Privacy Statement

Volterra takes your privacy seriously. This Privacy Statement outlines Volterra's practices regarding the collection, storage, and processing of Personal Information. It does not cover Protected Health Information (PHI), which is addressed in our HIPAA Notice of Privacy Practices.

We offer neurobehavioral assessments and scored results and may offer services by virtually connecting our users to clinical brain health specialists so that users may receive additional clinical services. We do this through our websites, including, but not limited to www.volterra.health (collectively, the "Sites"), our mobile application(s), and other electronic means such as video conferencing, chat, phone, and virtual events (together, "Volterra Services"). The Services are owned by or are provided through Volterra, Inc. ("Volterra").

Volterra provides Volterra Services through which you can access clinical services provided by a clinician ("Clinical Services"), research services provided by a researcher ("Research Services"), wellness services, and health information. Volterra, Inc. contracts with separate clinical practices, non-profits, and companies whose qualified Clinicians provide Clinical Services to you (the "Volterra Partner Clinicians"). These Clinicians, as well as independent clinicians, (each a "Clinician" or together, the "Clinicians") provide Clinical Services to you. Research Services may be provided by Volterra or by separate companies, non-profits, or individuals.

Some of the information that we collect relating to the Assessment Services, Clinical Services, Research Services, and wellness services may be Protected Health Information ("PHI") under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), such as your medical records that we receive from your healthcare provider, your lab results, your initial assessments, or device readings. PHI is covered by a separate policy called the HIPAA Notice of Privacy Practices. The HIPAA Notice of Privacy Practices describes how Volterra uses and shares PHI and contains more information about your rights under HIPAA. This Privacy Statement may provide additional detail on how PHI is collected, processed, or stored, but if there is a conflict between this Privacy Statement and the HIPAA Notice of Privacy Practices with respect to PHI, the HIPAA Notice of Privacy Practices will solely apply.

We encourage you to read both the Privacy Statement and the HIPAA Notice of Privacy Practices carefully. Please note, capitalized terms used in this Privacy Statement but not defined here have the definition given to them in the Volterra Terms of Service.

California Residents: See "Additional Information for California Residents" below for additional information about your rights.

International Users: Volterra is currently available only to users who are residents of the United States and are subject to U.S. privacy laws. Accessing the services from outside the United States is not permitted under our Terms of Service.

1. What Personal Information Does Volterra Collect?

We may collect information that identifies, describes, or is personally related to you ("Personal Information") in the categories below. We collect Personal Information from you, from your use of Volterra Services, when you visit the Sites and mobile applications and from certain third-party sources. By using Volterra Services, and visiting the Sites and mobile applications, you agree that we can collect and use your Personal Information as described in this Privacy Statement.

Information You Provide To Us

Volterra collects information that you provide to us, including when you enroll, give updates about your status, respond to a questionnaire or interactive assessment, or contact us. Some examples of this information include:

Contact or other Identifying Information, such as your name, address, email address, and phone number;
Personal health information, such as age, sex, diagnoses, medications, lifestyle information (e.g., sleep patterns, physical activity levels, dietary habits), and family history;
Information related to your communications with Volterra, including with the Clinicians;
Healthcare provider information (if you are a patient) or patient information (if you are a provider) or research participant information (if you are a researcher);
Professional licensure, organizational affiliation, license number, issuing state, and expiration date (if you are a provider or researcher).

Information Collected While Using Our Services

Volterra may also collect certain information when you access, browse, and use Volterra Services. This information is collected through the web apps and mobile apps used to deliver Volterra Services. Some examples include:

Touchscreen interactions, gyroscope and accelerometer data, audio and video recordings of you. Volterra will only collect audio and video recordings of user sessions needed for clinical evaluation and identity verification. Such recordings will be handled in accordance with this Privacy Statement and Volterra's HIPAA Notice of Privacy Practices.
Internet and other electronic activity data, such as technical information related to how you connect and use the services such as the date and time you access the service; how often you access Volterra Services, and the internet address of the website from which you directly linked to Volterra.
Performance Information like log files, diagnostic or crash data, website/app performance logs and error messages or reports.
Identifiers or geolocation data, such as Internet Protocol (IP) address and device identifiers;
Data from Tracking Technologies, such as information from cookies, web beacons, tags or other tracking technologies, as further described below.

Information Collected from Other Sources

In connection with your use of the Services, we may combine or compare data we have collected from you with information collected from a third party. Some examples of information we may receive from a third party include information we may collect from your past, current or future health care providers, such as medical records, past or present diagnoses, previous treatments, general health, test results and reports, family medical history, and records of communications related to your health.

For information on how Volterra Uses, Shares and Stores Personal Information that is Personal Health Information ("PHI"), see our HIPAA Notice of Privacy Practices.

Use of Personal Information

We may use the Personal Information we collect for one or more of the following business purposes:

To provide, personalize, improve, update, and expand Volterra Services, including for:
- Personalizing user experience;
- Troubleshooting and customer support;
- Developing new features and functionalities;
- Product testing, development, and data analysis; and
- Medical, scientific, statistical, and historical research.
To communicate with you about Volterra Services, including to:
- Send administrative and service-related information (e.g., appointment reminders, updates to our terms or policies);
- Provide customer and technical support;
- Respond to your inquiries and concerns;
- Provide you with information or request action in response to technical, security, and other operational issues;
- Follow-up with you regarding your enrollment process and session status;
Provide customer support and gather feedback.
To create de-identified information (for example, aggregated statistics) related to the use of the Services or for scientific research.
To comply with laws and regulations, including to respond to law enforcement or a government request(s) as required by applicable law, court order, or governmental regulations and to monitor our compliance with those obligations.
To protect the integrity and maintain the security of our Services or to enforce our Terms of Service.
For any other purpose for which you may provide consent or as disclosed to you when you provide information to us.

When we use the term "de-identified information," we mean information that is neither used, nor intended to be used, to identify an individual. We may use de-identified information without restriction and may share it with unaffiliated third parties.

Sharing Personal Information

Volterra does not share your Personal Information with third parties except as described in this Privacy Statement, the HIPAA Notice of Privacy Practices, or with your additional consent (if required).

Generally, Volterra uses Personal Information to improve our science and usability and to advance research on brain function and clinical care.

Volterra may share Personal Information with the following categories of third parties for the following purposes:

Service Providers: We may share your Personal Information with service providers, such as contractors and other third parties we use to support our organization and provide us with services. These companies are subject to contractual obligations to implement appropriate technical and organizational measures to protect the confidentiality, security, and integrity of your Personal Information, in accordance with applicable laws.
Corporate Affiliates: We may share your Personal Information with our subsidiaries, affiliates, partners, and associated organizations.
Research Partners: We may share your Personal Information with research partners if you provide us with your express consent or if otherwise permitted by law.
Health Care Providers, Health Plans, and Similar Organizations: Personal Information that we create or obtain about you may be shared with health care providers, health plans, or other similar healthcare organizations for purposes of treatment, payment, and other healthcare operations, as permitted by law or pursuant to your consent.
Law Enforcement, Government Agencies or Other Third Parties, and Safety: We may voluntarily or be required to share your Personal Information if we believe it is reasonably necessary to:
- Comply with valid legal process (such as subpoenas, warrants, court orders, or other legal demands) or respond to lawful requests from government agencies or regulatory bodies.
- Enforce or apply the Volterra Terms and Conditions.
- Investigate fraud or protect the security or integrity of the Services.
- Protect the rights, property, or safety of Volterra, our employees, members, or users.
Corporate Transactions: If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of all or a portion of our assets, we may share or transfer your Personal Information as part of such corporate transaction.
As permitted or directed by you: At your direction or with your permission.

*If we disclose your Personal Information in this way, we will reasonably attempt to provide you with advance notice, unless we are prohibited from doing so.

Retention of Personal Information

Volterra will retain the Personal Information you provide while creating your account and your profile until such time as you delete your account or you request deletion provided you are entitled to request deletion under applicable law. Any clinical records created as a result of your use of the Services (which constitutes Personal Health Information or medical information) will be securely maintained by Volterra for a period that is no less than the minimum number of years such records are required to be maintained under applicable law (typically at least six years). Volterra may also retain certain information as reasonably necessary to comply with our legal obligations (including law enforcement requests), resolve disputes, maintain security, prevent fraud and abuse, as well as to comply with tax, securities, and regulatory compliance requirements.

3. How to Review, Modify, and Delete Personal Information

Some applicable laws provide individuals with specific privacy rights and you may have certain privacy rights with respect to the Personal Information we collect and maintain about you, such as the following:

Right to Know/Access

You may have a right to request access to your Personal Information and to be provided with a copy of certain information in a readily usable format, including:

The categories of Personal Information we collected about you;
The categories of sources from which we have collected your Personal Information;
Our business or commercial purpose for collecting or selling that Personal Information;
The categories of your Personal Information that we have shared with third parties;
The categories of third parties with whom we share your Personal Information; or,
The specific pieces of Personal Information we collected about you.

Right to Modify

You may have the right to request that we modify the Personal Information we have collected and that we maintain about you. To request to modify your Personal Information, email us at admin@volterra.health. We may request additional information from you in order to verify your identity and update your Personal Information per your request.

Right to Request Deletion

You may have the right to request that we delete the Personal Information that we have collected and that we maintain about you subject to applicable law. We may deny your request under certain circumstances, such as if we need your Personal Information to:

Provide you with the services you requested;
Complete the transaction for which the personal information was collected;
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity;
Comply with a legal obligation; or
For other reasons permitted by applicable law.

If we deny your request for deletion, we will let you know the reason why. There may be some latency in deleting your Personal Information from our backup systems after it has been deleted from our primary production and development systems. Information that has been de-identified prior to your request can not be deleted. Volterra may be subject to legal limitations with respect to the Personal Health Information that can be deleted.

How to Exercise Your Privacy Rights

If applicable, you may exercise your right to know/access and your right to request deletion twice a year free of charge. To exercise your rights to know/access and request deletion, please contact us at admin@volterra.health.

You are responsible for the accuracy of the Personal Information you provide to us. We will take reasonable steps to verify your identity before processing your request. We will not fulfill your request unless you have provided sufficient information for us to reasonably verify that you are the individual about whom we collected Personal Information.

Authorized Agents: If required under applicable law, you may use an authorized agent to submit a request to know/access or a request to delete on your behalf. Even if you use an authorized agent, you will still need to communicate directly with Volterra to verify your identity and address. We require that your agent be registered to do business with the appropriate Secretary of State and/or that your agent provide us with a signed document from you that authorizes your agent to make the request on your behalf, and provide information necessary to verify your identity.

4. Additional Information for California Residents

If you are a California resident, California law provides you with additional rights regarding our collection, use and disclosure of your Personal Information under the California Consumer Privacy Act, as amended ("CCPA"), the Shine the Light law, and the Do Not Track law. The CCPA does not cover PHI collected by a covered entity or business associate that is governed by HIPAA. For information on how Volterra uses and shares your PHI please refer to our HIPAA Notice of Privacy Practices.

Within the preceding 12 months:

We have collected the categories of Personal Information described above in "Personal Information We Collect" from the sources described therein for the purposes described in "How We Use and Share Your Personal Information".
We have shared categories of Personal Information to Service Providers, Corporate Affiliates, and Other Third Parties (as described further in "How We Use and Share Your Personal Information").
We have not sold your Personal Information.

5. How We Protect Personal Information

We take great care to protect the Personal Information we maintain about you. Volterra has a broad information security program designed to protect your Personal Information using administrative, physical, and technical safeguards. We have measures in place to protect against inappropriate access, loss, misuse, or alteration of Personal Information under our control. For example, Personal Information is stored on encrypted servers. While we strive to protect your Personal Information, we cannot guarantee the security of information you provide to us. This is especially true for information you transmit to us via email because email may not have the security features that are commonly built into websites. To the fullest extent permitted by applicable law, we do not accept liability for unintentional disclosure of your Personal Information.

6. Tracking Technologies

We may use Tracking Technologies to improve the functionality of our website, understand user behavior, personalize content, and deliver relevant advertising such as cookies, web beacons or pixels, tags, scripts, and other storage technologies (collectively "Tracking Technologies") to collect or receive information on the Sites.

Cookies and Other Tracking Technologies

Cookies are small data files that we transfer to your device to collect information about your use of the Sites. Cookies can be recognized by the website that downloaded them or other websites that use the same cookies. We may use both first-party and third-party cookies on the Sites. The following types of cookies may be used on the Sites:

Strictly Necessary Cookies: Essential cookies that enable you to use the Sites. These cannot be disabled.
Functional or Preference Cookies: Used to remember your choices and tailor the Sites to provide enhanced features and personalized content.
Performance or Analytic Cookies: Collect passive information about how you use the Sites to help us improve and optimize. These can be disabled.
Targeting or Advertising Cookies: Used to deliver relevant online advertising. We may use these in limited circumstances associated with our public-facing sites.

Managing Your Tracking Technology Preferences

Cookies: When viewing the Sites, you can accept or reject the use of cookies. Many browsers allow you to manage your cookie preferences at the individual browser level. If you reject or delete cookies, please be aware that you may not be able to use some or all portions or functionalities of the Sites.

Do Not Track: "Do Not Track" (DNT) is a feature in some web browsers that allows users to signal to websites that they do not want their online activities tracked. Currently, there is no universally accepted standard for how websites should respond to DNT signals. The Sites do not currently process or respond to DNT signals.

Location Information: You may be able to adjust the settings of your device so that information about your physical location is not sent to us or third parties by disabling location services within the device settings or denying certain websites or mobile applications permission to access location information.

Analytics Tools: We may use tools such as Google Analytics, Facebook, and LinkedIn to help analyze how individuals use the Sites. You may prevent your data from being used by Google Analytics by downloading and installing the Google Analytics Opt-out Browser Add-on.

Regarding Targeted Advertising

We may participate in online behavioral advertising, also known as interest-based advertising. You can opt out of certain online behavioral advertising by visiting the Digital Advertising Alliance's opt-out tool.

7. Children's Information

If you are between the ages of 13 and 16, do not use our Site or Volterra Services unless your parent or legal guardian has provided explicit consent. We are committed to protecting the privacy of children and do not collect Personal Information directly from anyone who is, to our knowledge, under the age of 13. If you are under the age of 13, please do not provide any Personal Information to us through the Sites or Services. If you become aware that an individual under age 13 has provided Personal Information directly to us, please contact us as described in the "Contact Us" section, so that we can delete the information.

A parent or guardian of children aged 13 to 18 years may create an account on behalf of their child, provided that the parent assumes full responsibility for the account and for the interpretation and use of any information provided through the Services. Once a child reaches the age of 18, their Personal Information becomes theirs to control and the parent or guardian no longer has the ability to control the account. Currently Volterra is not designed for use and is not available for individuals under the age of 16.

8. External Websites

The Sites may contain links to other websites, including, but not limited to, investor relations sites, job applicant information gathering, assessment, and testing sites. These third party sites have their own privacy practices and measures to secure and protect your information. This Privacy Statement does not apply to any third party sites. We encourage you to review the privacy statement of any other third party website you may visit.

9. Changes to This Privacy Statement

This Privacy Statement is effective as of the date stated at the top of this Privacy Statement. We may change this Privacy Statement from time to time. We will notify you of any material changes to this Privacy Statement by posting a notice on the Sites or by sending you an email, as required by applicable law. Your continued use of the Sites or Services after the effective date of any changes constitutes your acceptance of the updated Privacy Statement.

10. Contact Us

Volterra, Inc. ATTN: Privacy
admin@volterra.health
2108 N St., Ste N
Sacramento, CA 95816