Privacy Policy

This Privacy Policy explains what personal data Digital Therapeutics, Inc. dba Pelago (“Pelago,” “we,” “us,” or “our”) collects from visitors of our websites pelagohealth.com, hellosona.com, sona.pelagohealth.com, and any related websites or webpages (the “Sites”), how we collect and use that information, and to whom we disclose it. This Privacy Policy does not apply to third-party websites, products, or services, even if the Sites link to them or vice versa.

In the event some of the information we collect, use, and disclose is regulated by the federal Health Insurance Portability and Accountability Act (HIPAA) and similar federal and state laws, including the privacy and security protections of those laws (collectively, “protected health information” or “PHI”), this Privacy Policy is not intended to apply to PHI, and any overlapping coverage of PHI in this Privacy Policy is incidental and provided to enhance your understanding of our data collection and use practices, and should not be construed as an acknowledgment of the applicability or inapplicability of certain privacy laws, including HIPAA and/or the state and other privacy laws that may apply. You can find more information about our collection and use of PHI in our Notice of Privacy Practices.

We may also collect, store, and use personal data (defined below) that is linked or reasonably linkable to you and that identifies your past, present, or future health status or mental health status, as may be applicable (“consumer health data”). If you are a resident of or located in Washington, we provide more information about consumer health data collected about you, as well as the rights you may have related to this data, in our Consumer Health Data Privacy Notice.

This Privacy Policy is supplemental to and incorporates the Notice of Privacy Practices as may be consistent with that notice’s coverage of the personal data and PHI collected or otherwise used by us, and incorporates our Terms of Use. In the event of any conflict between this Privacy Policy and the Notice of Privacy Practices, the disclosures in the Notice of Privacy Practices shall control.

We are providing the following disclosures and rights in this Privacy Policy in the interest of transparency and in furtherance of our privacy commitment to you. Such disclosures and rights are not intended to waive any applicable exemptions under state and federal law.

Sources of Personal Data	We collect personal data when you interact with us through the Sites and by other means.
Personal Data We Collect	We collect personal data when you use the Sites in accordance with applicable law.
Use of Personal Data	We use personal data for different purposes in connection with your use of the Sites.
Disclosure of Personal Data	We may disclose personal data to certain third parties, including our service providers.
Cookies and Other Tracking Technologies	We collect information about your use of the Sites through cookies and other tracking technologies.
Children’s Privacy	The Sites are not directed to or intended for use by anyone under the age of 18.
Data Security, Retention, and Transfers	We use reasonable measures to protect personal data and we retain personal data for as long as necessary to fulfill the purposes set out in this Privacy Policy.
Supplemental State Notices	We provide additional information to residents of California and Nevada.
Updates to this Privacy Policy	Updates to this Privacy Policy become effective on the date they are posted.
Contact Us	You may contact us for comments or questions in various ways.

* * *

As used in this Privacy Policy, “personal data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identifiable individual. Personal data includes “personal information” and “personally identifiable information” as those terms are defined in privacy laws.

Personal data does not include publicly available information; lawfully obtained, truthful information that is a matter of public concern; information that has been de-identified or anonymized; or aggregate information. “Publicly available information” includes information that is made available from federal, state, or local government records; information that a business has a reasonable basis to believe is lawfully available to the general public, either through widely distributed media, or by the individual; and information that is made available by a person to whom the individual has disclosed the information if the individual has not restricted the information to a specific audience.

We may create aggregated, de-identified, or anonymized information from data by removing certain data components that make the data identifiable, or through aggregation, obfuscation, or other means. Subject to applicable law, our use and disclosure of aggregated, de-identified, or anonymized information is not personal data and is not subject to this Privacy Policy.

• Directly from you. We collect personal data you provide to us directly, such as when you visit the Sites, contact us, or otherwise interact with us.
• Automatically through tracking technologies. We may use cookies and other tracking technologies such as web beacons, embedded scripts, and tags (collectively, “Cookies”) on our Sites. Our use of Cookies enables us to collect personal data about you from third-party platform providers, including advertising, social media, and analytics companies, who assist us in serving advertising regarding the Sites to others who may be interested. For example, if you visit the Sites while logged into social media or other third-party platform accounts, the platforms may collect information about your interactions with the Sites, such as browser/device data and usage data, including through Cookies on our Sites. We may also partner with third parties who use Cookies to serve interest-based advertising and content on their respective third-party platforms that may be based on your preferences, location, and/or interests. In this Privacy Policy, we refer to these third parties as “Third-Party Advertising Platforms and Analytics Providers.”
• From our service providers. We collect personal data from our service providers, including those providing hosting, advertising, analytics, email services, and other services.

We may combine the personal data we receive from third parties with personal data we otherwise collect about you through your use of the Sites.

We may collect the following types of personal data:

• Identifiers, such as your name, email address, and telephone number.
• Browser and device data, such as IP address; geolocation information; device identifier; device type; Internet browser type; screen resolution; operating system name and version; device manufacturer and model; plug-ins; add-ons; and the language version of the Sites.
• Usage data, such as time spent on the Sites; pages visited; searches conducted; links clicked; patterns of use; the pages that led or referred you to the Sites; diagnostic data; mouse clicks; mouse movements; keystrokes; and page scrolling. We may also collect information about your online activities on websites and connected devices over time and across third-party websites, devices, apps, and other online features and services.
• Inferences drawn from any of the information we collect to create a profile about you reflecting your preferences or behavior, including to assess the level of interest in the Sites.

Note that some of this information may be considered “consumer health data,” as further described in our Consumer Health Data Privacy Notice.

We may use the personal data we collect for the following purposes:

• To provide, operate, maintain, develop, improve, personalize, and expand the Sites.
• To perform internal analytics, research, and development.
• For marketing and promotional purposes.
• For internal business purposes, including general business administration.
• For systems and data security, including to prevent unauthorized, improper, or illegal activities on the Sites.
• To comply with our legal obligations, including responding to subpoenas, court orders, or legal process; and to establish or exercise our legal rights or defenses against legal claims.
• To enforce the legal or contractual terms that govern the Sites.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding, in which personal data held by us about the users of the Sites is among the assets transferred.
• For purposes disclosed at the time you provide your information or as otherwise set forth in this Privacy Policy, for purposes consistent with your consent or expressed preferences, or as otherwise required or permitted by applicable law.

We may disclose personal data to the following categories of third parties:

• Corporate affiliates. We may disclose personal data to our corporate affiliates, including parent entities, subsidiaries, business units, and other companies that share common ownership.
• Service providers. We may disclose personal data to our service providers to provide services to us and/or on our behalf, such as those providing hosting, advertising, analytics, and other services.
• Third-Party Advertising Platforms and Analytics Providers. We may disclose personal data to Third-Party Advertising Platforms and Analytics Providers.
• Business transferees. If we or our affiliates are involved in a merger, acquisition, asset sale, or other corporate combination, your personal data may be transferred to the acquiring or surviving entity.
• Professional advisors. We may disclose personal data to our professional advisors, including attorneys, auditors, bankers, and insurers, where necessary in the course of the professional services they render to us.
• Authorities for compliance and harm prevention. Under certain circumstances, we may disclose your personal data if required to do so by law, in response to valid requests by public authorities, and/or in response to a threat of harm involving an individual’s health and/or safety.
• Other parties with your consent. We may disclose personal data to other parties with your consent.

We use Cookies that collect information to improve and analyze the Sites. Some Cookies are offered by third parties who collect your personal data so they can provide services to us and information about your online activity to others. You can modify your browser settings to decline or accept certain Cookies. However, if you decline certain Cookies, some of the Sites’ features may not function as designed.

Cookies on the Sites generally fall into the following categories:

• Strictly Necessary. We may use Cookies that we consider to be strictly necessary to allow you to use and access the Sites, including Cookies required to prevent fraudulent activity and improve security.
• Functionality. We may use Cookies that are required to offer you enhanced functionality when accessing the Sites, including identifying you when you sign in to the Sites or keeping track of your specified preferences, including in terms of the presentation of content on the Sites.
• Performance/Analytics. We may use Cookies to assess the performance of the Sites, including as part of our analytics practices. For example, we may use Amplitude to track user language, location, device and browser used, and user sign in and actions. You can learn more about Amplitude’s practices at https://www.amplitude.com/privacy. We may also use Cookies to help us analyze how users use the Sites. Information generated by these services (e.g., your browser, device, and usage data) may be transmitted to and stored by the analytics providers and other service providers on servers in the U.S. (or elsewhere) and these service providers may use this information for purposes such as evaluating your use of our Sites, compiling statistical reports on our Sites’ activity, and providing other services relating to Sites activity and other Internet usage.
• Targeting/Advertising. These third-party Cookies are placed by third-party advertising platforms or networks to deliver ads and track ad performance, enabling advertising networks to deliver ads that may be relevant to you based upon your activities (sometimes called “targeted advertising”) on the Sites.

The Sites are not directed to or intended for children. We do not knowingly collect any personal data from anyone under the age of 18. If you think that your child provided information via the Sites, please email privacy@pelagohealth.com, and we will do our best to promptly delete such information.

The security of your personal data is important to us, but please keep in mind that no method of transmission over the Internet, or method of electronic storage, is 100% secure. We maintain appropriate technical, administrative, and physical safeguards to help protect the security of your personal data against unauthorized access, destruction, loss, alteration, disclosure, or misuse, but we cannot guarantee its absolute security. We will retain personal data for as long as necessary for the purposes outlined in this Privacy Policy, including complying with any legal obligations or policies, resolving disputes, enforcing legal agreements, and for internal analytics purposes. Our determination of precise retention periods will be based on (a) the length of time we have an ongoing relationship with you; (b) whether there is a legal obligation to which we are subject; and (c) whether retention is advisable in light of our legal position, including with regard to applicable statutes of limitations, litigation, or regulatory investigations.

Your personal data may be transferred and maintained outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction. If you are located outside of the United States and choose to provide information to us, please note that we transfer personal data to the United States and process it there. For such transfers, we take the necessary measures to ensure that your personal data receives an adequate level of protection.

A. Notice for California Residents

California residents have the right to request information regarding third parties to whom we have disclosed certain categories of personal data during the preceding year for the third parties’ direct marketing purposes under California’s “Shine the Light” law (Cal. Civ. Code §1798.83). We do not disclose personal data to third parties for such purposes. If you wish to request information regarding such practices under California’s “Shine the Light” law, please email privacy@pelagohealth.com. You must include your full name, email address, and postal address in your request so that we can verify your residency and respond.

B. Notice for Nevada Residents

We do not “sell” personal data as that term is defined under Nevada law. Nevada residents have the right to opt out of any future sale of their personal data under Nevada SB 220. If you are a Nevada resident and would like to make such a request, please email us at privacy@pelagohealth.com. You must include your full name, email address, and postal address in your request so that we can verify your residency and respond.

We may change this Privacy Policy from time to time to reflect changes in our data practices or applicable law. We will notify you of any changes consistent with applicable law, including by posting the new Privacy Policy on this page and updating the “Effective Date” at the top of this Privacy Policy. We recommend periodically reviewing this page for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

If you have questions or concerns regarding this Privacy Policy, please email us at privacy@pelagohealth.com or write to us at Digital Therapeutics, Inc., 1632 1st Ave. #20163, New York, NY 10028.