Consumer Health Data Privacy Notice

1. What this Notice Covers

This Consumer Health Data Privacy Notice supplements the COR5 Privacy Policy and applies to physiological and health-related information processed through COR5. COR5 uses this notice as a clear national disclosure for U.S. users and may provide additional notices where required.

The public COR5 website and Early Access/pilot inquiry forms do not collect device-generated physiological measurements. Physiological information is collected when a user uses the COR5 device and application.

2. Categories of Consumer Health Data

• Information you provide about fitness, lifestyle, sleep, health conditions, medications, or related health context when those questions are enabled in onboarding.
• ECG waveforms and information derived from ECG measurements.
• PPG or pulse waveforms and information derived from PPG measurements.
• Heart rate, heart-rate-derived information, and other cardiovascular or autonomic wellness metrics produced by COR5.
• Body-impedance information and body-status metrics when a BIA feature is used.
• Skin temperature and temperature-change information.
• Motion, posture, balance, and activity information from COR5 inertial sensors.
• Test timestamps, signal-quality information, training/recovery context, and wellness/performance scores or trends derived from these signals.

3. Sources

You; the COR5 mobile application; COR5 connected devices; authorized team or program configuration; and COR5 processing that derives metrics from measurements.

4. Why COR5 Collects and Uses this Data

• To provide the measurement, score, trend, report, or other COR5 feature you request.
• To maintain your longitudinal COR5 history and personal reference information where enabled.
• To support device operation, signal quality, troubleshooting, security, and customer support.
• To provide authorized team features.
• To improve COR5 using genuinely deidentified information where reasonably feasible. Data that remains linkable through a code or linkage key is coded or pseudonymous, not deidentified. A materially different participant-linked or coded/pseudonymous use beyond service necessity will be separately disclosed and authorized where required.

5. Sharing

COR5 does not share consumer health data with affiliates for their independent use. COR5 may provide consumer health data to service providers that support the operation of the COR5 service, including cloud hosting and storage, security, technical processing, customer support, communications, and report generation. These providers may process the data only as necessary to provide services to COR5, under COR5’s instructions, and subject to contractual restrictions regarding the use and protection of the data.

6. Team Sharing and Legal Disclosures

COR5 may share specified individual results with a named team or organization only when the applicable Team Sharing Authorization is active or another lawful basis applies. Raw ECG and raw PPG waveforms are not shared with team users by default.

COR5 may disclose information when required by law or valid legal process, or in a protected business transaction as permitted by law.

7. No Sale; No Targeted Advertising

COR5 does not sell consumer health data and does not use consumer health data for targeted advertising.

8. Authorization and Withdrawal

Before COR5 collects onboarding health information or physiological measurements on the basis of consent, COR5 presents a separate Physiological & Health Data Authorization that identifies the categories and purposes of processing and explains how to withdraw.

Team sharing is authorized separately for each named organization. You can manage applicable permissions under Settings > Security & Privacy > Privacy & Data when available. Withdrawal applies prospectively after processing and may disable affected features.

9. Access, Correction, Export, and Deletion

You may use the Privacy & Data area when available or contact support@cor5.com to request access, export, correction where applicable, information about sharing, or deletion. COR5 may verify your identity before acting. COR5’s national operating target is to complete authenticated privacy requests within 45 days unless a shorter law applies. For authenticated deletion requests, COR5 targets deletion from active systems within 30 days and directs applicable processors or recipients to honor the request. Valid consent withdrawal is applied as soon as practicable and no later than 15 days. Backup copies are deleted or rendered unavailable through the backup lifecycle, with a national engineering ceiling of 6 months where technically applicable unless a stricter rule applies.

Account deletion and deletion of physiological data are separate actions. Some records may be retained where required or permitted by law, including records needed to document consent, security, legal compliance, or dispute resolution.

10. Retention

COR5 aims to retain identifiable consumer health data only as long as reasonably necessary for the purposes described above. For inactive accounts or ended programs, COR5’s working default is up to 24 months for identifiable physiological data unless an earlier valid deletion request applies, the data remains necessary for an active service, or a different period is lawfully established for a specific program or contract and is properly reflected in the applicable notice or authorization.

Consent, authorization, and security or audit records may be retained longer. Properly deidentified data may be retained for product quality, research, and development.

11. Physiological / Biometric Precaution

Some laws may classify certain physiological signal information as sensitive or biometric information. COR5 does not use ECG or PPG signals to authenticate or verify your identity. COR5 nevertheless treats raw ECG and PPG as highly sensitive and biometric-sensitive information for collection, access, security, retention, and deletion controls.

12. Health-Data Security Incidents

COR5 maintains a security-incident response process. If an incident involves identifiable health or physiological information, COR5 evaluates notification obligations under applicable state law and, where applicable, the FTC Health Breach Notification Rule. Unauthorized disclosure may require the same escalation as unauthorized access.

13. Contact

COR5 Inc.

Consumer health data and privacy requests: support@cor5.com