ELUVE, INC. PRIVACY POLICY Last Updated: July 20, 2026

This Privacy Policy describes how Eluve, Inc., and our subsidiaries and affiliated companies (collectively, “Eluve,” “we,” “us,” and “our”) collect, use, and disclose information about you, your practice, and any healthcare professional within your practice who you have authorized and for whom you have approved access to our Service (collectively “you” or “your”), as well as information about your patients.

Eluve offers various artificial intelligence (“AI”) tools to assist medical and healthcare clinicians in managing their workflow (collectively, “Eluve AI”). Eluve’s medical scribe takes doctor/patient conversations and automatically generates medical grade clinical documentation, including but not limited to progress notes, including subjective, objective, assessment and plan notes (“SOAP notes”), patient follow-up care plans and billing code/insurance reimbursement documents for the clinician to review. Eluve also offers other AI-powered features, including clinical decision-support tools such as Differential Diagnosis, which reviews patient visit history and current visit data to suggest potential diagnostic considerations to clinicians, and Eluve Chat, an AI-powered clinical chat interface that enables clinicians to query patient records and access reference information to support their clinical decision-making.

This Privacy Policy applies to information we collect when you access or use our mobile applications and other online products and services, including Eluve AI (collectively, our “Service(s)”), or when you otherwise interact with us, such as through our customer support channels. By using our Service, you acknowledge and agree to the practices and policies outlined in this Privacy Policy.

Our Services are currently intended for use by medical and healthcare providers who are residents of the United States, Canada, and Indonesia only. If you are not a resident of the United States, Canada, or Indonesia, please do not provide any patient or practice information to us or otherwise use our Service. Our Services are strictly business to business services and are not offered to individuals in their personal or household capacity. While medical and healthcare providers may make information about their patients available on our Services, Eluve does not provide Services directly to patients, and patients should contact their medical or healthcare provider to understand their privacy practices, which govern their collection and use of patient data through our Services.

Our Service is not intended for use by individuals under the age of eighteen (18). If you are under the age of eighteen (18), please do not provide any patient or practice information to us or otherwise use our Service.

We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of this Privacy Policy. We may also provide you with additional notice (such as by adding a statement to the Service or sending you a notification), such as in connection with making material changes to this Privacy Policy. We encourage you to review this Privacy Policy regularly to stay informed about our information practices and the choices available to you.

CONTENTS

• Notice of Information We Collect
• Sources of Information
• Use of Information
• Disclosure of Information
• International Data Transfers
• Analytics
• Data Security and Retention
• Your Privacy Rights and Choices
• Federal and State-Level Privacy Protections
• Contact Us

Healthcare Disclaimer

We do not provide clinical or healthcare services. The Service, including any AI-generated output derived from the same (such as clinical documentation, diagnostic suggestions, or other clinical decision-support outputs), is not intended to replace the services of a licensed, trained, in-person physician or other health professional or be a substitute for the medical advice of a physician or trained health professional licensed in your state. All AI-generated outputs provided through the Service are informational only and are designed to augment, not replace, your clinical judgment. Instead, our Services, including Eluve AI and our AI system, are tools that assist a licensed provider with the inputting and manipulation of various physical and digital media, including but not limited to electronic health records (“EHR"), text, visual and/or audio healthcare recordings such as patient/provider treatment and provider follow-up case notes. Your use of the Service must at all times be in accordance with our Terms and Conditions, including Section 18 (Medical Advice).

Your HIPAA Obligations

The information collected through your use of Eluve AI may be considered protected health information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Eluve processes any such PHI as a Business Associate (as that term is defined under HIPAA). Accordingly, we will require that you enter into a Business Associate Agreement (“BAA”) with us before you use Eluve AI or provide us access to any PHI, which will govern our processing of PHI on your behalf. You remain at all times responsible for complying with your HIPAA obligations.

Notice of Information We Collect

We collect various types of data about you and your patients from various sources, as described below. To the extent you provide or make available to us information from or about your patients, you are responsible for obtaining any necessary consent and providing any required notices to do so.

• Identifiers and Customer Records: contact and account information. We may collect your name, email address, postal address, and phone number. We may also collect information you provide to create an account or profile on behalf of yourself or other authorized professionals in your practice who may utilize our Services. You agree that you will remain solely responsible for determining which individuals may access your account(s) with us within your practice, and you will keep the login credential access limited to those who have appropriate authorization and immediately revoke access for any individual who no longer has approved access. We may also collect the name and any other identifying information you provide us about your patient.

• Characteristics of Protected Classifications, including Demographic information. In order to provide the Services to you and ensure we are collecting and storing only your records to your account, we may collect information from or about you in order to prove or verify your identity. Examples may include your date of birth, age or age range, gender identity, geographic location (e.g., ZIP or Postal Code), photographs of your face (“selfie”) captured by the Service’s mobile application accessing your mobile device’s camera, and photographs of your government-issued identity documents.

• Audio. In order to provide the Services, we collect audio recordings of your interactions with your patients.

• Sensitive Personal Information, including Patient Healthcare information. In order to provide the Services, with your consent we will collect voice recordings of patient interactions, from which our Services may derive information regarding your designated patients’ treatment and other healthcare, vaccination records, names of treating physicians and healthcare providers including medical record numbers and other unique identifiers, health insurance information, and group health plan information. In connection with certain features of the Service, we may also access and process historical clinical notes, current visit transcripts, and patient records to generate clinical decision-support outputs and respond to clinician queries. We may also collect and store records of your interactions with AI-powered features of the Service, including queries, responses, and any associated feedback. You understand that you have the sole responsibility to obtain any necessary consents from patients and/or their parent or legal guardian (if a minor) for asynchronous or synchronous patient interactions, regardless of whether they are conducted in a telehealth or physical location. When you use our Services, we may record sessions described in this document and our Terms of Service for the following purposes: to provide our Services; to enhance the functionality, accuracy, and reliability of our AI systems by analyzing session data; to ensure that our Services meet high standards of quality and that interactions with our AI systems are consistent and effective; and to comply with legal obligations and ensure the security of our Services. The recorded sessions may include, but are not limited to, textual data (conversations and interactions between users and our AI systems) and metadata (including information such as timestamps, user session IDs, and other related data that does not personally identify you). Where permitted by applicable law, this may also extend to conversations between you and your patients processed by our AI systems.

• Commercial Information: We may collect information relating to the Services you purchase, obtained, or considered, as well as:

  • Customer service and feedback. We may collect information from you when you request customer support or information from us, provide feedback or reviews about your experience with us or our products, or otherwise communicate with or contact us.

  • Location Information: In accordance with your device permissions, we may collect or infer information about the location of your device based on your zip code or IP address.

• Internet or Other Electronic Network Activity Information: We collect information about how you access our Service, including data about the device and network you use, such as your hardware model, operating system version, mobile network, IP address, unique device identifiers, browser type, and app version. We also collect information about your activity on our Service, such as login attempts, logout events, access times, pages and data viewed, links clicked, and the page you visited before navigating to our Service.

• Professional or Employment-related Information. We may collect information about your job title, qualifications, licensing, and employer.

• any other information you choose to provide.

• data underlying any errors that may occur during your use of the Service.

SOURCES OF INFORMATION

There are several ways we may obtain information about you, your practice, and your patients. Eluve collects information from you (a) that you choose to share with us when you sign up for or are using our Services and when you otherwise interact with us, such as through our customer service channels, (b) that we collect about you, your practice, and your patients automatically when you use our Services, (c) when you view our website; and (d) that we receive from third parties.

We collect information from you directly. We collect information about you, your practice, and your patients when you use our Services or otherwise interact with us. This may include registering for an account with us, providing us with information regarding your authorized health care professionals who may access your account, providing us with information regarding your patients, providing a review, or signing up for communications. We may collect additional information if you participate in any of our surveys.

We collect information automatically. We and our third-party service providers collect data about you automatically when you interact with our Services, including the Internet or Other Electronic Network Activity Information described above. We and our third-party service providers also collect information using automated technology like cookies and pixels via our Services when you visit our website. We use these technologies to improve our Services and your experience, see which areas and features of our Services are popular, and count visits.

We get information about you and your practice from other sources. We may collect information about you and your practice from our business partners. We may also acquire information from other sources to help us maintain the accuracy of the information we collect and for internal business analysis or other business purposes, such as corroborating and verifying your identity to ensure that we are only accessing or sharing health care records with the right person. When you authorize us to integrate with your electronic health record system, we may also collect information from that system that you make available to us, including patient demographics (such as date of birth and contact information), appointment information, and, where you direct or enable us to do so, prior patient medical records and related clinical information, in each case to support our provision of the Services to you.

USE OF INFORMATION

We use the information that we collect for the business purposes described below:

• We use information to provide the Service. We primarily use personal information about you or your patients to provide the Service to you, including processing your registration, verifying your identity and obtaining information about you and your patients, and obtaining your designated patients’ health care records (including of various physical and digital media, including but not limited to electronic health records (“EHR"), text, audio and/or visual recordings of patient interactions/treatments). We also use information to provide clinical decision-support and other AI-powered features of the Service, including by accessing historical clinical notes, current visit data, and patient records. We use any PHI you make available to us in accordance with the BAA.

• We use information to communicate with you. We may use information to answer your questions and comments, including providing you with information about this Privacy Policy or our Terms of Service. We may also use information to provide you with customer service.

• We use information to improve our Services. We may use information to make our Services better. This may include information about how you interact with our AI-powered features, such as the queries you submit, how you use our chat features, and the type of information you seek to access. In addition, if as part of your engagement with our Services, you agree that we can use the information you make available to us, including PHI, to improve healthcare operations, we will use such information to improve our Services, including to train our AI models, in accordance with our BAA with you.

• We use information to advertise new features or additional services offered by Eluve, Inc.

• We use information to protect our company and others. We use information to identify fraud and secure our Services and systems and to monitor and prevent unauthorized or malicious activities in an effort to protect you and our other customers.

• We use information for other lawful purposes, pursuant to your consent, or as we may disclose to you.

DISCLOSURE OF INFORMATION

We take the privacy and security of your patients’ medical information very seriously and share PHI that you make available in the Service only as permitted under our BAA with you or applicable law. We may disclose information we collect from and about you as follows:

• We disclose information with service providers and other third parties we work with. We may disclose information, including your personal information, with external companies who perform business, technical, professional, or marketing related services for us. Examples include identity verification services, AI services, customer service providers, email delivery services, and cloud infrastructure providers. This also includes companies that help us with fraud detection and Service operations. Certain features of our Service may incorporate third-party medical reference content (e.g., medical literature, clinical guidelines, and research publications) to support the generation of AI-powered responses; however, your patient data is not shared with third-party medical reference content providers in connection with these features. We may disclose limited information with data analytics vendors or market research companies, in each case under contractual restrictions limiting their use of such information to providing services to us. These entities are not permitted to use your information for their own purposes.

• We disclose information with any successor to all or part of our business. In the event that Eluve, Inc. or its assets are acquired by or merged with another company, we may disclose all categories of information (including about you or your patients) as part of that transaction. This acquisition or merger may include part of our business or one of our brands. This may occur in the event of bankruptcy.

• We disclose information if we think we have to in order to comply with the law or to protect ourselves. For example, we may disclose all categories of information, including information regarding your patients, to respond to a court order or subpoena. We will disclose information if a government agency or regulatory body requests it. This includes U.S. and non-U.S. law enforcement or regulatory authorities.

• We disclose aggregate or anonymous information. We may disclose aggregate, anonymous, or de-identified information that cannot reasonably be used to identify you or your patients for the purpose of delivering the Services or any other purpose not prohibited by applicable law.

• We disclose information as permitted by law and for other reasons we may describe to you.

• We disclose information pursuant to your consent or direction or your patient’s consent or direction.

We may combine the information we receive from and about you, including information you provide to us and information we automatically collect through our Services, as well as information collected offline, across other computers or devices that you may use, and from third party sources.

Except as described in this Privacy Policy, we will not disclose your personal information or information regarding your patients with any other individual without your consent, and do not permit others to create or access accounts for anyone else without your prior approval. Only you are permitted to sign into, view, request, access, and direct the sharing of your patients’ records unless you have approved and delegated access to other health care professionals.

This is why we verify your identity, or the identity of any user which you have previously approved or shared the login credentials with, each and every time you use the Service.

We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you or your patients.

INTERNATIONAL DATA TRANSFERS

We are headquartered in the United States and process information in the United States. Information we collect from users located outside the United States, including in Canada and Indonesia, may be transferred to, stored in, and processed in the United States. Where required by law, we provide adequate protection for the transfer of personal data in accordance with applicable law, such as by obtaining your consent, relying on adequacy decisions, or executing Standard Contractual Clauses.

ANALYTICS

We engage others to provide analytics services across the web and in mobile apps. These entities may use cookies, web beacons, device identifiers, and other technologies to collect information about your use of our Service and other websites and applications, including your IP address, web browser, mobile network information, pages viewed, time spent on pages or in mobile apps, links clicked, and conversion information. This information may be used by Eluve, Inc. and others to, among other things, analyze and track data, determine the popularity of certain content, and better understand your online activity.

DATA SECURITY AND RETENTION

We make reasonable efforts to ensure a level of security appropriate to the risk associated with the processing of data. We maintain organizational, technical and administrative measures designed to protect data within our organization against unauthorized access, destruction, loss, alteration or misuse. Your personal data and the submitted patient/practice data is only accessible to a limited number of our personnel who need access to the information to perform their duties. It is your responsibility to restrict the access you provide to your submitted patient/practice data for professionals who are employed by, or associated with your practice through your access controls. No data transmission or storage system can be guaranteed to be 100% secure. If you believe that your interaction with us is no longer secure (for example, if you feel that the security of your account has been compromised), please contact us via the contact information in the Contact Us section of this policy.

We will retain your personal data as well as the submitted patient/practice data as long as we are providing the Service to you. We retain this data after we cease providing the Service directly to you to the extent necessary to comply with our legal and regulatory obligations, and for the purpose of fraud monitoring, detection and prevention. To the extent permitted by applicable law, certain data may be retained for product improvement purposes. Where we retain data, we do so in accordance with obligations imposed by applicable law and under this Privacy Policy.

YOUR PRIVACY RIGHTS AND CHOICES

Account Information

You may review, update and correct certain account and other personal information previously disclosed to us by updating your account information in the Service or contacting us at privacy@eluve.com. If you wish to delete your own personal information, or information regarding a particular patient, please contact us at privacy@eluve.com but note that we may retain certain information as required by law or for our legitimate business purposes. If we receive a request for deletion from an individual patient, we will refer that individual to you and/or your practice. Once you have deleted your account, your practice’s stored medical records will no longer be accessible, so you should download that data if you need to review it after you delete your account.

Cookies

Most web browsers are set to accept cookies by default. If you prefer, you can usually adjust your browser settings to remove or reject browser cookies. Please note that removing or rejecting cookies could affect the availability and functionality of our Service. For more information about cookies, please see All About Cookies.

Communications Preferences

You may opt out of receiving promotional emails from Eluve by following the instructions in those communications or by contacting us at privacy@eluve.com. If you opt out, we may still send you non-promotional emails, such as those about your account or our ongoing business relations.

Mobile Push Notifications

With your permission, we may send push notifications to your mobile device. You can deactivate these messages at any time by changing the notification settings on your mobile device.

ADDITIONAL INFORMATION FOR CALIFORNIA RESIDENTS

The California Consumer Privacy Act as amended (“CCPA”) affords consumers residing in California certain rights with respect to their personal information. Although Eluve does not collect personal information from consumers in the traditional sense who are acting in their personal or household capacity, “consumers” under the CCPA include those acting in their professional or business capacity. Accordingly, in addition to the notices provided above, if you are a California resident and are a user of our Services, this section applies to you as indicated.

In the preceding 12 months, we have collected the personal information described in the Notice of Information We Collect section above.

We collect, use and disclose personal information for the business and commercial purposes described in the “Use of Information” section above.

Sales, Sharing, and Targeted Advertising Activities

The CCPA requires that we notify you if we “Share” your personal information with third parties. For purposes of the CCPA, “Sharing” means that we make available or otherwise disclose your information to third parties for cross-context behavioral advertising, such as targeting of advertising to you based on your personal information obtained from your activity across businesses, websites, apps, and services other than our Services.

The CCPA also provides for certain disclosures about personal information we “sell,” which means certain scenarios in which we have disclosed personal information with third parties or affiliates, in exchange for valuable consideration, which could include situations where we “Share” your personal information as described above for cross-context behavioral advertising.

In the preceding twelve (12) months, Eluve has not “sold” or “shared” your personal information as described above.

Disclosures of Personal Information

In the preceding 12 months, we have disclosed the following categories of information to the following categories of recipients for the business purposes described above in the Disclosure of Information section:

Access, Correction, and Deletion

Depending on where you live, you may have the right to (1) request to know more about and access your personal information, including in a portable format, (2) request deletion of your personal information, and (3) request correction of inaccurate personal information. To request access, correction, or deletion of your personal information, please email us at privacy@eluve.com. We will verify your request by asking you to provide certain information, such as your name, email address, mailing address, and phone number.

Appeals

If we deny your request, you may appeal our decision by contacting us at privacy@eluve.com. If you have concerns about the results of an appeal, you may contact the attorney general in the state where you reside.

Nondiscrimination

We will not discriminate against you for exercising your privacy rights.

If you reside in certain states, you can designate an authorized agent to submit a privacy rights request on your behalf. We may ask authorized agents to submit proof of your authorization to make the request, such as a valid power of attorney or proof that they have signed permission from the individual who is the subject of the request. Please do not provide any sensitive personal information in connection with the request, such as a driver's license or other government-issued ID. In some cases, we may be required to contact the individual who is the subject of the request to verify his or her own identity or confirm the authorized agent has permission to submit this request. If you are an authorized agent seeking to make a request, please contact us at privacy@eluve.com.

Any request to exercise one of these rights will be assessed by Eluve on a case-by-case basis. There may be circumstances in which we are not legally required to comply with your request because of a relevant legal exemption provided for under applicable law. We will not discriminate or retaliate against you for exercising your privacy rights. If you choose not to disclose certain personal information, this may limit our ability to perform the Services to you.

We retain personal information for as long as necessary to carry out the purposes for which we originally collected it and for other purposes described in this privacy policy.

We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you. We do not knowingly “share” or “sell” any personal information about you without your explicit consent.

ADDITIONAL INFORMATION FOR CANADA RESIDENTS

This section describes how this Privacy Policy applies to residents of Canada who access or use our Services in Canada.

Consent: By submitting personal information to us, or our service providers and agents, you consent to the collection, use, disclosure, and transfer of your personal information in accordance with this Privacy Policy and as permitted or required by law. You may withdraw your consent at any time to the collection, use, disclosure, or transfer of your personal information by contacting us at privacy@eluve.com. If you withdraw your consent (or if you decide not to provide certain personal information), you acknowledge that we may not be able to provide you, or continue to provide you, with certain products, services, or information that may be of value to you. You are responsible for obtaining any necessary consent of a patient before using the Service to collect, use or disclose personal information (including personal health information) in a clinical setting.

Retention of Personal Information: The personal information that you provide will be retained by us in accordance with applicable laws. However, we will take reasonable steps to destroy or permanently de-identify personal information we hold if it is no longer needed for the purposes for which it was collected.

Access and Correction: We will take reasonable steps to ensure the personal information we hold is accurate, complete and up-to-date. Upon your written request, and subject to certain exceptions provided by law, we will inform you of the existence, use, and disclosure of your personal information and give you access to that information. We may charge a minimal fee for providing such access to you. If you believe that the personal information that we hold about you is not accurate or complete, you may write to us at privacy@eluve.com. If you are able to establish that the information is not accurate or complete, we will take reasonable steps to delete and/or correct the information so that it is accurate, complete, and up-to-date. In order to facilitate a request to correct or update information, we may ask you to provide additional information to confirm your identity. Any such information will only be used for the purpose of confirming your identity and will not be retained by us.

Interest-Based Advertising: To opt-out of interest-based advertising, and to find information about how to block or limit cookies, visit AdChoices, the Canadian self-regulatory program for online interest-based advertising, administered by the Digital Advertising Alliance of Canada (“DAAC”).

Canada’s Anti Spam Law (“CASL”)

We will only send you commercial electronic messages (“CEMs”) where we have your express or implied consent to do so. Your consent to receive CEMs is implied where we have an existing business relationship with you, or you have reached out to us and made an inquiry within a certain time frame. You may unsubscribe from receiving CEMs at any time, by clicking the unsubscribe button or link in an email or following the direction provided in a text message.

ADDITIONAL INFORMATION FOR INDONESIA RESIDENTS

This section describes how this Privacy Policy applies to residents of Indonesia who access or use our Services in Indonesia.

Sensitive Personal Data under Indonesian Law

Eluve recognizes that the health data processed through the Services constitutes sensitive personal data as defined under Law No. 27 of 2022 on Personal Data Protection (the “Personal Data Protection Law”). Eluve collects and processes such data based on the explicit and written consent of the data subject, which is obtained and retained by your practice as the Data Controller.

Patient Consent

Your practice is responsible for obtaining explicit and valid consent from your patients to process their personal data, including for collection by Eluve.

Sharing of Patient Records

We share Patient’s Personal Health Confidentiality (as such term is defined in Article 788 of Government Regulation No. 28 of 2024 on the Implementing Regulation of Law No. 17 of 2023 on Health) that you make available in the Services only with individuals, entities, or organizations that you designate (collectively, “Relying Parties”) for the purposes of: (i) obtaining access to your patients’ medical records; (ii) sharing your patients’ stored medical records with our third-party vendors; or (iii) other uses which you specify in the application, which may include sharing your patients’ stored medical records with other third parties with your direction and consent.

De-Identification and Research Use

For Indonesian residents, Eluve uses any patient health data collected through your use of the Services only in an anonymized and de-identified form, and only for medical research purposes. We do not use such data in any manner that would enable re-identification of the data subject.

Bilingual Versions

This Privacy Policy is made available to you in English and the Indonesian language, and both versions are intended to be binding. In the event of any discrepancy between the Indonesian and English language versions, to the extent otherwise required under prevailing laws and regulations, the English language text controls and the Indonesian language version is deemed amended to the extent of such inconsistency to conform with the English language version.

CONTACT US

If you have any questions about this Privacy Policy, you can email us at privacy@eluve.com or send us written correspondence at the following postal address:

Eluve, Inc.

8605 Santa Monica Blvd. PMB 880383

West Hollywood, CA 90069-4109