Last Updated September 29, 2026

1 Scope of this policy

Corvallis Health, LLC (“Corvallis,” “we,” “us,” or “our”) develops medical technology software, including SPEAR Lens for healthcare providers and SPEAR Vault for patients. This policy explains how we collect, use, protect, and disclose personal information through our website, platforms, AI assistants, support services, and business communications, collectively the “Services.” It applies to patients, authorized representatives, provider users, website visitors, and business contacts.

Our Services are intended for use in the United States, including Michigan, South Carolina, Indiana, and Alaska. The information we process depends on the features you use and the relationship through which we provide them. Descriptions of platform features in this policy apply when those features are available and used. Separate notices may apply to employment information or particular programs.

Personal information means information that identifies you or can reasonably be linked to you. It includes identifiable health information and health-related inferences. Reading this policy or using the Services does not, by itself, authorize a sale of information, optional model training, participation in research, or a disclosure that requires separate consent.

2 HIPAA and our role

We comply with the HIPAA Privacy, Security, and Breach Notification Rules and other HIPAA requirements applicable to our role. When we handle protected health information (“PHI”) on behalf of a healthcare provider, health plan, or other HIPAA-regulated organization, we act as a business associate or subcontractor under a written business associate agreement. We use and disclose that PHI only as the agreement and applicable law permit or require.

This policy does not replace your healthcare provider’s Notice of Privacy Practices. Your provider remains responsible for its medical records, treatment decisions, and HIPAA obligations. We assist providers in responding to patient requests as required by our agreements and law.

HIPAA does not automatically apply to every item of information held by a health technology company. Information you provide directly to an independent consumer service, including records transferred to an app at your direction, may fall outside HIPAA depending on our relationship with the provider. Such information remains subject to this policy and applicable consumer privacy, health data, and security laws. Where applicable law or a binding healthcare agreement requires stronger protection, we follow that requirement.

3 Information we collect

We collect the following categories as relevant to the Services you use:

• Account and contact information. Your name, email address, telephone number, address, date of birth, account identifiers, sign-in information, preferences, and information needed to verify your identity or an authorized representative’s authority.
• Health and insurance information. Medical history, conditions, symptoms, allergies, medications, test results, clinical notes, treatment information, insurance coverage, claims, and billing information that you or authorized sources provide. Connected features may also receive activity, sleep, nutrition, vital signs, and other wearable or device measurements.
• Assistant interactions and communications. Questions, messages, uploaded files, responses, feedback, and support correspondence. If you choose a voice-enabled feature, this may include recordings and transcripts, subject to any notice and consent required for that feature.
• Provider and business information. Professional contact details, credentials, organization, role, account permissions, contracting information, and communications about partnerships or Services.
• Technical and usage information. IP address, browser and device characteristics, session identifiers, pages and features used, timestamps, errors, and security and access logs. An IP address may indicate an approximate location.
• Derived information. Summaries, health-related patterns, risk indicators, and potential clinical trial matches generated from information available to the Services. These inferences may be inaccurate and remain personal information when linked to you.

Health records may contain especially sensitive information, including mental health, substance use, reproductive or sexual health, HIV status, disability, or genetic information. We apply additional restrictions when the law requires them. We do not treat the presence of this information in an uploaded record as permission for unrelated uses.

4 Where information comes from

We receive information from you, your authorized representative, healthcare providers, health plans, connected electronic health record systems, health information networks, and applications or devices you choose to connect. We also receive technical information from your use of the Services and information from vendors that help us verify identity, maintain security, or provide support.

We access external health records only through an authorized connection or another lawful basis. A provider using SPEAR Lens is responsible for having authority to provide and access patient information. Connecting a source does not authorize every possible use of the information it contains.

5 How we use information

We use personal information to create and manage accounts; verify identity and access permissions; retrieve, organize, and display records; deliver requested assistant responses and summaries; support authorized care coordination; provide technical support; administer contracts and billing; and communicate about the Services.

We also use information to protect accounts, investigate misuse, detect security threats, maintain audit records, correct errors, and meet legal obligations. We may analyze service performance and develop improvements subject to the restrictions on health information and AI training below. We limit collection and use to information reasonably needed for the stated purpose.

We use contact information to respond to inquiries and, where permitted, send information about Corvallis products or events. You may stop promotional messages through the unsubscribe instructions or by contacting us. Essential account, security, legal, and service messages may continue.

For consumer health data and other sensitive information, we obtain affirmative consent when required and distinguish optional uses from processing needed to provide a product or service you request. We do not rely on a general reference to business purposes to override a consent requirement.

6 AI assistants and model training

Our AI features process information you submit and information the feature is authorized to access to generate responses, summaries, and recommendations. Generating a response and training a model are different activities. An assistant may use information to answer your request without adding it to a training dataset.

We may use assistant interactions to evaluate, train, or improve Corvallis models. For optional training or improvement of models beyond providing your requested service or carrying out an authorized provider function, we will use either information properly de-identified as described below or identifiable information for which we have obtained your separate, affirmative opt-in consent and any legally required authorization. Consent will describe the information and purpose involved. Refusing optional training will not prevent you from using the core Services.

We do not use provider-controlled PHI to train models for our independent purposes merely because we can access it. Any use of PHI for training, evaluation, or improvement must be permitted by HIPAA, the applicable business associate agreement, and other governing law. When authorization is required, a general acceptance of this policy is insufficient. Creating de-identified information from PHI also requires authority under the applicable agreement.

We do not sell assistant interactions or datasets created from those interactions to third parties. Vendors that process identifiable assistant content for us may use it only to perform authorized services under appropriate agreements; we do not authorize them to train their own general-purpose models on that content.

You may withdraw optional training consent through the contact process below. We will stop future uses based on that consent and address deletion requests as required by law. Withdrawal does not undo processing lawfully completed before withdrawal. Information already irreversibly de-identified may no longer be traceable to you. These limits do not excuse compliance with a legal obligation to delete personal information from a dataset or system.

AI outputs can be incomplete or incorrect. You may ask us to correct information we control. Clinical decisions and verification of medical information remain with qualified healthcare professionals.

7 Clinical trial recommendations

We may use our systems to compare authorized health information with clinical trial criteria and identify trials that may be relevant to you. Where consent is required for this processing, we obtain it before screening. A potential match is a recommendation, not a determination that a study will accept you or that participation is medically appropriate.

We will not share your information, screening results, or interest in a trial with trial sponsors, researchers, recruitment organizations, or other external parties for trial recruitment without your explicit consent. Before a disclosure, we will identify the recipient, the information to be shared, and its purpose, and obtain any required HIPAA authorization or other written permission. Our contracted processors may support internal matching only under the service restrictions in this policy and may not use that information for their own recruitment.

Screening does not enroll you in research. Enrollment requires the study’s separate eligibility review and informed consent process. You may decline recommendations or withdraw consent for future recruitment disclosures by contacting us. Withdrawal does not retrieve information already lawfully disclosed; the recipient’s legal obligations and consent terms govern its continued handling.

8 When we disclose information

We disclose information only for the purposes and under the restrictions described in this policy:

• Providers and people you authorize. We make information available to providers, caregivers, representatives, connected services, or other recipients as you direct or as otherwise lawfully permitted within a provider relationship. Access is limited by the recipient’s role and applicable permissions.
• Service providers. Vendors may process relevant account, health, interaction, or technical information to provide hosting, secure storage, identity verification, record connectivity, AI processing, support, communications, or security. We require appropriate confidentiality, security, and use restrictions, including business associate agreements when required. These vendors do not receive unrestricted rights to use your information.
• Professional advisers and business transactions. We may disclose necessary information to legal, accounting, or other advisers subject to confidentiality obligations. A merger, acquisition, financing, or transfer of assets does not override HIPAA, consent requirements, or the promises in this policy. Any transfer of personal information must have a lawful basis and appropriate protections.
• Legal and public health obligations. Disclosures to courts, regulators, government authorities, or other legally entitled recipients are subject to Section 10.

An external provider, application, or research organization may have its own privacy practices once it lawfully receives information. Revoking a connection stops future access through that connection, subject to legal and contractual obligations, but does not automatically delete records already held by a recipient.

9 Sale of information and advertising

We will not sell your personal information to a third party without your prior, explicit consent and any separate authorization required by law. If the law prohibits a sale, consent does not make it permissible. Any proposed sale requiring authorization will be explained separately, including the data, recipient, purpose, and compensation disclosures required by law. We do not sell assistant interactions or datasets created from them, even under this general consent provision.

We do not use or disclose identifiable health information, assistant conversations, or clinical trial interests for targeted advertising. We do not permit advertising trackers to collect the contents of patient records or assistant conversations. Where applicable law gives you the right to opt out of a sale, sharing for cross-context behavioral advertising, or targeted advertising, you may exercise that right through the contact process below. We honor legally recognized opt-out preference signals, including Global Privacy Control, where required.

10 Legal requests and government reporting

We may disclose information when required by applicable law or valid legal process, including a qualifying subpoena or court order. We assess the request’s validity, scope, and the protections applicable to the records. A subpoena alone does not automatically permit every disclosure of health information. We comply with required notice, authorization, protective-order, and other safeguards, and limit a disclosure to what the law authorizes or requires.

We may provide de-identified, aggregate information to map health trends or meet lawful government reporting and contract requirements. A government contract alone does not authorize disclosure of identifiable health information. If identifiable information is legally required, we disclose it only under the applicable legal authority and restrictions. We notify affected people of legal requests when required and when legally permitted.

Where applicable law and our role permit, we may make limited disclosures for public health reporting, health oversight, or prevention of a serious and imminent threat. Additional protections for sensitive records continue to apply. In particular, records protected by 42 CFR Part 2 are subject to specific consent and court-order requirements, including restrictions on using or disclosing them in proceedings against a patient. General legal-process language in this policy does not waive those protections.

11 De-identified and aggregate information

We may create and use de-identified or aggregate information for model improvement, service evaluation, and health trend analysis, and provide de-identified aggregate reports for the government purposes described above. For PHI, de-identification must satisfy HIPAA’s Safe Harbor or Expert Determination method. We also comply with applicable state standards and contractual restrictions.

Removing names, replacing identifiers with codes, or combining records does not necessarily make information anonymous. We treat coded, pseudonymous, or aggregate information as personal information when it can reasonably identify a person. We maintain de-identified information in that form, do not attempt to re-identify it except for legally permitted testing of de-identification, and require appropriate restrictions on recipients. We take reasonable measures to prevent reports from identifying individuals, including through small groups or unusual combinations of characteristics.

12 Cookies and connected services

Our website and Services may use cookies or similar technologies to maintain sessions, remember preferences, protect accounts, and understand service performance. These technologies may collect the technical information described in Section 3. We obtain consent for nonessential technologies where required and do not use them to bypass the health information restrictions in this policy.

You can manage cookies through your browser and any consent controls provided with a feature. Blocking necessary cookies may prevent sign-in or other functions. Ordinary browser Do Not Track requests are not a uniform consent mechanism; we honor opt-out signals when the law requires them.

Links and integrations may take you to independently operated services. Review their notices before providing information or authorizing a connection. Disconnecting a device or application stops future collection through that connection but does not, by itself, erase information already received.

13 Security and incident notification

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information and applicable legal requirements. These include controls on access, authentication, encryption where appropriate, logging, workforce responsibilities, vendor oversight, and incident response. Access is limited to people and systems with an authorized need. No system can guarantee absolute security.

We investigate suspected unauthorized access, use, or disclosure and take appropriate steps to contain and address incidents. We notify affected individuals, healthcare customers, regulators, and others when required under HIPAA, the FTC Health Breach Notification Rule, state breach notification laws, or our contractual obligations. The rule that applies depends on the information and our role.

14 How long we retain information

We retain personal information only as long as reasonably necessary for the purpose for which it was collected, to provide requested Services, or to meet applicable legal, security, recordkeeping, and contractual obligations. Retention depends on the type of information, account status, provider instructions, and any required retention period or legal hold.

Account and contact data are retained as needed to manage the relationship and related obligations. Health records handled for providers follow applicable healthcare record requirements and authorized provider instructions. Assistant histories and training datasets are retained only for their permitted purposes and applicable retention needs. Security logs and consent records may be retained to demonstrate compliance or investigate incidents.

When retention is no longer justified, we delete or properly de-identify information. Where backups cannot be immediately overwritten, we restrict their use and remove information through the applicable backup lifecycle, subject to legally required deadlines. Closing a Vault account does not require a healthcare provider to delete its medical records.

15 Your choices and privacy rights

You may contact us to request access to personal information we control, a copy in an available portable format, correction of inaccuracies, deletion, or withdrawal of consent. You may also ask us to stop optional clinical trial recommendations or optional training, revoke an authorized connection, or stop promotional communications. Some features cannot function without the information necessary to provide them.

Depending on applicable law, you may have rights to confirm whether we process your information; obtain information about its sources and disclosures; limit uses of sensitive information; opt out of sale, targeted advertising, or certain profiling used for decisions with legal or similarly significant effects; and appeal a denied request. We do not retaliate or unlawfully discriminate because you exercise privacy rights.

Submit requests through https://www.corvallishealth.com/contact and identify your message as a privacy request. Include your name, a way to contact you, the relevant Service, and what you are requesting. Do not include medical records, passwords, Social Security numbers, or other sensitive information in the public form. We will arrange an appropriate verification and response process. We may request information reasonably needed to verify identity or an agent’s authority. You do not need to create a new account solely to submit a request.

We respond within the period required by applicable law. For consumer privacy requests, our standard response period is 45 days, subject to any shorter deadline or legally permitted extension. We explain an extension, denial, or lawful fee when applicable. If we deny a request, you may appeal through the same contact page by identifying the message as a privacy appeal. We respond to appeals within 60 days or a shorter applicable deadline and provide information about contacting the appropriate regulator if the appeal is denied.

For provider-controlled PHI, you may have rights to inspect or obtain records, request amendments, seek restrictions or confidential communications, receive an accounting of certain disclosures, and obtain the provider’s Notice of Privacy Practices. Direct these requests to your provider or contact us for assistance routing them. HIPAA access requests generally require action within 30 days, with one permitted extension when its conditions are met; other requests have their own deadlines. Deletion is not a general HIPAA right. We do not promise to remove a provider’s record or alter a clinical entry without the required authority.

16 State privacy protections

State protections depend on residency, the information involved, our role, and statutory coverage or exemptions. We apply additional protections when they govern the information, even if HIPAA also applies.

Michigan. Applicable Michigan law protects access to medical records and restricts disclosure of certain information, including HIV-related and mental health records. We observe applicable consent, access, and disclosure requirements when handling these records.

South Carolina. Applicable South Carolina medical record laws protect patient access and restrict certain transfers and sales of medical records. Our general sale and business-transfer provisions do not override those restrictions or a provider’s recordkeeping duties.

Indiana. Where the Indiana Consumer Data Protection Act applies, residents have rights to confirm processing, access and correct covered data, request deletion and a portable copy or representative summary as provided by law, and opt out of sale, targeted advertising, and covered profiling. The law also provides an appeal process and requires consent for covered sensitive-data processing. Statutory exemptions, including relevant HIPAA exemptions, may limit its application. The request and appeal procedures in Section 15 apply.

Alaska. Where Alaska genetic privacy law applies, collection, analysis, retention, or disclosure of genetic information requires the informed written consent or other legal authority specified by that law. A general acceptance of this policy does not substitute for required genetic-information consent.

Other states. We honor additional rights when another state’s law applies, including applicable consumer health data and comprehensive privacy laws. Where required, we provide a supplemental consumer health data notice and separate consent for collection or sharing. You may request legally available information about recipients of consumer health data, withdraw consent, and request deletion, including downstream deletion where required. We do not use geofencing around healthcare facilities to identify or track people seeking care or to send health-related advertisements.

17 Children and authorized representatives

Our public website and independent account registration are intended for adults. We do not knowingly collect information directly online from children under 13 without the notices and verifiable parental consent required by the Children’s Online Privacy Protection Act, unless a lawful exception applies. If you believe a child has provided information without required permission, contact us so we can investigate and take appropriate action.

A healthcare provider or legally authorized adult may supply a minor’s health information in an authorized care relationship. Access by parents, guardians, caregivers, and other representatives depends on legal authority, the patient’s rights, and the type of record. A family relationship alone does not establish unrestricted access, particularly for care a minor may lawfully obtain confidentially.

18 Changes and privacy contacts