Gia Participant Privacy Policy

Effective September 25, 2026. Version gia-privacy-2026-09-25.

## 1. Who we are and what this covers

Scienza Health, Inc., a Delaware corporation ("Scienza," "we," or "us"), operates Gia. This policy covers the Gia Direct participant service: signing in, requesting phone checks, receiving available results, and keeping your record over time.

Our separate Consumer Health Data Privacy Notice explains health-data practices and rights in more detail. It is part of this policy. Accepting Terms or reading a privacy notice does not replace a separate consent required for recording, processing, or sharing.

Scienza also supplies technology to healthcare organizations. Information handled solely on an organization's behalf may be governed by that relationship and its notices. That does not mean all Gia Direct information is HIPAA protected health information, or that direct participants must always make requests through a healthcare provider.

## 2. Information we collect and why

We collect information you provide, information created when Gia carries out your requests, and information from the service providers handling those requests. The categories below describe this participant service, not every Scienza product.

| Category | Examples and source | Purpose | Recipient categories |
| --- | --- | --- | --- |
| Contact and access information | Your phone number; an email if supplied; enrollment and verification records; session and permission records | Sign-in, requested delivery, access control, recovery, and documenting choices | Hosting, authentication, messaging, and support providers; authorized staff |
| Check information | Your answers, original call recording, transcript, separated participant speech, and supporting information produced during the check | Conduct and analyze your requested check; maintain its record | Calling, hosting, transcription, speech-processing, and AI-analysis providers; authorized staff |
| Results and inferences | Speech-analysis outputs, questionnaire results, and processing status generated from the check | Show available results and distinguish incomplete or unavailable information | Hosting and analysis providers; authorized staff; a recipient separately authorized by you |
| Support and rights requests | Information you send us and records of our response | Answer questions, verify requests where necessary, and document their handling | Support, communications, and hosting providers; authorized staff |
| Service and security information | Essential session cookies, timestamps, request and delivery status, and network/device information received when you connect | Operate Gia, troubleshoot failures, prevent misuse, and audit access | Hosting, delivery, security, and technical-support providers; authorized staff |

Health information may be sensitive even when it is not a recording or result. A telephone number linked to a check, a visit to a particular page, or an identifiable referral conversion may reveal information about health.

Reports used to investigate a service failure may contain technical details and personal information. Filtering helps reduce identifying information, but these reports are not necessarily anonymous.

This policy does not introduce laboratory testing, genetic testing, medical-record imports, wearable-device connections, precise-location tracking, payment collection, or public participant profiles. New features require accurate notices and any required permissions before their data collection starts.

## 3. Phone checks and artificial intelligence

Gia is an automated AI service, not a human clinician. Calling providers receive the information needed to place and process your requested call. Transcription and speech-processing providers may receive audio. Speech-analysis providers may receive separated participant speech, and language-model providers may receive transcripts to generate check outputs.

The separate phone consent explains recording and processing before the check. A sign-in text request does not authorize a recorded call. Results can be incomplete or wrong; maintaining a record does not promise a diagnosis, clinician review, or currently available comparison over time.

Retaining audio does not itself authorize another call, new research, reanalysis of an old recording, or model training. This policy grants no blanket permission to train models on your health information. Provider processing must be consistent with applicable permissions, notices, contracts, and law.

## 4. Access and disclosures

Authorized Scienza staff may access information needed for service operations, support, and permitted review. Record access is subject to the service's access controls and auditing.

We use providers for hosting, communications, calls, transcription, analysis, and other service operations. They receive information needed for their assigned work. Their involvement does not remove Scienza's own legal responsibilities.

A family member, payer, or person who referred you does not automatically receive your information. Sharing with a clinician or another person requires the applicable authorization, except for disclosures otherwise required or permitted by law. Family access uses its own permission process where supported.

We may disclose information to professional advisers or authorities when necessary and legally permitted, including to comply with legal process or protect legal rights. A request from an authority does not by itself mean every disclosure is allowed.

If our business is transferred or reorganized, any transfer of personal information remains subject to applicable legal and contractual protections, required notices, and required consent. A transaction does not automatically authorize new health-data uses.

Acting as a referral promoter does not by itself make someone a related Scienza company or grant access to your record. No related Scienza company receives your health information.

## 5. Cookies, advertising, and communications

Gia uses essential cookies and similar session tools to keep you signed in and protect access. Blocking them may prevent sign-in or use of the service.

In the preceding 12 months, Scienza has not sold personal information and has not shared it for cross-context behavioral advertising. During that period, Scienza has disclosed the categories in the table in section 2 to service providers for the business purposes in that table. Those disclosures operate the service you request. They are not a sale and they are not an advertising share.

The Gia participant pages that were checked do not include advertising tools designed to follow your activity across other websites. Service providers still receive what they need for the jobs described above. This policy does not describe what a provider does with information beyond that work.

You can send a privacy or marketing opt-out request to dpo@scienzahealth.com. Blocking cookies in your browser and sending that request are different.

If you separately choose marketing communications, you may withdraw that choice. Declining marketing does not stop service messages about a check you requested and does not change that check's permissions. Contact support for help with messaging choices.

## 6. Planned affiliate referral program

We plan to offer an affiliate referral program. An affiliate in this section is a person or business that promotes Gia and may receive compensation for a qualifying referral. It does not mean that person is part of Scienza or has access to your account.

The program has not started. Before any referral tracking begins, we will explain what is collected, why, who receives it, how long it is kept, and what choices you have.

A referral does not authorize sharing of your health record or marketing contact by the promoter. Promotions must disclose a paid referral relationship. This policy does not set payment rates or allow someone to upload another person's contact list.

## 7. Keeping your record

We retain original audio, separated speech, transcripts, results, and supporting consent and provenance information as a longitudinal record of your checks. The purpose is continuity and support for comparison over time; it is not a promise that a comparison feature exists now.

Stopping calls, declining marketing, or ending participation does not automatically erase earlier records. Retention must remain necessary for the disclosed purpose and subject to applicable access, deletion, withdrawal, and destruction requirements. We do not claim a right to keep every category forever.

We keep contact and access records as needed to administer access and document requests. We keep security and audit records as needed to protect the service, investigate incidents, and satisfy applicable obligations. Support and rights-request records are kept for resolution and accountability. Required legal holds may affect particular records; they are not a general exception for every record.

Backups and provider-held copies may have different deletion procedures. Applicable deadlines and downstream deletion duties still apply. Where an exception prevents deletion, we will explain it to the extent required and permitted by law. When information is no longer needed and retention is not required or otherwise permitted, it must be deleted or genuinely deidentified under the applicable standard.

## 8. Your choices and rights

Depending on applicable law, you may request confirmation of processing; access or a portable copy; information about sources, purposes, and recipients; correction; deletion; withdrawal of consent; limits on sensitive-information use; or an opt-out of sale, sharing, targeted advertising, or certain profiling. These rights have different scopes and exceptions. This notice does not remove protections available in your state.

Send requests to dpo@scienzahealth.com, call 888-400-1409, or write to the address below. Describe the request; do not send sign-in codes, recordings, or identification documents in an initial email. We may need proportionate information to verify requests involving records or account changes. Opt-out requests must not be subjected to verification or extra information requirements prohibited by law.

A legally authorized agent may submit a request. We may verify the agent's authority where permitted; a family relationship or payment alone is insufficient. We will respond within applicable deadlines and explain any permitted extension or denial. Where an appeal right applies, reply to our decision or email dpo@scienzahealth.com with “Privacy appeal.” We will provide the applicable escalation or regulator information.

We do not penalize you for exercising rights in a way prohibited by law. Declining information necessary for a requested feature may prevent that feature from working. Withdrawal of future collection or sharing consent and deletion of an existing record are separate requests.

## 9. Security and processing locations

We use access controls and safeguards designed to protect personal information. No system can guarantee complete security. This statement does not waive our responsibilities or any required breach notification.

Scienza is based in the United States. Service providers may process information for the roles described above. This policy does not give them permission to train models on your health information.

## 10. Adults only

Gia Direct is intended for adults 18 and older. If you believe a minor's information was submitted, contact dpo@scienzahealth.com. We will review the situation and handle the information as applicable law requires. This age rule does not establish that we have never received information about a minor.

## 11. Changes

We will identify the approved policy's effective date and later revisions. For material changes, we will provide appropriate notice and obtain new consent where required before new collection, use, or sharing. Continuing to browse is not a substitute for legally required affirmative consent.

## 12. Contact

Scienza Health, Inc., a Delaware corporation
21163 Newport Coast Drive #137
Newport Beach, CA 92657

Privacy requests: dpo@scienzahealth.com
Support: support@scienzahealth.com
Public telephone: 888-400-1409