Foxo U.S. Privacy Policy and Consumer Health Data Privacy Policy

U.S. Privacy Policy

Foxo Technology Pty Ltd – U.S. Privacy Policy

Last updated: October 2026

1. About this policy

1.1 This U.S. Privacy Policy explains how Foxo Technology Pty Ltd (ABN 88 625 517 428) ("Foxo", "we", "us") collects, uses, discloses and protects personal information about people in the United States who use our website at foxo.com (the "Website"), the Foxo application (the "App"), and our Patient Connect and Referrer Connect modules.

1.2 This policy applies in addition to our General Privacy Policy at foxo.com/privacy. If they conflict, this policy applies to U.S. users. It should be read with our U.S. Terms of Use at foxo.com/usa-terms. Words defined in the U.S. Terms of Use have the same meaning here.

1.3 This policy does not govern protected health information (PHI) that we handle on behalf of healthcare organisations under HIPAA. That information is covered by section 3.

1.4 If you are a resident of Washington, Nevada or Connecticut, our Consumer Health Data Privacy Policy also applies to you.

2. Our role

2.1 We act in two capacities:

(a) For our own users. When you create an Account, visit the Website or contact us, we decide how your personal information is used, as described in this policy.

(b) For healthcare organisations. When an organisation uses Foxo to communicate about patients, or enables Patient Connect or Referrer Connect, we process information on that organisation's behalf and under its instructions. The organisation is responsible for that information, and requests about it should be made to the organisation.

3. Protected health information and HIPAA

3.1 Where we create, receive, maintain or transmit PHI for an organisation that is a covered entity or business associate under HIPAA, we do so as its business associate under a business associate agreement (BAA).

3.2 We use and disclose PHI only as permitted by the BAA and HIPAA. We do not use PHI for marketing, advertising, analytics provided by third parties, or the sale of data.

3.3 The organisation's notice of privacy practices explains how it uses your PHI and your rights under HIPAA. To access, amend or obtain an accounting of disclosures of your PHI, contact the organisation directly. If we receive a request from you about PHI, we will refer it to the organisation.

4. Information we collect

4.1 Account and professional information. If you create an Account, we collect your name, work email address, password, position, organisation, profile photo, and professional details such as your National Provider Identifier and state licence number, which we use to verify your professional status.

4.2 Guest information. If you use Patient Connect or Referrer Connect, we collect your first name, last name, email address or mobile number, and any other information the organisation asks you to provide.

4.3 Messages and files. We collect the messages, files and other content you send and receive through Foxo. Where this content relates to patients of a HIPAA covered entity, it is PHI and is handled under section 3.

4.4 Device and usage information. We automatically collect information about how you use the Website and App, including IP address, device type, operating system, browser, app version, pages and features used, and the date and time of access.

4.5 Approximate location. We derive your approximate location (country and region) from your IP address. We do not collect precise location from your device. See section 6.

4.6 Billing information. Enterprise subscriptions are invoiced directly to the organisation. We collect billing contact details and keep invoice records. We do not take payments or collect payment card details through Foxo.

4.7 Information from others. We may receive information about you from the organisation that invited you to Foxo, from Integrations your organisation connects, and from public professional registers we use to verify your status.

5. How we use information

5.1 We use the information in section 4 to:

(a) provide, operate and support Foxo, including delivering messages and notifications;

(b) create and manage Accounts and Guest sessions, and send verification codes;

(d) keep Foxo secure, including preventing spam, fraud and unauthorised access;

(e) store data in the appropriate region (see section 6);

(f) invoice organisations and manage subscriptions;

(g) understand how Foxo is used and improve its features, using usage information only (see section 7);

(h) send service, security and policy notices;

(i) send marketing about Foxo to Account users, as described in section 16;

(j) comply with law, respond to lawful requests, and enforce our Terms of Use.

5.2 We do not use message content, PHI or other health information for marketing, advertising or training third-party models.

6. Approximate location

6.1 We use the approximate location derived from your IP address to store your data in the correct region and to block account creation and spam from regions where Foxo is not offered. We do not use location for advertising, and we do not track your location over time.

7. Analytics and cookies

7.1 We use cookies and similar technologies to keep you signed in, remember your preferences, keep Foxo secure, and understand how the Website and App are used.

7.2 We use Google Analytics to measure usage of the Website and App. It receives device and usage information, such as pages and features used. We configure it so that it does not receive message content, patient information or information entered in Patient Connect or Referrer Connect, and we do not use Google's advertising features. You can opt out of Google Analytics at tools.google.com/dlpage/gaoptout.

7.3 We do not use advertising cookies, and we do not allow third parties to collect information through Foxo for targeted advertising.

7.4 You can set your browser to refuse or delete cookies. Some features may not work without essential cookies.

8. How we disclose information

8.1 We do not sell personal information, and we do not share it for cross-context behavioural or targeted advertising.

8.2 We disclose personal information only:

(a) to the organisations you communicate with, including the organisation that invited you or that you contact through Patient Connect or Referrer Connect;

(b) to our service providers, who process information on our behalf under contract and only for the purposes we specify, including Microsoft Azure (hosting), messaging and email delivery providers, and Google Analytics. Service providers that handle PHI do so under a business associate agreement with us;

(d) in a corporate transaction, such as a merger, acquisition or sale of assets, subject to confidentiality obligations and, for PHI, the BAA;

(e) where required by law, such as in response to a subpoena, court order or lawful request from a government authority, or to protect the rights, safety or property of Foxo, our users or others; and

(f) with your consent or at your direction.

8.3 We may disclose aggregated or de-identified information that cannot reasonably be used to identify you. De-identification of PHI is carried out only as permitted by HIPAA and the BAA.

9. Text messages

9.1 If you provide a mobile number, we send text messages only for verification codes and notifications about your Foxo conversations. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help.

9.2 No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third party, except our service providers that deliver the messages.

10. Where we store information

10.1 Information about U.S. users is hosted in Microsoft Azure data centres located in the United States.

10.2 Foxo is based in Australia. Our authorised personnel in Australia may access U.S. data remotely for support, security and operations, under access controls, confidentiality obligations and, for PHI, the BAA.

11. How long we keep information

11.1 We keep personal information for as long as needed for the purposes in this policy, and as required by law.

11.2 Clinical communications and other health-related content are retained for a minimum of 10 years from the date of last activity, or until the subject of the record turns 25 where it relates to a minor, whichever is later, or longer if required by law or a BAA. PHI is retained and deleted in accordance with the BAA.

11.3 Account information is kept while your Account is active and for up to 7 years after it closes, for legal, tax and dispute purposes. Usage and analytics data is kept for up to 26 months.

11.4 When information is no longer needed, we securely delete or de-identify it.

12. Security and breach notification

12.1 We protect information with administrative, technical and physical safeguards, including encryption in transit and at rest, access controls, audit logging and staff training. Safeguards for PHI meet the requirements of the HIPAA Security Rule.

12.2 No system is completely secure, and we cannot guarantee that information will never be accessed without authorisation.

12.3 If a security incident affects PHI, we will notify the affected organisation as required by HIPAA and the BAA, and no later than 60 days after discovery. The organisation is responsible for notifying affected individuals. For other personal information, we will notify you and regulators as required by applicable state and federal law, including the FTC Health Breach Notification Rule where it applies.

12.4 We will never ask you by email or text for your password or verification code.

13. Your rights and choices

13.1 Depending on the state you live in, you may have the right to:

(a) know what personal information we hold about you and access a copy;

(b) correct inaccurate personal information;

(d) receive your personal information in a portable format;

(e) opt out of the sale of personal information, targeted advertising and profiling (we do not do any of these);

(f) limit the use of sensitive personal information; and

(g) not be discriminated against for exercising these rights.

We extend the rights in (a) to (d) to all U.S. users, whether or not their state law requires it.

13.2 How to make a request. Email privacy@foxo.com with your name, organisation (if any), the email address or mobile number you use with Foxo, and the request you are making. Account users can also update most account information in the App.

13.3 Verification. We will verify your identity before acting on a request, usually by confirming control of the email address or mobile number linked to your Account or Guest session.

13.4 Authorised agents. You may use an authorised agent to make a request. We may ask for proof of the agent's authority and verify your identity directly.

13.5 Timing. We will respond within 45 days. If we need more time, we will tell you why and may extend by a further 45 days where the law allows.

13.6 Appeals. If we decline your request, you may appeal by emailing privacy@foxo.com with "Privacy appeal" in the subject line. We will respond within the period required by your state's law. If you are not satisfied, you may contact your state Attorney General.

13.7 Limits. We may be unable to delete information that we must keep under section 11 or by law. Requests about PHI, or about information held for an organisation through Patient Connect or Referrer Connect, should be made to that organisation, and we will refer any such request we receive to it.

13.8 Account deletion. You can delete your Account from your profile in the App or by emailing privacy@foxo.com. Messages you have sent may remain available to the people and organisations you communicated with, and are retained under section 11.

14. California residents

14.1 To the extent the California Consumer Privacy Act (CCPA) applies, this section is our notice at collection and privacy policy for California residents. It does not apply to PHI or medical information governed by HIPAA or the California Confidentiality of Medical Information Act.

14.2 In the past 12 months we have collected the following categories of personal information, from the sources and for the purposes in sections 4 and 5:

Category	Examples	Disclosed for a business purpose to
Identifiers	Name, email address, mobile number, IP address, account ID	Organisations you communicate with; service providers
Professional information	Position, organisation, NPI, state licence number	Organisations you communicate with; service providers
Commercial information	Billing contact details and invoice records	Service providers
Internet or network activity	Pages and features used, device and browser information	Service providers, including Google Analytics
Approximate geolocation	Country and region derived from IP address	Hosting provider
Audio, electronic or visual information	Profile photo; files you send	Organisations you communicate with; service providers
Sensitive personal information	Account login credentials; health information in messages	Organisations you communicate with; service providers
Inferences	None	Not applicable

14.3 We do not sell or share personal information, and have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16.

14.4 We use sensitive personal information only to provide Foxo, keep it secure and comply with law, as permitted by the CCPA. We do not use it to infer characteristics about you.

14.5 Retention periods for each category are set out in section 11.

14.6 California Civil Code section 1798.83 lets California residents request information about disclosures of personal information to third parties for their direct marketing. We do not make such disclosures.

15. Children

15.1 Foxo accounts are for people aged 18 or over. We do not knowingly collect personal information directly from children under 13.

15.2 A parent, guardian or other personal representative may use Patient Connect on behalf of a minor, and an organisation may communicate about a minor patient through Foxo. That information is collected for and controlled by the organisation, and is handled under section 3 where it is PHI.

15.3 If you believe a child under 13 has given us personal information directly, contact privacy@foxo.com and we will delete it, unless we must keep it under section 11.

16. Marketing communications

16.1 We may send marketing about Foxo by email to Account users. We do not send marketing to Patient Guests or Referrer Guests, and we never use message content, PHI or health information for marketing.

16.2 You can unsubscribe at any time using the link in any marketing email or by emailing privacy@foxo.com. You cannot opt out of service, security or policy notices while you use Foxo.

17. Do Not Track and Global Privacy Control

17.1 Because we do not sell or share personal information or use it for targeted advertising, there is nothing for a Do Not Track or Global Privacy Control signal to opt you out of. If that changes, we will honour Global Privacy Control signals as an opt-out request.

18. Changes to this policy

18.1 We may update this policy from time to time. We will post the updated version with a new "last updated" date and, for material changes, notify Account users by email or in the App before the change takes effect. We will not reduce your rights over information already collected without your consent, unless required by law.

19. Contact us

19.1 For questions or requests about this policy or your personal information, contact:

Privacy Officer, Foxo Technology Pty Ltd

Email: privacy@foxo.com

Post: 1/10 Albert Avenue, Broadbeach QLD 4218, Australia

Consumer Health Data Privacy Policy

Foxo Technology Pty Ltd – Consumer Health Data Privacy Policy

Last updated: October 2026

1. Who this policy applies to

1.1 This policy applies to residents of Washington, Nevada and Connecticut, and to anyone whose consumer health data is collected in Washington, under the Washington My Health My Data Act, Nevada Senate Bill 370 and the Connecticut Data Privacy Act.

1.2 "Consumer health data" means personal information that is linked or reasonably linkable to you and identifies your past, present or future physical or mental health status.

1.3 This policy does not apply to protected health information (PHI) governed by HIPAA, which we handle as a business associate of healthcare organisations. Requests about PHI should be made to the healthcare organisation. It also does not apply to information about health professionals in their professional capacity.

1.4 This policy supplements our U.S. Privacy Policy at foxo.com/usa-privacy.

2. Consumer health data we collect

2.1 We may collect consumer health data when you use Patient Connect or Referrer Connect with an organisation that is not subject to HIPAA, including:

(a) the fact that you are communicating with a particular healthcare organisation or provider;

(b) health information you include in messages or files, such as symptoms, conditions, treatments, medications and appointments; and

2.2 We do not collect precise location, biometric data or genetic data, and we do not use geofencing around healthcare facilities.

3. Sources

3.1 We collect consumer health data from you directly, from the healthcare organisation you are communicating with, and from health professionals who refer you to that organisation.

4. Why we collect and use it

4.1 We collect and use consumer health data only as necessary to provide the service you have requested, which is secure communication with the healthcare organisation, including delivering, storing and securing your messages and meeting our legal retention obligations.

4.2 We do not use consumer health data for marketing, advertising or analytics, and we do not use it for any other purpose without your separate consent.

5. Who we share it with

5.1 We share consumer health data only as necessary to provide the service you have requested, with:

(a) the healthcare organisation you are communicating with, and its authorised users;

(b) our processors, which handle it on our behalf under contract: Microsoft Azure (hosting) and our messaging and email delivery providers; and

5.2 We may also disclose consumer health data where required by law, or with your consent.

5.3 We do not sell consumer health data.

6. Your rights

6.1 You have the right to:

(a) confirm whether we collect, share or sell your consumer health data;

(b) access your consumer health data, including a list of all third parties and affiliates we have shared it with and their contact details;

(d) have your consumer health data deleted, including from our processors; and

(e) appeal if we decline your request.

6.2 To exercise these rights, email privacy@foxo.com with "Consumer health data request" in the subject line, your name, and the email address or mobile number you use with Foxo. We will verify your request by confirming control of that email address or mobile number.

6.3 We will respond within 45 days. If we need more time, we may extend by a further 45 days and will tell you why.

6.4 If we decline your request, you may appeal by emailing privacy@foxo.com with "Consumer health data appeal" in the subject line. We will respond within 45 days with our decision and reasons. If you are not satisfied, you may contact the Attorney General of your state.

6.5 Where a healthcare organisation controls the information, we may refer your request to it. Where we must keep information to meet a legal retention obligation, we will tell you and delete it when that obligation ends.

7. Contact us

7.1 Privacy Officer, Foxo Technology Pty Ltd

Email: privacy@foxo.com

Post: 1/10 Albert Avenue, Broadbeach QLD 4218, Australia