Altius Privacy Notice

Last updated: 1.9.

IMPORTANT INFORMATION AND DISCLAIMER

The Altius platform provides general health-, wellbeing-, performance-, and work-experience-related information for educational and informational purposes only. Altius does not provide medical advice, diagnosis, treatment, or clinical services, and is not a substitute for professional healthcare or mental health services.

If you are experiencing a medical or mental health emergency, call 911 immediately. For mental health crisis support in the United States, call or text 988 (Suicide & Crisis Lifeline).

WHO WE ARE AND HOW TO CONTACT US

1.1 Controller / Processor Status

AltiusCo., Inc. (“Altius,” “we,” “us,” or “our”) is a Delaware corporation.

Depending on the context in which Altius Services are provided, Altius may act as: ● a data controller,

● a joint controller, or

● a data processor,

including where Services are delivered through an employer, organization, or partner (“Enterprise Client”).

Where Altius acts as a processor, we process personal data only on documented instructions from the relevant controller and in accordance with applicable data protection law.

1.2 Contact Details

Company name: AltiusCo., Inc.

Registered address: 108 Lakeland Avenue, Dover, DE 19901

Email: privacy@altiusco.com

Website: https://www.altiusco.com

You have the right to lodge a complaint with a supervisory authority. We encourage you to contact us first so we can address your concerns directly.

SCOPE OF THIS PRIVACY NOTICE

This Privacy Notice explains how we collect, use, share, and protect personal data when you: ● use the Altius website;

● access the Altius platform, dashboards, or analytics tools;

● use the Alti mobile application (“Alti App”), including iOS and Android versions; ● participate in an Altius program through an employer, organization, or partner; ● communicate with us; or

● otherwise interact with Altius Services (collectively, the “Services”).

Our Services are not intended for individuals under 13+ years of age, and we do not knowingly collect personal data from individuals under 13+.

PERSONAL DATA WE COLLECT

3.1 Categories of Personal Data

We may collect and process the following categories of personal data: ● Identity Data: name, username, or similar identifier

● Contact Data: email address and other contact details you choose to provide ● Account & Profile Data: account credentials, preferences, survey responses, feedback

● Technical Data: IP address, device identifiers, browser type, operating system, app version, log data

● Usage Data: information about how you use the Services and interact with features ● Communications Data: messages, support requests, and correspondence with Altius

3.2 Self-Reported Wellbeing and Performance Data

You may choose to provide self-reported information related to wellbeing and performance, including perceived stress, recovery, focus, energy, fatigue, mood indicators, non-clinical sleep quality, work experience signals, lifestyle factors, and activity patterns you voluntarily disclose.

This information is:

● voluntary and self-reported;

● used solely for non-clinical, informational, and insight-generation purposes;

● not intended to constitute protected health information (PHI) under HIPAA, as Altius is not a HIPAA-covered entity.

Altius does not collect medical diagnoses, prescriptions, clinical test results, treatment plans, insurance data, or healthcare provider records.

3.3 Biometric Information (Face Scan)

With your explicit consent, the Alti App may collect biometric information derived from facial scans, such as facial geometry or related indicators, for purposes including identity verification, wellbeing-related insights (e.g., indicators of stress or fatigue), and user experience features.

Biometric information:

● is collected only when you actively initiate a scan;

● is used only for the specific purposes disclosed at the time of collection;

● is not used for cross-context identification, facial recognition databases, or persistent identity tracking;

● is not shared with employers, advertisers, or third parties except service providers acting under contract;

● is not used for law enforcement, surveillance, or employment decision-making; ● is retained for the duration of your account or until deletion is requested; ● is deleted within 30 days of account closure or deletion request.

You may withdraw consent or request deletion at any time via privacy@altiusco.com or your account settings.

3.4 Mobile App Data, Device Permissions, and Sensors

When you use the Alti App, we may collect additional data only where you have granted permission, including:

Location Data (Foreground Only)

When enabled by you in device settings, the Alti App may collect approximate location data only while the app is open and actively in use (“foreground location”).

Foreground location data is used to support user-requested, context-aware features, such as providing time-zone awareness or environment-related wellbeing insights during an active session.

Location data is:

● collected only while the app is open and in use;

● not collected when the app is closed or running in the background; ● not used for real-time tracking;

● not used for advertising;

● not shared with employers;

● not used for employee monitoring, surveillance, or performance evaluation.

You may disable location access at any time through your device settings without losing access to core platform functionality.

Apple HealthKit & Google Health / Health Connect

With your explicit permission, the Alti App may access certain data made available through Apple HealthKit and Google Health / Health Connect, including activity metrics, movement data, heart-rate variability, or sleep duration.

Health platform data:

● is used only to provide non-clinical, informational insights related to wellbeing, recovery, and performance;

● is not sold or used for advertising;

● is not shared with employers in identifiable form;

● may be used only at the individual or aggregated, anonymized level.

You may revoke permissions at any time through your device settings.

3.5 Aggregated and De-Identified Data

We may create and use aggregated, anonymized, or de-identified data for analytics, benchmarking, research, and platform improvement. Such data does not identify individuals.

HOW WE USE PERSONAL DATA

We process personal data to operate the Services, provide insights, support users, maintain security, improve platform performance, produce aggregated insights for Enterprise Clients, and comply with legal obligations.

No Clinical or Automated Decision-Making

Altius does not use personal data to:

● provide medical advice, diagnosis, or treatment;

● make clinical determinations;

● make automated decisions with legal or similarly significant effects; ● support employment decisions, including promotion, compensation, or termination.

All insights provided by Altius are informational only and require human interpretation.

ENTERPRISE & EMPLOYER DATA USE

When Services are provided through an employer or organization:

● employers do not receive identifiable personal data;

● reporting is provided only in aggregated, anonymized form;

● Altius is not an HR monitoring or surveillance tool;

● individual usage patterns are not disclosed to employers.

DATA SHARING

We may share personal data with service providers supporting infrastructure, analytics, customer support, professional services, and legal or regulatory compliance. We do not sell personal data. All service providers are contractually required to protect personal data and process it only under our instructions.

INTERNATIONAL TRANSFERS

Personal data may be transferred to and processed in countries outside your country of residence, including the United States. Where required, we implement appropriate safeguards such as standard contractual clauses.

COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to operate and improve the Services, including for authentication, preferences, analytics, and security. Disabling cookies may limit functionality.

DATA SECURITY

We use appropriate technical and organizational safeguards, including encryption, access controls, monitoring, and incident-response procedures. No system is completely secure, and users are responsible for maintaining the confidentiality of their credentials.

DATA RETENTION

We retain personal data only as long as necessary for the purposes described: ● Account data: retained while active and up to 30 days after closure

● Biometric data: deleted within 30 days of closure or deletion request ● Aggregated/anonymized data: may be retained indefinitely

Inactive accounts may be deleted after 2 years of inactivity following notice.

YOUR RIGHTS

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or port your personal data, and to withdraw consent.

Requests may be submitted to privacy@altiusco.com. We respond within 30 days or as required by law.

CHANGES TO THIS NOTICE

We may update this Privacy Notice periodically. Material changes will be communicated through the Services, email, or in-app notification, and may require renewed consent where legally required.

Health Platform Compliance Statement

Data obtained through Apple HealthKit or Google Health / Health Connect is: ● not used for advertising or marketing,

● not sold to third parties,