Privacy Policy

Last updated — November 2026

1. About this Policy

COR5 Inc. ("COR5," "we," "us," or "our") provides wellness and sports-performance products and services, including the COR5 website, mobile application, connected COR5 devices, web portals, reports, team features, Early Access and pilot programs, and related support services.

This Privacy Policy explains how COR5 collects, uses, discloses, retains, and protects personal information. A separate Consumer Health Data Privacy Notice provides additional detail about physiological and health-related information processed through COR5.

2. Information We Collect

Website, Early Access, pilot, investor, and contact information, such as your name, email address, organization or team, sport, role, number of athletes, referral code, messages, and other information you choose to submit through a COR5 website form.
Account and profile information, such as name, email address, login credentials, date of birth or age information, state of residence for U.S. users, language, settings, guardian contact information for users age 13 through 17, and team or organization affiliation.
Information you provide during onboarding, which may include fitness, lifestyle, sleep, and health-related questionnaire responses.
Physiological and wellness information collected through COR5 devices and tests, which may include ECG waveforms, PPG or pulse waveforms, heart rate and heart-rate-derived metrics, blood-oxygen saturation (SpO2), body-impedance information, skin temperature and temperature change, motion/posture information, test timing, signal-quality information, and wellness or performance metrics derived from these signals.
Device and technical information, such as COR5 device identifiers, firmware, app version, operating system, connection status, diagnostic logs, and security information needed to operate and protect the service.
Website technical information processed as needed to operate and secure the site, such as IP address, browser or device information, security logs, and form-submission metadata.
Team and program information, such as team membership, program or pilot assignment, test schedules, completion status, and permissions granted for team access.
Support and communications information, including messages sent to support, feedback, survey responses, verification records, and records of legal notices or consents.

3. How We Collect Information

We collect information directly from you when you join Early Access, request a pilot, submit an investor or contact form, register, configure your profile, answer onboarding questions, provide consent, contact support, or use COR5.
We collect physiological and device information from the COR5 device and app when you choose to run a test or monitoring session.
We may receive limited roster or invitation information from an organization that invites you to join a COR5 team or program.
For a user age 13 through 17, we collect a guardian email address to request and record guardian authorization.
We create derived information when COR5 algorithms process measurements to generate wellness/performance metrics, trends, scores, quality indicators, and reports, and when an AI language model generates a plain-language summary of your results.

4. How We Use Information

To respond to Early Access, pilot, investor, contact, and support requests and to send launch or availability communications you request. You may unsubscribe from promotional email communications at any time.
To create and manage your COR5 account and authenticate access.
To verify age eligibility and, for users age 13 through 17, obtain and manage parent or legal-guardian authorization.
To connect COR5 devices, record measurements, process signals, calculate results, display trends, and generate reports.
To generate a plain-language summary and explanation of your test results using an AI language model. Only calculated test results are used for this purpose; the AI does not calculate your scores or change your results. COR5 asks for your permission before generating AI summaries, and you can turn them off at any time in Settings.
To provide team features when the applicable team sharing is authorized or otherwise lawfully permitted.
To provide support, troubleshoot problems, improve measurement quality, secure the service, prevent abuse, and maintain reliability.
To conduct quality assurance, internal research, product development, and algorithm improvement using genuinely deidentified information where reasonably feasible. Data that remains linkable through a code or linkage key is coded or pseudonymous, not deidentified. If COR5 seeks a materially different participant-linked or coded/pseudonymous use beyond service necessity, COR5 will provide additional disclosure and authorization where required.
To comply with law, enforce agreements, protect users, and respond to valid legal process.

5. When We Share Information

With CardioX, Inc., which provides the signal processing, metric calculation, and reporting technology behind COR5 under a white-label agreement, subject to contractual restrictions.
With a third-party AI language model provider that generates plain-language summaries of your test results. We send only calculated test results, not your name or account details. The provider processes this information only to generate the summary, under contractual terms that do not permit it to use the information to train its models.
With people you choose to share with. If you share a live session link or a report, anyone who has the link and PIN can view that session or report.
With service providers that perform website hosting, form processing, email or communications, cloud hosting, storage, security, support, e-signature, data processing, reporting, and similar functions for COR5 under contractual restrictions.
With affiliates and technical service providers that actually support COR5, as permitted by law and subject to appropriate contractual restrictions. Where applicable law requires identification of specific affiliates or additional recipient details, COR5 will provide those details in the Consumer Health Data Privacy Notice or other required disclosure.
With a team or organization only as disclosed in the applicable Team Sharing Authorization or where sharing is otherwise necessary and lawfully permitted to provide a feature requested by the user.
When required by law or valid legal process, or when reasonably necessary to protect rights, safety, and security.
In connection with a merger, financing, acquisition, reorganization, or sale of business assets, subject to applicable law and appropriate protections.

6. Consumer Health Data; Advertising

COR5 treats physiological and health-related information as sensitive. COR5 does not sell consumer health data and does not use consumer health data for targeted advertising. Additional information appears in the COR5 Consumer Health Data Privacy Notice.

7. Team Features

If you join a team or organization, COR5 will show you the organization name and categories of information proposed for team access. Team sharing is managed separately from COR5’s own processing of your physiological data.

Raw ECG and raw PPG waveforms are not shared with team personnel by default. Expanded sharing, if ever offered, must be specifically configured and disclosed.

8. Retention

COR5 retains information for as long as reasonably necessary to provide the service, support longitudinal features you use, comply with legal obligations, resolve disputes, and protect the service. Tests that fail COR5’s signal-quality check are not saved.

Identifiable raw and derived physiological data is retained only as reasonably necessary for the purposes described in this Policy. For inactive accounts, ended programs, or terminated team relationships, COR5’s working default is up to 24 months unless earlier deletion is requested, continued retention is necessary for an active service, or a different period is lawfully established for a specific program or contract and is properly reflected in applicable user-facing notices and authorizations.

Executed agreements, guardian authorizations, consent records, security records, and audit evidence may be retained for up to five years or longer when reasonably necessary for legal compliance or dispute resolution. Properly deidentified information that cannot reasonably be linked back to an individual may be retained longer.

9. Security

COR5 uses administrative, technical, and organizational safeguards designed to protect personal and physiological information. Access to sensitive information is restricted according to role and operational need. Account data and test results are stored on servers located in the United States. No system can guarantee absolute security.

10. Health-Data Incident Response

COR5 maintains a security-incident response process. Incidents involving identifiable health or physiological information are evaluated under applicable state breach-notification laws, contracts, and the FTC Health Breach Notification Rule where applicable. COR5 requires relevant service providers to report incidents and cooperate with investigation, containment, and legally required notification.

11. Physiological / Biometric Precaution

COR5 does not use ECG or PPG waveforms to authenticate or verify identity. COR5 treats raw ECG and PPG as highly sensitive and biometric-sensitive information as a national precaution, including for access, security, retention, and deletion controls.

12. Your Choices and Rights

Depending on applicable law, you may have rights to access, obtain a copy of, correct, delete, or request information about disclosures of your personal or consumer health data and to withdraw consent or appeal a refusal. COR5’s national operating target is to complete authenticated privacy requests within 45 days unless a shorter law applies; target authenticated deletion from active systems within 30 days; apply a valid consent withdrawal as soon as practicable and no later than 15 days; and remove or render unavailable covered backup copies through the backup lifecycle with a national engineering ceiling of 6 months where technically applicable unless a stricter rule applies.

COR5 intends to provide controls through Settings > Security & Privacy > Privacy & Data when those controls are available, and through support@cor5.com. We may need to verify identity before completing a request.

Withdrawing physiological-data authorization may disable COR5 measurement features. Withdrawing a Team Sharing Authorization stops future team sharing after processing, subject to applicable law and information already lawfully exported by the organization.

13. Minors Age 13 Through 17

COR5 does not currently permit registration by children under 13. For users age 13 through 17, COR5 requires authorization from a parent or legal guardian before account activation and before collecting onboarding health information or physiological measurements.

Guardian authorization is obtained through a secure link sent to the guardian email provided during registration. COR5 records the authorization and document versions. When the user reaches age 18, COR5 may require the user to accept adult terms and permissions directly.

14. Electronic Records and Consent History

COR5 records the version and date of important agreements and authorizations. Available records can be viewed under Settings > Security & Privacy > Consents & Documents when that feature is available.

15. Cookies and Website Technologies

COR5 uses cookies and similar technologies as described in the COR5 Cookie Policy. The current website is intended to use only technologies reasonably necessary to operate, secure, and support the site and its forms, unless this Policy and the Cookie Policy are updated before additional analytics, advertising, or tracking technologies are introduced.

16. Wellness Purpose and HIPAA

COR5 is offered as a wellness and sports-performance service and is not intended to establish a physician-patient relationship. Health-related information is not automatically subject to HIPAA merely because it relates to health. If COR5 separately agrees in writing to act as a HIPAA business associate for a particular customer, the applicable written agreement will govern covered information.

17. U.S. Launch Scope

COR5 Early Access, pilot requests, and the initial COR5 service rollout are currently intended for users and organizations in the United States unless COR5 expressly offers a program in another country. The public website may be viewable outside the United States, but launch and pilot forms should not be used for a non-U.S. program unless COR5 has expressly made that program available.

18. Changes to this Policy

We may update this Privacy Policy. If a change materially expands the categories of consumer health data collected, the purposes for which it is used, or the parties with whom it is shared, COR5 will provide additional notice and obtain renewed authorization when required.

19. School and University Programs

If COR5 is deployed through a school, college, or university, additional institutional privacy requirements may apply, including the Family Educational Rights and Privacy Act (FERPA) where applicable. COR5 and the institution may use additional contractual terms governing institution-controlled education records, access, use, redisclosure, security, and retention. Individual COR5 permissions remain separate from any institution-specific obligations.

20. Contact

COR5 Inc.

Privacy and support requests: support@cor5.com