TrialX Inc — Mobile Application Privacy Policy

Privacy Policy for FORETELL-Epilepsy

Effective Date: July 30, 2026

At TrialX Inc (“Company,” “we,” “us,” or “our”), we take your privacy seriously. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the FORETELL-Epilepsy mobile application (the “App”) and related research services (“Services”).

FORETELL-Epilepsy is a health research study application used by consented research participants to support epilepsy and seizure-forecasting research. Participants may complete surveys, report symptoms and seizures, connect wearable or health platforms, and share study-related data with authorized researchers for analysis and prediction research. The App is not a substitute for emergency or clinical medical care.

This App-specific policy is consistent with TrialX’s general privacy practices described at https://www.trialx.com/privacy-policy. Where this page and the company policy both apply, this page describes how those practices apply to FORETELL-Epilepsy.

If you have questions about this Privacy Policy or your privacy rights, contact us at MyData@trialx.com.

1. What Information Do We Collect?

We collect personal information depending on how you interact with the App and whether you join a research study. Categories may include:

Personal identifiers & account information

• Name, email address, phone number, and other contact details you provide
• Account credentials, passcode/login settings, and participant profile information
• Push notification tokens used to deliver study reminders and messages

Health & research study information

• Survey and questionnaire responses (for example daily AM/PM surveys, onboarding/profile surveys, stress assessments, and seizure-related questions)
• Self-reported health information such as seizure events, symptoms, medications, menstrual or other wellness details you choose to provide
• Informed consent records, signatures, and related study enrollment documents
• Messages you exchange with the research team through the App
• Optional active research tasks (for example voice, camera, movement, or cognitive tasks), when enabled for your study

Wearable, sensor & device health data

• Data synced from connected health platforms or devices you authorize, which may include Google Fit, Samsung Health, Empatica, or other supported wearables/integrations
• Examples of synced metrics: steps, heart rate, weight, activity, and other device-provided health metrics made available to the study
• Phone sensor data used for research features (for example step counting or activity recognition), when permitted

Location data

• Approximate or precise location, when you grant permission and when required for research or App functionality

Automatically collected technical data

• Device information such as device model, operating system, IP address, app version, and diagnostic/usage events
• Analytics events used to understand App performance and improve the Services

We do not process sensitive personal data unless it is required for the research study and collected with your informed consent (and any other required legal basis).

2. How Do We Use Your Information?

We process personal information for the following purposes:

• Research study operations: enroll participants, manage consent, collect surveys and wearable/sensor data, support study visits/reminders, and enable researchers to analyze data for seizure forecasting and related health research
• Service provision: provide App access, sync authorized device data, deliver notifications, and maintain participant accounts
• Customer & research support: respond to inquiries, troubleshoot issues, and communicate about study participation
• Analytics & improvement: monitor usage patterns and improve App reliability and features using aggregated or analytics data
• Legal compliance & security: comply with applicable laws, research requirements, and protect against fraud, misuse, or security incidents
• Communications: send study-related messages; marketing communications only where permitted and, where required, with your consent

3. What Legal Bases Do We Rely on to Process Your Information?

For individuals in the European Economic Area (EEA), United Kingdom (UK), or similar jurisdictions, we process personal information based on:

• Consent: including explicit consent for health/research data where required
• Contractual necessity: to provide the App and fulfill study-related service commitments
• Legitimate interests: such as securing the Services, improving functionality, and analytics, where not overridden by your rights
• Legal obligations: where processing is necessary to comply with law or regulation

4. Our Role as a Data Controller or Data Processor

• Data Controller: We act as a Data Controller when we collect data for our own purposes (for example App support, security, or certain platform operations) or when we determine the purposes and means of processing.
• Data Processor: We may act as a Data Processor when processing data on behalf of research customers, sponsors, or research sites who are the Data Controllers for a given study.

For FORETELL-Epilepsy research participation, authorized researchers and study teams may access study data you provide through the App in accordance with the informed consent and applicable agreements.

5. Cookies, SDKs, and Tracking Technologies

In the App and related web services, we may use cookies, SDKs, and similar technologies to:

• Remember preferences and keep you signed in
• Deliver notifications and core App functionality
• Collect usage and performance analytics (for example via analytics providers such as Mixpanel)
• Support push messaging (for example Firebase Cloud Messaging)

You can control certain device permissions (location, camera, microphone, activity recognition, health data access) in your device settings. Disabling permissions may limit study features.

6. International Data Transfers

We operate globally. Your personal data may be transferred to and processed in regions outside your home country, including the United States, the European Union, and other jurisdictions. We use appropriate safeguards for cross-border transfers as required by law, such as Standard Contractual Clauses (SCCs) or adequacy decisions, including for EEA, UK, and Switzerland users where applicable.

7. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy, including legal, regulatory, contractual, and research obligations. When data is no longer required, we securely delete or anonymize it.

Clinical and research study data retention periods may vary based on the study protocol, regulatory requirements, sponsor/customer agreements, and your consent choices. Opting out of ongoing participation may stop future collection, but previously collected study data may be retained until the study ends or deletion is permitted under applicable rules.

8. Sharing of Personal Data

We may share personal data with the following categories of recipients:

• Research investigators & study teams: authorized researchers analyzing participant surveys, wearable data, and related study information
• Clinical trial / study sponsors or research sites: where required to fulfill study contracts and protocols
• Subprocessors / service providers: companies that help us operate the App (for example cloud hosting, analytics, messaging, wearable/health data integrations)
• Legal authorities: when required by law or lawful requests
• Business transfers: in connection with a merger, acquisition, or similar corporate transaction

We do not sell personal data. Third parties that process data for us are expected to follow appropriate privacy and security standards.

9. Your Privacy Rights

Depending on your location, you may have rights including:

• Right to access your personal data
• Right to rectification of inaccurate or incomplete data
• Right to erasure, subject to legal and research limitations
• Right to restrict processing
• Right to data portability
• Right to object to certain processing, including direct marketing
• Right to withdraw consent where processing is based on consent

To exercise these rights, contact MyData@trialx.com. We will respond in accordance with applicable laws. Study-specific rights and limitations may also be described in your informed consent form.

10. Children’s Privacy

We do not knowingly collect personal information through the App from individuals under the age of 16 (or a higher age if required by local law) without appropriate consent where legally required. If you believe we have collected such data inappropriately, contact MyData@trialx.com and we will take steps to delete it where required.

11. Security Measures

We use physical, technical, and organizational measures to safeguard information, including encryption where appropriate, access controls based on least privilege, monitoring, and security assessments. No method of transmission or storage is completely secure, but we work to protect your data in line with industry practices for research platforms.

12. California Privacy Rights

If you are a California resident, you may request:

• Information about the categories of personal data we collect, use, and share
• Access to and deletion of personal data, subject to legal exceptions
• To opt out of the “sale” or “sharing” of personal data as defined by California law (we do not sell personal data)

Submit California privacy requests to MyData@trialx.com.

13. Account & Data Deletion

You may request deletion of your App account or personal information by contacting support@trialx.com or MyData@trialx.com, or through in-App opt-out / support options where available.

We will process deletion requests subject to study protocol requirements, legal retention obligations, and applicable privacy laws. Some research records may need to be retained in de-identified or legally required form.

14. Updates to This Privacy Policy

We may update this Privacy Policy periodically. When we do, we will revise the Effective Date above and, where required, provide additional notice of material changes. Please review this page regularly.

15. How to Contact Us

For questions about this Privacy Policy or how we handle personal data for FORETELL-Epilepsy:

• Legal entity: TrialX Inc
• App: FORETELL-Epilepsy (com.appliedinformatics.android.web2rk.prod.epilepsy)
• Privacy email: MyData@trialx.com
• App support: support@trialx.com
• Mailing address: TrialX Inc, 520 White Plains Rd Ste 500, Tarrytown, NY 10591-5118, USA
• Phone: +1 212 537 6944
• Contact form: https://www.trialx.com/contact
• Company privacy policy: https://www.trialx.com/privacy-policy