US Privacy Policy

Effective Date: May 2026

Applies to: Individuals in the United States (US)

1. Introduction

Apreo Health, Inc. (“Apreo”, “we”, “us”, or “our”) is committed to protecting your personal data and handling it in a lawful, fair, and transparent manner. This Privacy Notice explains how we collect, use, share, transfer, and protect your personal data when you:

  • Visit our website or digital platforms
  • Participate in a clinical trial using Apreo technologies
  • Contact us for support or business purposes
  • Use or interact with our health technologies or services

This Notice also explains your privacy rights and how you can exercise them.

2. Information We Collect

The types of information we collect depend on your relationship with us and how you interact with Apreo.

2.1 Information You Provide Directly

  • Contact details such as name, email address, phone number, role, and organisation
  • Account or login details, where applicable
  • Communications and correspondence
  • Information provided when you participate in or support clinical research, in line with approved study protocols

2.2 Health and Clinical Data

For clinical trial participants or users of our medical device, we may process:

  • Health, respiratory, or physiological information
  • Medical history relevant to study eligibility
  • Safety, adverse event, and vigilance information
  • Study documentation required for regulatory compliance

This information is subject to enhanced legal, technical, and organisational safeguards.

2.3 Technical and Website Data

  • IP address and general location information
  • Cookie and analytics identifiers
  • Browser, device, and operating system information
  • Website usage and activity data

2.4 Professional and Business Related Information

  • Contact and professional details of investigators, site staff, vendors, and partners
  • Contractual, billing, and payment information
  • Due diligence, compliance, and credentialing records
  • Business communications and project management information

2.5 Information from Third Parties

  • Information provided by clinical sites, investigators, or research partners
  • Regulatory or safety documentation
  • Publicly available professional information where relevant

3. How We Use Your Information

We use your information to:

  • Run and manage our clinical investigations, including BREATHE 3, under U.S. Food and Drug Administration regulations and Good Clinical Practice standards
  • Submit regulatory filings, adverse event reports, and required communications to the FDA, Institutional Review Boards, and Data Safety Monitoring Boards
  • Track and report safety signals, device issues, and adverse events
  • Respond to your website enquiries and manage relationships with patients, investigators, and healthcare professionals
  • Send communications and updates you have signed up for
  • Analyse website usage to improve our site and content
  • Operate, improve, and secure our website and systems
  • Comply with applicable federal and state law
  • Evaluate partnerships, financings, and business transactions
  • If you are in a clinical study, as described in your informed consent document

4. How We Share Your Information

We do not sell your personal information. We may share it as follows:

  • Trial partners: Clinical research partners, Clinical Research Organisations, research sites, and data managers under data protection agreements
  • Regulators: FDA, Institutional Review Boards, Data Safety Monitoring Boards, and other regulatory or ethics bodies, as required by law
  • Service providers: Information Technology, analytics, Customer Relationship Management, email marketing, and other service providers, contractually barred from using your data for their own purposes
  • Business transfers: A buyer or successor in a merger, acquisition, or sale of assets, and we will notify you of any ownership change
  • Legal process: Courts, law enforcement, or regulators, where required by law or to protect rights and safety
  • Deidentified data: Aggregated or deidentified data that cannot identify you may be shared for research and publications

4.1 Advertising and Tracking Disclosure

While we do not sell personal information in the traditional sense, some cookie and tracking disclosures, including social media advertising tools, may be considered “sharing” for cross context behavioural advertising under California and other state laws. Categories involved may include identifiers, usage or browsing data, and inferences. You can opt out as described in Section 6.

5. Clinical Trial Participants

If you take part in an Apreo clinical investigation, your health information is also governed by:

  • Your signed informed consent document and HIPAA Authorisation, where applicable
  • FDA human subjects regulations
  • Your site’s Institutional Review Board requirements and applicable state health privacy laws

Your health data will be used only as described at enrolment and shared only with your consent or as permitted by law. Note that rights such as deletion may be restricted where federal law or research integrity requires us to retain records.

6. Cookies and Tracking

We use four types of cookies on our Site:

  • Essential: Required for the Site to work and cannot be turned off
  • Analytics: Help us understand how visitors use the Site, such as Google Analytics. Data is aggregated and anonymous
  • Functional: Remember your preferences and settings to improve your experience
  • Marketing and Targeting: Used to deliver relevant advertising and measure ad effectiveness, such as LinkedIn Insight Tag

You can manage cookies through your browser settings or our cookie consent tool. To opt out of the sale or sharing of your data for targeted advertising, email privacy@apreohealth.com or use a browser that broadcasts a Global Privacy Control signal, which we will honour.

You can also visit www.aboutads.info/choices or optout.privacyrights.info.

7. How Long We Keep Your Information

  • Clinical trial records: Minimum 2 years after marketing approval or trial discontinuation and dependent on contractual retention requirements
  • Regulatory records: In line with applicable FDA and Institutional Review Board retention schedules
  • Contact form and CRM data: Up to 3 years after last contact
  • Email marketing data: Retained while subscribed, deleted within 90 days of unsubscribing
  • Server and security logs: Up to 12 months
  • Website and other operational data: Typically 3 to 7 years, unless law requires longer

When we no longer need your information, we securely delete or deidentify it.

8. Security

We protect your information with access controls, encryption in transit and at rest, vendor security assessments, and staff training. Since no system is completely secure, if your personal information is affected by a breach, we will investigate and, as required by law, notify you and the relevant authorities.

9. Your Privacy Rights

9.1 California Residents

California residents may have rights under the California Consumer Privacy Act and California Privacy Rights Act. You have the right to:

  • Know what personal information we collect, use, and share about you
  • Request a copy of the specific information we hold
  • Correct inaccurate information
  • Delete your information, subject to legal exceptions
  • Opt out of the sale or sharing of your information for advertising
  • Limit use of sensitive personal information
  • Not be discriminated against for exercising these rights

California residents may also request once per year whether we have shared personal information with third parties for their direct marketing purposes under California “Shine the Light” law.

9.2 Residents of Other States

If you live in Colorado, Connecticut, Virginia, Texas, Montana, Indiana, Tennessee, or another state with a privacy law, you may also have rights to access, correct, delete, and port your data, and to opt out of targeted advertising and profiling. We will honour these rights as required by applicable law.

9.3 How to Submit a Request

Email privacy@apreohealth.com with your first name, last name, and email address, and clearly describe your request.

We will:

  • Verify your identity before acting on any request
  • Respond within 45 days, extendable by a further 45 days with notice
  • Explain in writing if we deny your request and how you can appeal

Authorised agents may submit requests on your behalf with written proof of authorisation.

10. Children

Our Site is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have done so, please contact us at privacy@apreohealth.com, and we will delete it promptly. When our research involves minors, we obtain assent from the minor and consent from a parent or legal guardian, as required by FDA regulations.

11. Contact Us

For any privacy questions, requests, or concerns:

Apreo Health, Inc.
Attn: Privacy / Regulatory Affairs
4040 Campbell Avenue, Suite 210
Menlo Park, CA 94025
Email: privacy@apreohealth.com
Phone: (650) 450 8117
Web: www.apreohealth.com

12. Changes to This Policy

We may update this Policy at any time. When we make material changes, we will update the Effective Date and post notice on our Site. Continued use of our Site after changes are posted constitutes your acceptance of the updated Policy.

This Notice was last updated on May 2026.

CAUTION: Investigational Device. Limited by Federal US law to investigational use. Exclusively for Clinical Investigations. The BREATHE Airway Scaffold has not received FDA clearance or approval for commercial distribution.