Privacy Preferences Statement

Your Privacy; Our Accountability

At Doceree, we understand that personal information, especially health-related data, is sensitive, private, and deserving of rigorous protection. Through our Co-Pay Platform, we empower users to access prescription savings and educational tools without compromising their data autonomy or security.

This Privacy Preferences Statement outlines your data rights and the mechanisms we provide to manage how your information is collected, used, and shared through our platform.

We do not take your trust for granted. We embed privacy safeguards at every operational level and provide you with control, clarity, and confidence over your data.

Our Privacy Principles

Doceree's data privacy and protection practices are governed by the following core principles:

1. Data Minimization and Purpose Limitation

We collect only the information that is necessary to operate, maintain, and improve our services. We do not collect health or personal data for speculative or unrelated commercial purposes.

2. Optional Account Creation

Users may access the majority of services on the Platform without creating an account. Account registration is entirely optional and is offered solely for the purpose of unlocking certain convenience features, such as saved coupons, reminders, or personalized insights.

We do not condition access to essential features or coupon discovery on registration or user authentication.

3. No Sale of Personal Information

We do not sell personal information, including health-related data, in exchange for monetary compensation. Certain data-sharing activities conducted for operational or sponsored services may be considered a "sale" or "sharing" under applicable U.S. state privacy laws. Where such definitions may apply, we offer opt-out rights and mechanisms consistent with those laws.

4. User Autonomy and Access Rights

We are committed to respecting the rights of all users who engage with the Co-Pay Platform. To that end, we provide accessible and good-faith mechanisms that allow individuals to:

• Request access to the personal information we maintain about them;
• Request deletion of personal data, subject to legal and contractual retention obligations;
• Withdraw consent where our processing is based on user consent, as permitted by applicable law;
• Opt-out of certain data uses, including interest-based advertising or promotional messaging;
• Manage communication preferences, such as email frequency and message categories.

These options are available to all users, regardless of geographic location, and we do not impose unreasonable or discriminatory conditions on the exercise of these rights.

If you wish to exercise any of these rights or update your preferences, you may do so by contacting us directly at privacy@doceree.com. We respond to all legitimate requests in accordance with applicable privacy regulations and our internal governance standards.

5. Transparency and Accountability

We maintain clear and specific documentation regarding our data collection, use, and disclosure practices. We conduct internal reviews and partner audits to ensure alignment with our Privacy Policy internal governance standards, and evolving regulatory requirements.

Information We Collect

Doceree collects limited personal and usage information when you interact with the Co-Pay Platform. The specific categories of data collected may vary depending on how you use the service (with or without an account), but may include:

• Identifiers, such as name, email address, IP address, or device identifiers;
• Search and browsing activity, including medications searched, discount lookups, and interactions with educational tools;
• Communication data, such as messages you submit to us or preferences you express;
• Technical information, such as browser type, operating system, device information, and usage patterns;
• Location data, which may be inferred from your IP address or browser settings;
• Optional account information, if you create a user profile or manage saved preferences.

We may also collect limited information from third-party partners, analytics providers, or service providers acting on our behalf. This may include engagement data, coupon redemption insights, or performance metrics related to sponsored content. All data collection is conducted in accordance with applicable legal requirements and platform permissions.

We do not require users to create an account or log in to access most features of the Co-Pay Platform. However, certain functionality, such as saving prescriptions, receiving reminders, or managing preferences, may be enhanced through voluntary account registration.

How We Use Your Information

Doceree uses the information we collect to ensure the secure, effective, and compliant operation of the Co-Pay Platform, deliver relevant offers, and improve user experience. All data processing is conducted with purpose limitation and proportionality in mind.

We use personal and technical information for the following business and operational purposes:

• To provide core functionality of the Co-Pay Platform, including access to prescription discount offers;
• To personalize and enhance your experience, such as displaying location-relevant or condition-relevant coupons;
• To support optional account services, such as saving medication preferences or tracking past searches;
• To respond to inquiries, provide customer support, or send legally required notices;
• To maintain system integrity, including fraud prevention, access control, and usage monitoring;
• To analyze performance, optimize features, and develop new tools;
• To comply with legal obligations, enforce our Terms of Use, or defend our legal rights.

We may also use aggregated or de-identified data, which cannot reasonably be used to identify any individual, for internal analytics, product development, or research insights, in compliance with applicable laws.

If you wish to exercise control over your personal data, including deletion, opt-out, or preference changes, please contact us at privacy@doceree.com. For further detail on how information may be disclosed to service providers or partners, please consult our Privacy Policy.

Your Privacy Controls and Preferences

The following section outlines the privacy management options available to you on the Doceree Co-Pay Platform.

1. Accessing and Using the Platform Without an Account

• Anonymous Access: You are not required to create a user account to browse the Platform, search for medication offers, view educational content, or use coupon services.
• Voluntary Registration: If you choose to create an account, any information you provide will be processed in accordance with our Privacy Policy. Account-based features may include saved offers, reminders, messaging preferences, or personalized browsing history.
• Account Deletion: You may request deletion of your account and associated data at any time by emailing us at privacy@doceree.com.

2. Communications Preferences

• Email Marketing: If you receive marketing emails from Doceree and wish to stop, you may reply with your request or email privacy@doceree.com. We will process all opt-out requests in accordance with applicable laws, including the CAN-SPAM Act.
• Text Messages: If you receive SMS communications and wish to opt out, you may reply "STOP" or contact us via email.
• Postal Mail: If you receive physical marketing communications and prefer not to, please send your full name and mailing address (as it appears on the mail piece) to privacy@doceree.com.
• Transactional Communications: It should be noted that users may continue to receive non-marketing messages related to transactions, account updates, or system operations even after opting out of promotional communications.

3. Cookie and Tracking Preferences

• Website Cookies: The Platform uses cookies and similar technologies for operational performance, analytics, and limited marketing purposes. Where legally required, we obtain cookie consent and provide a means to modify preferences.
• Browser Controls: Users may manage cookie settings directly through their web browser. Certain essential cookies may not be disabled without impairing Platform functionality.
• Global Privacy Control (GPC): If your browser supports GPC signals, we recognize and honor them in accordance with applicable law.
• Email Option: If you prefer not to manage cookie settings through digital interfaces, you may write to us at privacy@doceree.com to express your preference. Our privacy team will respond with appropriate guidance or confirmation.

4. Data Sharing and "Do Not Sell or Share" Preferences

Doceree may engage in limited data sharing with third-party service providers, pharmaceutical manufacturers, or advertising partners for Platform operations and sponsored offerings. Some of this sharing may be interpreted as a "sale" or "sharing" of personal information under laws like the California Consumer Privacy Act (CCPA) or similar state regulations.

To exercise your right to opt out of such sharing:

• Email us at privacy@doceree.com with the subject line "Do Not Sell or Share My Personal Information."
• Provide sufficient information for verification (e.g., email address or device ID, if known).
• We will confirm receipt and honor your request as required by law.

5. Access, Correction, and Deletion Requests

You may request:

• A description of the categories of personal information we have collected;
• A copy of the specific personal data associated with your use of the Platform (if identifiable);
• Correction of inaccuracies in your data (where applicable);
• Deletion of personal information, subject to legal exemptions.

To submit such a request:

• Email privacy@doceree.com and provide enough detail for us to verify your identity and act on your request.
• We will not discriminate against any individual for exercising privacy rights and will process requests within applicable legal timeframes (typically 30–45 days).

Security of Your Information

At Doceree, safeguarding your information is not just a compliance requirement—it is a foundational principle embedded in every aspect of our operations.

We implement and maintain rigorous physical, administrative, and technical controls designed to protect the confidentiality, integrity, and availability of the personal information entrusted to us. These protections are modeled on industry-leading practices and tailored to the sensitivity of the data we process, particularly where it may relate to health or prescription activity.

Our security measures include, but are not limited to:

• Encryption of data in transit and at rest using modern cryptographic protocols;
• Role-based access controls implemented in accordance with the principle of least privilege;
• Network segmentation, firewalls, and intrusion detection systems to mitigate external threats;
• Ongoing security audits, vulnerability assessments, and third-party penetration testing;
• Mandatory employee privacy, confidentiality, and cybersecurity training;
• Annual SOC 2 Type II certification, supported by rigorous external audits and internal governance frameworks.

We maintain active surveillance of the cybersecurity threat landscape and evolving privacy regulations to adapt proactively and continuously reinforce our data protection posture.

HIPAA Applicability and Approach to Health Data

Certain data processed through the Co-Pay Platform may not fall within the scope of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), and Doceree may not always operate in a capacity that is subject to HIPAA's requirements.

In some circumstances, however, Doceree may act as a business associate to a healthcare provider, pharmacy, health plan, or other covered entity under HIPAA. Where such relationships exist, our obligations are defined and governed by the terms of applicable Business Associate Agreements (BAAs). In those cases, we handle any Protected Health Information ("PHI") in accordance with applicable privacy and security requirements.

Even where HIPAA does not apply, we aim to treat health-related information with a high degree of care and discretion, consistent with the trust placed in us by our users and partners. This includes applying appropriate safeguards to information collected through prescription discount searches, therapeutic offer interactions, or other engagement with the Co-Pay Platform that may reveal or imply health-related interests.

We continue to monitor changes in applicable law and maintain internal protocols designed to support responsible data handling in a healthcare context.

How to Exercise Your Privacy Preferences

We believe that users should be empowered to manage their privacy on their own terms. While we offer settings and disclosures throughout our site and communications, we recognize that preference management should not be complex or burdensome.

If you wish to:

• Request access to the personal information we have about you;
• Instruct us to delete or correct your information;
• Withdraw any previously granted consent;
• Inquire about how your information is being used, shared, or retained;
• Opt-out of data sharing, including for advertising or analytics purposes;

You may do so at any time by:

We review and respond to all privacy-related inquiries and requests in good faith, and in accordance with applicable data protection laws, including, but not limited to, the California Consumer Privacy Act (CCPA), Consumer Health Data Privacy laws, and other U.S. state-level privacy statutes.

Policy Updates and Ongoing Commitments

This Privacy Preferences Statement reflects Doceree's current privacy practices, legal obligations, and voluntarily adopted principles of responsible data governance. As privacy laws evolve and our services expand, we may revise this Statement to reflect new operational or legal considerations.

If material changes are made, we will provide notice in a manner consistent with applicable legal requirements, either via prominent updates on our Co-Pay Platform, email notifications, or in-platform prompts.

Your continued use of the Co-Pay Platform following such updates will be interpreted as acknowledgment of the revised terms, except where otherwise required by law.