PRIVACY POLICY

OSTEOCORE, INC. – PRIVACY POLICY

Effective Date: September 29, 2026

Note: This privacy policy applies to our collection, use, and disclosure of data received or created due to your access to and use of certain items provided by us, "OsteoCore, Inc." (referred to here as "OsteoCore," "we," "us," or "our"). These items consist of our website at www.osteocore.com (the "Site"), the OsteoCore mobile application (the "Application"). The Site and Application are referred to collectively as the "Services."

WE USE COOKIES, PIXELS, SOFTWARE DEVELOPMENT KITS, AND OTHER TRACKING TECHNOLOGIES, INCLUDING THIRD-PARTY TRACKING TECHNOLOGIES (COLLECTIVELY, "ADTECH"), ON OUR SERVICES. WE USE ADTECH TO COLLECT DATA AND PERFORM DATA ANALYTICS, TO RECORD HOW YOU INTERACT WITH THE SITE, THE APPLICATION AND OUR CONTENT, AND TO SERVE YOU WITH TARGETED ADVERTISING AND MEASURE HOW WELL THAT ADVERTISING WORKS.

ON THE SITE, WE USE OPTIONAL ANALYTICS AND ADVERTISING ADTECH ONLY AFTER YOU ACCEPT IT IN OUR COOKIE BANNER. YOU CAN ACCEPT OR DECLINE ANALYTICS AND ADVERTISING SEPARATELY, AND YOU CAN CHANGE OR WITHDRAW YOUR CHOICE AT ANY TIME USING THE "COOKIE PREFERENCES" LINK AT THE BOTTOM OF EVERY PAGE. IF YOU ACCEPT ADVERTISING ADTECH, WE SHARE PERSONAL INFORMATION ABOUT YOU THAT WE COLLECT FROM THE USE OF ADTECH WITH OUR ADTECH PARTNERS. THE APPLICATION USES ADTECH AS DESCRIBED IN "ANALYTICS AND ADVERTISING IN THE APPLICATION" BELOW. FOR MORE INFORMATION ABOUT HOW WE USE ADTECH AND THE CHOICES YOU HAVE, PLEASE SEE THE INFORMATION BELOW.

Your Consent

By accessing or using the Services, you are consenting to our processing of the information described in this Privacy Policy, except that on the Site we use optional analytics and advertising AdTech only if you accept it, as described in "Your cookie choices on the Site" below. "Processing," means using cookies on a computer or mobile device or using or touching information in any way, including, but not limited to, collecting, storing, deleting, using, combining, and disclosing information. Information processed by the Services will be transferred, processed, and stored in accordance with United States state and federal law.

What information is collected by the Services and how is it used?

We collect personal information (such as your name, mailing address, email address and phone number) from you when you download and log into the Application and/or submit information to us through the Site ("User Information"). We keep User Information to provide you with the Services. For us to provide you with the Services, it is required that we collect the User Information.

We collect your personal health and wellness information, inputs from user surveys and data created through your interaction with the Application ("Application Information"). Application Information may include clinical information (such as height and weight, current disease information, symptom history and other medical data related to your health) and non-clinical lifestyle information (such as eating habits and exercise activity). OsteoCore will only use this information as it relates to providing the Services.

In addition, the Site and Application may collect certain information automatically, such as the type of mobile device you use, your mobile device's unique device ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browsers you use, and information about your use of the Application ("Usage Data"). Usage Data will be used by us either individually or in aggregated form to enhance and improve the Application.

What AdTech do we use on the Site?

Cookies.

Cookies are pieces of information stored directly on your device. Cookies allow us to collect information such as browser type, time spent on our Site, pages visited, language preferences, and other anonymous traffic data. We and our service providers use the information for security purposes, to facilitate navigation, to display information more effectively, and to personalize your experience while using the Site and to enhance user engagement. We also use cookies to gather statistical information about use of the Site to continually improve its design and functionality, to understand how it is used, and to answer questions regarding the Site. We may also use cookies for advertising purposes. Among other uses, these cookies limit the number of times you may see our advertisements and help us measure the effectiveness of our outreach campaigns.

Tracking Technologies

Advertising companies and analytics providers that we work with may place cookies or tracking pixels on the Site on our behalf, but only if you have accepted them. They may record that you have visited the Site, including which pages you viewed, and we then share this information with the advertising network (this practice is sometimes referred to as "retargeting"). We work with the following providers. More information about their policies, and how you can customize or opt out of certain types of ads, is available using the links provided:

  • Google Analytics (analytics provider). Google Analytics measures how visitors use the Site, such as the pages viewed and how long a visit lasts. It is used only if you accept Analytics cookies. Learn how Google uses information from sites that use its services, or install the Google Analytics opt-out browser add-on.
  • Google Ads (advertising network). Google Ads lets us show OsteoCore ads to people who have visited the Site and measure how well those ads work. It is used only if you accept Advertising cookies. See the Google Privacy Policy and manage your ads in My Ad Center.
  • Meta Ads (advertising network, through the Meta Pixel). The Meta Pixel lets us show OsteoCore ads on Facebook and Instagram to people who have visited the Site and measure how well those ads work. It is used only if you accept Advertising cookies. See the Meta Privacy Policy and manage your Meta ad preferences.

When you submit the newsletter, app waitlist or contact form on the Site and you have accepted Advertising cookies, we send Meta a hashed (one-way scrambled) version of the email address you entered, so that Meta can match the sign-up to an ad you may have seen. We do not send Meta or Google the contents of your message, and we do not allow Meta to collect information from our forms automatically. Our account deletion page tells these providers only that the page was visited, and never what you entered on it.

Cookies we use on the Site

  • osteocore_consent (set by OsteoCore): Remembers your cookie choices. Lifetime: 12 months. Category: Strictly necessary.
  • _ga (set by Google Analytics): Distinguishes visitors. Lifetime: 2 years. Category: Analytics.
  • _ga_<id> (set by Google Analytics): Keeps session state. Lifetime: 2 years. Category: Analytics.
  • _gid (set by Google Analytics): Distinguishes visitors. Lifetime: 24 hours. Category: Analytics.
  • _fbp (set by Meta): Identifies browsers for advertising. Lifetime: 90 days. Category: Advertising.
  • _fbc (set by Meta): Stores the ad click that brought you to the Site. Lifetime: 90 days. Category: Advertising.

The osteocore_consent cookie is strictly necessary and is set whatever you choose, including when you decline everything, because it is the record of your choice. Google Ads may also set its own advertising cookies on Google's domains when you accept Advertising cookies; these are described in the Google Privacy Policy linked above.

Your cookie choices on the Site

  • Cookie banner. On your first visit, we ask whether you accept analytics and advertising cookies. You can choose "Accept all," "Reject all," or "Manage" to decide on Analytics and Advertising separately. Until you make a choice, no analytics or advertising cookies are set and none of those providers' scripts are loaded.
  • Cookie preferences. A "Cookie preferences" link at the bottom of every page reopens the same choices at any time. If you withdraw your consent, we stop loading those tools and delete the cookies they set on the Site.
  • Global Privacy Control. If your browser sends a Global Privacy Control ("GPC") signal, we treat it as a request to opt out of the sale and sharing of your personal information: analytics and advertising cookies stay off unless you later choose to turn them on yourself.
  • Renewal. Your choice is stored for 12 months, after which we ask you again.

Analytics and advertising in the Application

The Application uses Google Analytics for Firebase and the Meta software development kit ("SDK"). These tools record events such as installing and opening the Application, the names of the screens you open, signing up and logging in, starting a free trial, and making a purchase, together with device information, an identifier for your installation of the Application, your OsteoCore user ID and, where you allow it, your device's advertising identifier. We use this information to understand how the Application is used and to measure and improve our advertising, including advertising on Google and Meta. When a free trial becomes a paid subscription, our servers also report the purchase (the product, price, currency and transaction ID, together with your OsteoCore user ID and the identifier for your installation) to Google and Meta.

We do not send the health information you enter in the Application, such as your questionnaire answers, measurements, Fracture IQ™ results or program progress, to these providers.

Your choices in the Application:

  • iPhone and iPad. We ask for your permission through Apple's App Tracking Transparency prompt before the Meta SDK can use your device's advertising identifier. You can change your answer at any time in Settings > Privacy & Security > Tracking.
  • Android. You can delete or reset your device's advertising identifier in your device's Ads settings (for example Settings > Privacy > Ads or Settings > Google > Ads, depending on your device).

Do third parties see and/or have access to information obtained by the Services?

User Information and Usage Data may be shared with the third-party service providers who host and support the application on OsteoCore's behalf. These service providers do not have any right to independently use any personal information that we share with them.

Analytics and advertising providers receive information as described in "What AdTech do we use on the Site?" and "Analytics and advertising in the Application" above.

We may provide paid products and/or services within the Site or Application. In those cases, we work with third-party service providers to perform payment processing on our behalf (e.g. payment processors).

We will not store or collect your payment card details. Information that you provide to our third-party payment processors is governed by their Privacy Policy. These payment processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, MasterCard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information.

What are my opt-out rights?

Some of the information we collect is necessary to provide you with the Services, such as your account details and the information you enter in the Application. That information cannot be switched off while you continue to use the Services; the only way to stop it being collected is to stop using the Services, not visiting the Site, and uninstalling the Application.

You can opt out of analytics and advertising at any time:

  • On the Site: choose "Reject all" in the cookie banner, use the "Cookie preferences" or "Do Not Sell or Share My Personal Information" link at the bottom of every page, or turn on Global Privacy Control in your browser. See "Your cookie choices on the Site" above.
  • In the Application: use your device's tracking and advertising settings. See "Analytics and advertising in the Application" above.

If you do not wish to receive marketing emails from us, you can opt out of future marketing emails by following the instructions provided in the marketing emails. Opting out of marketing emails will not affect our administrative emails to you (e.g., emails about your transactions or policy changes).

Data retention policy

We retain personal information about you for as long as you use the Site, Application, or consume the Services, and for a reasonable period after you stop using the Application. We use and retain Usage Data, in both individualized or in aggregate form, indefinitely. The cookies used on the Site last for the periods listed in "Cookies we use on the Site" above.

Statement regarding the Categories of Personal Information being collected.

We collect "Personal Information" from the following categories:

(A) Identifiers (ex. real name, alias, postal address, unique identifiers, online identifiers, internet protocol ("IP") address, email address, account name, social security number, driver's license number, passport number, or other similar identifiers).

(B) Information about your health, including your mental or physical health conditions or diagnoses. More information about the health information we collect is available in our Consumer Health Data Privacy Policy, available at https://www.osteocore.com/consumer-health-data-privacy-policy.

(C) Characteristics of protected classifications under federal law, including racial or ethnic origin.

(D) Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

(E) Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer's interaction with an internet website, application or advertisement.

(F) Geolocation data.

(G) Inferences drawn from any of the information identified in this subdivision to create a profile about a reflection of the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Your Personal Information Rights

You may make certain requests regarding our use of your personal information by emailing us at contact@osteocore.com. If you are a resident of the State of California, some of these requests may be governed by CCPA. If you are not a California resident, or a response to any given request is not required by CCPA or other applicable law, you agree that we are under no obligation to provide a specific response to any such request, however, we agree to make commercially reasonable efforts to respond to any request we receive, subject to local laws. For your protection, we may need to verify your identity before acting on your request.

  • You may request to review and obtain a copy of your personal information. We will provide a copy or a summary of your information, usually within 30 days of your request. We may charge a reasonable, cost-based fee.
  • You may request to amend your personal information. You can ask us to correct personal information about you that you think is incorrect or incomplete. In your request, please make clear what personal information you would like to have changed. We may say "no" to your request, but we'll tell you why in writing within 60 days.
  • You may request to restrict use or disclosure of Personal Information in certain circumstances. We do not sell personal information about our users. We do, however, "share" personal information, as that term is defined under California law, when we allow Google and Meta to use information from the Site and the Application for cross-context behavioral advertising, as described in "What AdTech do we use on the Site?" and "Analytics and advertising in the Application" above. The categories of personal information we share for this purpose are identifiers (such as cookie identifiers, device advertising identifiers, IP address and hashed email address), internet or other electronic network activity information, and commercial information (such as subscription purchases). You have the right to opt out of this sharing. On the Site, use the "Do Not Sell or Share My Personal Information" link at the bottom of every page, which opens your cookie preferences, or turn on Global Privacy Control in your browser. In the Application, use your device's tracking and advertising settings described above. This opt-out right does not apply to personal information that we share with third-party service providers involved in the operation of the Site or the Application.
  • You may ask for a list of those with whom we've shared personal information with. You can ask for a list of who we've shared your personal information with, and why. We will usually deliver the list within 30 days of your request.
  • You may request confidential communications. Within reason, we will act upon requests to contact you in a specific way (for example, home or office phone) or to send mail to a different address.
  • You may request a copy of this Privacy Notice. You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.

Delete your information

You can ask us to delete your account and the personal information associated with it at any time by submitting a request in the OsteoCore app, at this link, or by contacting us at contact@osteocore.com.

Age Requirements

The Site and Application are not designed or intended to appeal to minors and we do not knowingly collect User Data from children under the age of 13. As a tool for providing the Services, users of the Application may enter Application Information related to minors into the application where a parent or guardian has consented to use of the Services with that individual. It is your responsibility to make sure that consent from the parent or guardian is collected and documented.

If a parent or guardian becomes aware that his or her child has provided us with information without their consent, he or she should contact us at contact@osteocore.com so we can promptly delete such information.

Security

We are concerned about protecting the confidentiality of all information that we interact with in providing the Services. We and our service providers make use of physical, electronic, and procedural safeguards to protect the information that we process and maintain. Although we endeavor to provide security for the information that we process and maintain based on the sensitivity of that information, no security system can prevent all potential security breaches.

In addition to the security safeguards we provide, we urge you to take precautionary measures in maintaining the integrity of your data. Please be responsible for making sure that no one can see or access your account or log-in/password information, or your mobile device.

Links to other sites and services

The Site or Application may contain links to other sites or services that are not operated by us. If you click an outside link, you will be directed to that outside site or service. We strongly advise you to review the privacy policy of every site you visit. We are not responsible for the privacy practices or the content of any outside sites or services.

Changes

We reserve the right to modify this Privacy Policy at any time in our sole discretion by including such alteration and/or modification in this Privacy Policy, along with a notice of the effective date of such modified Privacy Policy. Any continued use by you of the Site after the posting of such modified Privacy Policy shall be deemed to indicate your agreement to such modified Privacy Policy. Accordingly, if at any time you do not agree to be subject to any modified Privacy Policy, you may no longer use the Site.