Exxat, Inc. (collectively with its subsidiaries, “Exxat,” “the Company,” “we,” “us,” and “our,”) respects your privacy and is committed to protecting your privacy through our compliance with this services privacy policy (the “Policy”). This Policy should be read in conjunction with our services Terms of Use, into which this Policy is incorporated by reference.

This Policy describes:

• The types of information we collect from you or that you may provide when you visit our websites available at: com, apps.exxat.com, and support.exxat.com as well as any websites and blogs directly owned by Exxat (the “Services”).

• Our practices for collecting, using, maintaining, protecting, and disclosing that information.

Please read this Policy carefully to understand our practices regarding your information and how we will treat it. If you do not agree with our policies and practices, then please do not use our Services. By using our Services, you agree to the terms of this Policy. This Policy may change from time to time (see below, “Changes to this Policy”). Your continued use of our Services after we make changes is deemed to be acceptance of those changes, so please check the Policy periodically for updates.

What We Collect and How We Collect It

To ensure that we provide you with the best possible experience, we will store, use, and share information about you in accordance with this Policy.

Information You Provide to Us

Personal Information is any information that can be used to individually identify you from a larger group, such as data including, but not limited to, your:

• first and last name
• email address
• a picture of your image or likeness
• social security number
• graduating year
• academic status
• gender identity
• sex assignment at birth
• race
• ethnicity
• school student ID number
• telephone number
• age
• mailing address
• employment history
• information relating to your health and well-being
• any information

You may provide us Personal Information when you:

• request information
• register yourself with the Services
• create a profile with the Services
• upload documents and other information to your profile with the Services

The information that you provide in each case will vary. In some cases, we may ask you to create a username and password that should only be known to you. If you provide Personal Information relating to someone else, please ensure that you have the proper authorization and consent from that person before submitting or sharing their Personal Information.

Important Notice About Your Health Information. You should also understand that much of the Personal Information you provide may be related to your health, diagnoses, vaccination status, health insurance card, and physical examination results. Exxat is not a health provider. Exxat is a platform that enables health professional schools to manage internships for its students at clinical sites. Unless otherwise established in an agreement between Exxat and a Covered Entity (i.e., a doctor, pharmacy, or insurer) as defined by the Health Insurance Portability and Accountability Act (“HIPAA”), Exxat does not collect “Protected Health Information” as defined under HIPAA. Therefore, your Personal Information is not entitled to the same protections as regulated data under HIPAA.

Please also note that any Personal Information relating to your health, diagnosis, vaccination status, health insurance card, or physical examination results may be shared with third parties. When such Personal Information is shared with third parties, the entirety of that Personal Information, including all health documents provided to Exxat, may be shared with the applicable third party.

Automated Information Collection

In addition to the information that you provide to us, we may also collect information about you during your use of our Services. We collect this information using automated tools that are detailed below. These tools may collect information about your behavior and your computer system, such as your internet address (IP Address), your browser, your operating system, your device details, your location, the pages you have viewed, and the actions you have taken while using the Services. Some of the tools we use to automatically collect information about you may include:

• Cookies. A “cookie” is a small data file transmitted from a website to your computer’s hard drive. Cookies are usually defined in one of two ways, and we may use both of them:(1) session cookies, which do not stay on your computer after you close your browser, and(2) persistent cookies, which remain on your computer until you delete them or they expire.We use the following categories of cookies on our Services.

  1. Strictly Necessary Cookies. These cookies are essential in order to enable you to move around the Services and use their features. Without these cookies, services you have requested, such as maintaining a record of your recent actions, cannot be provided.

  2. Performance Cookies. These cookies collect anonymous information on how people use our Services to help us understand how you arrive at our site, browse or use our Services and highlight areas where we can improve, such as navigation. The data stored by these cookies never show personal details from which your individual identity can be established.

• Functionality Cookies. These cookies remember choices you make such as the country from which you visit our Services, your preferred language, and your search parameters. This information can then be used to provide you with an experience more appropriate to your selections and to make your visits to our Services more tailored to your preferences. The information in these cookies may be anonymized. These cookies cannot track your browsing activity on other websites.

Targeting Cookies or Advertising Cookies. These cookies collect information about your browsing habits in order to make advertising more relevant to you and your interests. They are also used to limit the number of times you see an advertisement as well as help measure the effectiveness of an advertising campaign. The cookies are usually placed by third-party advertising networks. These cookies remember the websites you visit and that information is shared with other parties.

Of course, if you do not wish to have cookies on your devices, you may turn them off at any time by modifying your internet browser’s settings. However, by disabling cookies on your device, you may be prohibited from full use of the Services’ features or lose access to some functionality.

• Google Analytics. The Website sends aggregated, non-Personal Information to Google Analytics for the purpose of providing us with the ability to conduct technical and statistical analysis on the Website’s performance. For more information on how Google Analytics supports the Website and uses information sent from the Website, please review Google’s privacy policy available at https://policies.google.com/technologies/partner-sites

• Applications Insight. Applications Insight is a product from Microsoft Azure that assists Exxat in logging activity and troubleshooting features of the Website. Exxat may also elect to use Application Insight features for usage analysis, such as user segmentation and retention of usage information. For more information on Applications Insights and how it supports the Website and uses information sent from the Website, please review Azure’s privacy statement available at https://docs.microsoft.com/en-us/azure/azure-monitor/app/data-retention-privacy.

• SendGrid. For email delivery, the Website uses SendGrid, which is a product by Twilio. SendGrid assists with our marketing campaigns, and may use tracking technologies to identify when our emails are opened and what links, if any, are clicked. For more information on SendGrid and how it supports this Website, and uses information sent from the Website, please review Twilio’s privacy policy available at https://www.twilio.com/legal/privacy#sendgrid-services.

• Web Beacons. A Web Beacon is an electronic image. Web Beacons can track certain things from your computer and can report activity back to a web server allowing us to understand some of your behavior. If you choose to receive emails from us, we may use Web Beacons to track your reaction to our emails. We may also use them to track if you click on the links and at what time and date you do so. Some of our third-party marketing partners may use Web Beacons to track your interaction with online advertising banners on our Services. This information is only collected in aggregate form and will not be linked to your Personal Information. Please note that any image file on a webpage can act as a Web Beacon.

• Embedded Web Links. As mentioned above, links provided in our emails and, in some cases, on third-party websites may include tracking technology embedded in the link. The tracking is accomplished through a redirection system. The redirection system allows us to understand how the link is being used by email recipients. Some of these links will enable us to identify that you have personally clicked on the link and this may be attached to the Personal Information that we hold about you. This data is used to improve our Services to you and to help us understand the performance of our marketing campaigns.

• Third-party Websites and Services. We work with a number of service providers of marketing communications technology. These service providers may use various data collection methods to improve the performance of the marketing campaigns we are contracting them to provide. The information collected can be gathered on our Services and also on the websites where our marketing communications are appearing. For example, we may collect data where our banner advertisements are displayed on third-party websites.

Do Not Track Disclosure

Other than as disclosed in this Policy, the Services do not track users over time and across third-party websites to provide targeted advertising. Therefore, the Services do not operate any differently when it receives Do Not Track (“DNT”) signals from your internet web browser.

Your Choices and Selecting Your Privacy Preferences

We want to provide you with relevant information that you have requested.

If we ever provide subscription-based services, such as email newsletters, we will allow you to make choices about what information you provide at the point of information collection or at any time after you have received a communication from us while you are subscribed. Any transactional or service-oriented messages are usually excluded from such preferences, as such messages are required to respond to your requests or to provide goods and services, and are not intended for the purposes of marketing. Any such communications you receive from us will be administered in accordance with your preferences and this Policy.

If you email a link to a Services profile, you may select security features to restrict access to the Personal Information included in that profile. For example, you may select a password to access the link, or you may select a date to expire access to that link. If you share a link to a Services profile on a student’s behalf, you are responsible for ensuring that you have proper authorization and consent to share that link with the selected third party.

Accuracy and Access to Your Personal Information

We strive to maintain and process your information accurately. We have processes in place to maintain all of our information in accordance with relevant data governance frameworks and legal requirements. We employ technologies designed to help us maintain information accuracy on input and processing.

Where we can provide you access to your Personal Information in our possession, we will always ask you for a username and password to help protect your privacy and security. We recommend that you keep your password safe, that you change it periodically, and that you do not disclose it to any other person or allow any other person to use it.

To view and change the Personal Information that you have provided to us, you can log in to your account and follow the instructions on that screen, or contact us directly for assistance.

Information of Minors

We do not intentionally seek to gather information from individuals under the age of thirteen. We do not target the Services to minors, and would not expect them to be engaging with our Services. We encourage parents and guardians to provide adequate protection measures to prevent minors from providing information unwillingly on the internet. If we are aware of any Personal Information that we have collected about minors, we will take steps to securely remove it from our systems.

How We Use Your Information

The information we gather and that you provide is collected to provide you information and the services you request, in addition to various other purposes, including, but not limited to:

• Assisting you with items such as personalized experiences, facilitation of Services usage, and enforcement of Terms of Use.
• Preventing malicious activity and providing you with a secure experience.
• Providing service and support for actions you request.
• Providing marketing communications that are effective and optimized for you.
• Keeping you up-to-date with the latest benefits available from us.
• Preventing unwanted messages or content.

How We Share Your Information

We do not sell or lease your information to any third party. We will disclose your Personal Information to our trusted third-party business partners in accordance with this Policy. We work with a number of clinics and partners that help us process your requests, deliver customer service and support, send email communications, and provide experiences that you have come to expect from us. We will share your Personal Information with these third parties in order to fulfill the service that they provide to us. These third-party partners are under contract to keep your Personal Information secure and not to use it for any reason other than to fulfill the service we have requested from them. Please understand that your Personal Information may be shared collectively, as opposed to having selected data elements of Personal Information shared at the exclusion of others. In other words, when your Personal Information is shared, all data elements you have provided to Exxat, and fields from your profile and associated documents, may be shared.

California Residents. We will not disclose or share your Personal Information with third parties for the purposes of third-party marketing to you without your prior consent.

Except as described in this Policy, we will not share your information with third parties without your notice and consent, unless it is under one of the following circumstances:

• Responding to duly authorized information requests from law enforcement or other governmental authorities.
• Complying with any law, regulations, subpoena, or court order.
• Investigating and helping prevent security threats, fraud, or other malicious activity.
• Enforcing or protecting the rights and properties of Exxat or its subsidiaries.
• Protecting the rights or personal safety of Exxat’s employees.

There are circumstances where Exxat may decide to buy, sell, or reorganize its business in selected countries. Under these circumstances, it may be necessary to share or receive Personal Information with prospective or actual partners or affiliates. In such circumstances, Exxat will ensure your information is used in accordance with this Policy.

Third-party Websites

This Policy does not apply to websites or other domains that are maintained or operated by third parties or our affiliates. Our Services may link to third-party websites and services, but these links are not endorsements of these sites, and this Policy does not extend to them. Because this Policy is not enforced on these third-party websites, we encourage you to read any posted privacy policy of the third-party website before using the service or site and providing any information

For Website Visitors Outside of the United States

Our websites are designed for use by individuals in the United States only. We do not warrant or represent this Policy or the Services’ use of your Personal Information complies with the laws of any other jurisdiction. Furthermore, to provide you with our services, we may store, process, and transmit information in the United States and other locations around the world, including countries that may not have the same privacy and security laws as yours. Regardless of the country in which such information is stored, we will process your Personal Information in accordance with this Policy.

Safeguarding the Information We Collect

We take reasonable technical, administrative, and physical safeguards in order to protect your Personal Information against accidental loss and from unauthorized access, use, alteration, and disclosure. However, we can never promise 100% security. You have a responsibility, as well, to safeguard your information through the proper use and security of any online credentials used to access your Personal Information, such as a username and password. If you believe your credentials have been compromised, please change your password. Please also notify us of any unauthorized use.

Changes to this Policy

If we make any changes to this Policy, a revised Policy will be posted on this screen and the date of the change will be reported in the “Last Revised” block above. You can get to this page from any of our screens by clicking on the “Privacy Policy” link (usually at the bottom of the screen).

How to Contact Us

We value your opinions and welcome your feedback. To contact us about this Policy or your Personal Information, please contact us at info@exxat.com.