THALAMUS PRIVACY POLICY

SJ Medconnect, Inc. (hereinafter referred to as “Thalamus,” “us,” “we,” “our,” or “Company”) created this Privacy Policy to apply to users of our websites, including but not limited to this website www.thalamusgme.com and all digital assets contained, or offered therein (“Website”), our applications and platforms, and through any offline activities (collectively, our “Services”), except as described below. If you are a customer or partner of Thalamus (“Customer”), Thalamus may collect personal information as defined under applicable laws from your organization or your organization’s users (“Users”) to the extent that you’ve integrated your application or services with our Services or otherwise provided personal information to Thalamus. This Privacy Policy describes, among other things, the types of information we collect from users when they use our Services, how we use it, and how users can access their information.

This Privacy Policy is integrated into our Terms & Conditions of Use (“Terms & Conditions”).

By using the Services and providing us with your Information (defined below), you acknowledge and agree to the practices described in this Privacy Policy and Terms & Conditions referenced above and to the updates to these policies posted here from time to time.

This Privacy Policy does not apply to information collected by or provided in connection with an individual’s application for employment, current or former employment, or independent contractor arrangement with Thalamus.

I. CONSENT

By using the Services, you consent to the use of your Information or your Users’ Information as described in this Privacy Policy. You may choose not to provide us with the Information listed in this Privacy Policy, but we may not be able to provide the Services to you if you choose to do so.

If you are an End User of one of our Customers and want to learn about how that Customer handles your Information, we encourage you to read the Customer’s privacy policy. This Privacy Policy does not apply to the services that our Customers provide to their Users independently of Services contracted through Thalamus.

II. INFORMATION WE COLLECT ABOUT YOU

We may collect the following categories of information about you which are described in more detail below: (A) information you provide to us, (B) information we may automatically collect, (C) cookies and technologies used to collect information about you, and (D) information we may receive from third parties. To the extent that this information includes “Personal Information” or “Personal Data” as defined under the appliable law, this information is referred to collectively as “Information”. Specifically, Information includes any information relating to an identified or identifiable natural person, who could be identified either directly or indirectly by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

A. Information You Provide to Us

In using our Services, you may provide us with Information, including, without limitation:

· Individual identifiers such as name, username, date of birth;

· Contact information such as mailing address, phone number, and email address;

· Commercial information such as products or services purchased, obtained, or considered;

· Communications with us, preferences, and other Information you provide to us such as any messages, (including via online chat feature), opinions, and feedback that you provide to us, your user preferences (such as in receiving updates or marketing information), and other Information that you share with us when you contact us directly (such as for customer support services);

· Autobiographical information you add to your user profile, including images, video, and other files;

· Data that is personal to your interview and travel planning to enable us to facilitate personal interviews and travel scheduling;

· Application information, such as professional references and educational background;

· Personal financial and billing information;

· Association of American Medical Colleges (“AAMC”) ID number and/or ACGME ID number, or similar educational service identification numbers, including but not limited to SFMatch and NRMP;

· Additional information to facilitate participation in voluntary surveys and to conduct contests in connection with our Services;

· Images, data, graphics, video, or other files you upload to participate in community features, such as forums, and other parts of the Services that enable you to communicate with us or with other users; and

· Additional Information as otherwise described to you at the point of collection or pursuant to your consent.

Sensitive Information. We may need to collect or process Information that is deemed “sensitive information” or “sensitive data” under certain laws. We may process the following categories of sensitive information when you use our Services:

· Geolocation data, such as your physical location if you have enabled location services on your device;

· Authentication data such as account personal information and log in credentials, including unique identifiers such as username, account number, and password;

· Racial or ethnic origin information;

· Social Security number;

· Citizenship and immigration status.

When required by applicable law, Thalamus will collect consent prior to processing certain categories of sensitive Information.

B. Information We May Automatically Collect About You

Our Services may automatically collect the following categories of usage and technical Information about you. This Information is used by Thalamus for the operation of the Services, to maintain quality of the Services, and to provide general statistics regarding use of the Services. This Information may include:

· IP address, which is the number associated with the service through which you access the Internet, like your ISP (internet service provider);

· Date and time of your visit or use of our Services;

· Domain server from which you are using our Services;

· Type of computer, web browsers, search engine used, operating system, or platform you use;

· Data identifying the web pages you visited prior to and after visiting our website or use of our Services;

· Your movement and activity within the website, which is aggregated with other Information, including but not limited to what elements of the Services you use and other users you interact with; and

· Mobile device Information, including the type of device you use, operating system version, and the device identifier (or “UDID”).

C. Cookies & Technologies Used to Collect Information About You

We and/or certain service providers operating on our behalf may collect information about your activity, or activity on devices associated with you over time, on our sites and applications, and across non-affiliated websites or online applications.

We may collect this Information by using certain technologies, such as cookies, web beacons, pixels, software developer kits, third party libraries, and other similar technologies. Third-party service providers, advertisers, and/or partners may also view, edit, or set their own cookies or place web beacons.

· Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting, you may be unable to access certain parts of our Services. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our website.

· Web Beacons. Website pages may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited those pages and for other related statistics (for example, recording the popularity of certain content and verifying system and server integrity). We also use these technical methods to analyze the traffic patterns, such as the frequency with which our users visit various parts of the Services. These technical methods may involve the transmission of Information either directly to us or to a third party authorized by us to collect Information on our behalf. Our Services use retargeting pixels from Google, Facebook, and other ad networks. We also use web beacons in HTML emails that we send to determine whether the recipients have opened those emails and/or clicked on links in those emails.

· Analytics and Fraud Detection. Analytics are tools we may use, such as Google Analytics, to help provide us with information about traffic to our website and use of our Services, which Google may share with other services and websites who use the collected data to contextualize and personalize the ads of its own advertising network. We may also use reCAPTCHA, a tool which utilizes advanced risk analysis techniques to distinguish humans and bots in order to help us protect our websites from fraud, spam, and abuse. You can view Google’s Privacy Practices here: Privacy Policy – Privacy & Terms – Google.

· Mobile Application Technologies. If you access our Services through our mobile application, we may automatically collect Information about your device, your phone number, and your physical location.

D. Information We May Receive from Third Parties

We may collect additional Information about you from third-party websites, social media platforms and/or sources providing publicly available information (e.g., from the U.S. postal service) to help us provide the Services to you, to manage your account, to maintain our customer/visitors lists, to provide feedback, for authentication purposes, for service improvement, to provide updates and announcements, to help prevent fraud, and for marketing and advertising purposes.

This Privacy Policy only applies to Information collected by our Services. We are not responsible for the privacy and security practices of those other websites or Social Media Platforms or the Information they may collect (which may include IP address). You should contact such third parties directly to determine their respective privacy policies. Links to any other websites or content do not constitute or imply an endorsement or recommendation by us of the linked website, Social Media Platform, and/or content. As you are using our Services, you may click through certain links or promotions that will enable you to purchase products or use services provided by promotional partners or other sites or commerce providers. Some of those entities may share with us certain information that you provide to them.

Further, as part of their use of the Services, and subject to the administrator’s determination that such data sharing is permitted under the third party’s terms of use, administrators of residency programs may pull applicant data directly from third parties that they have access to, including ERAS and ACGME, and provide this Information to Thalamus. We may also receive Information from the AAMC.

You may also separately provide Information to websites, retailers or other commerce, product, or service providers through which we provide access to register for our Service. Depending on the particular promotion, when you register for the Service through such a promotional partner of ours, that partner may provide us with a user/member name that you already use with that partner’s products or services or that you or it have otherwise pre-selected as part of the promotion.

III. HOW WE USE YOUR INFORMATION

A. Use and Purpose of Processing Your Information

We use and process your Information for things that may include, but are not limited to, the following:

· To provide you with the Services and Information you request;

· To manage your account;

· To respond to your inquiries and questions and provide customer service;

· For quality control, service improvement, research, analysis, and development of new or related products and services;

· For general or targeted marketing and advertising purposes, including sending you promotional material or special offers on our behalf or on behalf of our marketing partners and/or their respective affiliates and subsidiaries and other third parties, provided that you have not already opted-out of receiving such communications;

· To fulfill contracts we have with you;

· To manage, improve, and foster relationships with third-party service providers, including vendors, suppliers, and parents, affiliates, subsidiaries, and business partners;

· Maintain, improve, customize, or administer the Services, perform business analyses, or other internal purposes to improve the quality of our business, the Services, resolve technical problems, or improve security or develop other products and services;

· Comply with our Terms and Conditions;

· Analytics for business purposes and business intelligence;

· Comply with any applicable laws and regulations and respond to lawful requests; and/or

· For any other purposes disclosed to you at the time we collect your Information and/or pursuant to your consent.

We may also use Information we receive from partners such as the AAMC to provide Services to you and for data analysis and research that we share with Users and the general public. In addition, to the extent permitted under relevant agreements, we may use Information received from partners for improvements to products or the Services, as well as the development of future products or services.

Additionally, we may provide your Information to our partners in order to provide Users with selected retail and other types of offers. In addition to marketing and advertising, our partners may use your data for services that include but are not limited to, verification, validation, reference, lookup, risk mitigation and data enhancement (collectively, these are known as “Permitted Partner Uses”). We may also use your personal contact information to contact you to further discuss your interest in the Service, to send you information about us or our partners, to identify your company/organization as a customer, and to use your company/organization’s name and/or logo on our website and in our marketing materials. For our internal purposes, we may retain logs of all comments or messages that you post or send through our Services or via any partner or customer facilities. All information you send or post to areas of the Services are public or semi-public (such as message boards accessible to all Services Users) will be publicly available.

We may also use Information that has been de-identified and/or aggregated for purposes not otherwise listed above.

B. Disclosing Your Information

We may disclose your Information as set forth in the Privacy Policy and in the following circumstances:

· Third-Party Service Providers. We may disclose your Information to third-party service providers that perform certain functions or services on our behalf (such as to host the Services, manage databases, perform analyses, process credit card payments, provide customer service, or send communications for us). These third-party service providers are authorized to use your Information only as necessary to provide these services to us. In some instances, we may aggregate Information we collect so third parties do not have access to your identifiable Information to identify you individually.

· Analytics Information. We sometimes utilize third party service providers to help us track analytics information. We may disclose this Information to track an individual End User’s movement and use of the Services. Such data may be stored and analyzed for purposes of internal analysis by Thalamus. We may work with advertisers and other third parties whose products or services are promoted on our Services that may also use similar technologies.

· Survey Data. Any Personal Information collected via survey will be used only by Thalamus unless we specify otherwise when we ask you to participate in a survey. However, we may share aggregate survey or contest result information with third parties.

· Partner Organizations. We may provide certain Information to our partners, including partner organizations to perform data analysis and product development or improvement; and for research, which may involve collaborators, contractors, and other partner organizations subject to agreement with participating researchers and confidentiality restrictions.

· Disclosure of Information for Legal and Administrative Reasons. We may disclose your Information without notice: (i) when required by law or to comply with a court order, subpoena, search warrant, or other legal process; (ii) to cooperate or undertake an internal or external investigation or audit; (iii) to comply with legal, regulatory, or administrative requirements of governmental authorities (including, without limitation, requests from the governmental agency authorities to view your Information); (iv) to protect and defend the rights, property, or safety of us, our subsidiaries and affiliates, and any of their officers, directors, employees, attorneys, agents, contractors, and partners, and the website Service users; (v) to enforce or apply our Terms of Use; and (vi) to verify the identity of the user of our Services.

· Business Transfers. Your Information may be transferred, sold, or otherwise conveyed (“Conveyed”) to a third party where we: (i) merge with or are acquired by another business entity; (ii) sell all or substantially all of our assets; (iii) are adjudicated bankrupt; or (iv) are liquidated or otherwise reorganize.

· Information Shared with our Subsidiaries and Affiliates. We may share your Information with our subsidiaries and affiliates.

· De-Identified or Aggregated Data. We may share your Information on an aggregated basis for any purpose, including but not limited to for research purposes which may involve collaborators and contractors, in which your specific Information is blinded, masked, or otherwise not identifiable.

· With Your Consent. We may disclose Information consistent with this Privacy Policy with your consent.

C. Use and Disclosure of Sensitive Information

We do not collect, use, or disclose sensitive Information beyond the purposes authorized by the applicable law. Accordingly, we only use and disclose sensitive Information as reasonably necessary and proportionate: (i) to perform our services requested by you; (ii) to help ensure security and integrity, including to prevent, detect, and investigate security incidents; (iii) to detect, prevent and respond to malicious, fraudulent, deceptive, or illegal conduct; (iv) to verify or maintain the quality and safety of our services; (v) for compliance with our legal obligations; (vi) with our service providers who perform services on our behalf; and (vii) for purposes other than inferring characteristics about you.

IV. LINKS TO OTHER WEBSITES

Our Services may contain links to other websites or services that are not owned or controlled by us, including links to Social Media Platforms such as Facebook, Instagram, or YouTube, or may redirect you off our website away from our Services.

V. INFORMATION SECURITY

We use commercially reasonable and appropriate administrative, physical, and technical security measures to provide our Services and safeguard your information. However, no data transmitted over the Internet or stored or maintained by us or our third-party service providers can be 100% secure. Therefore, we do not promise or guarantee, and you should not expect, that your Information or private communications will always remain private or secure. We do not guarantee that your Information will not be misused by third parties. We are not responsible for the circumvention of any privacy settings or security features. You agree that we will not have any liability for misuse, access, acquisition, deletion, or disclosure of your Information.

You are also responsible for helping to protect the security of your Information. For instance, you should never share your password or other personal credentials when you are using the Services. Furthermore, you are responsible for maintaining the security of any computer, laptop, phone, tablet or other device on which you utilize the Service.

If you believe that your Information has been accessed or acquired by an unauthorized person, you should promptly Contact Us so that necessary measures can quickly be taken.

VI. DATA RETENTION

We will retain your Information for as long as needed to provide you Services, and as necessary to comply with our legal obligations, resolve disputes, and enforce our policies. We will retain and use your Information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. In accordance with our routine record keeping, we may delete certain records that contain Information you have submitted to us. We are under no obligation to store such Information indefinitely and disclaim any liability arising out of, or related to, the destruction of such Information.

VII. YOUR CHOICES

A. Marketing Communications. If you do not want to receive marketing and promotional emails from us, you may click on the “unsubscribe” link in the email to unsubscribe and opt-out of marketing email communications or see how to Contact Us below for more information.

B. Text Messages. You may sign up to receive text messages from Thalamus or third-party service providers on behalf of Thalamus (e.g., text message marketing). By using our Services, signing up for text messaging services or otherwise opting in to receive text messages (opting in via short code or entering your phone number into an on-site collection widget), you agree that you have provided Thalamus or its third-party service providers with prior express written consent to be contacted by text message, including recurring automated promotional and personalized marketing text messages.

a. By providing prior express and/or prior express written consent, you agree to receive text messages under the Telephone Consumer Protection Act and related state laws, including by the use of an automatic telephone dialing system (“ATDS”) to deliver text messages to the mobile phone number which you provided to Thalamus While you consent to receive messages sent using an ATDS (or “autodialer”), the foregoing shall not be interpreted to suggest or imply that any or all of Thalamus mobile messages are sent using an autodialer. We will use the Information provided by you in connection with the text messaging services in accordance with this Privacy Policy. Your consent is not a condition of any purchase or use of our Services and your consent to be contacted as described is voluntary. The number of text messages you receive may vary based upon the text messaging service(s) you sign up for. Message and data rates may apply.

b. You may revoke your consent and opt out to discontinue text messages at any time. If you no longer want to receive text messages from us, reply STOP (or as otherwise instructed).

C. Opting Out of Direct Marketing by Third Parties. To exercise choices regarding the marketing information you receive, you may also review the following links:

· You may opt-out of tracking and receiving tailored advertisements on your mobile device by some mobile advertising companies and other similar entities by downloading the App Choices app at www.aboutads.info/appchoices.

· You may opt-out of receiving permissible targeted advertisements by using the NAI Opt-out tool available at http://optout.networkadvertising.org/?c=1 or visiting About Ads at http://optout.aboutads.info.

· You can opt-out of having your activity on our Services made available to Google Analytics by installing the Google Analytics opt-out add-on for your web browser by visiting: https://tools.google.com/dlpage/gaoptout for your web browser.

VIII. NOTICE OF PRIVACY RIGHTS FOR RESIDENTS OF CERTAIN U.S. STATES

Residents of certain U.S. states may have rights and choices regarding their Information. To the extent any data protection law applies to our collection of your Information, this supplemental section of our Privacy Policy outlines the individual rights you may be entitled to and how to exercise those rights.

Depending on where you live and subject to certain exceptions, you may have some or all of the following rights.

· Right to Know and Access. You may have the right to request that we confirm whether we process your Information, and to request information about our collection and use of your Information. You may also have the right to request access to Information we may process about you.

· Right to Data Portability. Where the processing is carried out by automated means, and subject to certain exceptions, you may have the right to request and obtain a copy of your Information that you previously provided to us in a portable format. In addition, to the extent technically feasible, you may have the right to obtain your Information in a readily usable format that allows you to transmit the Information to another data controller without hindrance.

· Right to request Correction of Inaccurate Information. To the extent that we may maintain inaccurate Information, you may have the right to request that we correct such inaccurate Information, taking into account the nature of the Information and the purposes of the processing of the Information.

· Right to Request Deletion. You may have the right to request that we delete certain Information or records provided by or obtained about you, with certain exceptions and limitations as allowed under law.

· Right to Opt-Out of the use of Information for Targeted Advertising and Profiling. You may have the right to opt out of the processing of your Information for purposes of targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. We do not use your Information for targeted advertising or profiling purposes.

· Right to Limit Use and Disclosure of Sensitive Information. You may have the right to request that we limit the ways we use and disclose your sensitive Information to uses which are necessary for us to perform the Services, or deliver the goods reasonably expected by you, or and as authorized by law. As noted elsewhere we do not use or disclose your sensitive information other than for the permitted business purposes outlined above.

· Right to Non-Discrimination. You may have a right to not be discriminated against in the Services or quality of Services you receive from us for exercising your rights. We will not discriminate against you for exercising any of your rights in this section including denying goods or Services, charging different prices or rates for goods or Services, or providing a different level of quality of goods and Services.

· Right to Disclosure of Direct Marketers. You may have a right to know the categories and names/addresses of third parties that have received Information for their direct marketing purposes upon simple request, and free of charge.

· Right to Appeal. You may have the right to appeal our denial of any request you make under this section. To exercise your right to appeal, please submit an appeal request via the information in the Contact Us section below. Within the certain timeframe of receipt of your appeal, as proscribed by the applicable law we will inform you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for the decisions. If we deny your appeal, you may contact the Attorney General or another authority which we will help you identify.

To learn more about whether you are guaranteed certain rights, or to submit a request to exercise your rights, please contact us using any of the methods in the Contact Us section.

IX. EXERCISING YOUR DATA SUBJECT RIGHTS

To exercise any of the rights described above, please submit a verifiable consumer request to us via the methods described below. The verifiable consumer request must:

· Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Information, or an authorized representative; and

· Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

To help protect your privacy and maintain security, if you request access to or deletion of your Information, we will take steps and may require you to provide certain information to verify your identity before granting you access to your Information or complying with your request. In addition, if you ask us to provide you with specific pieces of Information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose Information is the subject of the request.

If permitted by the applicable data protection law, you may use an authorized agent to submit requests on your behalf provided that the authorized agent is a natural person or a business entity that you have authorized to act on your behalf. If you use an authorized agent, we will require: (1) proof of written permission for the authorized agent to make requests on your behalf, and identity verification from you; or (2) proof of power of attorney pursuant under applicable law. Only you or your authorized agent may make a verifiable consumer request related to your Information. We may deny a request from an authorized agent that does not submit proper verification proof. You may also make a verifiable consumer request on behalf of your minor child.

Email us: privacy@thalamusgme.com

Write us: SJ Medconnect, Inc.

77 Alviso Street

Santa Clara, CA 95050

Submit a data subject request by emailing us at privacy@thalamusgme.com

X. GEOGRAPHIC LOCATION OF DATA STORAGE AND PROCESSING

Our Services are targeted to individuals located inside and outside the United States, and we maintain significant operations in the United States. As such, the Services collect Information and process and store that Information in databases located in the United States. If you are visiting the Services from a country outside the United States, you should be aware that you may transfer personally identifiable Information about yourself to the United States, and that the data protection laws of the United States may not be as comprehensive as those in your own country. By visiting the Services and submitting any personally identifiable Information you consent to the transfer of such personally identifiable Information to the United States.

XI. CHILDREN’S INFORMATION

The Services are intended only for users over the age of sixteen (16). If we become aware that a user is under sixteen (16) (or a higher age threshold where applicable) and has provided us with Information, we will take steps to comply with any applicable legal requirement to remove such Information. Contact us if you believe that we have mistakenly or unintentionally collected Information from a child under the age of sixteen (16 ).

XII. DIFFICULTY ACCESSING OUR PRIVACY POLICY

Individuals with disabilities who are unable to usefully access our Privacy Policy online may contact us to inquire how they can obtain a copy of our policy in another, more easily readable format.

XIII. “DO NOT TRACK” SIGNALS

We do not support “Do Not Track.” Do Not Track is a preference you can set in your web browser to inform websites that you do not want to be tracked. You can enable or disable “Do Not Track” by visiting the “Preferences” or “Settings” page of your web browser. Do Not Track is different from Global Privacy Controls (“GPC”), which may notify websites of consumers’ privacy preferences regarding the sale or sharing of Information, or the use of sensitive personal Information.

XIV. CHANGES TO THIS PRIVACY POLICY

We reserve the right to change, modify or amend this Privacy Policy at any time to reflect changes in our products and service offerings, accommodate new technologies, regulatory requirements, or other purposes. If we modify our Privacy Policy, we will update the “Effective Date” and such changes will be effective upon posting. It is your obligation to check our current Privacy Policy for any changes.

XV. CONTACT US

If you have any questions about this Privacy Policy or the Information we have collected about you, please contact us at the following: