CALCUMETIC PRIVACY POLICY

Effective Date: August 23, 2026
Last Updated: August 23, 2026

Calcumetic is operated by Calcumetic LLC (“Calcumetic,” “we,” “our,” or “us”).

This Privacy Policy explains how Calcumetic collects, uses, maintains, protects, and discloses information when you visit calcumetic.com, use Calcumetic's decision-support services, purchase access, communicate with us, or otherwise interact with Calcumetic.

Calcumetic may process information relating to healthcare expenses, benefits, family circumstances, employer plans, and other matters that may be sensitive or health-related. We therefore design our information practices around data minimization, purpose limitation, separation of personalized decision evidence from general analytics, and limited retention.

This Privacy Policy should be read together with any separately applicable Consumer Health Data Privacy Policy, Terms of Use, and disclosures presented within the Calcumetic service.

1. Calcumetic's Privacy Principles

Calcumetic is designed around several fundamental principles.

Personalized information serves the personalized decision.

Information you provide about your circumstances is collected and processed primarily to provide the Calcumetic service you requested.

We seek to collect only what we reasonably need.

Calcumetic does not need your complete medical history or medical records to perform an ordinary FSA analysis. We seek information relevant to the decision rather than information merely because it might be available.

Personalized decision evidence is not an advertising asset.

Calcumetic does not use your individualized healthcare or decision information for targeted or behavioral advertising.

Personalized decision evidence is not sold.

Calcumetic does not sell individualized healthcare information or personalized decision evidence.

Employers do not receive your individual decision evidence merely because they provide or sponsor access.

Identifying your employer, entering through an employer-specific page, or receiving employer-sponsored access does not by itself authorize Calcumetic to provide that employer with your individual responses, healthcare circumstances, or personalized result.

General learning should not require personal exposure.

Calcumetic may use aggregated, statistical, or de-identified information to understand how the service performs and to improve Calcumetic. We intend that such analysis occur outside the personalized decision layer and not be used to reconstruct or identify individual users or their individualized decision evidence.

2. Information You May Provide

A. Decision Information

To provide a personalized benefits decision, Calcumetic may ask you to provide information such as:

• anticipated healthcare expenses;

• medical, dental, vision, prescription, or other potentially eligible expenses;

• expected care or utilization;

• relevant family or dependent circumstances;

• benefits-plan information;

• employer or plan identity;

• contribution or election information;

• applicable plan features;

• information concerning carryover, grace periods, eligibility, or other plan rules;

• responses to Calcumetic questions or clarifications;

• uncertainty concerning anticipated expenses or events; and

• changes you make when reviewing or recalculating a decision.

Some of this information may constitute sensitive personal information or consumer health data under applicable law.

Calcumetic requests such information to the extent reasonably relevant to providing the service you requested.

Do not provide medical records, Social Security numbers, complete payment-card numbers, government identification numbers, or other information Calcumetic does not request.

B. Account, Access, and Entitlement Information

Calcumetic is designed to avoid requiring unnecessary account information.

Where necessary to establish or maintain access, we may process limited information associated with:

• payment status;

• purchase entitlement;

• authorized promotional or beta access;

• session or return access;

• decision state;

• permitted recalculation; and

• technical identifiers necessary to provide those functions.

The exact information processed may depend on the version of the Calcumetic service you use.

C. Payment Information

Payments are processed through an independent payment processor, currently expected to be Stripe.

The payment processor may collect information including your name, email address, billing information, payment credentials, transaction information, device information, and information used for fraud prevention and payment authentication according to its own terms and privacy practices.

Calcumetic does not require or intend to store your complete payment-card number.

We may receive limited transaction information reasonably necessary to:

• confirm payment;

• establish access;

• associate a purchase with an entitlement;

• provide customer support;

• process refunds or disputes;

• prevent fraud or abuse; and

• satisfy accounting, tax, contractual, or legal obligations.

D. Communications and Support

If you contact Calcumetic, we may process:

• your name;

• email address or other contact information;

• the contents of your communication;

• technical or transaction identifiers necessary to investigate your request; and

• other information you voluntarily provide.

Please do not send healthcare details, medical records, complete payment-card information, Social Security numbers, or other unnecessary sensitive information through ordinary support email.

3. Information Processed Automatically

When you visit or use Calcumetic, limited technical and operational information may be processed automatically.

Depending on the service and configuration, this may include:

• browser type;

• device characteristics;

• IP address;

• approximate geographic information derived from technical information;

• referring page or campaign;

• pages or product stages reached;

• timestamps;

• session and performance information;

• security events;

• diagnostic information;

• error information; and

• privacy-minimized product events.

Calcumetic's analytics and operational systems are intended to answer questions such as:

Did the service load?

Did a user reach the pricing page?

Did a user begin or complete the decision journey?

Did a technical error occur?

They are not intended to answer questions such as:

What medical condition does this individual have?

How much does this identifiable individual expect to spend on healthcare?

What personalized FSA result did this particular employee receive?

Calcumetic is designed to keep individualized healthcare and decision evidence outside ordinary advertising and general product-analytics systems.

4. Why Calcumetic Processes Personalized Decision Information

Calcumetic may process personalized information as reasonably necessary to:

• provide the decision-support service you requested;

• determine which questions are relevant;

• identify information requiring clarification;

• evaluate uncertainty;

• apply relevant benefits or plan rules;

• generate a personalized analysis;

• determine an appropriate level of precision;

• explain a result;

• identify circumstances that could materially change a result;

• allow you to review or correct evidence;

• recalculate a decision;

• maintain permitted save-and-return functionality;

• preserve appropriate evaluation history;

• provide customer support;

• protect the integrity and security of the service; and

• comply with applicable legal obligations.

Calcumetic does not collect personalized health-related decision evidence for the purpose of selling that evidence, behavioral advertising, or creating advertising profiles.

5. Aggregate and De-Identified Analysis

Calcumetic may use information that has been aggregated, statistically summarized, or de-identified for legitimate purposes such as:

• measuring overall product performance;

• identifying areas where users commonly encounter difficulty;

• evaluating completion or abandonment patterns;

• improving question design and user experience;

• evaluating the performance of analytical methods;

• conducting internal research;

• measuring aggregate decision patterns;

• improving future Calcumetic products; and

• producing aggregate business or institutional insights where legally permissible.

This provision does not authorize Calcumetic to treat individualized decision evidence as a general-purpose commercial data asset.

Our intended architecture is:

personalized evidence → personalized decision

and, separately where appropriate:

privacy-protected aggregate/de-identified observations → general analysis and product improvement.

Calcumetic does not intend to use aggregate or de-identified information to reconstruct an individual's identity, healthcare circumstances, or personalized decision.

Where applicable law establishes requirements for information to qualify as de-identified, Calcumetic will apply the applicable standard before treating the information as de-identified for purposes governed by that law.

Calcumetic does not use identifiable health-related decision evidence to train third-party general-purpose artificial-intelligence models.

Any materially different future use of identifiable consumer health information will be subject to applicable notice, consent, and other legal requirements.

6. Employers, Universities, Benefits Organizations, and Sponsors

You may discover or receive access to Calcumetic through an employer, university, benefits organization, broker, consultant, administrator, or other organization.

Unless Calcumetic expressly provides different terms and disclosures for a particular arrangement:

Calcumetic does not provide that organization with your individualized healthcare circumstances, personalized responses, or personalized Calcumetic result merely because the organization referred you, sponsored access, or is identified as your employer or benefits provider.

An organization may receive operational information necessary to administer an access program where applicable, such as aggregate utilization or access counts.

Calcumetic may in the future offer privacy-protected aggregate reporting concerning matters such as overall utilization, completion, product performance, or generalized areas of benefits uncertainty.

Such reporting will be designed and governed so that the institutional reporting layer does not function as access to individual employee decision evidence.

If Calcumetic proposes an institutional arrangement involving materially different handling of individual information, the applicable disclosure and any legally required authorization will be provided separately.

7. How Calcumetic Does Not Use Personalized Decision Evidence

Calcumetic does not use individualized healthcare or decision evidence to:

• sell individualized health information;

• sell personalized decision histories;

• deliver behavioral advertising based upon healthcare circumstances;

• create advertising profiles based upon personalized health information;

• provide employers with individualized employee healthcare circumstances merely because the employer sponsors access;

• provide advertisers with personalized FSA analyses;

• determine employment eligibility or employment decisions; or

• train third-party general-purpose AI models.

Calcumetic also does not knowingly permit third-party advertising technologies to collect individualized decision evidence from the protected decision experience for cross-site behavioral advertising.

8. Information Sharing

Calcumetic may disclose information only as reasonably appropriate for the purposes described below and subject to applicable law.

A. Service Providers and Processors

Calcumetic may use service providers to perform functions such as:

• infrastructure and hosting;

• payment processing;

• transactional communications;

• customer support;

• security;

• operational monitoring; and

• privacy-minimized analytics.

Service providers receive information only as reasonably necessary for their authorized functions and are subject to applicable contractual and legal requirements.

Where consumer-health-data law requires specific processor agreements, access limitations, or processing instructions, Calcumetic will implement those requirements.

Nevada, for example, requires regulated entities to limit employee and processor access to consumer health data and requires qualifying processors to operate pursuant to contracts specifying permitted processing.

B. Payment Processing

Payment processors receive information necessary to process transactions, prevent fraud, authenticate payments, process disputes, and perform related services.

Their independent processing is governed by their own privacy policies and applicable law.

C. Legal, Security, and Protection Requirements

Calcumetic may disclose information when reasonably necessary to:

• comply with applicable law or lawful legal process;

• respond to valid governmental requests;

• protect the security or integrity of Calcumetic;

• investigate fraud, abuse, or security incidents;

• protect legal rights; or

• protect users or others from harm.

Nothing in this Privacy Policy requires Calcumetic to disclose information where disclosure is not legally required or otherwise appropriate.

D. Business Transactions

Information may be transferred as part of a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, subject to applicable law and continuing privacy obligations.

A business transaction does not by itself authorize materially incompatible uses of consumer health information.

E. At Your Direction

Calcumetic may disclose information when you expressly direct or authorize us to do so, subject to applicable law.

Where a law requires consent or authorization meeting particular requirements, Calcumetic will use the legally required mechanism rather than relying merely on acceptance of this general Privacy Policy.

9. Sale and Advertising

Calcumetic does not sell individualized consumer health data or personalized decision evidence.

Calcumetic does not use individualized consumer health data for targeted behavioral advertising.

If applicable privacy law gives terms such as sale, sharing, targeted advertising, or consumer health data a particular legal definition, Calcumetic will apply the governing definition and provide any rights, disclosures, or controls required by that law.

Calcumetic will not rely upon this Privacy Policy as blanket authorization for a future sale of consumer health data.

10. Retention

Calcumetic's objective is to retain identifiable information only for as long as reasonably necessary for the purpose for which it was collected or another legitimate purpose permitted by law.

Retention periods may vary by category.

Factors affecting retention may include:

• whether information remains necessary to provide the service;

• whether you maintain an active entitlement or decision state;

• whether information is necessary to process a payment or refund;

• accounting or tax requirements;

• security and fraud-prevention requirements;

• legal obligations;

• dispute resolution; and

• establishment, exercise, or defense of legal rights.

Personalized decision evidence should not be retained merely because indefinite retention might someday prove useful.

Where appropriate, information no longer requiring identification may be deleted or converted into aggregate or de-identified information.

Backups may retain information temporarily after deletion from active systems until those backups rotate, expire, or are securely overwritten according to applicable system practices.

11. Your Ability to Review, Correct, and Delete Information

Calcumetic may provide functionality allowing you to review, correct, update, or delete information associated with your decision.

Where available, Clear My Data is intended to remove applicable Calcumetic decision information within the scope described by the product.

Certain information may remain when reasonably necessary for purposes such as:

• transaction and accounting records;

• fraud prevention;

• security;

• legal compliance;

• dispute resolution; or

• establishing or defending legal rights.

Deletion of personalized decision evidence does not necessarily require deletion of a lawful payment record that Calcumetic must or reasonably needs to maintain separately.

You may also submit applicable privacy requests using the contact information below.

12. Consumer Health Data

Certain information processed by Calcumetic may constitute consumer health data under applicable state law even when Calcumetic is not a healthcare provider and the information is not governed by HIPAA.

Consumer-health privacy laws are developing rapidly.

Calcumetic will maintain additional disclosures, policies, consent mechanisms, rights procedures, and contractual controls where required by applicable law.

For jurisdictions requiring a separate Consumer Health Data Privacy Policy, Calcumetic will make that policy separately available.

Washington, for example, requires a qualifying regulated entity to prominently link a separate consumer-health-data privacy policy from its homepage. Nevada requires a qualifying consumer-health-data policy to identify categories collected, sources, purposes, sharing, third parties, processing, consumer rights, cross-site collection practices, and material-change procedures.

[LINK: Consumer Health Data Privacy Policy]

This section does not represent that every consumer-health-data statute applies to every Calcumetic user or activity. Applicability depends upon the relevant law and circumstances.

13. Security

Calcumetic maintains administrative, technical, and organizational safeguards appropriate to the nature of the information processed.

These may include:

• encryption of information in transit using HTTPS/TLS;

• restricted production-system access;

• separation of personalized decision evidence from general analytics;

• protected server-side processing;

• credential and secret isolation;

• access controls;

• browser security controls;

• data-minimization practices;

• retention controls;

• operational monitoring designed to minimize sensitive information; and

• incident-response procedures.

No method of electronic transmission, processing, or storage is completely secure. Calcumetic therefore cannot guarantee absolute security.

14. Security Incidents and Health-Information Breaches

Calcumetic maintains procedures for evaluating security incidents and will provide notifications where required by applicable law.

The FTC's Health Breach Notification Rule can apply to certain non-HIPAA entities offering or interacting with personal health records and requires covered entities to notify affected individuals, the FTC, and in some circumstances the media following qualifying breaches of unsecured identifiable health information. The FTC's 2024 amendments expressly clarified application to health apps and similar technologies.

Calcumetic will evaluate the applicability of federal and state breach-notification requirements based upon the nature of the information, the service involved, and the circumstances of an incident.

15. Cookies, Browser Storage, and Similar Technologies

Calcumetic may use cookies, local browser storage, or similar technologies reasonably necessary to:

• operate the service;

• maintain security;

• preserve permitted session or entitlement state;

• provide save-and-return functionality;

• remember appropriate preferences; and

• measure privacy-minimized service performance.

Calcumetic does not intentionally use individualized healthcare or decision evidence to create cross-site advertising profiles.

Disabling browser storage or clearing local browser information may affect functionality, including saved decision state or return access.

16. Third-Party Links and Services

Calcumetic may contain links to third-party websites, benefit resources, plan information, payment services, or other external services.

Calcumetic does not control the independent privacy or security practices of those third parties.

This Privacy Policy applies to Calcumetic's practices and does not replace the privacy policies of independent third parties.

17. Children's Privacy

Calcumetic is intended for adults making their own or their household's benefits decisions and is not directed to children under 13.

Calcumetic does not knowingly solicit personal information directly from children under 13 through the ordinary consumer service.

An adult may provide information concerning anticipated expenses for a dependent when relevant to the adult's benefits decision. That does not make the dependent a Calcumetic user.

If you believe information concerning a child has been collected improperly, contact us using the information below.

18. Privacy Rights

Depending upon your residence and applicable law, you may have rights concerning personal information or consumer health data, potentially including rights to:

• confirm whether information is being processed;

• access information;

• correct inaccurate information;

• delete information;

• obtain certain information in a portable format;

• withdraw consent where processing depends upon consent;

• request information concerning certain disclosures;

• restrict or object to certain processing; and

• appeal certain privacy-request decisions.

Not every right applies in every jurisdiction or circumstance.

Calcumetic may take reasonable steps to verify your identity before fulfilling a request and may retain information concerning a request where reasonably necessary to document compliance.

Requests may be submitted to:

privacy@calcumetic.com

Where applicable law requires another method, appeal process, or response mechanism, Calcumetic will provide it.

19. International Use

Calcumetic is operated from the United States and is presently designed principally for U.S. benefits decisions.

If you access Calcumetic from another jurisdiction, information may be processed in the United States or other locations in which authorized service providers operate.

Calcumetic does not represent that every product or benefit analysis is appropriate or available in every jurisdiction.

20. Material Changes to Privacy Practices

Calcumetic may update this Privacy Policy as the service, technology, or applicable law evolves.

The Effective Date and Last Updated date will identify the current version.

Where a change is material, Calcumetic will provide additional notice where appropriate or required.

A change to this Privacy Policy does not itself authorize Calcumetic to use previously collected sensitive or consumer health information for a materially different purpose where applicable law requires additional notice, consent, or authorization.

Calcumetic will not treat continued website use as a substitute for affirmative consent where applicable law requires affirmative consent.

This is particularly important in consumer-health contexts. Nevada, for example, requires affirmative voluntary consent before certain additional categories, recipients, or purposes can be added beyond those disclosed in the consumer-health policy.

21. Contact

Calcumetic
Operated by: Calcumetic LLC

Privacy inquiries:
privacy@calcumetic.com

Customer support:
support@calcumetic.com

Business/legal address:
[BUSINESS ADDRESS]

Consumer Health Data Privacy Policy:
[LINK]

© 2026 Calcumetic. All rights reserved.