COTHERAPY PRIVACY POLICY

Last updated: October 13, 2026

CoTherapy Technologies, Inc. ("CoTherapy," "we," "our," or "us") takes your privacy seriously. This Privacy Policy ("Policy") describes the information CoTherapy collects from and about you when you use our website (our "Website"), our web application (our "App"), and the non-clinical, artificial-intelligence-enabled coaching tool (the "AI Agent") and related tools available through them (collectively, the "Platform," and together with related tools and functionality, our "Digital Services"), and how we use, disclose, and protect that information.

This Policy applies to any information relating to a natural person who is, or can be, identified from that information, including a person's name, contact information, health information, and device or usage data ("Personal Information"). You are not legally required to provide Personal Information to us, but if you decline, we may be unable to register you for the Digital Services.

Please read this Policy carefully. By accessing or using our Digital Services, you agree to this Policy. This Policy may change from time to time (see Section titled "Changes to This Policy" below); your continued use of the Digital Services after a change becomes effective constitutes your acceptance of it.

Who This Policy Covers

An Individual is any person visiting the public portions of our Website.

A Registered User (or User) is a client of a participating Therapist who has registered to use the authenticated, secure portions of the Platform, including the AI Agent.

A Therapist is the independently licensed mental health professional who treats you and who has entered into CoTherapy's Master Services Agreement to make the Platform available to you.

Protected Health Information

Because the AI Agent collects and processes information relating to your mental health treatment and shares certain of that information with your Therapist for treatment purposes, some Personal Information we collect may constitute protected health information ("PHI") under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"). If your Therapist is a HIPAA "covered entity," CoTherapy acts as a HIPAA "business associate" of your Therapist with respect to that PHI, and CoTherapy has entered into a Business Associate Agreement with your Therapist governing CoTherapy's use and disclosure of that PHI. CoTherapy maintains administrative, technical, and physical safeguards designed to comply with HIPAA and will use and disclose PHI only as HIPAA, our Business Associate Agreements, and this Policy permit.

1. PERSONAL INFORMATION WE COLLECT AND HOW WE COLLECT IT

We collect the following categories of Personal Information from and about Users of our Digital Services:

• Your name, contact information, date of birth, billing information, and other identifying information;

• The clinical approach, boundaries, and reinforcement priorities your Therapist sets for your use of the AI Agent (your "Configuration"), and the session summary and/or progress notes and clinical context your Therapist enters about your treatment;

• Information you provide to the AI Agent between sessions, including information about your mental health symptoms, your completion of follow-up activities, and your responses to AI Agent prompts in the course of non-clinical coaching;

• Information about your Therapist and your treatment relationship necessary to operate the Platform; and

• Information about the device you use to access the Digital Services and your usage of them, such as IP address, operating system, browser type, and app version.

We collect this information: (a) directly from you; (b) from your Therapist, including your Configuration, enrollment information, and the session summary and/or progress notes and clinical context your Therapist enters; (c) automatically as you use the Digital Services; and (d) from our service providers, such as our hosting, payment-processing, and messaging providers.

Automatic Data Collection Technologies

We and our service providers use essential and functional cookies, session and authentication cookies, and first-party usage and error logging to operate the Digital Services and understand how they are used, such as log data and the pages or features you use. We do not use advertising cookies, cross-site tracking technologies, third-party advertising networks, or social-media pixels. You may adjust your browser or device settings to refuse cookies, though doing so may limit your ability to use portions of the Digital Services.

2. HOW WE USE YOUR PERSONAL INFORMATION

We use Personal Information to:

• Provide, operate, and maintain the Platform and the AI Agent;

• Provide non-clinical coaching support to you between therapy sessions;

• Share information with your Therapist, as described below, for review and integration into your ongoing treatment;

• Process payment for the Digital Services;

• Communicate with you about your account and the Digital Services;

• Maintain the security of the Digital Services and detect and prevent fraud; and

• Comply with applicable law and respond to safety concerns.

We may also use aggregate or de-identified data that does not identify you for any legally permissible purpose without restriction. CoTherapy does not use identifiable client conversations to train general-purpose AI models, and our agreements with AI providers prohibit them from doing so. We use de-identified data, and feedback and corrections your Therapist provides, to improve the Platform. We do not use your Personal Information for marketing purposes.

3. DISCLOSURE OF PERSONAL INFORMATION

Disclosure to Your Therapist

The record of your AI Agent use, including flagged moments and the conversation record, is available to your Therapist for review and use in your ongoing treatment. This sharing is central to how the Platform works: your Therapist reviews this information as described in CoTherapy's Terms of Service and the practice's own protocol; not every message is individually read, and a safety-stop notification does not guarantee immediate review. The AI Agent does not contact emergency services or any other person on your behalf. CoTherapy may, but is not obligated to, contact emergency services or another appropriate resource where we believe it is necessary to address an emergency, consistent with applicable law.

Other Disclosures

Your Personal Information may also be disclosed to:

• Service providers that host the Platform, process payments, provide AI, messaging, analytics, or error-logging services, or otherwise support our operations;

• A third party in connection with a reorganization, merger, sale, or other transfer of our business or assets, in which case we will notify you of any change in ownership or control of your Personal Information; and

• A third party where we believe disclosure is necessary or appropriate: to comply with applicable law or legal process; to respond to a request from a government authority; to enforce our Terms of Service; to protect our rights, safety, or property, or those of others; or, at our discretion, to notify emergency services or another appropriate resource under emergency circumstances.

CoTherapy does not sell or rent your Personal Information to third parties for any purpose and does not offer an opt-out of such sale or rental because we do not engage in it. We may disclose aggregate or de-identified data that does not identify you for any legally permissible purpose without restriction.

4. RETENTION OF PERSONAL INFORMATION

We retain Personal Information only as long as necessary to fulfill the purposes for which we collected it, subject to any longer retention period required by applicable law or contract, including our Business Associate Agreements.

5. WASHINGTON RESIDENTS

Washington's My Health My Data Act (RCW 19.373) protects "consumer health data" that HIPAA does not otherwise cover. The consumer health data we collect includes your Configuration, the information you provide to the AI Agent, and the session summary and/or progress notes and clinical context your Therapist enters. We collect this data to operate the AI Agent, generate the Non-Clinical Support Services the Terms of Service describe, and share relevant information with your Therapist for your treatment, as Section 2 describes in more detail. We collect it directly from you, from your Therapist, and automatically through your use of the Digital Services.

We share your consumer health data with your Therapist for treatment purposes; with the service providers described in Section 3 that host, process, or otherwise support the Digital Services; and, in the circumstances Section 3 describes, with a party involved in a business transfer, or with emergency services, law enforcement, or another party as necessary to comply with law or address a safety concern. We do not sell consumer health data. We will not collect, use, or share a new category of consumer health data, or use it for a new purpose, without first disclosing that change here and obtaining your consent.

If you are a Washington resident, or your consumer health data is collected in Washington, you have the right to:

• Confirm whether we collect, share, or sell your consumer health data, and access that data, including a list of the third parties with whom we have shared or sold it. On request, we will also give you an active email address or other online mechanism you can use to contact each of those third parties directly;

• Withdraw your consent to our collection or sharing of your consumer health data; and

• Request deletion of your consumer health data. We will delete it from our records, including archived or backup systems as the Act permits, and notify the affiliates, processors, and other third parties with whom we have shared it of your request.

To exercise these rights, contact us at support@cotherapy.ai. If we decline to act on your request, you may appeal by contacting us at the same address. We will respond to your appeal in writing within 45 days and explain our decision. If we deny your appeal, we will also give you a way to contact the Washington Attorney General to submit a complaint.

Protected health information we handle as a HIPAA business associate is exempt from this law; this section addresses only consumer health data that HIPAA does not otherwise cover.

6. TEXT MESSAGES

If you provide a mobile phone number and opt in, CoTherapy will send you text messages related to your account, such as sign-in verification codes and account and access notices. Text messages do not contain clinical information or identify any client. Message frequency varies. Message and data rates may apply. Opting out of text messages does not stop notifications we send through the Platform or by email. If you opt out of text messages, you will need to use an authenticator app to sign in.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

7. SECURITY

CoTherapy maintains reasonable administrative, physical, and technical safeguards to protect the Personal Information we collect. No method of transmission or storage is completely secure, however, and we cannot guarantee against every possible security incident. If you believe someone has accessed your information without authorization, contact us immediately at support@cotherapy.ai.

8. NOT FOR USE OF MINORS

Our Digital Services are intended for use by adults 18 years of age or older. We do not knowingly collect Personal Information from anyone under 18. If we learn we have received Personal Information from a person under 18, we will take steps to delete that information, subject to any retention obligations under applicable law. To report unauthorized information from a minor, email support@cotherapy.ai.

9. CORRECTING OR UPDATING YOUR PERSONAL INFORMATION

To correct or update your Personal Information, contact CoTherapy at support@cotherapy.ai.

10. THIRD PARTIES

This Policy does not address, and CoTherapy is not responsible for, the privacy practices of any third party, including your Therapist's own practice and any third-party website or application to which the Platform links. We encourage you to review the privacy policies of any third party you interact with.

11. CHANGES TO THIS POLICY

CoTherapy may modify this Policy at any time by updating the location where it is posted. We will update the "Last updated" date at the top of this Policy. You should periodically review this Policy; your continued use of the Digital Services after a change becomes effective constitutes your agreement to the revised Policy.

Questions about this Policy may be directed to CoTherapy at support@cotherapy.ai.