PATCH THERAPY, INC. – PRIVACY POLICY

Effective Date: August 20, 2026

Patch Therapy, Inc. ("Patch," "we," "us," or "our") provides a technology platform www.carebypatch.com, (collectively, the "Platform"), that allows parents and legal guardians to locate licensed pediatric therapy Providers, complete intake processes, schedule in-person sessions, communicate with Providers, share documents, and manage session payments.

The Platform is intended for use by adults. Minors may not create accounts or independently use the Platform. Parents and legal guardians may provide information about a minor for pediatric therapy coordination and care.

1. REGULATORY FRAMEWORK & SCOPE

Depending on your geographic location and your user classification, Patch handles data under the following distinct legal structures:

United States Users (HIPAA): HIPAA applies when Patch processes "Protected Health Information" (PHI) as a Business Associate on behalf of a healthcare Provider that is a Covered Entity. Not every piece of health-related information processed by a consumer- facing platform is necessarily PHI under HIPAA; however, Patch applies appropriate privacy and security safeguards to all sensitive pediatric health information.

2. THE TYPES OF INFORMATION WE COLLECT

We limit data collection to the information necessary to successfully connect Families with Providers, manage clinical intake routing, and maintain Platform security.

A. Information Submitted by Families

Account Registration Data: Full names, email addresses, physical addresses, and general location information used for local Provider matching, scheduling, and billing. Passwords are encrypted by our authentication provider and are never accessible to us in plaintext.

Pediatric Patient Care Data (Sensitive Health Information): A child's full name, date of birth, developmental or diagnostic history summaries, previous clinical evaluations, therapist logs, physician information, Therapy type requested, Intake responses, Availability and appointment information, Provider communications, Uploaded assessments, referral documents, school records or clinical records, Parent/guardian relationship and authorization information, and school documentation voluntarily uploaded by the family to facilitate and expedite clinical intakes.

Financial Processing & Payment Data:

Therapy Sessions (Stripe): Stripe processes payments for therapy sessions. Patch receives transaction statuses, amounts, dates, customer identifiers, billing contact info, and limited payment details. Full card numbers are never stored by Patch, nor do we submit clinical information, diagnoses, or child names to Stripe. o App Subscriptions
App Subscription (Apple & RevenueCat): Apple processes in-app subscription purchases. RevenueCat validates and manages subscription entitlements. Patch receives subscription status, product/transaction identifiers, renewal status, and purchase history, but never full payment card details.

B. Information Submitted by Providers

Credential Verification Data: National Provider Identifier (NPI) numbers, professional clinical licensing credentials, Identity verification, Licensure status, Professional documents, Availability, Service location, Subscription status, Appointment and payment information, geographic practicing sub-specialties, proof of professional liability insurance, and clinical address profiles.

C. Passively or Automatically Collected Data ("Usage Data")

Device & Usage Metrics: Technical logs including IP addresses, device models, operating systems/versions, unique device identifiers, mobile network details, time zone settings, push-notification tokens, crash/performance data, security logs, and in-app interaction telemetry (screens viewed, actions taken).

Cookies and Tracking: Essential cookies, local storage objects (LSOs), and technical tokens used to maintain secure sessions, store preferences, and compile aggregate analytics. We do not currently respond to browser "Do Not Track" signals.

Location Data: Precise GPS information collected with your permission to match Families with nearby therapists. You can disable location tracking at any time in your device settings.

With the user’s permission, Patch may collect precise or approximate device location to identify nearby Providers. Users may decline device location access and instead enter an address, ZIP/postal code, city, or other location manually.

Users may withdraw device-location permission through device settings and use manual location entry instead. Users may manage push-notification permissions through device settings, opt out of nonessential SMS communications by replying STOP, and withdraw future authorization for Provider access through the Platform or by contacting Patch. Withdrawal does not affect processing that occurred lawfully before withdrawal.

Messages and attachments:

Patch collects private messages exchanged between Families and Providers, including sender and recipient identifiers, message contents, timestamps, delivery status, and attachments. Attachments may include images, PDFs, assessments, referral documentation, school documentation, or other information uploaded by a user.

Messaging and attachments are processed using Stream. Authorized Patch personnel may access reported messages and related information when necessary for safety, moderation, support, security, or legal compliance.

3. PERMITTED USES & DISCLOSURES OF DATA

Patch uses your Personal Information and health-related data for the performance of the core connecting services for which it was given. Permitted operations include:

Treatment Facilitation: Securely transmitting registration information, developmental histories, and intake documentation to the specific independent Provider selected and approved by the Family.

Account Operations: Authenticating user credentials, executing platform optimizations, verifying professional licenses, and sending operational notifications (such as text message appointment alerts).

Legal Obligations & Enforcement: Disclosing information in good faith to satisfy applicable laws, regulations, subpoenas, court orders, or enforceable governmental requests, as well as addressing platform fraud or security vulnerabilities.

Corporate Successors: In the event of an acquisition, merger, asset sale, or liquidation, transferring account structures to the acquiring organization, provided they agree to maintain all privacy commitments outlined herein.

Strict Prohibition on Marketing Sales: Patch does not sell personal information. Patch does not use or disclose pediatric health information, therapy records, private communications, uploaded clinical documents, or precise location for targeted advertising, behavioral advertising, data-broker activities, marketing profiles, or unrelated commercial data mining.
-  Managing intake and appointment scheduling.
-  Creating and authenticating accounts.
-  Verifying Provider credentials.
-  Matching Families with nearby Providers.
-  Enabling secure private messaging and attachments.
-  Processing Provider subscriptions.
-  Processing in-person therapy payments.
-  Providing customer support.
-  Investigating reported content, abuse, fraud and security incidents.
-  Sending operational notifications.
-  Maintaining audit and security records.
-  Complying with healthcare, billing and legal obligations.
-  Improving reliability and performance through appropriately limited analytics.

4. HOW INFORMATION IS SHARED

Selected Providers

Patch shares a child’s intake and health information with a Provider only when the Family selects or authorizes that Provider, or when disclosure is otherwise permitted or required by law.

Supabase

Patch uses Supabase for database, authentication, storage, and related infrastructure services. Supabase may process account, patient, Provider, appointment, document, and technical information on Patch’s behalf.

Stream

Patch uses Stream to provide private messaging and attachment functionality. Stream processes messages, sender and recipient identifiers, timestamps, attachments, and related communication metadata on Patch’s behalf.

Stripe

Patch uses Stripe to process payments for in-person therapy sessions.

Apple and RevenueCat

Apple processes Provider In-App Purchases. RevenueCat processes subscription transaction identifiers and entitlement information to validate subscription access.

Other providers

Hosting and infrastructure.
Email/SMS/push providers.
Analytics and crash reporting.
Maps/location.
Customer support.
Professional license verification.
Legal and security advisers.

Patch requires service providers that process personal information on its behalf to use the information only for authorized purposes and to provide privacy and security protections appropriate to the sensitivity of the information and consistent with Patch’s contractual and legal obligations.

Corporate transactions

Any successor receiving personal information must assume applicable privacy, security, contractual, and legal obligations. Where required, affected users will receive notice before their information becomes subject to materially different practices.

Patch uses administrative, technical, and organizational safeguards designed to protect personal information and PHI. These measures include encryption in transit and at rest where appropriate, role-based access controls, multi-factor authentication for privileged accounts where supported, logging, monitoring, backup controls, secure development practices, vendor management, and incident-response procedures.

5. TECHNICAL, PHYSICAL, & ADMINISTRATIVE SAFEGUARDS

Patch implements industry-standard technical, physical, and organizational security procedures to protect data from unauthorized access, electronic intrusion, or unlawful disclosure.

U.S. Operations: Patch strictly executes data workflows in accordance with the HIPAA Security Rule safeguards detailed below as part of its obligations as a Business Associate.

Our platform-wide safeguards include:

Enterprise Encryption: All personal data and electronic clinical records are encrypted using enterprise-grade cryptographic algorithms while in transit across public networks and at rest within cloud storage systems.

Role-Based Access Controls (RBAC): Access to patient information is restricted through role-based access controls. Patient information is ordinarily available to the relevant parent or legal guardian and authorized Provider. A limited number of authorized Patch personnel and service providers may access information when necessary for support, moderation, security, legal compliance, system administration, or another purpose described in this Policy. Administrative access is restricted according to job responsibilities and is logged where appropriate.

Audit Logs: Audit logs designed only to record access and administrative activity. The Platform utilizes persistent server logging systems to record all actions involving client intake files, creating a clear history of which accounts have accessed, updated, or exported health information.

Statutory Breach Notification: Patch provides breach notifications within the timeframes required by applicable law and relevant contractual obligations. Where the HIPAA Breach Notification Rule applies, notification will be provided without unreasonable delay and within the applicable statutory deadline.

6. INDIVIDUAL PRIVACY RIGHTS & DATA PORTABILITY

Users utilizing the Platform retain comprehensive rights over their data files under regional health and data regulations:

A. Right of Access, Portability, and Account Export

Families and Providers may submit a formal request to download or transmit a copy of their Account Data (including profile information, preferences, and user-submitted intake documentation).

Patch will provide this export within a reasonable time, free of charge, delivered in a structured, commonly used, machine-readable format (e.g., JSON or CSV). We reserve the right to verify your identity and account ownership before delivering files. This feature excludes internal security, fraud-prevention, or administrative records.

B. Right to Rectification / Amendment

If you determine that account parameters or structural intake entries contain errors, you may update them directly within your account settings or request modifications for legitimate purposes. Patch requires identity verification prior to approving major administrative changes.

C. Account Deletion & Retention

Users may initiate account deletion through Settings → Account → Delete Account. Patch manually verifies and processes requests because the Platform handles healthcare and sensitive pediatric information. Patch informs users of the expected processing period and confirms completion.

Patch deletes, or de-identifies, account information that it is not legally required to retain. Certain medical, billing, security, fraud-prevention, transaction, or legal records may be retained when required or permitted by applicable law. Independent Providers may separately retain records under professional healthcare record-retention requirements.

Deleting a Patch account does not automatically cancel an Apple subscription. Providers can manage Apple subscriptions through their Apple Account.

D. California Privacy Rights

Under the California "Shine the Light" law (California Civil Code § 1798.83), California residents have the right once a year to inquire about the categories of personal information a business has shared with third parties for those third parties' direct marketing purposes. Inquiries must be emailed to contact@carebypatch.com with the subject line "California Privacy Request". Please note that as stated in Section 3, Patch explicitly prohibits the selling or sharing of health data or personal information for commercial marketing.

Pursuant to the California Consumer Privacy Act (CCPA/CPRA), Patch collects and processes "Sensitive Personal Information"—specifically precise geolocation and pediatric care history records—solely to perform the core operational services necessary to connect Families with Providers as requested. Because this data is used strictly to fulfill expected service functions and is never used to infer characteristics or build profiling matrices, Where applicable, Patch processes sensitive personal information only for permitted operational purposes. Patch does not use sensitive personal information to infer characteristics or for targeted advertising. California residents may contact Patch regarding any rights available under applicable California law.

Where required by law, Patch will obtain consent before applying a materially expanded use of previously collected sensitive information.

E. Chat deletion

Chat messages and attachments are deleted or retained according to Patch’s retention requirements, applicable healthcare-record obligations, safety requirements, and Stream’s contracted deletion and backup processes. Information that has already become part of an independent Provider’s medical record may remain subject to that Provider’s legal retention obligations.

F. No Defined Period

When no fixed period applies, Patch retains information only for as long as reasonably necessary for the purpose for which it was collected, applicable legal obligations, dispute resolution, fraud prevention, security, and enforcement of agreements.

7. RETENTION PERIODS

The current “operational timeframes” language is insufficient. Add a table or list with confirmed periods for:

Active account data.
Deleted account data.
Stream messages and attachments.
Supabase patient documents.
Security/audit logs.
Billing and Stripe transaction records.
Apple subscription records.
Provider credentialing documents.
Backups.
Moderation reports.
Legally retained clinical records.

8. INTERNATIONAL PROCESSING & STORAGE LOCATION

Patch is based in, and its systems are operated from, the United States. Accordingly, your information may be processed, accessed, and maintained in the United States, where data laws may differ from those in your jurisdiction of residence.

9. CHANGES TO THIS PRIVACY POLICY

Patch reserves the right to modify or update this Privacy Policy at any time. If we implement updates that are materially less restrictive on our use or disclosure of Personal Information previously collected, we will obtain your explicit consent or provide at least thirty (30) days' advance notice via an in-app alert or directly to the primary email address listed on your active account before implementation.

10. CONTACT AND PRIVACY COMPLIANCE OFFICER

For regulatory inquiries, data portability requests, or concerns regarding regional healthcare compliance frameworks, please contact our designated Privacy Officer at:

Email Contact: contact@carebypatch.com
Mailing Address:

Patch Therapy, Inc.,

Attn: Privacy & Compliance Department,

131 Continental Drive, Suite 305,

Dover, DE 19713, USA