect from you with information from other sources and use the combined information as described in this Privacy Policy.

Tally (Survey Data):

• Tally is a Belgium-based company operating under European Union data protection laws (GDPR).
• All survey data is stored on EU-based servers.
• Data is encrypted in transit (TLS) and at rest.
• Tally acts as a data processor; Liby Health, Inc. is the data controller.
• Tally does not sell data to third parties.
• Tally only shares data with GDPR-compliant service providers necessary for platform operation.
• Liby Health, Inc. retains full control to export and delete all survey data.

Google Sheets (Aggregate Data Sync):

• Unlinked individual-level survey responses are synced to Google Sheets on a Liby Health Google Workspace account for analysis.
• This data contains no personally identifying information.
• Access is restricted to authorized Liby Health team members.

Google Fonts

• Our Services utilize Google Fonts to ensure consistent rendering of text. When you access the Course, your IP address is transferred to Google servers to allow for the rendering of these fonts on your device.

Teachable (Account and Progress Data):

• Account information and course progress are stored by Teachable in accordance with their Privacy Policy.
• Liby Health, Inc. accesses this data through the Teachable instructor dashboard.

Teachable Payments and Stripe

• When you purchase a Course or other paid materials through the Services, payments are processed by Teachable Payments, our Course platform provider's payment product, which partners with Stripe for secure transaction processing. Information collected may include payment card details, billing address, and transaction amount.
• Liby Health, Inc. does not store full payment card information.
• Teachable's and Stripe's handling of your payment information is governed by their respective Privacy Policies.

Usage Data. We also automatically collect Usage Data when you interact with the Services.

From cookies and other data collection tools. We, along with the service providers that help us provide the Services, use small text files called "cookies", which are small computer files sent to or accessed from your web browser or your computer's or tablet's hard drive that contain information about your computer, such as a user ID, user settings, browsing history and activities conducted while using the Services. Cookies are not themselves personally identifiable, but may be linked to Personal Information that you provide to us through your interaction with the Services. A cookie typically contains the name of the domain (internet location) from which the cookie originated, the "lifetime" of the cookie (i.e., when it expires) and a randomly generated unique number or similar identifier.

Cookies help us improve the Services by tracking users' navigation habits and storing users' password, customizing users' experience with the Services; enabling us to analyze technical and navigational information about the Services; and helping to detect and prevent fraud.

We also use other cookies and other data collection tools (such as web beacons and server logs), which we collectively refer to as "data collection tools," to help improve your experience with the Services. For example, data collection tools help us remember users and make the Services more relevant to them.

The Services also may use data collection tools to collect information from the device used to access the Services, such as operating system type, browser type, domain and other system settings, as well as the operating system used and the country and time zone in which the computer or device is located.

Web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to manage and delete cookies, visit www.allaboutcookies.org. Some web browsers (including some mobile web browsers) provide settings that allow a user to reject cookies or to alert a user when a cookie is placed on the user's computer, tablet or mobile device. Most mobile devices also offer settings to reject mobile device identifiers. Although users are not required to accept cookies or mobile device identifiers, blocking or rejecting them may prevent access to some features available through the Services.

Interactive Tools. We utilize third-party interactive platforms (e.g., Google Docs) to provide educational features and journaling prompts. Please note that while these tools are used to facilitate your experience, any information you input into these platforms may be subject to the third party's own data practices. We encourage you to review the privacy policies of these providers, as Liby Health, Inc. does not store permanent copies of such data on our proprietary infrastructure.

How We Use Your Information

We may use the information we collect for any of the following purposes:

• to provide the Services to you;
• to operate, improve and personalize the products and services we offer, and to give each user a more consistent and personalized experience when interacting with us;
• for customer service, security, to detect fraud or illegal activities, or for archival and backup purposes in connection with the provision of the Services;
• to communicate with users, including sending Course reminders, content updates, support responses, research participation invitations, and optional marketing communications you may unsubscribe from at any time;
• to better understand how users access and use the Services, for the purposes of trying to improve the Services and to respond to user preferences, including language and location customization, personalized help and instructions, or other responses to users' usage of the Services;
• to help us develop our new products and services and improve our existing products and services;
• to enforce our Terms of Service or other applicable policies;
• to provide access to courses, manage your account, and facilitate support group sessions;
• to send program updates, reminders for sessions, and administrative notices;
• to maintain the security of our platform and improve our educational content;
• to analyze qualitative notes and anecdotes to improve our educational content and better understand user preferences;
• to analyze unlinked individual-level survey responses to improve Course content;
• to track Course completion for certificate issuance; and
• to understand general usage patterns to improve the learning experience.

Please note that, in order to provide you with a better experience and to improve the Services, information collected through the Services may be used in an aggregated or individualized manner.

How We Share and Disclose Your Information

We may share and disclose information as described at the time information is collected or as follows:

When you consent. We may share Personal Information with third parties if you have given us your consent to do so. We will only share Sensitive Personal Information when you have given us your opt-in consent.

To perform services. We may disclose Personal Information to third parties in order to perform services requested or functions initiated by users, such as Teachable, Inc. (course hosting and account management), Teachable Payments / Stripe (payment processing), and Zoom or Google Meet (if used for optional support group sessions). In addition, we may disclose Personal Information in order to identify a user in connection with communications sent through the Services. We also may offer users the opportunity to share information with friends and other users through the Services.

With third party service providers performing services on our behalf. We may share information, including Personal Information, with our service providers to perform the functions for which we engage them (such as hosting and data analyses). We may share information as needed to operate other related services.

For legal purposes. We also may share information that we collect from users, as needed, to enforce our rights, protect our property or protect the rights, property or safety of others, or as needed to support external auditing, compliance and corporate governance functions. We will disclose Personal Information as we deem necessary to respond to a subpoena, regulation, binding order of a data protection agency, legal process, governmental request or other legal or regulatory process. We may also share Personal Information as required to pursue available remedies or limit damages we may sustain.

In aggregated form. We may share Personal Information about you in an aggregated form, that is, in a statistical or summary form that does not include any personal identifiers, with third parties in order to discover and reveal trends about how users like you interact with our services.

During corporate changes. We may transfer information, including your Personal Information, in connection with a merger, sale, acquisition or other change of ownership or control by or of us or any affiliated company (in each case whether in whole or in part). When one of these events occurs, we will use reasonable efforts to notify users before your information is transferred or becomes subject to a different privacy policy.

Information Storage and Security

We retain information as long as it is necessary and relevant for our operations. We also retain Personal Information from closed accounts to comply with applicable law, prevent fraud, resolve disputes, troubleshoot problems, assist with any investigation, enforce our Terms of Service, collect any fees owed and other actions permitted by law. After it is no longer necessary for us to retain information, we dispose of it according to our data retention and deletion policies.

We employ industry-standard security measures designed to protect the security of all information submitted through the Services. However, the security of information transmitted through the internet can never be guaranteed. We are not responsible for any interception or interruption of any communications through the internet or for changes to or losses of data. Users of the Services are responsible for maintaining the security of any password, user ID or other form of authentication involved in obtaining access to password protected or secure areas of any of our digital services. In order to protect you and your data, we may suspend your use of any of the Services, without notice, pending an investigation, if any breach of security is suspected. Access to and use of password protected and/or secure areas of any of the Services are restricted to authorized users only. Unauthorized access to such areas is prohibited and may lead to criminal prosecution.

Data Retention and Deletion

A. Deletion Requests. Liby Health, Inc. honors data deletion requests for personal information within our direct control. While aggregate, fully de-identified data is retained indefinitely for research and course improvement purposes, you may request the deletion of your course-specific records by contacting us at privacy@libyhealth.com. We will acknowledge and process such requests within thirty (30) days, or as otherwise required by applicable law.

B. Platform Data. Certain account data (such as your name and email address) is managed through the Teachable platform. Requests to delete a Teachable account must be submitted directly through your Platform account settings and are governed by Teachable's Privacy Policy.

C. Retention Periods. We retain your information only for as long as necessary to fulfill the educational objectives of the Course and to comply with our legal and professional obligations. Our standard retention periods are as follows:

• Course Progress and Account Information. Duration of your active enrollment plus twelve (12) months.
• Survey Response Data. Three (3) years from the date of collection to support aggregate trend analysis.
• Administrative and Support Records. Two (2) years following the closure of your account to resolve potential disputes.
• Financial and Regulatory Records. Seven (7) years to comply with applicable tax and business record-keeping laws.

Your Rights

It is important to us that you are able to access and review the Personal Information we have about you and make corrections to it or delete it, as necessary. You can visit Your Account to manage and correct the information we have on file about you.

If you have any questions about how to access your Personal Information, please contact us at privacy@libyhealth.com.

Links to Third Party Services

The Services may contain links to third-party websites and services ("Third Party Services") with which we have no affiliation. A link to any Third Party Service does not mean that we endorse it or the quality or accuracy of information presented on it. If you decide to visit a Third Party Service, you are subject to its privacy policy and practices and not this Privacy Policy. We encourage you to carefully review the legal and privacy notices of all other digital services that you visit.

Disclaimer: Not Child-Directed

The Services are not intended for use by children. If you are under the age of majority in your place of residence, you may use the Services only with the consent of or under the supervision of your parent or legal guardian.

Consistent with the requirements of the Children's Online Privacy Protection Act (COPPA), if we learn that we have received any information directly from a child under age 13 without first receiving his or her parent's verified consent, we will use that information only to respond directly to that child (or his or her parent or legal guardian) to inform the child that he or she cannot use the Services and subsequently we will delete that information.

California Residents (CCPA/CPRA)

We include this section for residents of California in order to comply with the California Consumer Privacy Act of 2018, and its amendment, the California Privacy Rights Act of 2020 (together, the "CCPA"). This section is intended to comply with the CCPA by supplementing the information provided elsewhere in this Privacy Policy.

Applicability. The CCPA applies to for-profit businesses that meet certain revenue or data-processing thresholds. While Liby Health, Inc. may not currently meet these thresholds, we provide the following disclosures to California residents in the interest of transparency and to establish a compliance foundation as our services grow.

Collection of Personal Information. Liby Health, Inc. may collect the personal information described in the "Information We Collect" section of this Privacy Policy. Please note that some of this personal information is considered Sensitive Personal Information under the CCPA, including health-related information you voluntarily provide through self-assessment surveys (e.g., symptom patterns, experience ratings, recovery reflections). We treat all health-related information collected through the Course as Sensitive Personal Information.

Use of Personal Information. Liby Health, Inc. may collect, use, or disclose personal information about California residents for the purposes listed in the "How We Use Your Information" section of this Privacy Policy. We use Sensitive Personal Information for the same purposes, except that we do not use Sensitive Personal Information to infer characteristics about you for purposes unrelated to the services you have requested.

Disclosure of Personal Information. We may disclose your personal information to the categories of service providers and third parties identified in the "How We Share and Disclose Your Information" section of this Privacy Policy, and in the ways described in that section.

Sale and Sharing of Personal Information. Liby Health, Inc. does not sell Personal Information as defined by the CCPA, including for monetary or other valuable consideration. We do not "share" Personal Information for cross-context behavioral advertising. We do not use or disclose Sensitive Personal Information for purposes beyond those authorized under CCPA § 1798.121.

Data Retention. We retain Personal Information for the periods described in the "Data Retention and Deletion" section of this Privacy Policy.

Your California Privacy Rights. We generally provide the privacy rights described in the "Your Rights" section above to you regardless of your location. Subject to applicable exceptions under the CCPA, California residents have the following additional or supplemental rights:

• Right to Know. You may request that we disclose the categories and specific pieces of Personal Information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we have disclosed your information.
• Right to Delete. You may request that we delete Personal Information we have collected from you, subject to certain exceptions (e.g., legal obligations, completing a transaction, security purposes).
• Right to Correct. You may request that we correct inaccurate Personal Information.
• Right to Opt Out of Sale and Sharing. Because we do not sell or share Personal Information, this right does not currently apply. If our practices change, we will update this section and provide an opt-out mechanism.
• Right to Limit Use of Sensitive Personal Information. You may direct us to limit the use of your Sensitive Personal Information to uses necessary to provide the services you have requested. Because we already limit our use to these purposes, this right is satisfied by our current practices.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights.

How to Exercise Your Rights. To submit a request, contact us at privacy@libyhealth.com or at the address provided in the "Contact Us" section of this Privacy Policy. Please specify that you are making a request under the CCPA. We will verify your identity before processing your request by matching information you provide against information in our records. We will respond within forty-five (45) days of receiving a verifiable request. If we require additional time (up to an additional forty-five days), we will notify you in writing. You may designate an authorized agent to submit a request on your behalf; we may require written authorization and identity verification from both you and the agent.

Privacy Notice for Residents of Other U.S. States

We include this section for residents of other U.S. states with privacy laws that may impact them. These privacy laws include the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Utah Consumer Privacy Act ("UCPA"), the Delaware Personal Data Privacy Act ("DPDPA"), the Indiana Consumer Data Protection Act ("ICDPA"), the Iowa Consumer Data Protection Act ("ICDPA"), the Kentucky Consumer Data Protection Act ("KCDPA"), the Maryland Online Data Privacy Act ("MODPA"), the Minnesota Consumer Data Privacy Act ("MCDPA"), the Montana Consumer Data Privacy Act ("MCDPA"), the Nebraska Data Privacy Act ("NDPA"), the New Hampshire Privacy Act ("NHPA"), the New Jersey Data Privacy Act ("NJDPA"), the Oregon Consumer Privacy Act ("OCPA"), the Rhode Island Data Transparency and Privacy Protection Act ("RIDTPPA"), the Tennessee Information Protection Act ("TIPA"), and the Texas Data Privacy and Security Act ("TDPSA"). This section is intended to comply with these laws by supplementing the information provided elsewhere in this Privacy Policy.

Note: Consumer health data rights under the CTDPA (Connecticut), as well as rights under Washington's My Health My Data Act and Nevada's SB 370, are addressed in the Consumer Health Data Privacy Policy linked here.

Collection, Use, and Disclosure of Personal Information. Liby Health, Inc. may collect the personal information described in the "Information We Collect" section, use it for the purposes described in the "How We Use Your Information" section, and disclose it to the recipients described in the "How We Share and Disclose Your Information" section of this Privacy Policy. Some of this personal information may be considered "sensitive data" under your state's legal definition, which varies across states. For Liby Health, Inc., the personal information most likely to be classified as sensitive includes information relating to physical or mental health conditions (e.g., self-assessment survey responses regarding ICU recovery symptoms and experiences). Liby Health, Inc. does not sell personal data as defined under any applicable state privacy law. We do not process personal data for purposes of targeted advertising.

Your Privacy Rights. We generally provide the privacy rights described in the "Your Rights" section above regardless of your location. Depending on your state of residence, you may have the following additional rights, subject to applicable exceptions and limitations:

• Right to Access. You may confirm whether we are processing your personal data and request access to that data.
• Right to Correct. You may request correction of inaccurate personal data.
• Right to Delete. You may request deletion of personal data we have collected from or about you.
• Right to Data Portability. You may request a copy of your personal data in a commonly used, machine-readable format.
• Right to Opt Out. You may opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. Because Liby Health, Inc. does not currently engage in any of these activities, these opt-out rights do not currently apply. If our practices change, we will update this section and provide appropriate opt-out mechanisms, including honoring universal opt-out mechanisms where required by law.

Sensitive Data. Under several state laws, information revealing a mental or physical health condition or diagnosis constitutes "sensitive data" requiring opt-in consent before processing. We obtain your affirmative consent before collecting and processing such data as described in the Terms of Service and through the consent mechanism presented during Course enrollment. You may withdraw your consent at any time by contacting privacy@libyhealth.com.

How to Exercise Your Rights. To submit a request, contact us at privacy@libyhealth.com or at the address provided in the "Contact Us" section. We will verify your identity before processing your request. We will respond within the timeframe required by your state's law (generally forty-five (45) days, with extensions as permitted).

Right to Appeal. If we decline your request, you may appeal by contacting us at privacy@libyhealth.com with the subject line "Privacy Rights Appeal." We will respond within the timeframe required by applicable law. If your appeal is denied, you may contact your state's Attorney General to file a complaint.

State-Specific Disclosures.

Colorado, Connecticut (general provisions), and Virginia: Residents may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. Liby Health, Inc. does not currently engage in profiling of this nature.

Minnesota and Oregon: Residents may obtain a list of the specific third parties to whom we have disclosed personal data. You may make this request using the contact information in the "Contact Us" section. General information about the categories of third parties with whom we share data is available in the "How We Share and Disclose Your Information" section.

Rhode Island: The RIDTPPA entitles residents to know the third parties to which we sell or may sell their personal data. Liby Health, Inc. does not sell personal data.

Nevada: Nevada provides residents a right to opt out of the sale of covered information. Liby Health, Inc. does not sell covered information as defined by Nevada law.

Universal Opt-Out Mechanisms: Where required by applicable state law (including in Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas), Liby Health, Inc. will honor universal opt-out preference signals (such as the Global Privacy Control) received through your browser. Because we do not currently sell personal data or process personal data for targeted advertising, opt-out signals will be acknowledged but will not result in a change to your experience.

International Data Transfers

Liby Health, Inc. is based in the United States, and our service providers may process data in the European Union or other jurisdictions. For transfers of personal data from the EU/EEA to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or other lawful transfer mechanisms that ensure an adequate level of protection for your personal data.

HIPAA and Health Information Disclaimer

Liby Health, Inc. is not a "covered entity" under the Health Insurance Portability and Accountability Act (HIPAA), and therefore HIPAA does not apply to our collection, use, or disclosure of your information. However, we adhere to strict privacy standards and implement reasonable security measures to protect your health-related information. Our services are educational in nature and do not constitute medical advice, diagnosis, treatment, or clinical documentation. You should not rely on our services as a substitute for professional medical advice. The health-related information you provide may be subject to other applicable privacy laws, including state health privacy laws and the Federal Trade Commission Act.

Contact Us

If you have questions about this policy or your data rights, please contact:

Liby Health, Inc.

Email: privacy@libyhealth.com

Mailing Address:

Liby Health Inc.
c/o Legalinc Corporate Services Inc. (registered agent)
131 Continental Drive, Suite 305
Newark, DE 19713

Subject: Privacy Policy Inquiry

For EU residents exercising rights under GDPR, please include "GDPR Request" in your subject line. We will respond to your inquiry within thirty (30) days, or as otherwise required by applicable law.