Cure Gate LLC — Privacy Notice

This Privacy Notice explains how Cure Gate LLC collects, uses, discloses, retains, and protects information when a person uses the Platform. It should be read with the Terms of Use. This Notice applies to United States Platform operations and is subject to applicable law, contract, and authorized workflow requirements.

Depending on the feature selected, Cure Gate LLC may collect account and contact information, organization information, communications, technical and security information, and information voluntarily submitted for an authorized workflow. A workflow may include health-related information only where Cure Gate LLC has made that workflow available, the submitting person is authorized to provide the information, and applicable requirements are met. Cure Gate LLC does not require a person to submit more information than is reasonably necessary for an available workflow. Users should not submit information that is not requested or that they are not authorized to provide.

Cure Gate LLC may use information to provide available Platform functions; verify access; maintain security, auditability, and integrity; respond to support requests; measure whether our advertising works, as described in Cookies and advertising tags; comply with legal and contractual obligations; investigate misuse; and improve Platform reliability. Limited automated tools may be used for administrative integrity and precheck functions subject to the boundaries in the Terms. Cure Gate LLC does not use an automated tool to make a diagnosis, treatment decision, clinical eligibility determination, enrollment decision, or independent sensitive-information release.

Cure Gate LLC does not sell personal information. It may disclose information when authorized or required by applicable law, consent, contract, or an activated controlled workflow; to service providers operating under appropriate obligations; to protect security or safety; or to comply with lawful process. Our website also sends limited information to Google and Meta through advertising tags, as described in Cookies and advertising tags. That information does not include health information. Cure Gate LLC does not currently authorize automatic public profile release, automatic external referral, or automatic provider delivery. Cure Gate LLC does not message research sites, sponsors, or CROs without clinician approval. Patient text messages are sent only after the patient opts in, as described in Text messaging. A future disclosure workflow to a research site, sponsor, CRO, provider, or other third party will require applicable authorization, agreement, and technical controls before disclosure.

Cure Gate LLC uses administrative, technical, and organizational safeguards designed to protect information. No security program can guarantee absolute security. Cure Gate LLC limits direct access to protected workflow data and uses role-based and service-mediated controls for sensitive operations. Cure Gate LLC does not represent a specific security certification, encryption configuration, HIPAA status, audit cadence, or training program unless that statement is current, documented, and separately approved for public use.

Cure Gate LLC retains information for the period determined by applicable law, contract, documented operational need, and an approved retention schedule. Automated retention enforcement and purge functions are not enabled merely by this Notice. Information may be preserved when required for legal hold, security, safety, audit, dispute, or compliance purposes.

Individuals may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or information about disclosures, depending on applicable law and their relationship to Cure Gate LLC. Requests may be sent to info@curegate.ai. Cure Gate LLC will evaluate requests under applicable law, contract, security obligations, and any legal hold, and may verify identity and authority before acting.

We use cookies and similar browser storage that the Platform needs to work, stay secure, remember your session, and fix problems. We also keep our own visit counts, such as which campaign link brought a visitor to the site. That information stays with us. We advertise on Google and Meta (Facebook and Instagram). To learn whether those ads work, we use two advertising tags: the Google Ads tag and the Meta pixel. This section explains what they collect, where they run, and how you can turn them off. What the tags collect • Cookies and identifiers. The tags can set or read the ad company's cookies or similar identifiers for your browser. Google and Meta also receive the basic information every website request includes, such as your IP address and browser type. • Page address. The Google Ads tag gets a shortened address of the page: the website and page path only (for example, curegate.ai/terms). It also gets the Google ad click ID and general campaign labels from the link you followed. Search keywords, and campaign labels that name a condition, biomarker, or treatment, are removed before anything is sent. Google gets "CureGate" as the page title. The Meta pixel runs in a separate, sealed-off frame, so it never sees the address or title of the page you are on. Meta always gets the same neutral address (curegate.ai/px.html). • Conversion events. An event is a short label saying that a general step happened. Google Ads gets "Aria call request" after a call request goes through, and "Quick check started" when someone starts the quick check. The Meta pixel gets only these event names: PageView, QuickScreenStart, QuickScreenComplete, CallbackRequested, Lead, and CompleteRegistration. What the tags do not get We do not share health information with Google, Meta, or any other ad platform. The events above contain no answers, no condition or diagnosis, no biomarker or test results, no records, and no name, email address, or phone number. Google's "enhanced conversions" is turned off, so we do not send Google contact details, not even in coded (hashed) form. The Meta pixel's automatic data collection is turned off, so it does not read buttons, page details, or form fields. Because CureGate is a clinical trial service, Google or Meta can tell that a browser visited CureGate and completed one of these general steps. Where the tags run • Google Ads tag: only on these general pages: the homepage, About Us and Contact Us, the referral pages, this Privacy Notice, and the Terms of Use. It does not run on condition or biomarker pages (including the cancer quick check at curegate.ai/start/cancer), the Aria page, clinical trial pages, the patient dashboard, the records upload page, registration, or results. • Meta pixel: only on the same general pages as the Google Ads tag, listed above, except the referral pages: the homepage, the general cancer quick check, About Us and Contact Us, this Privacy Notice, and the Terms of Use. On those pages it runs only inside the sealed-off frame described above. That frame cannot see the page address, page title, anything you type or upload, or our cookies. The Meta pixel does not run, not even inside that frame, on condition or biomarker pages (including the quick check pages for a specific cancer type), clinical trial pages, the referral pages, the patient dashboard, the records upload page, registration, results, or staff pages. Ad clicks If you arrive by clicking a Google ad, we save the ad click ID in your browser for up to 90 days. This lets us connect the ad click to a later step on the site. Saving it does not send anything to Google. No remarketing We do not use these tags for remarketing (retargeting). That means we do not build lists of visitors to show them our ads later as they browse elsewhere. Ad personalization is turned off in our Google Ads tag. We do not target ads based on health information or create lookalike audiences from visitor data. Your choices • Global Privacy Control and Do Not Track: if your browser sends either signal, we do not load the Google Ads tag or the Meta pixel, and we do not save the Google ad click ID. • Browser controls: you can block or delete cookies, or block third-party cookies, in your browser settings. Browser privacy features and tracker blockers also limit both tags. • Google: you can manage or turn off personalized ads at Google's My Ad Center (adssettings.google.com). • Meta: you can manage ad preferences and your activity off Meta technologies in your Facebook or Instagram settings (Accounts Center). Turning off these tags does not affect your use of CureGate.

The Platform is not intended for use by children except where an authorized representative and applicable law permit a controlled workflow. The Platform is operated in the United States. Individuals outside the United States should not submit information unless an applicable authorized workflow and legal basis permits it.

Program name: CureGate Patient Updates, operated by Cure Gate LLC. If you opt in, Cure Gate LLC (CureGate), which operates the CureGate / HopeFirst platform, may send transactional text messages for the purposes you choose. On patient registration there are three separate, optional checkboxes, and we text you only for the purposes you check: (1) clinical trial match requests, (2) case updates, and (3) appointment and callback reminders. We may also text a shareable summary you asked to forward, or about an unfinished registration, if you opted in to those. Your choice is recorded separately for each purpose. These messages are not marketing. Message frequency varies. Message and data rates may apply. Reply STOP to opt out and HELP for help. Consent is not a condition of using CureGate. Mobile numbers and SMS opt-in data are not shared with third parties or affiliates for marketing or promotional purposes. Mobile numbers and opt-in data are not shared with third parties for marketing. Twilio is a service provider that delivers these text messages for Cure Gate LLC. Opt-in and opt-out records, including the mobile number, timestamp, text version, page URL, source, and consent text, are retained for as long as needed to honor your choice, document consent, and meet legal and carrier requirements. Sending number: texts are sent from toll-free +1 (855) 606-1679 (CureGate Patient Updates). Support: text HELP to +1 (855) 606-1679 or email info@curegate.ai. Cure Gate LLC, Los Angeles, CA.

Cure Gate LLC may update this Privacy Notice when its practices, legal obligations, or Platform functions change. An updated version and effective date will be published, and required notice will be provided. Cure Gate LLC is a California limited liability company (California Secretary of State No. B20260351772) based in Los Angeles, CA. For privacy questions or requests, contact info@curegate.ai.