Privacy Policy

EyeD ID Lab (“EyeD ID Lab,” “we,” “our,” or “us”) is committed to protecting your privacy and handling data responsibly. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you access our websites (eyedlab.io, mypulsescan.com, mypulsescan.health) or use our clinical data infrastructure services (collectively, the “Services”).

Please read this Policy carefully. By using the Services, you agree to the collection and use of information as described herein.

1. Information We Collect

1.1 Information You Provide Directly

• Contact information (name, business email address, phone number, organization name) when you submit partnership or developer inquiry forms.
• Account credentials when you register for API access or a developer account.
• Communications you send us via email or through the Services.

1.2 Information Collected Automatically

• Log data: IP address, browser type, operating system, pages visited, referring URLs, timestamps, and API request metadata.
• Cookies and similar tracking technologies used to maintain sessions and analyze usage patterns. You may disable cookies through your browser settings; however, some features of the Services may not function properly as a result.
• Device information including device identifiers and network connection data.

1.3 Clinical and Health Data

As a clinical data infrastructure provider, EyeD ID Lab processes Protected Health Information (PHI) on behalf of covered entities and business associates under executed Business Associate Agreements (BAAs). PHI processed through the Services is handled in strict compliance with HIPAA, as described in Section 3 below.

2. How We Use Your Information

We use information we collect to:

• Provide, operate, maintain, and improve the Services.
• Respond to inquiries, process partnership and developer applications, and communicate with you about the Services.
• Send transactional and operational communications, including service updates, security alerts, and support messages.
• Monitor and analyze usage patterns to improve performance, security, and user experience.
• Detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• Comply with legal obligations and enforce our Terms of Service.
• Process clinical data queries on behalf of authorized healthcare partners under applicable BAAs.

We do not sell your personal information to third parties for their own marketing purposes.

3. HIPAA Notice — Clinical Data Infrastructure

EyeD ID Lab operates as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act. We process Protected Health Information (PHI) only on behalf of covered entities and other business associates that have executed a valid Business Associate Agreement (BAA) with EyeD ID Lab.

EyeD ID Lab implements the following safeguards for PHI:

• Administrative: Workforce training, access controls, security officer designation, and incident response procedures.
• Physical: Data center physical access controls and workstation use policies.
• Technical: Encryption in transit (TLS 1.2+) and at rest (AES-256), audit logging, automatic logoff, and unique user identification.

PHI is accessed and used only as necessary to perform services under the applicable BAA. EyeD ID Lab does not use PHI for marketing or sell PHI to any third party. Our infrastructure is HITRUST Certified and SOC 2 Type II audited.

If you are a patient whose records may be accessed through our Services, please contact your healthcare provider regarding your rights under HIPAA, including the right to access, amend, and receive an accounting of disclosures of your PHI.

4. SMS / Text Messaging Policy (TCPA Compliance)

Where EyeD ID Lab or its products (including MyPulseScan and MyPulseScan Health) utilize SMS or text messaging to communicate with users, the following terms apply:

Opt-In

You consent to receive SMS messages from EyeD ID Lab only by explicitly opting in through a designated opt-in mechanism (such as a web form, in-app consent checkbox, or SMS keyword). By opting in, you confirm that the phone number you provide is a number you own or are authorized to use to receive SMS messages.

Message Types and Frequency

Message types may include account notifications, service alerts, authentication codes, and operational updates relevant to your use of the Services. Message frequency varies based on account activity and the specific product you are using. We will not send promotional or marketing SMS messages without your explicit consent.

Opt-Out

You may opt out of SMS messages at any time by replying STOP to any message you receive from us. After opting out, you will receive a single confirmation message and no further SMS messages unless you opt in again. You may also opt out by contacting us at partnerships@eyedlab.io.

Help

Reply HELP to any SMS message for assistance, or contact us at partnerships@eyedlab.io.

Carrier Disclaimer

Message and data rates may apply depending on your mobile carrier plan. EyeD ID Lab is not responsible for any charges your carrier may assess for SMS messages.

No Sale of SMS Data

We do not sell, share, or disclose your mobile phone number or SMS opt-in data to third parties for their own marketing purposes.

5. Third-Party Sharing and Disclosure

We may share your information with third parties in the following circumstances:

• Particle Health: EyeD ID Lab’s clinical data infrastructure is powered by Particle Health, a HITRUST-certified health information network platform. Clinical data queries are routed through Particle Health’s network to access records from CommonWell, Carequality, TEFCA, and Surescripts. All PHI sharing with Particle Health is governed by applicable BAAs and HIPAA requirements.
• Service Providers: We engage trusted third-party vendors to help operate the Services (e.g., cloud hosting, analytics, communications platforms). These vendors access information only as necessary to perform services on our behalf and are contractually required to protect it.
• Legal Requirements: We may disclose information if required to do so by law or in response to valid legal process (such as a court order or subpoena), or when we believe disclosure is necessary to protect the rights, property, or safety of EyeD ID Lab, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction.
• With Your Consent: We may share information with third parties when you have given us explicit consent to do so.

6. Data Retention

We retain personal information for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or anonymize it in accordance with our data retention policies. PHI is retained and disposed of in accordance with the applicable BAA and HIPAA requirements.

7. Security

We implement industry-standard technical and organizational security measures designed to protect your information against unauthorized access, disclosure, alteration, and destruction. These measures include TLS encryption for data in transit, AES-256 encryption for data at rest, multi-factor authentication, role-based access controls, and continuous security monitoring.

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

8. Your Rights and Choices

Depending on your location and applicable law, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete personal information.
• Deletion: Request that we delete your personal information, subject to applicable legal obligations.
• Opt-Out: Opt out of certain data uses, including marketing communications.

To exercise any of these rights, please contact us at partnerships@eyedlab.io. We will respond to verified requests within the timeframe required by applicable law.

9. Children’s Privacy

The Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected such information, we will take steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by updating the “Last updated” date at the top of this page. We encourage you to review this Policy regularly. Your continued use of the Services after any changes constitutes your acceptance of the updated Policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

EyeD ID Lab — Privacy Team
Email: partnerships@eyedlab.io
Website: eyedlab.io