Privacy Policy

Introduction

Anton Health ("Anton," "we," "us," or "our") operates a consumer sexual-health platform offered under the "Anton" brand, including the website at https://myanton.org/ and https://myanton.care/ (collectively the "Website") and the Anton mobile and web application (the "Platform"). The Website and the Platform, with all related content and functionality, are the "Services."

Anton helps you access sexual-health care, including at-home STI testing, eligibility for and initiation of PrEP, and ongoing treatment and adherence support. Anton is a technology and administrative-services company. Anton is not a medical practice, is not your healthcare provider, and does not perform laboratory testing. Clinical care is delivered by independent licensed providers, and laboratory testing is performed by an independent reference laboratory. For additional information, please refer to the "Anton Is Not Your Healthcare Provider" section of this Privacy Policy below.

This Privacy Policy describes the information we collect through the Services, how we use and share it, and the choices and rights you have. By accessing or using the Services, you acknowledge that you have read this Privacy Policy. If you do not agree with it, do not use the Services. Your access and use of the Services, any part thereof, or anything associated therewith, including its content, any products or services provided through the Services or otherwise by Anton, and any affiliated website, software, or application owned or operated by Anton, are subject to this Privacy Policy unless specifically stated otherwise.

Please also review our Terms of Use, which govern your use of the Services. This Privacy Policy does not apply to information collected by independent third parties, including the independent healthcare providers who treat you, the reference laboratory that tests your specimens, or any third-party application (such as a dating app) with which you choose to interact or share information.

Anton Is Not Your Healthcare Provider

It is important that you understand who is responsible for your information at each step.

• Anton: Anton provides the Website, the Platform, and non-clinical administrative, technology, and operational support. Anton is not a medical practice or provider, and does not provide clinical care.
• Provider: Independent licensed clinicians (each a "Provider") provide clinical services (e.g., telehealth visits, diagnoses, and prescriptions).
• Lab: An independent reference laboratory (each a "Lab") performs STI and related testing under a written Reference Testing Agreement with Anton.

How This Privacy Policy Relates to Our Other Documents

You may receive several documents while receiving Services from Anton, including:

• Consumer Health Data Privacy Policy: Certain of the information Anton accesses, creates or receives is "consumer health data" regulated by applicable laws. Those topics are addressed in our separate Consumer Health Data Privacy Policy, and are incorporated by reference. Where the two documents address the same topic, the Consumer Health Data Privacy Policy controls for consumer health data.
• Notice of Privacy Practices: Your Provider maintains its own Notice of Privacy Practices describing how it uses and discloses your protected health information under the Health Insurance Portability and Accountability Act of 1996 (as amended) and its implementing regulations (collectively "HIPAA"). That Notice is a separate document provided by the Provider. This Privacy Policy is Anton's document and does not replace the Provider's Notice of Privacy Practices.
• Consent and Authorization Forms: You may access or receive several consent and authorization forms that you are asked to sign or review in connection with your use of the Services, including your Provider's consent to treatment and telehealth consent, and Anton's testing and information-sharing authorization(s). Any such forms will govern the specific uses, rights, and disclosures described in those forms.

If you have questions about these forms, please ask us by using the contact information identified at the end of this Privacy Policy.

Information We Collect About You

We may collect the following categories of information from you when you access or use the Services:

• Identifiers and Contact Information: name, email, mailing/shipping address, telephone number, date of birth, and account login credentials.
• Demographic Information: age, gender identity, sexual orientation, and, where you choose to provide it, race or ethnicity.
• Health and Sexual-Health Information: sexual-health history and risk information you self-report; PrEP, PEP, DoxyPEP, and ART status; STI and HIV testing information and laboratory results; diagnoses and treatment information relayed through the Services; medication and adherence information; and information about at-home test kits you order, activate, and return.
• In-Circle Information: information used to determine and display your In-Circle verification status. For additional information, please refer to the "In-Circle and Sharing Your Verified Status" Section below.
• Care Engagement Program Information: whether you have met applicable clinical milestones, dating-app subscription receipts or proof of purchase you submit for reimbursement, and related disbursement information.
• Payment Information: billing information and transaction records; payment-card data is processed by our third-party payment processor.
• Communications: messages you send to us or your care team, and support records.
• Commercial Information: information about purchases or other transactions with us, including information about your Provider, if applicable.
• Customer Service Information: information about your customer service and maintenance interactions with us.
• Information You Provide in Apps: videos (and in some cases the recordings of such videos), photos, and signatures.
• General Geolocation Information: address, city, state, or zip code.
• Device, Usage, and Location Information: IP address, device and browser identifiers, app interaction and log data, and, where you provide or enable it, general location information.
• Sensitive Personal Information:
  • Health information, such as information about your symptoms, medical history, lifestyle, prescriptions, mental health, drug or alcohol use, genetics, treatment options, and relevant physical characteristics (e.g., your height and weight) as well as medical photos you upload, lab results, and your insurance information.
  • Information about your sex life and sexual orientation.
  • Log-in credentials, if you create an account.
  • Sensitive demographic data, such as race and ethnicity.
  • Identity verification information (e.g. driver's license or other government-issued ID card or number), and your signature (if required for notarization purposes).
  • Contents of communications made via the Services.
• Third-Party App Information: if you choose to connect or share information with a third-party application (such as a dating app), the limited identifiers needed to deliver what you asked us to share.
• Information From Third Parties: information from your Provider, the Lab, referral sources, and service providers.
• Other Information: Any other information you choose to directly provide to us in connection with your use of the Services.

We automatically collect certain information about your use of the Services and the devices you use to access the Services, as described in this Section. As discussed further below, we and our service providers (which are third party companies that work on our behalf), may use a variety of technologies, including cookies, SDKs, and similar tools, to assist in collecting this information. In some instances, such information may be considered sensitive personal information, in which case we will only collect/process it in accordance with applicable legal requirements depending on your state of residence.

Our Website: When you use our Website to access or receive the Services, we collect and analyze information such as your IP address, browser types, browser language, operating system, the state or country from which you accessed the Services, software and hardware attributes (including device IDs) referring and exit pages and URLs, platform type, the number of clicks, files you download, domain names, landing pages, pages viewed and the order of those pages, the amount of time spent on particular pages, the terms you use in searches on our sites, the date and time you used the Services, error logs, and other similar information.

Our Platform: When you use our Platform to access or receive the Services, we automatically receive certain information about the mobile phone, tablet, or computer used to access the Services, including a mobile device identifier, advertising identifiers (in accordance with your device settings), IP address, operating system, version, Internet service provider, browser type, domain name and other similar information, whether and when you update the Services, date and time of use, and how you use the Services, including time spent in different portions of the Services.

Location Information: When you use the Services via the Website or Platform, we and our service providers may automatically collect general location information (e.g., IP address, city/state and or postal code associated with an IP address) from your computer or mobile device. This information allows us to enable access to content that varies based on a user's general location (e.g., to provide you with accurate sales tax information and to deliver content customized to your location).

We refer to the above collectively as "Personal Information." Some Personal Information is also "consumer health data" or "protected health information," which receives heightened protection under the laws described in this Policy and in our Consumer Health Data Privacy Policy.

Cookies and Tracking Technologies

To collect the information discussed in this Section, we and our service providers may use web server logs, cookies, tags, SDKs, tracking pixels, and other similar tracking technologies. We may use these technologies to offer you a more tailored experience.

• Web Server Log: A file where website activity is stored.
• SDK: A set of tools and/or code that we embed in our Services and software to allow third parties to collect information about how users interact with the Services.
• Cookie: A small text file that is placed on your computer or mobile device when you visit a site, that enables us to: (i) recognize your computer/device; (ii) store your preferences and settings; (iii) understand the parts of the Services you have visited and used; (iv) enhance your user experience by delivering and measuring the effectiveness of content and advertising tailored to your interests; (v) perform searches and analytics; and (vi) assist with security and administrative functions.
• Tracking Pixels: Sometimes referred to as web beacons or clear GIFs, are tiny electronic tags with a unique identifier embedded in websites, online ads and/or email that are designed to: (i) collect usage information like ad impressions or clicks and email open rates; (ii) measure popularity of the Services and associated advertising; and (iii) access user cookies.

As we adopt additional technologies, we may also gather information through other methods.

Please note that you can change your settings to notify you when a cookie is being set or updated, or to block cookies altogether. Please consult the "Help" section of your browser for more information (e.g., Internet Explorer; Google Chrome; Mozilla Firefox; or Apple Safari). Please note that by blocking, disabling, or managing any or all cookies, you may not have access to certain features or offerings of the Services.

Social Media and Other Content Platforms

When you "like" or "follow" us on Facebook, Instagram, Twitter, or other social media platforms, we may collect some information from or about you including your name, email address, and any comments or content you post relevant to us. We also collect your information if you sign up for one of our promotions or submit information to us through social media platforms.

If you access the Services through a third-party connection or log-in (e.g., through a social network or third-party authentication tool), you may allow us to have access to and store certain information from such third parties depending on your settings on such services. If you do not wish to have this information disclosed, do not use these connections to access the Services. For a description of how these third parties handle your information, please refer to their privacy policies and terms of use, which may permit you to modify your privacy settings.

Similarly, if you choose to connect your receipt of the Services to third-party platforms or tools, or with other apps on your device (e.g., dating sites or applications, health or fitness monitoring platforms or tools, or your contacts, photos, or calendar), such third parties and tools may allow us to have access to and store additional information as it relates to your use of the Services (e.g., to integrate your dating data or fitness data within the Services or access your calendar to help you schedule an appointment). If you do not wish to have this information disclosed, do not initiate these connections.

How We Use Your Personal Information

We use the personal information we collect for purposes described in this Privacy Policy or as otherwise disclosed to you. For example, we use personal information for the following purposes:

In addition to the above:

• We may aggregate and/or de-identify any information collected through the Services so that such information can no longer be linked to you or your device ("Aggregate/De-Identified Information"). We may use Aggregate/De-Identified Information for any purpose, including for research and marketing purposes, and may also disclose such data to any third parties, including advertisers, promotional partners, and sponsors. Once information has been aggregated/de-identified, we have a policy of not attempting to re-identify it.
• We may combine the information that we collect through the Services with information that we receive from other sources, both online and offline, and use and disclose such combined information in accordance with this Privacy Policy.
• We will seek your separate, specific consent or authorization where required by law before using your information for a purpose that requires it, including for certain uses of HIV-related and other specially protected information.

Disclosure of Your Personal Information

We share Personal Information only as described below.

• With Your Healthcare Provider: We may share your information with physicians or other health care providers (including but not limited to a Provider) who treat you so that they can deliver and document your care.
• With the Lab: We may share information necessary for the Lab (IHD) to test your specimens and return results. Under our Reference Testing Agreement, Anton is responsible for obtaining your signed informed consent and authorization for specimen collection, testing, and the transfer of your specimens and related data to the Lab. Please refer to the "HIV-Related and Other Specially Protected Information" Section of this Privacy Policy.
• With Third-Party Apps (including dating apps): We may share your information with third-party apps (including dating apps) when you direct us to do so. Please refer to the "In-Circle and Sharing Your Verified Status" of this Privacy Policy.
• In Connection with the In-Circle Feature: Your verification status is made visible as you choose. The In-Circle feature is discussed in greater detail under the "In-Circle and Sharing Your Verified Status" Section below.
• For Exposure or Partner Notification: We will only share information for purposes of notifying partners of a potential exposure as you direct. This notification feature is discussed in greater detail under the "Exposure and Partner Notification" Section below.
• With Care Engagement Program Partners: We may use or share information with service providers that help administer the Care Engagement Program, as discussed in greater detail under the "The Care Engagement Program" Section below.
• With Service Providers and Business Associates: We may share information with vendors (hosting, payment processing, communications, shipping, support) under contracts that limit their use of the information to providing services to us.
• Affiliates and Subsidiaries: We may disclose information we collect with any Anton member or group (i.e., our subsidiaries and affiliates, including our ultimate holding company and its subsidiaries) to deliver products and services to you, ensure a consistent level of service across our products and services, and enhance our products, services, and your customer experience.
• For Legal and Safety Reasons: We may share information to comply with law and lawful requests, enforce our Terms of Use, and protect rights, safety, and property. By using the Services, you acknowledge and agree that we may access, retain and disclose the information we collect and maintain about you if required to do so by law or in a good faith belief that such access, retention or disclosure is reasonably necessary to: (i) comply with legal process (e.g. a subpoena or court order); (ii) enforce this Privacy Policy or other contracts with you, including investigation of potential violations thereof; (iii) respond to claims that any content violates the rights of third parties; (iv) respond to your requests for customer service; and/or (v) protect the rights, property or personal safety of Anton, its agents and affiliates, its users and/or the public. This includes exchanging information with other companies and organizations for fraud protection, and spam/malware prevention, and similar purposes.
• Public Forums / User Interactions: Certain features of our Services make it possible for you to disclose comments publicly or with other users. Any information that you post publicly is not confidential, and we may use it for any purpose (including in testimonials or other marketing materials). For example, if you submit a product review on one of our Websites, we may display your review (along with the name provided, if any) on other Anton Websites and on third-party websites. Any information you post openly in these ways will be available to the users you disclosed it to and potentially the public at large, and may be accessible through third-party search engines. Accordingly, please take care when using these features. We are not responsible for how others use the information about you that you disclose to them through the Services.
• In a Business Transaction: We may use and share information in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this Policy and law.
• With Your Consent: We may also disclose your information in other ways you direct us to and when we have your consent.
• De-identified and Aggregated Information: We may use and share information that does not reasonably identify you and will not attempt to re-identify it except as permitted by law.

In-Circle and Sharing Your Verified Status

In-Circle is an optional feature. If you choose to participate, Anton determines a verification status reflecting, for example, whether you have completed STI testing within the applicable interval and are currently on PrEP or ART, and displays a verification indicator or "badge."

Participation is voluntary, and you choose whether and where your status is shown.

Sharing to third-party apps is at your direction. If you connect a third-party application or generate a shareable link, you are directing Anton to disclose the information you select. Once shared, that information is handled by the third party under its own privacy policy and terms, which Anton does not control. Review them before sharing.

An In-Circle badge reflects information available to Anton as of a point in time. It is not a guarantee of any person's current health status, is not a diagnosis, and is not a substitute for direct conversation, testing, or safer-sex practices. Verification status can lapse.

You may stop ongoing sharing through your account settings or by contacting us. We cannot retrieve, delete, or control information already received by a third party.

Exposure and Partner Notification

The Services may offer features that let you notify recent or past partners of a potential exposure, including options to send a notification or generate an anonymous notification link.

These features operate only at your direction. Anton does not send exposure notifications on your behalf unless you choose to use the feature.

"Anonymous" notifications are designed to avoid identifying you to the recipient. Depending on the circumstances, a recipient may still be able to infer the sender's identity. We cannot guarantee anonymity.

Public-health reporting of certain conditions is performed by your Provider or the Lab as required by law; that reporting is separate from these optional features.

The Care Engagement Program

Anton offers a care-engagement support program intended to reduce barriers to ongoing STI testing and medication adherence (the "Care Engagement Program"). Eligibility is tied to objective clinical milestones. For example, completing STI testing on the applicable schedule and remaining current on PrEP or ART. To administer the program, we use information about whether you have met those milestones and information you submit to obtain reimbursement of an eligible dating-app subscription, and related disbursement information. We apply the eligibility criteria uniformly to all patients who meet them.

HIV-Related and Other Specially Protected Information

Information about HIV status, HIV testing, and certain other conditions receives heightened protection under federal and state law. We treat this information with particular care.

Because our Reference Testing Agreement places responsibility on Anton to obtain each patient's informed consent and authorization, you will be asked to review and sign specific consent and authorization documents during the patient journey, covering at minimum specimen collection and testing, the transfer of your specimens and related data to the Lab, and the return and use of results.

Disclosing medical information that originates with your Provider to any non-provider third party (including a dating app) may require your specific, written authorization. We will not make such disclosures without your authorization where required by applicable law.

Some states impose additional, HIV-specific consent or release requirements for disclosing HIV-related information.

Online Advertising

In accordance with applicable legal requirements, the Services may integrate third-party advertising technologies that use cookies, pixels, and other technologies to deliver relevant content and advertising for Anton's products and research on the Services, as well as on other websites you visit and other applications you use. The ads may be based on various factors such as the content of the page you are visiting, information you enter such as your searches, demographic data, and other information we collect from you. These ads may be based on your current activity or your activity over time and across other websites and online services.

We sometimes provide our customer information (such as email addresses) to service providers, who may "match" this information in de-identified form to cookies (or mobile ad identifiers) and other proprietary IDs, in order to provide you with more relevant ads when you visit other websites and mobile applications. We may also disclose customer information such as your email address with third-party advertising networks that use such information to better target advertising to you regarding Anton products and services, as well as other products and services, as you browse the internet.

If you are interested in more information about tailored browser advertising and how you can generally control cookies from being put on your computer to deliver tailored advertising, you may visit the Network Advertising Initiative's Consumer Opt-Out link, the Digital Advertising Alliance's Consumer Opt-Out link, or Your Online Choices to opt-out of receiving tailored advertising from companies that participate in those programs. We do not control these opt-out links, whether these opt-out links change over time, or whether any particular company chooses to participate in the industry opt-out programs listed above. We are not responsible for any choices you make using these mechanisms or the continued availability or accuracy of these mechanisms.

For additional ways to opt out of online advertising activities, please see the "Your Choices" Section below.

Please note that if you exercise the opt out choices above, you may still see advertising when you use the Services, but it will not be tailored to you based on your online behavior over time.

Mobile Advertising

When using our Services or others, you may also receive tailored in-application advertisements. We may use third-party service providers to deliver advertisements on mobile applications or for mobile application analytics. Each operating system, iOS for Apple phones, Android for Android devices, and Windows for Microsoft devices provides its own instructions on how to prevent the delivery of tailored in-application advertisements. We do not control how the applicable platform operator allows you to control receiving personalized in-application advertisements; thus, you should contact the platform provider for further details on opting out of tailored in-application advertisements. You may review the support materials and/or the device settings for the respective operating systems to opt-out of tailored in-app advertisements.

Your Choices

We provide a variety of ways for you to control the personal information we hold about you, including choices about how we use that data. In some jurisdictions, these controls and choices may be enforceable as rights under applicable law.

• Access, Portability, Correction, and Deletion: If you wish to access, copy, download, correct, or delete personal information about you that we hold, please submit a request using the contact information featured at the end of this Privacy Policy. In some states, you also have the right to request information about third parties with whom we share your personal information, which you may exercise through the same mechanism.
• Data Sales: Some privacy laws define "sale" broadly to include some of the activities described in the "How We Use Your Personal Information" and "Disclosure of Your Personal Information" Sections of this Privacy Policy. To opt-out from such data "sales," please submit a request using the contact information featured at the end of this Privacy Policy.
• Sensitive Data Opt Out/Opt-In Right: To provide you with more relevant online advertising regarding Anton's products and services, as described in this Privacy Policy, we may use information about the treatments you have requested or received and similar information. This may include the processing of information that is considered "sensitive data" or "sensitive personal information" under applicable laws, such as health information and information about sex life and sexual orientation. You may submit a request to limit or opt out of our use of sensitive data for purposes other than to provide the Services, including our and our partner's processing of sensitive data for tailored advertising purposes. To opt-out from such additional purposes, please submit a request using the contact information featured at the end of this Privacy Policy. If you consent and subsequently change your mind, you can revoke your consent by submitting a request using the contact information featured at the end of this Privacy Policy, provided that such revocation will not be effective with respect to disclosures of sensitive data that occurred prior to Anton's receipt of your written revocation.
• Targeted Advertising: If you wish to opt-out of the use of your personal information for targeted advertising, please submit a request using the contact information featured at the end of this Privacy Policy. In addition, there are certain browser and platform controls that may be available to you in order to opt-out from or otherwise control targeted advertising as described below. You can use the opt-out controls offered by the organizations our advertising partners may participate in. These choices are specific to the device or browser you are using. If you access our services from other devices or browsers, you will need to take these actions from those systems to ensure your choices apply to the data collected when you use those systems.
• Communications Preferences: You can choose whether to receive promotional communications from us by email or SMS. If you receive promotional email or SMS messages from us and would like to stop, you can do so by following the directions in that message or by submitting a request using the contact information featured at the end of this Privacy Policy. These choices do not apply to certain informational communications including surveys and mandatory service communications.
• Non-Discrimination: Anton will not discriminate against anyone that makes a rights request, but in some cases we will not be able to provide our Services to you without that information.

Accessing and Changing Your Personal Information

To request access to, correction of, or deletion of Personal Information, contact us using the contact information featured at the end of this Privacy Policy. We will respond as required by law. Requests concerning information held by your Provider or the Lab may need to be directed to them; we will help route your request.

How We Keep Your Personal Information Secure

We use administrative, technical, and physical safeguards designed to protect Personal Information, varying with the sensitivity of the information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential and for notifying us promptly of any suspected unauthorized use. In the event of a data or security incident, we will investigate, take appropriate remediation steps, and provide notice to affected individuals and regulators as required by applicable law.

Data Retention

We retain Personal Information for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements, after which we dispose of it in accordance with our retention and deletion policies. The length of time for which we retain information depends on the purposes for which we collected and use it, the nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we process the information, and our legitimate interests, and/or as required to comply with applicable laws.

Links to Other Sites and Third-Party Services

This Privacy Policy does not address, and we are not responsible for, the privacy, information, or other practices, including data privacy and security process and standards of any third parties, including Providers using the Services, the manufacturer of your mobile device and other IT hardware and software, and any other third party mobile application, website, or service to which our Services may contain a link. These third parties may at times gather information from or about you. We have no control over the privacy practices of these third parties. The collection, use, and disclosure of your information will be subject to the privacy policies of the third-party websites or services, and not this Privacy Policy. We urge you to read the privacy and security policies of these third parties.

Children

The Services are intended for adults 18 and older and are not directed to minors. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact us using the contact information featured at the end of this Privacy Policy. If we discover we have received any "personal information" (as defined under the Children's Online Privacy Protection Act) from a child under the age of 13 in violation of this Privacy Policy, we will take reasonable steps to delete that information as quickly as possible.

Marketing, Electronic Communications, and SMS

If you have consented, we may send you marketing communications. You can opt out at any time using the unsubscribe instructions in the message; even then, we may send non-marketing messages about your account and care. We offer SMS communications related to your care, such as testing and refill reminders, lab coordination, scheduling, and messaging with your care team. Consent to SMS is separate from, and not a condition of, your account or these policies.

Additional Privacy Information for California Residents

This Section supplements this Privacy Policy and applies if you are a California consumer.

• Rights to Request Correction or Deletion: You have the right to request that we correct inaccurate personal information and that we delete personal information under certain circumstances, subject to a number of exceptions. To make a request to correct or delete, please email us using the contact information set forth at the end of this Privacy Policy.
• Shine the Light Disclosure: The California "Shine the Light" law gives residents of California the right under certain circumstances to request information from us regarding the manner in which we disclose certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes. California Customers may request further information about our compliance with this law by emailing us using the contact information set forth at the end of this Privacy Policy. Please note that businesses are required to respond to one request per California consumer each year and may not be required to respond to requests made by means other than through the designated email address.
• Verification: To exercise rights under this Section with respect to personal information, we will need to verify your identity to the degree of certainty required by law. We will verify your request by asking you to send it from the email address associated with your account or requiring you to provide information necessary to verify your account.
• Notice Concerning Do Not Track: Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. We are committed to providing you with meaningful choices about the information collected on our Websites for third party purposes, and that is why we provide the variety of opt-out mechanisms listed above. However, we do not currently recognize or respond to browser-initiated DNT signals. To learn more about DNT, you can do so here.

Changes to This Privacy Policy

We may amend this Privacy Policy from time to time. Whenever reasonably possible, we will provide advance notice of material changes. We will not make retroactive changes that reduce your privacy rights unless legally required. Your continued use of the Services after a change takes effect constitutes acceptance of the updated Privacy Policy, so please review it periodically. The amended Privacy Policy supersedes prior versions.

Contacting Us

If you have questions about this Privacy Policy or our privacy practices, or wish to make a request, contact us at privacy@myanton.care or Anton Health, Inc., 3080 South Ct, Palo Alto, CA 94306.