Privacy Policy

Introduction

Endo Mind, Inc. ("Endo Mind," "Thyra," "we," "us," or "our") builds and operates the Thyra platform, including our websites, applications, and related services (collectively, the "Services"). We are committed to protecting privacy and building clinician grade trust. This Privacy Policy explains what information we collect, how we collect it, how we use it, how we share it, and the choices you have.

This Privacy Policy applies to information collected through the Services, including when you visit our websites, request a demo, subscribe to updates, or use the platform as a Customer or Authorized User.

Important note about health information. When we provide the Services to healthcare organizations, we may receive or create Protected Health Information ("PHI") on their behalf. Our handling of PHI is governed by applicable law, including the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"), and by our agreements with Customers, including any Business Associate Agreement ("BAA"). If you are a patient of a healthcare organization using Thyra, this Privacy Policy does not replace your provider's Notice of Privacy Practices. Please direct requests about your medical record or your provider's privacy practices to your provider.

This Privacy Policy supplements any contract terms between Endo Mind and a Customer. If you are an Authorized User, your organization may control and administer your account, including access rights and retention settings.

We may provide a separate notice or addendum for specific features or events. If we do, that notice applies to the context described in it.

What Information We Collect

We collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with an individual or a device ("Personal Information"). The categories of Personal Information we may collect include:

• Contact and account information. Name, email address, phone number, title, specialty, organization name, and account credentials.
• Professional and practice information. Practice size, workflows, scheduling preferences, billing and operational details, and communications history with us.
• Device and usage information. IP address, device identifiers, browser type, operating system, approximate location derived from IP address, log files, and usage data about how you interact with our websites and Services.
• Support and communications. Content of messages you send us, support tickets, recordings of calls (where permitted by law), and feedback you provide.
• Marketing and events. Preferences for receiving updates, webinar registrations, and participation in events.
• Mobile number and SMS consent. If you opt in to text messages from a medical practice that uses Thyra, we collect your mobile number, your consent status, the date, time and source of that consent, and the exact disclosure text you were shown, together with the delivery status of messages we send you.
• Sensitive information. Depending on your use of the Services, we may process information that could be considered sensitive under certain laws, such as precise geolocation (if you enable it) or biometric identifiers related to voice.

We do not intentionally collect sensitive Personal Information through the public marketing website.

Protected Health Information

When we act as a service provider to healthcare organizations, we may process PHI, as defined by HIPAA, including clinical notes, lab results, medication history, and related patient data. PHI is handled under our contractual and legal obligations and is not used for advertising.

Information we do not intend to collect on the marketing site. We do not ask for patient medical records, diagnoses, or insurance details through our public website. If you include PHI in a web form or email, we may remove it or ask you to submit it through a secure channel.

Log and security data. We collect security related logs, such as authentication events, administrative actions, and error reports, to protect the Services and investigate incidents.

How We Collect Your Information

We collect information in the following ways:

• Information you provide directly. When you request a demo, join a waitlist, contact support, sign up for a newsletter, apply for a job, or otherwise communicate with us.
• Information collected automatically. When you visit our websites or use the Services, certain device and usage information is collected automatically through cookies and similar technologies (see Data Collection Technologies).
• Information from Customers and authorized sources. If you are an Authorized User, your organization may provide us with your account details and permissions. If you are a patient interacting with a portal powered by Thyra, your healthcare provider or their authorized systems may provide information to enable that interaction.
• Information from third parties. We may receive information from service providers that help us operate our business, such as identity and access management, analytics providers, payment processors (for website purchases if enabled), and event platforms. We may also receive contact information from public sources when relevant to business outreach, subject to applicable law.

How We Use Your Information

We use Personal Information to operate, maintain, and improve the Services. Common purposes include:

• Provide the Services and fulfill requests. Deliver demos, onboard Customers, administer accounts, and provide platform functionality.
• Support and customer success. Respond to inquiries, troubleshoot issues, and provide training and operational support.
• Security and integrity. Authenticate users, enforce access controls, prevent fraud, monitor for threats, and maintain audit logs.
• Product improvement and research. Understand how features are used, debug issues, develop new capabilities, and evaluate performance. Where feasible, we use aggregated or de identified data for analytics and improvement.
• Communications. Send administrative messages, updates, and support notices. With your consent where required, we may send marketing communications about our Services. You can opt out of marketing messages at any time.
• Legal and compliance. Comply with legal obligations, enforce our agreements, protect rights and safety, and respond to lawful requests.
• PHI. When we process PHI as a business associate, we use PHI only as permitted by HIPAA and our agreements with Customers, including to provide and support the Services, maintain security, and carry out permitted operational functions.
• Aggregate data. We may generate Aggregate Data to understand usage patterns, improve performance, and build benchmarks. Aggregate Data does not identify individuals or Customers.
• Compliance and audit readiness. We may use information to support compliance with security standards, contractual obligations, and lawful audits, including maintaining audit trails.

Data Collection Technologies

We and our service providers use cookies, pixels, log files, local storage, and similar technologies (collectively, "Cookies") to operate and understand the Services.

Types of Cookies we may use include:

• Strictly necessary. Required to operate the website and enable core functionality such as session management and security.
• Analytics. Help us understand how visitors use the website so we can improve it. For example, analytics tools may collect page views, navigation paths, and device characteristics.
• Preference. Remember choices you make, such as language preferences, where implemented.

We may also use session replay or error monitoring tools to diagnose issues and improve user experience. These tools are configured to minimize collection of sensitive content and to support security and performance.

You can control Cookies through your browser settings. Disabling Cookies may limit some functionality. Some browsers offer a "Do Not Track" signal. Because there is no consistent industry standard, our Services may not respond to all such signals.

Analytics providers. We may use analytics tools to understand website traffic and product usage. These tools may include providers such as Google Analytics or similar services. Microsoft Clarity uses cookies and pseudonymous identifiers to record page interactions and session replays to improve the site.

Advertising. We may run limited B2B advertising campaigns. We do not use PHI for advertising and we do not build patient advertising profiles.

Opt out of interest based ads. You can opt out of certain interest based advertising through your browser controls and industry opt out tools such as the Network Advertising Initiative and Digital Advertising Alliance, where available.

How We Share Your Information

We do not sell Personal Information. We may share information as follows:

• With service providers. We share information with vendors that provide hosting, analytics, customer support tools, email delivery, identity and access management, and other services on our behalf. These vendors are contractually required to protect the information and use it only to provide services to us.
• With Customers and Authorized Users. If you use the Services through a healthcare organization, information may be shared within that organization consistent with permissions, workflows, and applicable law.
• With third party integrations at your direction. If a Customer enables an integration, relevant data may be exchanged with that third party as part of the integration. Integrations are configured and governed by the Customer's choices and agreements.
• For legal reasons. We may disclose information if we believe it is necessary to comply with law, respond to lawful requests, protect rights and safety, investigate fraud or security incidents, or enforce our agreements.
• In connection with a business transaction. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be disclosed as part of due diligence and transferred as part of the transaction, subject to appropriate protections.
• De-identified and aggregated information. We may share aggregated or de-identified information that cannot reasonably be used to identify an individual, for lawful purposes such as benchmarking, security, and product improvement.
• With professional advisors. We may share information with legal, accounting, and security advisors who are bound by confidentiality obligations.
• Within Endo Mind. We may share information among our personnel on a need to know basis to operate the Services.

Mobile and SMS Messaging

Medical practices use Thyra to send text messages to their own patients. The practice is the sender; Endo Mind, Inc. ("Thyra") transmits those messages on the practice's behalf as its service provider.

When you opt in, we collect your mobile number and consent status in order to deliver appointment reminders and confirmations, cancellation and reschedule handling, patient-portal invitations, and account and security notifications. These are transactional messages. We do not send marketing or promotional text messages, and we do not use purchased lists.

Mobile opt-in information and consent are never sold, rented, or shared with third parties or affiliates for their own marketing purposes, and are not shared with any third party for any purpose other than delivering the messaging service you requested — for example, our messaging carrier and aggregator, acting solely to transmit messages on our behalf under contract.

Message frequency varies. Message and data rates may apply. Reply STOP to any message to cancel, or HELP for help. Text messaging is never required to create an account or to receive care; you can choose email or the secure patient portal instead. See our SMS/Text messaging terms for the full messaging terms.

Your Choices; Interest-Based Ads

• Marketing communications. You may opt out of marketing emails by using the unsubscribe link in the email or by contacting us at support@thyrahealth.com. Even if you opt out of marketing messages, we may still send administrative communications related to your account, security, or service updates.
• Interest based advertising. We may work with advertising partners to reach business audiences. These partners may use cookies or similar technologies to measure campaign performance. We do not sell Personal Information. We do not use PHI for advertising.
• Your browser and device choices. You can manage cookie settings through your browser. You can also limit ad tracking on some devices through system settings. If you block cookies, some features may not work as intended.
• Account controls. Authorized Users can update certain profile information within the Services, subject to Customer administrator permissions.
• Patient requests. If you are a patient, direct requests related to your medical record to your healthcare provider. We act under the provider's instructions.

Biometric Data

Certain features may capture audio recordings and generate transcripts as part of clinical documentation workflows. Depending on applicable law, voiceprints or derived identifiers may be considered biometric data.

We process audio and related data only to provide and secure the feature, improve accuracy and performance, and comply with legal obligations. We do not use patient or clinician audio for advertising. Where required by law, Customers control whether biometric or audio features are enabled. If you are an Authorized User and you do not want audio processed, disable the feature or do not use it. If you are a patient, audio features are used only as permitted by your provider and applicable law.

U.S. State Privacy Rights

Depending on where you live, you may have additional rights under state privacy laws, such as the California Consumer Privacy Act and similar laws in other states. These rights may include:

• The right to know and access. Request information about the Personal Information we collected, used, or disclosed.
• The right to delete. Request deletion of certain Personal Information, subject to exceptions.
• The right to correct. Request correction of inaccurate Personal Information.
• The right to opt out. Opt out of certain forms of processing, such as targeted advertising in some contexts. We do not sell Personal Information.
• The right to non discrimination. You will not be discriminated against for exercising your privacy rights.

How to submit a request. Email support@thyrahealth.com with the subject line "Privacy Rights Request". We may need to verify your identity and your authority to make the request. If you are an Authorized User, your organization may need to submit the request on your behalf depending on account configuration.

PHI and HIPAA. State privacy laws generally do not apply to PHI regulated by HIPAA. Requests related to PHI should be directed to your healthcare provider.

Authorized agent. In some states, you may use an authorized agent to submit a request. We may require proof of authorization and identity verification.

Appeals. Where required by law, you may appeal our decision on a privacy request by replying to our response email within 30 days and stating that you are requesting an appeal.

Children's Information

The Services are not directed to children under 13 and we do not knowingly collect Personal Information from children under 13. If you believe a child has provided Personal Information to us, contact support@thyrahealth.com and we will take appropriate steps.

Links to Other Sites

The Services may contain links to third party websites or services. This Privacy Policy does not apply to third party practices. We encourage you to review the privacy policies of any third party site you visit.

Protection of Your Information

We use reasonable administrative, technical, and physical safeguards designed to protect Personal Information and PHI from unauthorized access, use, or disclosure. Safeguards may include access controls, encryption in transit, monitoring, and audit logging.

No method of transmission or storage is completely secure. While we work to protect information, we cannot guarantee absolute security.

• Access management. We use role based permissions and authentication controls to limit access to Customer Content.
• Encryption. We use encryption in transit. Encryption at rest is used where supported by our infrastructure.
• Monitoring. We monitor for suspicious activity and maintain processes for vulnerability management.

Data Retention

We retain Personal Information for as long as reasonably necessary to provide the Services, meet legal obligations, resolve disputes, and enforce agreements.

PHI retention is controlled by Customers and applicable law. Upon termination of a Customer agreement, we handle PHI in accordance with the agreement and any BAA, including return or destruction where feasible.

Note to International Visitors

The Services are intended for use in the United States. If you access the Services from outside the United States, you understand that your information may be transferred to and processed in the United States and other jurisdictions where we or our service providers operate.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on our website and update the "Last Updated" date. If changes are material, we may provide additional notice as required by law.

Contacting Us

If you have questions or comments about this Privacy Policy or our privacy practices, contact us at support@thyrahealth.com with the subject line "Privacy".

Endo Mind, Inc. Delaware, United States.