Privacy Policy

METAT8 LLC

IMPORTANT NOTICE REGARDING PROTECTED HEALTH INFORMATION

METAT8 LLC operates as a technology platform. Where METAT8 creates, receives, maintains, or transmits Protected Health Information ("PHI") on behalf of a Covered Entity (as defined under HIPAA, 45 C.F.R. § 160.103), METAT8 functions as a Business Associate and such processing is governed by a separate Business Associate Agreement ("BAA"). This Privacy Policy does not supersede, modify, or limit any BAA in effect between METAT8 and a Covered Entity partner. In the event of a conflict between this Privacy Policy and an executed BAA, the BAA controls with respect to PHI.

This Privacy Policy does not constitute legal advice and does not create an attorney-client relationship.

1. Scope and Applicability

This Privacy Policy (the "Policy") governs the collection, use, disclosure, retention, and protection of personal information and, where applicable, Protected Health Information by METAT8 LLC ("METAT8," "we," "us," or "our") in connection with the following products and services (collectively, the "Services"):

• METAT8 mobile and web application ("App")
• METAT8 clinical and administrative dashboard ("Dashboard")
• METAT8 public-facing website ("Website")

METAT8 provides Services across two operational tracks:

Privacy protections described in this Policy apply equally across both tracks. Where additional or differentiated obligations apply to a specific track, they are identified explicitly.

2. Foundational Privacy Principles

METAT8 is designed around the following privacy commitments, which inform every product decision, data architecture choice, and third-party relationship:

• Data Minimization: We collect only the information necessary to provide the Services and fulfill our legal obligations. We do not collect data speculatively.
• Least-Privilege Access: Access to personal information is restricted to personnel and systems that require it to perform specific, authorized functions. Role-based access controls are enforced at the application layer.
• Contextual Integrity: Information shared in one context (e.g., a clinical integration session) is not repurposed for incompatible uses without your knowledge and, where required, your explicit consent.
• Transparency: We explain clearly what data we collect, why we collect it, who we share it with, and how long we keep it. We do not use dark patterns to obscure material data practices.
• User Control: We provide meaningful access, correction, export, and deletion mechanisms, subject to legal retention requirements and the constraints of organization-managed accounts.
• Security by Design: We implement administrative, technical, and physical safeguards commensurate with the sensitivity of the information we process, including encryption in transit and at rest for sensitive data categories.

3. Information We Collect

We collect information in the following categories depending on how you interact with the Services:

3A. Account and Profile Information

When you register for an account or are provisioned access by an organization, we collect:

• Full name or alias (at user discretion where alias is supported)
• Email address and/or phone number used for authentication
• Organizational affiliation and assigned role (e.g., participant, facilitator, clinician, administrator)

3B. User-Generated Content

Depending on the features you access, you may provide:

• Reflections, journals, and integration notes entered directly into the App
• Responses to structured questionnaires or assessment instruments
• Files or attachments you choose to upload
• Clinical notes, session observations, or annotations entered by clinicians or facilitators via the Dashboard

Sensitivity Notice: User-generated content in the Clinical Track may constitute PHI under HIPAA (45 C.F.R. § 160.103) or Mental Health Records subject to Texas Health & Safety Code § 611.001 et seq. Such content receives the highest level of access restriction and encryption within our platform.

3C. Device and Usage Data

We automatically collect limited technical data to maintain security, diagnose errors, and improve performance:

• Device type, operating system, and browser or application version
• IP address (used to derive approximate geographic region; not used for precise location tracking)
• Log data including session timestamps, feature interactions, and crash reports

We do not use device or usage data to build individual behavioral profiles for advertising purposes.

3D. Organization-Provided Data

If you access the Services through a clinic, treatment program, or community organization, that organization may transmit the following to METAT8 to facilitate your access:

• Program enrollment or participant identifiers
• Scheduling references or session linkage data
• Role assignments and permission configurations

METAT8's processing of such data is governed by the agreement between METAT8 and the organization, which may include a BAA and/or a Data Processing Agreement ("DPA").

3E. Cookies and Similar Technologies

On the Website, we may use:

• Strictly necessary cookies required for authentication and security functions
• Analytics cookies or similar technologies, using privacy-preserving configurations where feasible, to understand aggregate usage patterns and improve reliability

We do not use third-party advertising cookies or cross-site tracking technologies. [Note: Confirm and list specific analytics tools — e.g., PostHog, Plausible — prior to publication and update this section accordingly.]

3F. AI-Assisted Feature Processing

Where AI-assisted features are enabled (e.g., session summaries, suggested reflection prompts), User Content may be processed by underlying AI models to generate outputs. The following disclosures apply:

• AI outputs are informational tools only. They do not constitute clinical diagnosis, treatment recommendations, or medical advice.
• Clinicians and facilitators retain full professional responsibility for all care decisions. No AI output overrides or substitutes clinical judgment.
• User Content submitted to AI features is processed under the same confidentiality and access controls as other data. We do not use PHI to train third-party AI models without explicit written authorization.
• Where AI processing involves a third-party model provider, such provider is engaged as a subprocessor under contractual obligations that include data confidentiality, use restrictions, and security standards.

4. Legal Bases and Purposes for Processing

We process personal information for the following purposes, each of which corresponds to a lawful basis:

5. Disclosure and Sharing of Information

METAT8 does not sell, rent, or trade personal information or Protected Health Information to any third party. We do not disclose personal information for third-party advertising purposes.

We disclose information only in the following circumstances:

5A. Service Providers and Subprocessors

We engage vetted third-party service providers to assist in operating the Services, including cloud hosting, infrastructure monitoring, communications delivery, and technical support. All such providers are contractually required to:

• Process data only on our documented instructions
• Maintain confidentiality and implement appropriate security safeguards
• Not further disclose data except as authorized in writing by METAT8
• Execute a BAA where required under HIPAA

Current infrastructure hosting: DigitalOcean (United States — region: [confirm specific region prior to publication]). All data is hosted within the United States.

5B. Your Organization

If you access the Services through an organization (clinic, treatment program, or community partner), authorized personnel within that organization — such as your treating clinician, program administrator, or designated facilitator — may access your data consistent with:

• Their role-based permissions as configured in the platform
• The organization's own privacy and confidentiality policies
• Applicable professional ethical obligations (e.g., therapist-patient confidentiality, Texas Health & Safety Code § 611.001 et seq.)
• Any BAA or DPA executed between METAT8 and that organization

METAT8 does not grant organizational access beyond what is necessary for legitimate program operations.

5C. Legal Process and Safety Disclosures

We may disclose information when we have a good-faith belief that disclosure is necessary to:

• Comply with a valid subpoena, court order, government investigation, or other legal process
• Enforce our Terms of Service or protect the legal rights of METAT8, our users, or third parties
• Prevent or respond to fraud, security incidents, or imminent physical harm
• Fulfill mandatory reporting obligations under applicable law (e.g., mandatory abuse reporting under Texas Family Code § 261.101)

Where legally permitted, we will attempt to notify affected users before disclosing their information in response to legal process.

5D. Corporate Transactions

In the event of a merger, acquisition, asset sale, financing transaction, or reorganization involving METAT8, personal information may be transferred as part of that transaction. Any successor entity will be required to honor the commitments made in this Policy or provide you with advance notice and an opportunity to object. PHI transfers in such events will comply with HIPAA requirements, including 45 C.F.R. § 164.502(b).

6. Data Access, Roles, and Permissions

Access to personal information within the METAT8 platform is governed by role-based access controls enforced at the application layer. Access levels reflect the minimum necessary standard required under HIPAA (45 C.F.R. § 164.514(d)) and are applied consistently across both tracks.

Clinical Track. Authorized Dashboard users — including licensed clinicians, clinical supervisors, and program administrators — may access participant-level data to the extent required for care coordination, session documentation, safety monitoring, and regulatory compliance. Access is logged and auditable.

Community Track. Facilitators and community administrators may access participant data necessary for program operations (e.g., enrollment status, participation records). They do not have access to Clinical Track health data.

METAT8 maintains audit logs of data access events. Access by METAT8 internal personnel to production data containing personal information requires documented authorization and is subject to internal review.

7. Data Retention and Deletion

We retain personal information for the minimum period necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law.

General retention principles:

• Account and profile information is retained for the duration of the active account and for a reasonable period thereafter to support account recovery and audit obligations.
• User Content is retained as directed by the user and/or governing organization agreement. For Clinical Track data, retention periods may be governed by Texas Health & Safety Code § 241.103 (hospital records) or applicable professional board rules (e.g., Texas State Board of Examiners of Professional Counselors).
• Device and usage data (logs) are retained for [specify period, e.g., 90 days] for security and diagnostic purposes, then purged or anonymized.
• Data subject to a BAA is retained and destroyed in accordance with the terms of that BAA and HIPAA requirements.

Deletion requests are processed within [specify SLA, e.g., 30 days] of receipt, except where retention is required by legal obligation, an active BAA, or a pending dispute. We will confirm completion of deletion to the requesting user.

Note: Where data is held in backups, deletion from backups will occur in the ordinary course of the backup rotation cycle, which may extend the effective deletion timeline.

8. Security

METAT8 implements a layered security program designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. Our safeguards include:

• Encryption in transit (TLS 1.2 or higher) for all data transmitted between users and our systems
• Encryption at rest for databases and storage volumes containing personal information and PHI
• Role-based access controls with principle of least privilege enforced at the application and infrastructure layers
• Multi-factor authentication requirements for Dashboard and administrative access
• Audit logging of authentication events, data access, and administrative actions
• Periodic security assessments and vulnerability management processes
• Vendor security review for third-party subprocessors with access to personal data

Important: No system or transmission of information over the internet is guaranteed to be completely secure. While we implement and maintain reasonable safeguards, METAT8 cannot warrant the absolute security of any information you transmit to us. You are responsible for maintaining the confidentiality of your account credentials and for ensuring secure device practices.

In the event of a security incident that triggers notification obligations under applicable law (including HIPAA Breach Notification Rule, 45 C.F.R. §§ 164.400–164.414, and the Texas Identity Theft Enforcement and Protection Act, Tex. Bus. & Com. Code § 521.053), we will provide required notifications within applicable statutory deadlines.

9. Your Rights and Choices

Subject to applicable law and the constraints of your account type, you have the following rights with respect to your personal information:

To exercise any of the above rights, contact us at inquire@metat8.com. We will respond within 30 days of receipt, or within any shorter period required by applicable law. We may request verification of your identity before processing your request.

Organization-Managed Accounts: If your account is provisioned and managed by an organization (e.g., a clinic or community program), certain rights requests — including deletion and data portability — may need to be submitted through or coordinated with that organization, which acts as the data controller for your enrollment data.

10. Mental Health and Sensitive Data Protections

METAT8 processes information that may include mental health records, psychotherapy notes, and integration experiences relating to mental health treatment. We apply the following heightened protections to this category of data:

• Mental health records processed in the Clinical Track are treated as confidential under Texas Health & Safety Code § 611.001 et seq. and are not disclosed without a specific, written authorization except as required by law or as permitted under an applicable BAA.
• Psychotherapy notes (as defined under 45 C.F.R. § 164.501) are maintained separately from the general medical record and are subject to more restrictive use and disclosure limitations under HIPAA.
• Information relating to substance use disorder treatment, where applicable, may be subject to additional federal protections under 42 C.F.R. Part 2, which requires patient-specific authorization before disclosure in most circumstances. METAT8 will identify and apply Part 2 protections where its partner programs are Part 2 programs.
• AI-generated outputs are never treated as clinical diagnoses or notes. They are not incorporated into official clinical records without clinician review and attestation.

11. Children's Privacy

The Services are designed and intended for users who are 18 years of age or older.

Individuals under the age of 18 may only access the Services where:

• Access is provisioned by an authorized clinic, program, or community organization
• Verified parental or legal guardian consent has been obtained and documented in accordance with applicable law, including the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506, where applicable
• Required clinical supervision is in place

METAT8 does not knowingly collect personal information from individuals under 13 without verifiable parental consent. If we become aware that we have inadvertently collected such information without proper consent, we will promptly delete it. If you believe a minor's information has been collected without proper consent, contact us at inquire@metat8.com.

12. Data Residency and International Availability

METAT8 currently hosts all data in the United States. Our primary infrastructure provider is DigitalOcean, operating within U.S.-based data centers (region: [confirm prior to publication]).

The Services are not currently offered outside the United States. If international availability is introduced in the future, METAT8 will:

• Evaluate and implement applicable cross-border data transfer mechanisms (e.g., Standard Contractual Clauses for EEA-to-U.S. transfers)
• Update this Policy to reflect applicable regional requirements (e.g., GDPR, PIPEDA)
• Notify affected users in advance of any changes to hosting jurisdiction

13. HIPAA Notice — Business Associate Relationships

Where METAT8 processes PHI on behalf of a Covered Entity (as defined under 45 C.F.R. § 160.103), METAT8 acts as a Business Associate. In this capacity:

• A separate, executed Business Associate Agreement (BAA) governs all PHI processing. The BAA supersedes this Privacy Policy with respect to PHI.
• METAT8 will use and disclose PHI only as permitted or required by the BAA and applicable law.
• METAT8 will implement and maintain safeguards as required under the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C).
• METAT8 will report breaches of unsecured PHI to the applicable Covered Entity within the timeframe required under the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414).
• Patients retain HIPAA rights as described in the Covered Entity's Notice of Privacy Practices (NPP), which is issued by the Covered Entity, not by METAT8.

Organizations seeking to engage METAT8 as a Business Associate should contact inquire@metat8.com to initiate BAA execution prior to transmitting any PHI to our platform.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Services. When we make material changes, we will:

• Post the updated Policy on our Website and App with a revised effective date
• Provide in-app or email notice to registered users at least 30 days before material changes take effect, where feasible
• For changes affecting the processing of PHI under an active BAA, notify the applicable Covered Entity as required under that BAA

Your continued use of the Services after the effective date of an updated Policy constitutes your acceptance of the changes. If you do not agree with the updated Policy, you should discontinue use of the Services and may request deletion of your account and data.

15. Governing Law and Dispute Resolution

This Policy and any disputes relating to METAT8's privacy practices are governed by the laws of the State of Texas, without regard to conflict of law principles. For privacy disputes that cannot be resolved informally, you may contact us at inquire@metat8.com and we will attempt to resolve the matter within 30 days.

Nothing in this Section limits rights available to you under applicable federal law, including HIPAA or the FTC Act.

16. Contact and Privacy Requests

For any questions, concerns, or requests relating to this Privacy Policy or METAT8's privacy practices, contact our Privacy team: