Privacy Policy

INTRODUCTION

Airvet, Inc., a Delaware corporation and its related companies ("Airvet", "we", "us", or "our") is committed to protecting the privacy and security of the personal information we collect, use, share, and otherwise process as part of our business. We also believe in transparency, and we are committed to informing you about how we treat the data we collect and process.

When does this Policy apply?

This privacy policy (the "Policy") describes how Airvet, Inc. collect, use and share personal and pet-related information of individual users ("Pet Owners") and veterinarian users, which include all providers of health and behavior services to pets (e.g. veterinarian hospitals, DVMs, and LVTs) ("Veterinary Providers") (collectively, "Users," "you," or "your"), of the Airvet telehealth service and platform, including any Company website (the "Site") or mobile software application (the "App") (collectively, the "Platform"). Beyond the Policy, your use of our Platform is also subject to our Pet Parent Terms of Use or Veterinary Terms of Use, as applicable. You may obtain an accessible version of this Policy by contacting us via the methods identified in the "Contact Information" section of this Policy.

Please review this Policy carefully. By submitting your information to us, by registering for or using the Platform, by using the Site, or by voluntarily interacting with us, you consent to our collection, use, and disclosure of your information as set out in this Policy. If you do not agree with the terms of this Policy, we ask that you please do not use the Site and App.

WHAT PERSONAL INFORMATION DO WE COLLECT, USE, AND DISCLOSE?

We receive information about you and/or your pet in various ways for the purposes listed below. You may choose not to provide us with any personal information, but you will not be able to access portions of the Site or Apps that require personal information. For purposes of the EU General Data Protection Regulation, 2016/679 (the "GDPR"), UK General Data Protection Regulation (the "UK GDPR"), and certain other applicable law, we act as a data controller with respect to the personal information described below. For residents of California, pursuant to the California Consumer Privacy Act, as amended ("CCPA"), we have identified the categories of personal information collected.

We will process your personal information in connection with any of the purposes and uses described in this Policy on one or more of the following legal grounds:

• Because it is necessary to perform the services you have requested or to comply with your instructions or other contractual obligations between you and us;
• To comply with our legal obligations as well as to keep records of our compliance processes;
• Because our legitimate interests, or those of a third-party recipient of your personal information, make the processing necessary, provided those interests are not overridden by your interests or fundamental rights and freedoms;
• Because you have chosen to publish or display your personal information on a public area of the Site or Apps, such as a comment area;
• Because it is necessary to protect your vital interests;
• Because it is necessary in the public interest; or
• Because you have expressly given us your consent to process your personal information in a particular manner.

We do not use personal information for making any automated decisions affecting or creating profiles other than as described herein.

COOKIES AND SIMILAR TECHNOLOGIES

What are first and third-party cookies?

A "cookie" is a small file created by a web server that can be stored on your device (if you allow) for use either during a particular browsing session (a "session" cookie) or a future browsing session (a "persistent" cookie). "Session" cookies are temporarily stored on your device and remain there until they expire at the end of your browsing session. "Persistent" cookies remain stored on your device until they expire or are deleted by you. Local shared objects (or "flash" cookies) are used to collect and store information about your preferences and navigation to, from, and on a website. First-party cookies are set by the website you are visiting, and they can only be read by that site. Third-party cookies are set by a party other than that website.

What are "similar technologies"?

In addition to cookies, there are other data collection technologies, such as Internet tags, web beacons, pixels (clear gifs, pixel tags, and single-pixel gifs), and navigational data collection (log files, server logs, etc.) that can be used to collect data as you navigate through and interact with a website. For example, web beacons are tiny graphics with unique identifiers that are used to understand browsing activity. UTM codes are strings that can appear in a URL when you move from one web page or website to another. The string can represent information about your browsing, such as which advertisement, page, or publisher sent you to the receiving website.

Mobile Device Identifiers and SDKs.

We also sometimes use, or partner with publishers or app developer platforms that use, mobile Software Development Kits ("SDKs") that are incorporated into the Platform to collect Information, such as mobile identifiers (e.g., Apple IDFAs and Android Advertising IDs), geolocation information, and other information about your device or use of the App. A mobile SDK may act as the mobile version of a web beacon (see the What are "similar technologies"? section above) and we may use this technology to deliver or help our advertising partners deliver certain advertising through the App or Site based on information associated with your mobile device.

Other third-party technologies.

Some third parties may use data collection technologies to collect information about you when you browse the Internet. We do not control these third parties' technologies or how they may be used. If you have questions about targeted content, you should contact the responsible party directly or consult their privacy policies.

Choices about cookies and similar technologies.

Most web browsers are set by default to accept cookies. If you do not wish to receive cookies, you may set your browser to refuse all or some types of cookies or to alert you when cookies are being stored. These settings may affect your enjoyment of the Site's functionality. In addition, adjusting the cookie settings may not fully delete all of the cookies that have already been created. To delete them, you should review your web browser settings after you have changed your cookie settings. The links below provide additional information about how to disable cookies or manage the cookie settings:

• Google Chrome
• Firefox
• Microsoft Edge
• Safari for Mac and iPhone

You can learn more about internet advertising practices and related consumer resources at https://youradchoices.com/control, https://thenai.org/about-online-advertising/faq, and http://www.networkadvertising.org/choices.

SHARING OF INFORMATION

We may share your information as follows:

• We may share your information with our corporate affiliates (and their officers, directors, employees, and agents) for any of the purposes described in this Policy.
• When you register to use the Platform, your user profile and some of your information will be viewable by your Veterinary Provider.
• We may share your information with your consent, including to your employer or sponsor (where applicable). For example, with your consent we will share certain information about your enrollment with your employer or sponsor.
• We may transfer your information to a third party in connection with the consideration, negotiation, or completion of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, brands, affiliates, subsidiaries, or other assets.
• We may share your information for legal, protection, and safety purposes. For example, we may share your information as may be permitted or required by applicable law, including laws outside your country of residence, to comply with laws, to respond to lawful requests and legal processes, to allow us to pursue available remedies or limit the damages that we may sustain, and to protect the rights, privacy, and property of Airvet, our operations, our agents, affiliates, customers, and others. This includes enforcing our agreements, policies, and Terms of Use. We may also share information in the event of an emergency, which includes protecting the safety of our employees and agents, our customers and their pets, or any other person.
• We may share information with those who need it to do work for us (for example, we share information with vendors and service providers in connection with the provision of our Platform). In addition, we may share information with our professional advisors (accountants, attorneys, etc.) that need access to information to provide services on our behalf.
• We may work with third party advertising partners to show you ads that we think may interest you. These advertising partners may set and access their own cookies, pixel tags and similar technologies on our Platforms and they may otherwise collect or have access to information about you which they may collect over time and across different online services. Some of our advertising partners are members of the Network Advertising Initiative (http://optout.networkadvertising.org/?c=1#!/) or the Digital Advertising Alliance (http://optout.aboutads.info/?c=2&lang=EN). If you do not wish to receive personalized ads, please visit their opt-out pages to learn about how you may opt out of receiving web-based personalized ads from member companies. You can access any settings offered by your mobile operating system to limit ad tracking, or you can install the AppChoices mobile app to learn more about how you may opt out of personalized ads in mobile apps.
• We may also share aggregated and/or anonymized data with others.
• We rely on third party service providers to perform a variety of services on our behalf, such as e-commerce providers, payment card processers, telephone and technical support providers, hosting, data storage and processing service providers, and research and analytics providers.

HOW LONG DO WE KEEP YOUR INFORMATION?

We will keep your information for as long as is necessary to fulfill the purposes for which it was collected, to comply with our business requirements and legal obligations, to resolve disputes, to protect our assets, to operate our business, and to enforce our agreements.

We may delete your information if we believe it is incomplete, inaccurate, or that our continued storage of it is contrary to our objectives or legal obligations. When we delete data, it will be removed from our active servers and databases, but it may remain in our archives when it is not practical or possible to delete it.

We may retain and use anonymous, de-identified, or aggregated information for as long as is permitted under applicable law.

We are required by law to maintain records of consumer requests submitted under the CCPA and how we responded to such requests for at least 24 months. We only use this information for recordkeeping purposes. For more information, please contact us via the contact information provided below.

YOUR RIGHTS, CHOICES, AND CHANGES

The following section details your rights regarding your information. Please use the "Contact Information" details at the end of this Policy to exercise your rights and choices under this Policy. If you have an Airvet account, you have the ability to review and update certain of your information within the Platform. You also may close your account by contacting the customer support team and receiving confirmation that your account is no longer active. If you close your account, we will retain certain information associated with your account for analytical purposes and record keeping integrity, as well as to prevent fraud, enforce our Terms of Use, take actions we deem necessary to protect the integrity of our Platform or our users, or take other actions otherwise permitted by law.

Email Preferences.

We may send you emails about our Site, Apps, products, and services. If you do not want to continue receiving emails from us, you may opt-out by clicking the "unsubscribe" button at the bottom of our emails or by contacting us at privacy@airvet.com. Please provide your name and contact information in your request, and we will respond to your request in accordance with applicable law. Please note that registered users cannot opt out of receiving transactional e-mails related to their account.

Accuracy and Updating Your Personal Information.

Our goal is to keep your personal information accurate, current, and complete. If any of the personal information you have provided to us changes, please update it in your user/account profile, or let us know via the "Contact Information" details at the end of this Policy. We are not responsible for any losses arising from any inaccurate, inauthentic, deficient or incomplete personal data that you provide to us.

Complaints.

If you believe your rights relating to your personal information have been violated, please contact us via the "Contact Information" details provided at the end of this Policy.

Individual Rights.

You may have certain rights relating to your personal data under local data protection laws, and we discuss the rights provided in various jurisdictions below. We honor individuals' rights where required under applicable law, and, depending on the applicable laws, these rights may include the right to:

• Access your personal information;
• Know more about how we process your personal information;
• Rectify inaccurate personal information and, taking into account the purpose of processing the personal information, ensure it is complete;
• Erase or delete your personal information;
• Restrict our processing of your personal information;
• Transfer your personal information to another controller, to the extent possible;
• Object to certain processing of your personal information;
• Opt-out of certain disclosures of your personal information to third parties;
• If you're under the age of 16, or such other applicable age of consent, opt-in to certain disclosures of your personal information to third parties;
• Not be discriminated against for exercising your rights described above;
• Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects; and
• Withdraw your consent at any time (to the extent we base processing on consent), without affecting the lawfulness of the processing based on such consent before its withdrawal.

All requests should be sent to the contact details noted in the "Contact Information" section of this Policy. Your personal information may be processed in responding to these rights.

RESIDENTS OF UNITED STATES

Depending on where you live in the United States, you may have certain rights relating to your personal information. We honor these rights where required under applicable law. These may include the following:

Right to Confirmation and Access.

Residents of certain states have the right to confirm whether we process their personal information and to access such personal information.

Right to a Copy.

Residents of certain states have the right to access their personal information, including a right to obtain a copy of the consumer's personal information in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity without hindrance. Residents of certain states also have the right to receive a list of specific third parties to which we have disclosed the consumer's personal data.

Right to Know.

Residents of certain states have the right to request: (1) the specific pieces of personal information we have collected about you; (2) the categories of personal information we have collected about you; (3) the categories of sources from which the personal information is collected; (4) the categories of personal information about you that we have sold or shared and the categories of third parties to whom the personal information was sold or shared; (5) the categories of personal information about you that we disclosed for a business purpose and the categories of third parties to whom the personal information was disclosed for a business purpose; (6) the business or commercial purpose for collecting, disclosing, selling, or sharing personal information; and (7) the categories of third parties to whom we disclose personal information. Our response will cover the 12-month period preceding our receipt of a verifiable request unless a longer period is requested by you.

Right to Delete.

Residents of certain states have a right to request the erasure/deletion of certain personal information collected or maintained by us. As described herein, we will delete your personal information from our records and, as applicable, notify any service providers and contractors (as defined under applicable law) to delete your personal information from their records. However, we are not required to honor a deletion request if an exemption applies under the law.

Right to Correct.

Residents of certain states have a right to correct inaccuracies in their personal information, taking into account the nature of the personal information and the purposes for which we process the personal information. We will use commercially reasonable efforts to correct the inaccurate personal information as directed by you.

Rights Regarding Sensitive Data.

We only process sensitive data with your consent or where otherwise permitted by applicable law. For residents of Maryland, where required, we only collect, share, or use Sensitive Data where strictly necessary to provide or maintain a specific product or service that you request, and we do not sell or share Sensitive Data except where permitted by law. Where you have provided consent to this processing, you may revoke your consent or opt out of the processing of your sensitive data at any time. For residents of California, this includes your CCPA right to limit the processing of sensitive personal information to that processing permitted by the CCPA.

Right to Opt-Out.

Residents of certain states have the right to direct us to stop selling, and for residents of California, sharing, your personal information to third parties and to refrain from doing so in the future. Residents of certain states also have the right to opt of targeted advertising and profiling based on your personal information. In addition to the Submission Process below, you can opt-out of targeted advertising by adjusting your preferences in the Privacy Preference Center for the Site, which can be accessed within the Cookies Policy for the applicable Site.

Submission Process.

You may submit a request to exercise one of the above rights by emailing privacy@airvet.com, or by submitting your request through your Airvet account. If a request is submitted in an incorrect manner or if it is deficient, we will either (1) treat the request as if it had been submitted via the designated manner, or (2) provide you with specific directions on how to submit the request or remedy any deficiencies, as applicable.

Verification Process.

We are required to verify the identities of those who submit requests to exercise certain of the above rights. To determine whether the individual making the request is the consumer about whom we have collected information, we will verify your identity by matching the identifying information provided by you in the request to the personal information that we already maintain about you. As a part of this process, you will be required to provide your name, email address, address, and/or telephone number. We will inform you if we cannot verify your identity.

• If we cannot verify the identity of the person making a request for categories of personal information, we may deny the request. If the request is denied in whole or in part for this reason, we will provide a copy of, or direct you to, our privacy policy.
• If we cannot verify the identity of the person making the request for specific pieces of personal information, we are prohibited from disclosing any specific pieces of personal information to the requestor. However, if denied in whole or in part for this reason, we will evaluate the request as if it is seeking the disclosure of categories of personal information about the consumer.
• If we cannot verify the identity of the person making a request to delete, we may deny the request.
• If there is no reasonable method by which we can verify the identity of the requestor to the degree of certainty required, we will state this in our response and explain why we have no reasonable method by which we can verify the identity of the requestor. In such cases we may not be required to comply with the request or may request additional information reasonably necessary to verify the request.

Authorized Agents.

Authorized agents may submit requests via the methods identified in this Policy. If you use an authorized agent to submit a request to know or a request to delete, we may require: (1) the authorized agent to provide proof that you gave the agent signed permission to submit the request; (2) you to verify your identity directly with us; and (3) you to directly confirm with us that you provided the authorized agent permission to submit the request. However, we may not require these actions with respect to confirmed guardianship, conservatorship, power of attorney, or other protective arrangement in accordance with applicable law.

Excessive Requests.

If requests from a consumer are manifestly unfounded or excessive, in particular because of their repetitive character, we may either (1) charge a reasonable fee, or (2) refuse to act on the request and notify the consumer of the reason for refusing the request. If we charge a fee, the amount will be based upon the administrative costs of providing the information or communication or taking the action requested.

Non-Discrimination.

You have the right not to receive discriminatory treatment by us due to your exercise of the above rights. We do not offer financial incentives and price or service differences, and we do not discriminate against consumers, employees, applicants, or independent contractors for exercising their rights under applicable law.

Appeals Process.

Residents of certain states have the right to appeal a refusal to take action on a request within a reasonable time after your receipt of the decision. You may submit an appeal to a decision on your request by email to privacy@airvet.com. We will inform you of any action taken or not taken in response to the appeal, along with a written explanation of the reasons in support of the response.

Nevada.

Nevada residents may submit a verified request to us at privacy@airvet.com to request that we not make any sale (as defined under Nevada law) of any covered information (as defined under Nevada law) that we have collected or will collect about you. Please provide your name and contact information in your request, and we will respond to your request in accordance with Nevada law.

RESIDENTS OF CALIFORNIA

The following applies for residents of California. All terms used in this section shall have the meanings given in the California Consumer Privacy Act ("CCPA"), when applicable.

CCPA Notice at Collection.

We collect and process personal information for as described in the "What Personal Information Do We Collect, Use, and Process" section of this Policy. The relevant CCPA categories for this information are indicated above. We may provide a separate notice at collection if we collect additional information or intend to use information for additional purposes.

Data Practices During the Last 12 Months:

The disclosures below describe our data practices during the last twelve months:

• Personal Information Collected: We have collected the categories of personal information listed below during the preceding 12 months:
  • Identifiers
  • Categories of Personal Information described in the California Customer Records statute
  • Commercial Information
  • Internet or Other Electronic Network Activity Information
  • Professional or Employment-related Information
  • Education Information
  • Geolocation Data
  • Audio, Electronic, Visual, thermal, or Similar Information
  • Sensitive Information
• Categories of Sources: We have collected the personal information identified in this Policy from you, and in some situations, from your employer or sponsor.
• Business and Commercial Purposes for Collecting: We have collected the categories of personal information listed above for the following purposes:
  • to operate our Site, Apps, and business;
  • to provide our products and services to you;
  • to provide customer support;
  • to ensure the privacy and security of our Site, products, Apps, and services;
  • to administer promotions, contests, surveys, and other customer engagement features;
  • to maintain our databases and back-ups;
  • to manage our relationships with you;
  • to serve you the content and functionality you request;
  • to enhance your experience and provide you with a more personal and interactive experience;
  • to communicate with you;
  • to keep records of our communications with you;
  • to determine user interests;
  • to develop new products and services;
  • for usage analytics purposes;
  • to process and complete payments and other transactions, including refunds or returns;
  • to detect fraud and prevent loss;
  • to assess and document your qualifications for the requirements of your role;
  • for recruitment or human resources purposes;
  • to carry out our obligations under employment law, for the performance of the employment relationship, or as permitted by applicable law;
  • to facilitate reimbursements and to prevent fraudulent payments;
  • to confirm your identity and your entitlement to work in the applicable country;
  • to manage the applicable marketing and advertising platform and provide related electronic commerce products and services;
  • to monitor, process, and support transactions;
  • to comply with legal or regulatory obligations applicable to the processing and retention of payment data; and
  • to improve products and services.
• Personal Information Sold or Shared: We have sold or shared the categories of personal information listed below during the preceding 12 months. We have sold or shared each category of personal information to the following categories of third parties: (1) subsidiaries and affiliates; (2) distribution partners; (3) advisors (accountants, attorneys); (4) service providers and contractors (data analytics, data storage, mailing, marketing, shipping fulfillment, payment processing, Site and App administration, technical support); and (5) operating systems and platforms. We do not knowingly sell or share the personal information of consumers under 16 years of age.
  • Identifiers
  • Categories of Personal Information described in the California Customer Records statute
  • Commercial Information
  • Internet or Other Electronic Network Activity Information
  • Professional or Employment-related Information
  • Education Information
  • Geolocation Data
  • Audio, Electronic, Visual, thermal, or Similar Information
  • Sensitive Information
• Personal Information Disclosed for a Business Purpose: We have disclosed for a business purpose the categories of personal information listed above during the preceding 12 months. We have disclosed each category of personal information to the following categories of third parties: (1) subsidiaries and affiliates; (2) distribution partners; (3) advisors (accountants, attorneys); (4) service providers and contractors (data analytics, data storage, mailing, marketing, shipping fulfillment, payment processing, Site and App administration, technical support); and (5) operating systems and platforms.

Financial Incentives.

This section explains each financial incentive and price or service difference that we may offer in exchange for the retention, sale, or sharing of your personal information so that you may make an informed decision on whether to participate.

• Summary and Material Terms. We provide some offers periodically to individuals who share their information (for example, name and email address) with us. For example, we offer some incentives for completing surveys or participating in user interviews. Participation is completely voluntary.
• Categories of personal information implicated by the financial incentive. This program involves the following categories of personal information under the CCPA: Identifiers; Categories of personal information described in the California Customer Records statute; Commercial information; Internet or other electronic network activity information; professional or employment-related information; Education information; Geolocation data; Audio, electronic, visual, thermal, or similar information.
• Value. Our financial incentives are reasonably related to the value of the data provided, and we need the email address to do so. The value of the data provided varies based on your purchases. For example, you may receive 10% off of your purchase in exchange for providing your email address to us. We have calculated this value by considering the profit generated from the incentives as well as the overall average value to us with respect to collecting the data.
• How to opt-in. You may opt-in to the financial incentive or price or service difference by signing up via our Site.
• How to withdraw. You have the right to withdraw from the financial incentive at any time. You may exercise that right by contacting us using the Contact Us information provided at the end of this Policy.

Notice of Right to Opt-out of Sale/Sharing.

As a California resident, you have the right to direct us to stop selling or sharing your personal information to third parties and to refrain from doing so in the future. You may submit a request to opt-out of the selling or sharing of your personal information using the Submission Process identified above or by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC) (on the browsers and/or browser extensions that support such a signal). If you do not have an account with us or you are not logged into your account, the signal sent by your browser will be linked to your browser only and will not be linked to your account, as we do not have a way to associate the browser with your account.

California Shine the Light.

Under California Civil Code Section 1798.83, California residents who provide personal information in obtaining products or services for personal, family, or household use may be entitled to request and obtain from us once a calendar year information about the information we shared, if any, with other businesses for direct marketing uses. At present, we do not share your personal information with third parties for those third parties' direct marketing purposes. Please be aware that not all information sharing is covered by the "Shine the Light" requirements and only information on covered sharing, if any, will be included in our response. As part of the California Online Privacy Protection Act, all users of our Site may make any changes to their information at any time by contacting us at privacy@airvet.com.

RESIDENTS OF EU/EEA/UK

Right of Access.

To the extent required by law, you have the right to receive confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information: the purposes of the processing; the categories of personal data concerned; and the recipients or categories of recipient to whom the personal data have been or will be disclosed. We will provide a copy of your personal information in compliance with applicable law.

Right of Rectification.

Our goal is to keep your personal information accurate, current, and complete. Please contact us if you believe your information is not accurate or if it changes.

Right to Erasure.

In some cases, you have a legal right to request that we delete your personal information when (1) it is no longer necessary for the purposes for which it was collected; (2) consent has been withdrawn in certain instances; (3) you have objected to the processing in certain instances; (4) the personal information has been unlawfully processed; (5) the personal information has to be erased for compliance with a legal obligation; and (6) the personal information was collected in relation to the offer of information society services. However, the right is not absolute. When we delete personal information, it will be removed from our active servers and databases; but, it may remain in our archives when it is not practical or possible to delete it. We may also retain your personal information as needed to comply with our legal obligations, resolve disputes, or enforce any agreements.

Right to Restrict Processing.

You have the right to restrict the processing of your data when (1) the accuracy of the personal data is contested, for a period enabling the controller to verify the accuracy of the personal data; (2) the processing is unlawful and you oppose erasure and request a restriction instead; (3) we no longer need the personal data, but you need us to keep it for the establishment, exercise, or defense of legal claims; or (4) you have objected to us processing the personal information, pending resolution of the objection.

Right to Object.

In certain circumstances, you have the right to object to the processing of your personal information where the processing is necessary for performance of a task carried out in the public interest, for our legitimate interests, or for the legitimate interests of others. You also have the right to object where personal data are processed for direct marketing purposes or for scientific or historical research purposes or statistical purposes.

Right to Withdraw Consent.

If you have provided your consent to the collection, processing, and transfer of your personal information, you may have the right to fully or partially withdraw your consent. Once we have received notice that you have withdrawn your consent, in whole or in part, we will no longer process your information for the purpose(s) to which you originally consented and have since withdrawn unless there are compelling legitimate grounds for further processing that override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims. Withdrawal of consent to receive marketing communications will not affect the processing of personal information for the provision of our services.

Right to Complain.

If you believe we have not processed your personal information in accordance with applicable law, we encourage you to contact us at privacy@airvet.com. You may also have the right to make a complaint to an applicable Supervisory Authority or seek a remedy through the courts. A list of Supervisory Authorities for residents of the EU or EEA is available at: https://edpb.europa.eu/about-edpb/board/members_en. UK residents may contact the UK Supervisory Authority here: https://ico.org.uk/make-a-complaint/data-protection-complaints/. Residents of Switzerland may contact the Federal Data Protection and Information Commissioner at https://www.edoeb.admin.ch/en/report-form-data-subjects. If you need further assistance regarding your rights, please contact us using the contact information provided below and we will consider your request in accordance with applicable law.

Data Privacy Framework Certification.

Please see the "Data Privacy Framework" section of this Policy for more information.

Exceptions.

Please note, however, that applicable law includes certain exceptions to the foregoing rights as a matter of law. Your exercise of the rights described above will be subject to any applicable exceptions and legal requirements.

RESIDENTS OF CANADA

If you are located in Canada, you have the following rights under Canada's main federal law relating to privacy, the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, substantially similar provincial laws, including the Quebec Act Respecting the Protection of Personal Information in the Private Sector, the British Columbia Personal Information Protection Act, and the Alberta Personal Information Protection Act:

• ask whether we hold Personal Information about you and request copies of such Personal Information and information about how it is processed;
• request that inaccurate Personal Information is corrected;
• request deletion of Personal Information that is no longer necessary for the purposes underlying the processing, processed based on withdrawn consent, or processed in non-compliance with applicable legal requirements; and
• lodge a complaint with us regarding our practices related to your Personal Information.

To exercise any of these rights, please contact us using any of the methods listed in the "Contact Information" section of this Policy. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.

We may transfer your personal information outside of Canada, including to the United States, for storage, processing, and other business purposes. Personal information located in another jurisdiction is subject to the laws of that jurisdiction and may be accessed by courts, law enforcement, or national security authorities in that country as set forth herein. By using the Platform or accessing the Site, you consent to the transfer, storage, and processing of your personal information outside of Canada as described above.

RESIDENTS OF BRAZIL

This Brazil Residents section describes our personal data collection and processing practices when we are acting in the role of controller (sometimes referred to as a data controller or business under certain laws) under Brazilian law, including the Lei Geral de Protecao de Dados Pessoais ("LGPD"). We act as the controller for personal data collected, received, or processed in connection with the Site and our other Offerings.

Our contact details are provided in the Contact Information section at the end of this Privacy Policy.

Legal Basis for Processing Personal Data

We may use your personal data for the purposes described in the What Personal Information Do We Collect, Use, and Disclose section of this Privacy Policy, based on one or more of the following legal grounds:

• Consent. With your consent as the data subject.
• Contract. As necessary for the execution of a contract or preliminary procedures related to a contract to which you, as the data subject, are a party, at your request.
• Legal Obligations. As necessary to comply with our legal or regulatory obligations, as well as to keep records of our compliance processes.
• Legal Rights. As necessary for us to exercise our legal rights in judicial, administrative, or arbitration proceedings.
• Vital Interests. As necessary to protect your life or physical safety, or the life or physical safety of other third parties.
• Legitimate Interests. As necessary to fulfill our legitimate interests or those of third parties (except when the fundamental rights and liberties of data subjects which require the protection of personal data prevail).

How to Exercise Your Brazil Privacy Rights.

If you are a resident of Brazil, you may request to exercise your Brazil privacy rights by contacting us using the information provided in the Contact Us section of this Privacy Policy. As a resident of Brazil, you have the right to object to our use of your personal data. If you no longer agree with us processing any types or categories of your personal data, you can contact us using the information provided in the Contact Us section of this Privacy Policy.

Complaints.

As a resident of Brazil, you have the right to file a complaint concerning our processing of your personal data with the Autoridade Nacional de Protecao de Dados ("ANPD").

RESIDENTS OF INDIA

We will continue to monitor changes in the Digital Personal Data Protection Act, 2023; however, to the extent applicable to our collection, use, and disclosure of Personal Data relating to Indian individuals, we comply with the principles of the Information Technology Act 2000 ("ITA").

Lawfulness of Processing.

If you are an individual in India, we collect and process Sensitive Personal Data and Information ("SPDI") about you only where we have a legal basis for doing so under applicable Indian laws. The legal basis depends on the products and services you use and how you use them. This means we collect and use your SPDI only where the:

• SPDI is collected for a lawful purpose connected with a function or activity of us collecting or using the information;
• Collection of the SPDI is considered necessary for that purpose; and
• SPDI collected is used for the purpose for which it has been collected, and if for any other purpose consent will be obtained in advance of such use.

Your Rights.

If you fall under the scope of the ITA, you have the right to know the:

• SPDI being collected;
• Purposes the SPDI is collected;
• Intended recipients of the SPDI; and
• Name and address of the agency collecting or retaining the information.

THIRD PARTIES

Our Platform may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Policy does not apply to your activities on these third party sites and services or any information you disclose to these third parties.

Third parties links are to external resources and third parties that have their own privacy policies. It may not always be clear which links are to external, third-party resources. If you click on a third-party link, you will be redirected away from the Site and App. You can check the URL to confirm whether you have left the Site and App.

We cannot and do not (1) guarantee the privacy or security practices of third parties or any content provided by third parties; (2) control third parties' collection or use or your information; or (3) endorse any third-party information, products, services, applications, or websites. We encourage you to read their privacy policies before providing any information to them.

CHILDREN

The Platform is not intended for children under 18 years of age and we do not knowingly collect personal information from children under 18. No one under the age of 18 may access, browse, or use the Site and App or provide any information to us. If we learn that we have collected or received personal information from a child under the age of 13 without a parent's or legal guardian's consent, we will take steps to stop collecting that information and to delete it. If you learn that a child has provided us with personal information in violation of this Policy, then you may alert us at support@airvet.com.

For information about the Children's Online Privacy Protection Act, please visit the Federal Trade Commission's website.

HOW DO WE PROTECT YOUR INFORMATION

We have implemented physical, organizational, contractual, and technological security measures with a view to protecting your information from loss or theft, unauthorized access, disclosure, copying, use, or modification. From time to time, we review our security procedures and consider new technologies and methods.

Despite the measure outlined above, no method of information transmission or information storage is 100% secure or error-free, so we unfortunately cannot guarantee absolute security. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any information that you provided to us has been compromised), please contact us immediately using the contact information in the "Contact Information" section below. Your use of the Site and App is at your own risk. We cannot guarantee that your data will remain secure in all circumstances.

If a data breach compromises your personal information, we will notify you and any applicable regulator when we are required to do so by applicable law.

YOUR CONSENT

We collect, use and disclose your information with your consent or as permitted or required by law. How we obtain your consent (i.e. the form we use) will depend on the circumstances, as well as the sensitivity of the information collected. Subject to applicable laws, your consent may be express or implied, depending on the circumstances and the sensitivity of the information in question. By using the Platform, you consent to us processing your information as outlined in this Policy now and as amended by us. "Processing" means using cookies on a computer/mobile device or using or touching information in any way, including, but not limited to, collecting, storing, deleting, using, combining and disclosing information, all of which activities will take place in Canada and the United States.

If you provide information about another individual to us, it is your responsibility to obtain the consent of that individual to enable us to collect, use and disclose his or her information as described in this Policy.

LOCATION OF PROCESSING, INTERNATIONAL TRANSFER, AND STORAGE OF INFORMATION

Your information may be stored and processed in any country where we have facilities or in which we engage third party service providers. As a result, your information may be transferred to countries outside your country of residence, which may have different data protection rules than in your country. While such information is outside of your country, it is subject to the laws of the country in which it is located, and may be subject to disclosure to the governments, courts, or law enforcement or regulatory agencies of such other country, pursuant to the laws of such country.

UPDATES TO THIS PRIVACY POLICY

This Policy is current as of the "updated" date which appears at the top of this page. We may modify this Policy from time to time. When changes are made to this Policy, they will become immediately effective when published in a revised Policy posted on our website unless otherwise noted. We may also communicate any material changes through our services or by other means. By submitting your information to us, by registering for or using any of the services we offer, by using our website, or by voluntarily interacting with us after we publish or communicate a notice about the changes to this Policy, you consent to our collecting, using and disclosing your information as set out in the revised Policy.