Privacy Policy

PRIVACY POLICY

Effective Date: March 25, 2026

IMPORTANT NOTICE REGARDING YOUR HEALTH INFORMATION

If you are a patient of Affect Therapeutics or any of its affiliated professional corporations (collectively, “Affect”), your protected health information (“PHI”), including any records relating to substance use disorder treatment, is governed separately by our Notice of Privacy Practices, not by this Privacy Policy. Please review our Notice of Privacy Practices carefully. It describes how we use and disclose your PHI, including records protected under 42 C.F.R. Part 2, and your rights with respect to that information.

1. Introduction and Scope

This Privacy Policy (“Privacy Policy”) describes how Affect Therapeutics, Inc. (“Affect,” “Affect Therapeutics,” “we,” “us,” or “our”) collects, uses, and shares information that we gather when you interact with us, including when you use the Services or the Affect App. By using the Services or the Affect App, you accept the terms of this Privacy Policy and consent to our collection, use, and sharing of your information as described herein.

What This Privacy Policy Covers. This Privacy Policy applies to information collected from general users of the Services and the Affect App that does not constitute PHI or records protected under 42 C.F.R. Part 2. It does not govern:

• PHI, as defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”), collected from you in connection with health care services provided by or through Affect or any affiliated Provider or Professional Corporation; or
• Records relating to the identity, diagnosis, prognosis, or treatment of any patient for a substance use disorder (“Part 2 Records”), as protected under 42 C.F.R. Part 2 (“Part 2”).

PHI and Part 2 Records are governed by our Notice of Privacy Practices. To the extent any information you provide could constitute PHI or a Part 2 Record, our Notice of Privacy Practices controls.

• Definitions. The following definitions apply to this Privacy Policy:

• “Affect App” means collectively (i) the Affect Therapeutics website located at [www.affect.com], (ii) any other website set up by Affect Therapeutics in connection with scheduling or delivering the Services, and (iii) the Affect Therapeutics mobile application;
• “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health (HITECH) Act, and their implementing regulations, including the HIPAA Privacy Rule (45 C.F.R. Parts 160 and 164) and the HIPAA Security Rule;
• “Part 2” means 42 C.F.R. Part 2, the federal regulations governing confidentiality of substance use disorder patient records;
• “Part 2 Records” means records relating to the identity, diagnosis, prognosis, or treatment of any patient for a substance use disorder that are maintained in connection with the performance of any program or activity relating to substance use disorder education, prevention, training, treatment, rehabilitation, or research that is conducted, regulated, or directly or indirectly assisted by any United States department or agency;
• “PHI” means protected health information as defined under HIPAA, meaning individually identifiable health information that is created, received, maintained, or transmitted by a covered entity or business associate in connection with health care operations, treatment, or payment; 
• “Providers” mean the healthcare professionals and Affect Provider Group, P.S.C. or another professional corporation with which Affect contracts (each, a “Professional Corporation”) who offer or schedule their services through the Affect App.  Depending on the state that you are located in, Services may be provided to you by: (i) Affect or (ii) a Professional Corporation with certain management services being provided by Affect;
• “Services” mean the Affect App and the website, www.affect.com, and other products and services offered by Affect; and
• “User” or “you” means an individual  using the Services who is not acting in their capacity as a patient (i.e., not receiving health care services from a Provider), or, when acting as a patient, with respect only to information that does not constitute PHI or Part 2 Records. 

3. The Information We Collect. 

3.1 Information You Provide Us

We collect the information that you provide to Affect Therapeutics, such as when you fill out any information form, including for account creation, scheduling or otherwise in connection with the Services. The categories of personal information that we may collect include:

• Contact information and identifiers (such as name, email address, mailing address, phone number, electronic signature, federal or state-issued professional identification information, and emergency contact information);
• Biographical and demographic information (such as date of birth, age, gender, race, height, weight, ethnicity, marital status, and sexual orientation);
• General health and medical information you voluntarily provide in connection with your use of the Services that does not constitute PHI or Part 2 Records (such as general wellness preferences, activity metrics such as steps taken, exercise, calories burned, heart rate, eating and sleeping habits, to the extent not associated with a specific clinical encounter or diagnosis);      
• Payment-related information we need to complete a transaction (such as credit card number, billing address, and financial account information);
• Employment-related information, including job title, professional experience, education, performance history, and compensation;
• Username and password that you may select in connection with establishing an account on the Affect App;
• Your photograph, social media handle or digital or electronic signature; and
• Information that you post or provide through the Affect App or through social media.

• Information Automatically Collected 

We may automatically collect information such as your Internet Protocol (“IP”) address,  location information (if available from your IP address or your service provider), activity or usage information relating to your use of the Affect App or the Services, and device information, such as hardware model, operating system, browser type, and website preferences. We use cookies and other data collection technologies to gather such information. If you  access the Services through a mobile device, you may also choose to provide us with geolocation data, e.g., your physical location or movements. For more information on our use of such technologies, please see Section 6 (Cookies and Other Data Collection Technologies) below. 

• Information from Other Sources. 

We may collect information from other sources, including public sources, such as demographic information.

4. How We Use Information 

We may use information about you for the following purposes:

• To provide, maintain and improve our Services;
• To provide and deliver the Services you request, and send you related information;
• To send you technical notices, updates, security alerts and support and administrative messages;
• To respond to your comments, questions and requests and provide customer service;
• To communicate with you about products, Services, offers, promotions, rewards, and events offered by Affect Therapeutics and others, and provide information we think will be of interest to you;
• To monitor and analyze trends, usage and activities in connection with our Services;
• To conduct research and measurement activities, using only de-identified or aggregated data that cannot reasonably be used to identify you;
• To detect, investigate and prevent fraudulent transactions and other illegal activities and protect the rights and property of Affect Therapeutics and others; and
• To carry out any other purpose to which you consent.

We also may use aggregated or de-identified information, which cannot reasonably be used to identify you. Once de-identified and aggregated, such information is no longer personal information and  is not subject to this Privacy Policy. We may use or disclose de-identified or aggregated information in our discretion.

• How We Disclose Information 

We do not share your information with third parties, except as set forth below. All of the categories of information described in Section 3 above may be shared as described below. 

1. Subsidiaries and Affiliates. We may share your information with our subsidiaries and affiliates.
2. Service Providers. We may share your information with third-parties that provide services to us in connection with our business, including to maintain the Affect App and to provide Services. It is our policy to require our service providers to keep the information confidential and to not use the information outside of our business relationship. 
3. Business Partners. We may share your information with our business partners, such as Providers and insurers, to enable them to provide services to us or to you. 
4. Sales and Acquisitions. We may disclose your information with a third-party in the event of our merger, acquisition, reorganization, sale of assets, or similar transaction, or in the event of bankruptcy.
5. As Required By Law or In Connection With Legal Rights. We may disclose your information if, in our sole discretion, we believe it reasonable or necessary (a) to comply with the law, (b) in cases of medical emergency, abuse, neglect, or a court order, (c) to prevent illicit or unethical activity, (d) to protect and defend our, your, or others’ rights, property, safety, or interests, or (e) to detect, prevent, or respond to fraud, misuse of the Affect App or the Services, or other violations of law.
6. With Your Consent. We may otherwise disclose your information if we have your consent.
7. Other Purposes Disclosed at Time of Collection. For any other purpose disclosed by us when you provide the information.

• Cookies and Other Data Collection Technologies 

We use cookies and other data collection technologies. Cookies are small data files sent to your computer from a web server and stored on your computer. The types of personal information that we may collect using these technologies are described in Section 3 above. 

We also use  Google Analytics to provide usage statistics and support your access to and use of the Affect App. Google Analytics uses cookies to collect information, such as the number of visitors to the website, the pages visited, and the length of time on the Affect  App. To learn more about how Google Analytics uses and shares your information and what choices you have, please visit 

https://www.google.com/policies/privacy/partners/ and 

https://www.google.com/analytics/terms/us.html.  

If you do not want the Affect App or the Services to collect information through the use of cookies and similar data collection technologies, your browser may allow you to manage and reject the use of cookies. Each browser is different, so you should check your browser’s “Help” menu to learn more about changing cookie settings. If you reject or block cookies, you may lose some of the functionality or features of the Affect App or certain Services. The Affect App does not currently respond to  “do-not-track” signals or similar mechanisms. 

• Your Choices 

• Opt-Out from Marketing Emails

If you no longer wish to receive marketing emails from us, you may unsubscribe by clicking the “unsubscribe” link in the emails or by contacting us as described in Section 13 below. Please note that even if you opt out of receiving marketing emails from us, you may continue to receive administrative,  legal or other important communications from us.

• Updates to Your Information Through Your Account 

If you have an account for the Affect App, you may review and make changes to your information through your account.

• Opt Out of Internet-Based Advertising 

You may be able to opt out of the use of your information for tailored advertising. For more information about interest-based advertising, or to opt out, please visit the  Digital Advertising Alliance (www.aboutads.info) and the Network Advertising Initiative (www.networkadvertising.org).

• Deletion of Personal Information

You may request deletion of your personal information by contacting us as described in Section 13. However, please be aware that we may be required (by law or otherwise) to keep such data and not delete it (or to retain it for a certain period of time, in which case it will be deleted after the required retention period). By deleting your personal information, we will remove it from active databases, however, it may remain in archives, and we also may continue to use de-identified information about your use of Services. If we have disclosed personal information to third parties as permitted under this Privacy Policy, we may no longer be able to access this data and be able to compel its deletion or modification by such party. After we delete personal information, we may retain de-identified information and will continue to use de-identified information as permitted under this Privacy Policy.

• Security. 

Affect Therapeutics maintains administrative, physical, and technical safeguards designed to protect your information we collect, consistent with applicable law. However, no information system is 100% secure, and we cannot guarantee the absolute security of your information.

• Children’s Privacy. 

The Affect App and the Services are not directed to, nor do we knowingly collect or sell personal information (as such term is defined under the U.S. Children’s Online Privacy Protection Act) from, children under the age of 18 without the verifiable consent of the child’s parent or guardian. If you become aware of a child providing his or her personal information without parental or guardian consent, please contact us using the  information in Section 13 below.

• Third Party Websites. 

The Affect App and the Services may link to or reference third-party websites (“Linked Websites”). We do not control and are not responsible for any Linked Websites, and you use such websites and services at your own risk. We encourage you to read the privacy policies and other legal documents applicable to such Linked Websites prior to using them.

• International Data Transfers. 

Affect Therapeutics and its Services are intended for use by persons located in the United States only  . If you are accessing the Services or the Affect App from outside of the United States, you do so at your own risk and are responsible for compliance with the laws  in your jurisdiction. By accessing and using the Services or the Affect App, you acknowledge and consent to the transfer to and processing of your personal information in the United States.

• Changes To This Privacy Policy. 

Affect Therapeutics reserves the right to modify, amend, add to, replace or remove this Privacy Policy at any time. If we make changes to this Privacy Policy, we will notify you by posting a new Privacy Policy on this page, with an updated effective date.

• Contact Us or Filing a Complaint. 

If you have any questions, comments, or concerns about this Privacy Policy, or if you believe your privacy rights have been violated, please contact our Privacy Officer at privacy@affect.com or by mail at:

Affect Therapeutics, Inc.
Attn: Privacy Officer
1640 Boro Place, 4th Floor
McLean, VA 22102

If you believe your PHI or Part 2 Records have been improperly used or disclosed, please refer to our Notice of Privacy Practices for information on how to file a complaint with us or with the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights. We will not retaliate against you for filing a complaint.

• Communications

14.1 Operational Communications. We may send you communications that are necessary to provide the Services, including appointment reminders, billing notices, and other administrative or transactional messages. These communications are not marketing, and you may not opt out of receiving them while you remain a user of the Services.

14.2 Marketing Communications. With your consent, we may send you promotional or marketing communications by email, text message, or other electronic means. You may opt out of marketing communications at any time by clicking the “unsubscribe” link in any marketing email, replying “STOP” to any marketing text message, or contacting us at privacy@affect.com. Opting out of marketing communications will not affect your receipt of operational communications.

14.3 Text Messages. By providing your mobile telephone number and consenting to receive text messages from us, you agree to receive autodialed or prerecorded text messages at the number provided. Message and data rates may apply. You may opt out at any time by replying “STOP.”

14.4 Communications Containing Health Information. Any communications containing your PHI are subject to our Notice of Privacy Practices. You have the right to request that we communicate with you by alternative means or at an alternative location as described in our Notice of Privacy Practices.

• California Privacy Rights

This section applies solely to residents of the State of California and supplements the other provisions of this Privacy Policy.

15.1 Scope and HIPAA/Part 2 Exemption. The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”), provides California residents with certain rights regarding their personal information. However, personal information that constitutes PHI maintained by Affect as a HIPAA-covered entity, and Part 2 Records maintained in compliance with 42 C.F.R. Part 2, are exempt from the CCPA to the extent collected, used, or disclosed in compliance with HIPAA and Part 2, respectively. Your rights with respect to PHI and Part 2 Records are governed exclusively by our Notice of Privacy Practices.

The rights described in this section apply only to personal information about you that is not exempt as PHI or Part 2 Records.

15.2 Your California Privacy Rights. Subject to the limitations above, California residents have the following rights under the CCPA:

• Right to Know. You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete. You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Correct. You have the right to request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing. You have the right to opt out of the sale or sharing of your personal information. We do not sell or share personal information as those terms are defined under the CCPA.
• Right to Limit Use of Sensitive Personal Information. You have the right to limit our use of sensitive personal information to purposes authorized by the CCPA.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA rights.

15.3 Submitting a Request. To exercise any of the rights described above, please submit a verifiable consumer request to us by:

• Emailing us at: privacy@affect.com
• Writing to us at: Affect Therapeutics, Inc., Attn: Privacy Officer, 1640 Boro Place, 4th Floor, McLean, VA 22102

We will respond to verifiable consumer requests within 45 days of receipt, with an extension of an additional 45 days where reasonably necessary and upon notice to you.

15.4 Authorized Agents. You may designate an authorized agent to submit a request on your behalf. We may require verification of the agent’s authority and your identity before processing the request.

15.5 “Do Not Sell or Share My Personal Information.” We do not sell or share (as defined under the CCPA) your personal information. Accordingly, we do not offer a formal opt-out mechanism at this time. If our practices change, we will update this section and provide appropriate mechanisms to exercise your opt-out rights.

• Other State Privacy Rights

Residents of certain U.S. states may have rights under applicable state privacy laws regarding their personal information, including rights to access, correct, delete, or obtain a copy of their personal information, and to opt out of the sale or sharing of personal information. To exercise applicable state privacy rights with respect to personal information that does not constitute PHI or Part 2 Records, please contact our Privacy Officer.

* * * * * *

Affect Therapeutics, Inc., a Delaware corporation, Affect Provider Group, P.S.C., a Kentucky professional services corporation, and AT Provider Group of California, P.C., a professional corporation, are collectively referred to as Affect.