PRIVACY POLICY – CHECK VITALS NOW

1WHO WE ARE

This Privacy Policy explains how Global Care International, Inc. ("GCI", "we", "us", "our") collects, uses, shares and protects information when you use the Check Vitals Now mobile application for iOS and Android (the "App").

The App works with your My Records Now patient portal account. It collects readings from compatible Bluetooth medical devices and uploads them to your My Records Now record.

2IMPORTANT HEALTH DISCLAIMER

3INFORMATION WE COLLECT

3.1 Account and profile information

When you sign in with your My Records Now account, the App receives:

• Your username and password (used to sign you in)
• Your name, email address, date of birth, and profile photo, as stored in your My Records Now account

3.2 Health information from your medical devices

When you choose to take a measurement with a supported device, the App collects and uploads to your My Records Now record:

• Blood pressure (systolic/diastolic) and pulse / heart rate
• Blood oxygen (SpO2) and perfusion index
• Body temperature
• Weight and body mass index (BMI)
• Blood glucose
• Spirometry readings (for example PEF and FEV1)
• ECG waveforms, the ECG result reported by the device, and the ECG PDF report generated by the App
• The date and time of each reading

The App does not collect health data that is not needed to provide these features.

3.3 Information you enter

• Email addresses you enter to have an ECG report emailed
• Messages you send, and questionnaire answers you submit through the App

3.4 Device permissions

The App asks for these permissions and uses them only as described:

• Bluetooth: to find and connect to the medical devices you select, and to receive their readings.
• Location (Android, and iOS where the system requires it for Bluetooth scanning): Android requires location permission to scan for nearby Bluetooth devices. The App does NOT collect, store, or share your location.
• Network access: to sign in and to upload and retrieve your records.

3.5 Information we do not collect

• We do not collect your precise or approximate location.
• We do not use advertising identifiers.
• The App contains no third-party advertising or analytics tools.
• We do not access your contacts, photo library, microphone, or camera.

4HOW WE USE YOUR INFORMATION

We use your information only to:

• Sign you in and keep your session secure
• Record readings from your devices in your My Records Now record
• Show your current and previous readings in the App
• Create ECG reports and with the option to email them to addresses you provide
• Deliver messages and questionnaires between you and your care providers
• Provide customer support and respond to your requests
• Meet legal and regulatory obligations

We do NOT:

• Sell your personal or health information
• Use your health information for advertising, marketing, or data mining
• Use your health information to build advertising profiles

5HOW WE SHARE YOUR INFORMATION

We share information only as needed to provide the App's features:

• My Records Now (operated by GCI): stores your account, profile, readings, ECG reports, and messages.
• GCI e-consultation service (icmydoctor.com, operated by GCI): handles messages and questionnaires.
• Email delivery: when you request for an ECG report to be emailed, our servers send it to the address you enter through a third-party email delivery provider that is bound by confidentiality obligations and may use the information only to deliver the email.
• Your healthcare providers: the people and organizations involved in your care who uses My Records Now, as described in our Notice of Privacy Practices.
• Service providers (business associates) who host or operate our systems under written agreements that require them to protect your information in accordance to all applicable regulatory requirements of HIPAA and others as we do and to use it only for the services they provide to us.
• When required by law, for example in response to a court order, or to protect someone's health or safety, as described in our Notice of Privacy Practices.

We do not share your information with advertisers or data brokers.

6HOW WE PROTECT YOUR INFORMATION

On your device:

• All communication between the App and our servers uses encrypted connections (HTTPS/TLS).
• Sign-in uses authenticated, time-limited access tokens.
• If you choose to save your password ("Remember Me" or "Auto Login"), it is stored on your device in the operating system's secure storage (iOS Keychain / Android Keystore), not in plain text.
• ECG files the App creates are stored in the App's private storage on your device, which other apps cannot access.

On our servers:

• Your information is hosted in the United States with a secure hosting provider.
• Access to patient information is restricted to authorized personnel through role-based access controls, and access is logged and audited.
• We maintain administrative, physical, and technical safeguards in line with the HIPAA Security Rule, and we have business associate agreements with service providers that handle protected health information.

No method of transmission or storage is completely secure, but we use reasonable safeguards to protect your information.

7DATA RETENTION

• Readings, ECG reports, and messages stored in your My Records Now record are kept for as long as your account is active, and afterwards for as long as required by applicable medical-records retention laws.
• ECG files on your device are kept for 30 days and are then removed from the device; the readings and reports remain available in your My Records Now portal.
• A saved username, and a password saved with "Remember Me" or "Auto Login", remain in your device's secure storage until you clear them (for "Remember Me", tap it with empty fields; for "Auto Login", turn it off in your account profile), sign in with different details, or uninstall the App.

8YOUR CHOICES AND RIGHTS

• Access and correction: you can view your readings in the App and in the My Records Now portal and ask us to correct inaccurate information.
• Deleting your account and data: you can ask us to delete your account and associated data by emailing info@globalcareintl.com from the email address on your account. We will delete or de-identify your information within 45 days, except where we must keep certain records by law (for example medical-records retention laws); we will tell you if that applies.
• Withdrawing consent: you can stop using device features at any time, turn off Bluetooth or location permissions in your device settings, clear saved login details, or uninstall the App.
• Depending on where you live (for example California or other U.S. states with privacy laws), you may have additional rights to know, access, correct, or delete your personal information. Contact us to exercise them. We will not discriminate against you for exercising these rights.

9CHILDREN'S PRIVACY

The App is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, contact us at info@globalcareintl.com and we will delete it.

10WHERE YOUR INFORMATION IS PROCESSED

Your information is processed and stored in the United States.

11CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will post the updated version at this address and change the "Last updated" date above. If the changes are significant, we will also notify you in the App or by email before they take effect.

12RELATED NOTICE

As a provider of telemedicine services, GCI also maintains a Notice of Privacy Practices under HIPAA that describes how medical information may be used and disclosed and how you can access it:
https://www.myrecordsnow.com/PageFiles/v-637795582930036942/GCI_Privacy_Policy_2022.pdf

13CONTACT US

Questions, requests, or complaints about this Privacy Policy:

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights: https://www.hhs.gov/ocr/complaints