Privacy Policy – Deal Health-AI™ by Prescriptas, Inc.

Effective Date: October, 2026

Prescriptas, Inc. (“Prescriptas,” “we,” “our,” or “us”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and disclose information when you use Deal Health-AI™, our AI-powered SaaS platform (the “Service”). This Policy should be read together with our Terms of Use.

1. Eligibility

The Service is available only to individuals who are at least 18 years of age. We do not knowingly collect personal information from individuals under 18. If we discover that we have collected such information, we will delete it promptly.

2. Information We Collect

We collect information in the following categories:

a) Account Information: name, email, company, billing and payment information, and login credentials.

b) Customer Content: information, documents, and inputs submitted or provided by users through the Service, including deal data, uploaded documents, CRM-derived information, conversational interactions with AI-powered features, prompts, instructions, responses, notes, corrections, and other customer-supplied deal context.

c) Customer Data: refers more broadly to Customer Content together with system-generated data associated with the Customer’s use of the Service.

d) Usage Data: IP address, device type, browser version, operating system, log data, feature usage, and support interactions.

e) Cookies and Tracking Data: information collected through cookies or similar technologies (see Section 14).

f) Other Information: any data you choose to provide through in-app forms, support channels, or communications.

g) Location Information for Setup Convenience: To simplify setup, the Service may determine an approximate country or region from browser settings or IP address for features such as country-code selection. This information may be processed in connection with routine service operation and security logging. You can change the suggested selection manually.

3. How We Use Information

We use personal information to:

a) Provide, operate, and improve the Service.

b) Process transactions and deliver requested functionality.

c) Provide customer support and respond to inquiries.

d) Personalize experiences and deliver tailored content.

e) Detect, prevent, and address technical or security issues.

f) Enforce our Terms of Use and comply with legal obligations.

g) Analyze aggregated and anonymized usage data to improve platform features and system performance.

h) Send service-related communications, including security alerts, system notifications, and administrative messages.

4. Legal Basis (GDPR)

For Customer Content processed on behalf of business customers, Prescriptas generally acts as a data processor, and the customer organization acts as the data controller. Prescriptas may act as an independent controller for account administration, billing, security, customer support, and business-contact information that it processes for its own purposes.

For users located in the European Economic Area, United Kingdom, or Switzerland, our legal bases for processing personal data include:

a) Contract performance: to provide the Service you subscribed to.

b) Consent: when you opt into certain processing (e.g., marketing communications).

c) Legal obligations: to comply with applicable law.

d) Legitimate interests: to improve the Service, secure systems, and support business operations (balanced against your rights).

5. AI-Generated Outputs

Deal Health-AI® with Nello™ uses artificial intelligence to generate analytical outputs, including deal health assessments, diagnostics, insights, recommendations, summaries, coaching guidance, proposal reviews, and other decision-support materials.

a) These AI-generated outputs may be incomplete, inaccurate, or inconsistent. Customers remain solely responsible for reviewing, validating, and determining the appropriateness of AI-generated outputs before relying on them.

b) AI-generated outputs are produced through automated processing and are not reviewed or verified by Prescriptas personnel prior to delivery to users.

6. Automated Decision-Support and AI Transparency

a) Deal Health-AI™ uses automated systems, including artificial intelligence and machine learning models, to analyze Customer Content and generate analytical outputs such as insights, recommendations, summaries, and deal health assessments.

b) These outputs are generated through automated processing and are not independently reviewed or verified by Prescriptas personnel before being delivered to users.

c) The Service is designed to provide decision-support tools and analytical assistance. It does not make automated decisions that produce legal effects or similarly significant impacts on individuals.

d) Customers remain solely responsible for evaluating and determining how to use any AI-generated outputs in their business operations.

7. AI Providers & Automatic Model Switching

Deal Health-AI™ uses artificial intelligence models operated by one or more third-party providers (“AI Providers”) to process Customer Content and generate outputs. To support reliability, availability, and performance, Prescriptas may automatically route or re-route Customer Content between AI Providers (“Auto-Pivot”) based on latency, performance thresholds, outages, or other operational conditions.

Customer acknowledges and agrees that:

a) Use of Multiple Providers: Prescriptas may use any current or future AI Provider, including but not limited to OpenAI, Google, Anthropic, or other providers, without requiring Customer approval.

b) Automatic AI Routing: The Service may automatically switch between AI Providers without notice when performance or availability issues are detected. This routing is part of normal Service operation.

c) Processing by AI Providers: Customer Content transmitted to AI Providers is processed for the purpose of delivering the Service. Prescriptas does not use Customer Content to train, fine-tune, or improve general-purpose or third-party artificial intelligence models. Prescriptas requires AI Providers to process Customer Content solely for providing the Service and not to use Customer Content to train or improve their general-purpose models, consistent with applicable contractual agreements.

d) Subprocessors: AI Providers function as subprocessors. Prescriptas maintains an up-to-date list of subprocessors available upon request or through its website.

e) No Guarantee of a Specific Provider: Prescriptas may add, remove, or substitute AI Providers at any time. Prescriptas does not guarantee that any specific AI model or provider will be used for any request.

8. Protection of Customer Contact Personal Information

a) Deal Health-AI™ does not use any Customer Content or Customer Data to train, fine-tune, or improve general-purpose artificial intelligence models.

b) As an additional layer of data protection, Deal Health-AI offers a configurable PII masking capability designed to identify and remove or mask certain personally identifiable information associated with Customer Contacts before Customer Content is transmitted to third-party AI Providers.

c) For purposes of this Policy, PII means any information that can identify an individual directly or indirectly, including names, employer names tied to an individual, email addresses, phone numbers, physical addresses, job titles, CRM contact identifiers, account identifiers, or any other data associated with a specific person.

d) When enabled, the PII masking capability is designed to remove or mask identified Customer Contact PII from supported fields and content formats before transmission to an AI Provider. The effectiveness of masking depends on the type, structure, and format of the information processed.

e) Customers may enable or disable PII masking through supported application settings. Customers remain responsible for determining whether masking is appropriate for their data and for avoiding the submission of sensitive information that they are not authorized to process or disclose.

f) If Customer elects to not activate this function, Customer acknowledges that personally identifiable information may be transmitted to AI Providers as part of normal Service operation.

9. Sharing of Information

We may share information as follows:

a) Subprocessors and Service Providers: trusted third-party service providers who host, process, or support our operations. AI model providers used to process Customer Content or Customer Data, including automatic routing between providers to maintain uptime and performance.

b) Third-Party Integrations: if you choose to connect third-party services (e.g., CRM or email tools), data will be shared as necessary.

c) Data accessed through authorized third-party integrations, such as CRM systems, is treated as Customer Data and subject to the same privacy, security, and access controls described in this Policy.

d) Legal Authorities: when required by law, regulation, subpoena, or court order.

e) Business Transactions: in connection with a merger, acquisition, or sale of assets.

Subprocessors are bound by written agreements to safeguard data. Prescriptas maintains and makes available an up-to-date list of subprocessors upon request or via its website.

10. Data Protection & Residency

a) Prescriptas has implemented and will maintain appropriate technical and organizational measures to protect Customer Data against unauthorized access, disclosure, alteration, or destruction.

b) Data Hosting and Residency: Deal Health-AI is hosted using Amazon Web Services (AWS) infrastructure located in the United States. Customer Data is stored within AWS-hosted environments managed by Prescriptas. Prescriptas may use authorized third-party service providers, including AI Providers, to process Customer Content as necessary to deliver the Service, subject to applicable contractual data protection and confidentiality obligations.

c) Changes to Data Hosting: Prescriptas may modify its hosting infrastructure or geographic deployment locations as necessary to operate and improve the Service, subject to applicable contractual commitments, data protection requirements, and any specific data residency obligations agreed to in writing with Customer.

11. Data Retention

We retain Customer Data as long as necessary to provide the Service. Upon termination of the Service, Customer Data will be retained for up to 30 days to allow for final export, after which it may be deleted from active systems. Deleted Customer Data may persist in encrypted backup systems for up to ninety (90) days before final removal in accordance with Prescriptas’ data retention practices. We may retain limited information where required to comply with legal obligations, enforce agreements, or resolve disputes.

12. Data Subject Rights

Depending on your location, you may have rights under applicable data protection laws, including the right to:

a) Access your data.

b) Correct inaccurate or incomplete data.

c) Delete your data.

d) Restrict or object to processing.

e) Port your data to another provider.

f) Withdraw consent where processing is based on consent.

g) Lodge a complaint with a supervisory authority.

Requests may be submitted to support@prescriptas.com.

13. CCPA & GDPR Compliance

If you are a resident of California, you have rights under the California Consumer Privacy Act (CCPA), including:

a) The right to know what personal data we collect and how we use it.

b) The right to request deletion of your personal data.

c) The right to opt out of the sale or sharing of personal data (Prescriptas does not sell personal data).

d) The right to non-discrimination for exercising your rights.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, your data is protected under the GDPR or equivalent laws. Prescriptas acts as a data processor for Customer Data and complies with applicable requirements.

Prescriptas does not sell or share personal data for cross-context behavioral advertising purposes.

14. Cookies & Tracking

We use cookies and similar technologies to operate the Service, analyze usage, and improve features. You may disable cookies through your browser settings, but some features may not function properly. Some browsers transmit “Do Not Track” signals; the Service does not currently respond to those signals. Where applicable law requires recognition of opt-out preference signals, including Global Privacy Control, Prescriptas will handle such signals in accordance with its legal obligations. The availability and effect of these signals may depend on the technologies deployed on the Service or website.

15. Security

a) We use industry-standard measures to protect Customer Data. However, no system is completely secure, and we cannot guarantee absolute security.

b) These measures include encryption of data in transit and at rest, logical tenant isolation, role-based access controls, least-privilege access for personnel, and audit logging of system access.

Customer Data is logically isolated by tenant. Access to Customer Data within the Service is governed by role-based access controls and permissions. Prescriptas personnel do not have standing access to Customer Data. Access required for authorized support, troubleshooting, security, or operational purposes is restricted to designated personnel on a need-to-know basis and is subject to appropriate logging and monitoring.

c) In the event of a confirmed security incident affecting Customer Data, Prescriptas will notify affected Customers without undue delay and in accordance with the security incident notification provisions described in the Terms of Use.

16. Children’s Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from individuals under 18. If such data is identified, it will be deleted promptly.

17. International Data Transfers

Prescriptas operates its primary hosting infrastructure in the United States. Customer Data may be processed in the United States or other jurisdictions where authorized service providers and subprocessors operate, as necessary to deliver and support the Service. Where personal data is transferred across international borders, Prescriptas will implement appropriate safeguards as required by applicable data protection laws. These safeguards may include Standard Contractual Clauses or other legally recognized transfer mechanisms, where applicable. Additional international data transfer requirements may be addressed through a Data Processing Agreement between Prescriptas and Customer.

18. Changes to this Policy

We may update this Privacy Policy from time to time. Updated versions will be posted on our website with the effective date clearly indicated. Material changes will be communicated in advance.

19. Additional Disclosures

Customers may request data portability or export of their Customer Data by contacting support@prescriptas.com. Prescriptas will treat Customer Data as confidential and will not disclose it except as provided in this Policy or required by law.

20. Contact Us

Prescriptas, Inc.
Email: support@prescriptas.com
Address: PO Box 16, Hampton Falls, NH 03844

21. Policy Approval Record

Policy: Privacy Policy
Version: 2.1 (Proposed)
Approved by: Pending Prescriptas Management Approval
Effective Date: October 15, 2026 (upon approval and publication)