EN-VISION AMERICA, INC.
PRIVACY POLICY

1. Information Collected

EVA collects information in three categories: information you provide to us directly, information collected automatically when you use the app, and information EVA receives from third parties in connection with the services.

a. Information You Provide Directly

When you register for an account, contact customer support, or otherwise interact with the app, you may provide us with the following personal information:

1. Name — used to identify your account and personalize communications.
2. Email address — used to create and authenticate your account, send service-related notices (such as account confirmations, security alerts, and updates to this policy), respond to support inquiries, and, where you have opted in, send product communications.
3. Phone number — used to contact you about your account, to deliver SMS-based notifications or one-time passcodes where you have enabled them, and to assist customer support in verifying your identity.

b. Information Collected Automatically

When you install, open, or use the app, EVA and EVA’s service providers automatically collect certain device and technical information, including:

1. Device type — the make and model of the mobile device on which the App is installed.
2. Operating system — the operating system and version running on your device.
3. IP address — the internet protocol address assigned to your device, which EVA uses for security, fraud prevention, troubleshooting, and approximate (city- or region-level) geolocation. EVA does not collect precise GPS location through the App unless you explicitly enable a feature that requires it.
4. App version — the version of the App installed on your device, used for compatibility, support, and to identify which users are affected by a particular issue or update.
5. Device identifiers — such as advertising identifiers (IDFA on iOS, AAID on Android) and similar resettable identifiers, where permitted by the device operating system and consistent with your platform-level privacy settings.

EVA also automatically collects information about how you interact with the App, referred to as usage information:

6. Features accessed — the screens, buttons, and functions you use within the app, the order in which you use them, and the time spent on each.
7. App activity logs — records of in-app events such as logins, searches, settings changes, and similar actions, used to operate and improve the service and to detect misuse.
8. Crash reports — diagnostic information generated when the App encounters an error or unexpected termination, including the state of the App at the time of the crash, the device configuration, and a stack trace. Crash reports help us identify and fix bugs.
9. Analytics data — aggregated and event-level metrics about App performance and user engagement, collected through analytics service providers. Where required by law or by the device operating system, EVA obtain your consent before enabling analytics that involve tracking across other apps or services.

c. Information From Third Parties

EVA may also receive information about you from third parties, such as authentication providers if you choose to sign in using a third-party account, app stores in connection with installation and purchases, and service providers that assist with security and fraud prevention. The information EVA receives is limited to what is necessary for the related purpose and is handled in accordance with this Policy.

d. Information Not Collected

EVA does not collect Social Security numbers, government-issued identification numbers, financial account numbers, payment card numbers, or precise real-time geolocation through the app. EVA does not collect protected health information except as described in any separate notice provided to users in connection with pharmacy-related features, and any such collection is governed by applicable law including HIPAA where it applies.

2. Sharing and Disclosure

EVA does not rent, trade, or otherwise disclose your personal information to third parties in exchange for monetary or other valuable consideration. EVA also does not share your personal information for cross-context behavioral advertising (sometimes called "targeted advertising") as those terms are defined under the California Consumer Privacy Act, the Florida Digital Bill of Rights, and similar state privacy laws. EVA shares information only in the limited circumstances described below:

1. With Service Providers. EVA shares information with third parties that perform services on EVA’s behalf, including cloud hosting, analytics, crash reporting, customer support, communications delivery, and security and fraud prevention. Each service provider is bound by a written contract that limits its use of the information to the services it provides to us and prohibits it from selling the information or using it for its own purposes.
2. When Required by Law. EVA may disclose information in response to a subpoena, court order, warrant, or other valid legal process, or when required by law, regulation, or governmental request.
3. To Protect Legal Rights and Safety. EVA may disclose information when EVA reasonably believes it is necessary to enforce the terms of this Policy, investigate fraud or abuse, protect the rights, property, or safety of En-Vision America, ScripTalk users, or the public, or establish or defend legal claims.
4. In Connection with a Business Transaction. If EVA is involved in a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, personal information may be transferred to the successor or acquiring entity as part of that transaction. EVA will require the recipient to honor the commitments made in this Policy or provide notice and choice to affected users where required by law.
5. With Your Consent. EVA may share personal information with other parties when you direct us to do so or otherwise consent to the sharing — for example, when you choose to connect a third-party service to the app.
6. Aggregated and De-Identified Information. EVA may share aggregated or de-identified information that cannot reasonably be used to identify you. Where EVA shares de-identified information, EVA contractually requires recipients not to attempt to re-identify it, consistent with state privacy law requirements.

3. Third-Party Services and SDKs

The App uses third-party services and software development kits (SDKs) to operate, monitor performance, and improve the user experience. These services may collect or process information about your use of the app, your device, and your interactions, subject to their own privacy practices. The principal categories of third-party services EVA use are:

1. Analytics. EVA uses Google Firebase Analytics to collect data about how users interact with the app, including features accessed, session duration, App version, device type, operating system, and approximate location derived from IP address.
2. Crash Reporting. EVA uses crash reporting tools to capture diagnostic information when the App encounters an error, including a stack trace, device model, operating system, and App version. This helps us identify and fix bugs.
3. Cloud Hosting. EVA uses cloud hosting providers to store and process the data that supports the app. These providers function as service providers under EVA’s contractual control and do not use the information for their own purposes.

4. Data Retention

EVA retains personal information only for as long as necessary to provide the services you have requested, to operate and improve the app, and to comply with EVA’s legal, regulatory, and contractual obligations. When information is no longer needed for these purposes, EVA delete it or de-identify it so that it can no longer reasonably be associated with you.

a. Retention Period

EVA does not apply a single retention period to all data. Instead, EVA determines how long to keep each category of information based on:

1. The purpose for which the information was collected and whether that purpose remains active (for example, whether you still have an account with EVA);
2. The nature and sensitivity of the information, with more sensitive data retained for shorter periods where practical;
3. Legal and regulatory requirements, including record-keeping obligations under tax, accounting, consumer protection, and health-information laws (such as HIPAA, where applicable);
4. The need to establish, exercise, or defend legal claims, including applicable statutes of limitations; and
5. Legitimate operational needs, such as security, fraud prevention, audit, and dispute resolution.

b. Retention Practices

1. Account information (such as name, email address, and phone number) is retained for as long as your account is active and for a reasonable period afterward to allow for account reactivation, dispute resolution, and compliance with legal obligations.
2. Usage and analytics data is typically retained in identifiable form for a limited period and is thereafter aggregated or de-identified for ongoing analysis.
3. Crash reports and diagnostic data are retained only as long as needed to investigate and resolve the underlying issue.
4. Customer support records are retained for a reasonable period after the matter is resolved to allow for follow-up and quality assurance.
5. Records required by law (such as transaction records, tax records, or records required by health-information regulations) are retained for the period required by the applicable law.

c. Request for Deletion

You may request deletion of your personal information at any time, as described in the section on your rights and choices. Where you make such a request, EVA will delete the information unless EVA is required or permitted by law to retain it — for example, to comply with a legal obligation, to complete a transaction you requested, to detect or prevent fraud, or to establish or defend legal claims. Where EVA cannot delete information, EVA will restrict its use to those purposes and delete it when the basis for retention no longer applies. To request access, amend, withdraw consent, or delete your personal data, contact us at support@scriptability.com.

d. Backup Copies

Information may persist in routine system backups for a limited period after deletion from active systems. Backup copies are protected by the same security measures as active data and are overwritten or deleted on EVA’s standard backup cycle.

6. Security Measures

EVA implements administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, loss, and destruction. EVA’s security program is intended to be appropriate to the sensitivity of the information EVA handle and is reviewed and updated periodically. Where appropriate to the information involved, EVA’s measures include: (a) encryption of personal information in transit and, for sensitive information, at rest; (b) access controls that limit access to authorized personnel who need it for their job functions; (c) network and infrastructure security, including firewalls and segregation of production systems; (d) vendor management, including written agreements requiring service providers to maintain appropriate security measures, and HIPAA business associate agreements where applicable; (e) personnel practices, including confidentiality obligations and training; (f) monitoring and testing of EVA’s security controls; and (g) incident response procedures for identifying and responding to suspected security incidents.

7. Children’s Privacy

The App is intended for a general audience and is not directed to children under 13. Consistent with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506, and 16 C.F.R. Part 312, EVA does not knowingly collect personal information from children under 13. If EVA learns that EVA has collected information from a child under 13 without verified parental consent, EVA will delete it promptly.

If you believe your child under 13 has provided personal information to us, please contact us at support@scriptability.com. You may request that EVA (i) review the information collected, (ii) delete it, and (iii) stop any further collection. EVA may ask for reasonable verification before acting on the request. Personal information of users ages 13 to 17 may be subject to additional protection under state laws. EVA honor those rights where they apply.

8. International Data Transfers

The information EVA collects is processed and stored in the United States. If you access the App from outside the United States, please be aware that your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your country of residence.

9. Platform-Specific Disclosures

The App is distributed through third-party platforms, including the Apple App Store and Google Play. In connection with that distribution, EVA provides additional privacy disclosures required by each platform:

• Apple App Store — The App Privacy Information (sometimes called the "Privacy Nutrition Label") is available on the app's listing page in the App Store. It summarizes the categories of data collected by the App and EVA’s service providers, and whether that data is linked to your identity or used to track you across other apps and websites.
• Google Play — EVA’s Data Safety disclosures are available on the app's listing page in the Google Play Store. They describe the categories of data the App collects and shares, the purposes for which it is used, and the security practices that apply.

EVA works to keep these platform disclosures consistent with this Policy. If you notice a discrepancy, this Policy controls, and EVA encourages you to contact us so EVA can review and correct any inconsistency.

These platforms also collect information about your device and your use of the App in accordance with their own privacy policies, which are independent of ours:

• Apple: https://www.apple.com/legal/privacy/
• Google: https://policies.google.com/privacy

10. Modifications

EVA may update this Policy from time to time to reflect changes in EVA’s practices, the services EVA offer, or applicable legal requirements. When EVA makes changes, EVA will revise the "Effective Date" at the top of this policy and post the updated version in the App and on EVA’s website. If EVA make a material change EVA will provide additional notice before the change takes effect. Your continued use of the App after the effective date of an updated Policy constitutes your acknowledgment of the updated policy, except where applicable law requires separate consent. If you would like a copy of a prior version of this Policy, please contact us using the information provided in the "Contact Information" section.

11. Contact Information

EVA will respond to your inquiry within a reasonable time and, where applicable law requires a response within a specific period, within the time required by law.