Privacy Policy

Last updated: October 1, 2025

Witty Wilma, Inc. ("Wilma," "we," "us," or "our") respects the privacy of its customers, who may be healthcare or wellness providers ("Customers" or "providers") as well as the privacy of its Customers' patients, patient caregivers, and/or clients ("Users," "you," or "your") privacy while using the Wilma platform (the "Platform") and we are committed to protecting it through our compliance with this Privacy Policy (the "Policy").

Please read this Policy carefully to understand our privacy policies and practices. If you do not agree with our policies and practices, please do not use the Platform. By creating an account on the Platform, using the Platform, and/or by agreeing to our Terms of Use, you consent to and agree with our policies and practices as set forth in this Policy.

1. Definitions

For purposes of this policy, the following terms shall have the following definitions:

"Personal Information" shall mean information that identifies a particular individual, and may include your name, address, email address, phone number, and IP address.
"Sensitive Information" shall mean your race or ethnic origin, sexual orientation, credit or debit card number, account and routing numbers, driver's license, social security numbers, and/or secure messages by and between you and your provider.
"Protected Health Information" or "PHI" shall mean, pursuant to 45 CFR § 160.103, individually identifiable health information: (1) except as provided in paragraph (2) of this definition that is: (i) transmitted by electronic media; (ii) maintained in electronic media; or (iii) transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information: (i) in education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232(g); (ii) in records described at 20 U.S.C. 1232g(a)(4)(b)(iv); (iii) in employment records held by a covered entity in its role as employer; and (iv) regarding a person who has been deceased for more than 50 years.
"Information" shall mean Personal Information, Sensitive Information, and PHI.
"Non-Personal Information" shall mean information that is not Personal Information, Sensitive Information, or PHI.

2. Wilma's Agreements with Providers

Our treatment of User Information is governed by our agreements with Users' providers, including Business Associate Agreements (BAAs) and Master Service Agreements (together, "Customer Agreements"). If there is a conflict between the terms of this Policy and any of the Customer Agreements, the Customer Agreements will control to the extent of the conflict. If you have any questions about how your provider handles your Information, please contact your provider.

3. Territorial Scope

This Policy applies to users of our Platform located in the United States.

4. Minors and Children Under the Age of 13

Our Platform and services are not directed at or intended for minors and children under the age of 18. Further, we do not knowingly collect Information about children under the age of 13 unless (a) we are directed to do so by your provider; and (b) you, as caregiver of someone 13 or younger, are a patient or client of a provider using our Platform. If you have any questions about how your provider handles the Information of someone younger than 13, please reach out to your provider.

5. Information We Collect About You

During the course of you using our Platform, we may collect Information from you or from your provider. The types of Information that we collect will depend on how you interact with your provider, what instructions our provider gives us with respect to such Information, and how you use the Platform. For example, we may collect:

Personal Information, Sensitive Information, and/or PHI, which we collect on behalf of your provider to enable your provider to provide services to you using our Platform.
Billing information, such as your insurance information, credit card information, debit card information, account and routing numbers, your provider's information, date and location of services rendered. We may store such information on behalf of you and your provider may process your payments to them, and so that you may view and manage your billing information on the Platform.
Audio, electronic, and visual information, such as your photograph, image, and voice. We process such information to enable you and your provider to communicate using the audio and video communication features on our Platform.
Appointment information, such as date, time, and location of your appointments with your provider, which we collect in order to enable you and your provider manage your appointments.
Geolocation information, to enable our Customers, your providers, to enable Electronic Visit Verification, and to integrate with mapping features to allow our Customers to more efficiently map routes to their patient's locations.

We may collect several types of Non-Personal Information including but not limited to:

Your responses to survey questions, customer service requests, and helpdesk tickets that in each case do not include Personal Information, Sensitive Information, or PHI.
Non-identifiable technical, usage, performance, and aggregated statistical data (e.g., device/browser info, app interactions, error logs, general usage patterns, and anonymized system metrics) to improve functionality and user experience.
Anonymized identifiers, session tokens, preferences, or analytics tags to understand traffic sources and improve navigation/UX.

6. How We Collect Your Information

We collect your information from:

You Directly. Information you provide directly when you use or otherwise interact with our Platform.
Our Customers. Your Information inputted into the Platform by your provider.

7. How We Use Your Information

We use Information that we collect about you or that you provide to us:

To present our Platform and its contents to you, as applicable.
To provide you with information, products, or services that you request from us.
To notify you about changes to our Platform or any additional services that we offer or provide through it.
To allow you to participate in interactive features on our Platform.
To improve your Platform experience.
To provide you support services.
To support internal recordkeeping.
To conduct market research.
To investigate, deter, and protect against fraudulent, unauthorized or illegal activity.
To inform you about promotions, events, and news related to our Platform.
To contact you with respect to our Platform.
To fulfill any other purpose for which you provide it.
In any other way we may describe when you provide the Information, or for which you may otherwise consent to.

8. Disclosure of Your Information

Wilma does not sell, share, lease, or otherwise disclose your Information except as expressly stated in this Policy.

We may disclose Information that we collect, or that you provide, as described in this Policy:

To your providers/our Customers in order to enable your use and your provider's use of the Platform and its features.
To our employees on a need-to-know basis.
In anonymized and/or aggregated form to contractors, service providers and other third parties, such as our payment processing partners, we use to support our business and who are bound by contractual obligations to keep Information confidential and use it only for the purposes for which we disclose it to them.
To a buyer or successor in the event of a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation or similar proceeding.
For any other purpose disclosed by us when you provide the Information.
With your consent.

We may also disclose your Personal Information:

To comply with any court order, law, or legal process, including responding to any government or regulatory request.
To enforce other agreements, including for billing and collection purposes.
If we believe disclosure is necessary or appropriate to protect our rights, property, or safety, or the rights, property, or safety of you, our customers, or others.

9. Choices About How We Use and Disclose Your Information

Platform Information. You can change some of your Personal Information from within your Platform account, for example, your address, email address, phone number, and billing information. In order to change or delete other Information, such as Sensitive Information or PHI, you must contact your provider.
Communications. We may send you notifications or push notifications that will appear on your mobile and other devices. These notifications will merely notify you that we, or your provider, have sent you a secured message from within the Platform, and you will have to log into the Platform in order to view the contents of the message. You may opt out of these notifications from within your account settings.
Account Deletion. We provide our Customers use and access of the Platform in order to manage their User's/your Information. We only control a limited amount of your Information. If you wish to have all Information associated with your Platform account deleted, please contact your provider. Please note that this will materially impact (a) your ability to use the Platform and (b) your provider's ability to provide you services. Furthermore, any Information that you request your provider to delete may be subject to certain retention requirements under applicable data privacy laws, including HIPAA.

10. Third Party Links On Our Platform

Our Platform may contain links to other third-party websites, platforms, applications, software, or services for your convenience. We are not responsible for the privacy policies and practices of other third-parties and any Information you submit to a third-party is subject to their privacy policy. Once you leave our Platform or are otherwise redirected to a third-party website, application, or other service, we encourage you to read the privacy policy applicable to that third party.

11. Retention and Security

We will retain your Information for as long as your Information resides in our Customer's clients or patients list or until otherwise instructed by your provider, as needed to provide you our services and use/access of the Platform, to comply with legal obligations, to resolve disputes, and to enforce the Terms of Use.

We use generally accepted standards to protect your Information. For example, we encrypt transmissions using socket layer technology (SSL). However, no method of transmission of information over the Internet can be 100% secure, and so we cannot guarantee absolute security.

12. Your State Privacy Rights

This section applies only to Information collected about residents of California, Colorado, Connecticut, Delaware, Florida, Illinois, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Nevada, Oregon, Rhode Island, Tennessee, Texas, Utah, Vermont, Virginia, and Washington. We reserve the right to modify and add any additional residents of states that implement similar privacy laws.

Users who reside in one of the specified states above are permitted (unless otherwise not allowed under specific state's privacy laws) to request and obtain from Wilma, twice a year and free of charge, information about the Personal Information (if any) Wilma disclosed to third parties for the third parties' direct marketing purposes in the preceding calendar year (see Right to Request Information below). In addition, Users who reside in one of the specified states (excluding Nevada, and in limited circumstances Virginia) are permitted to request the right to have his or her Personal Information deleted (See Deletion Request Rights below). Your request to obtain information about the Personal Information Wilma collects or your request to delete your Personal Information shall be fulfilled within 45 days (unless your applicable state provides a longer period of time such as 60 days for certain states). If we require more time we will inform you of the reason and an extension period in writing. If you are a resident of one of these applicable states and would like to make such a request, please submit your request in writing and include in the Subject Line the State you reside to:

Witty Wilma, Inc.

Attn: Privacy Officer

P.O. BOX 745

Diablo CA 94528

Email: privacy@wittywilma.com

Right to Request Information

For those residents of one of the specified states above, we shall disclose certain information to you upon your verifiable consumer request about our collection and use of your Personal Information two times over the past 12 months and in accordance with your state's privacy law. Once we receive and confirm your verifiable consumer request we will disclose to you:

The categories of Personal Information we collected about you;
The categories of sources for the Personal Information we collected about you;
Our business or commercial purpose for collecting, sharing, or selling that Personal Information;
The specific pieces of Personal Information we collected about you;
The categories of third parties with whom we share Personal Information; and
If Company sold or disclosed your Personal Information for a business purpose.

Deletion Request Rights

Our Customers, and your providers, are ultimately responsible for deleting your Information and accounts through the Platform if you request such deletion. Pursuant to this section, we provide you the right to make a verifiable consumer request to delete any of your Personal Information that we collected from you and retained, subject to certain exceptions and based on your state's privacy law. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your Personal Information from our records unless an exception applies, and will notify your provider accordingly. We may deny your deletion request if retaining the Information is necessary for Wilma, Wilma's service providers, or your provider to:

Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
Debug products to identify and repair errors that impair existing intended functionality.
Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
Comply with the California Electronic Communications Privacy Act.
Comply with HIPAA.
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the Information's deletion may likely render impossible or seriously impair the research's achievement, provided that you previously provided informed consent.
Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
Comply with a legal obligation.
Make other internal and lawful uses of that Information that are compatible with the context in which you provided it.

Right to Appeal

Pursuant to this section, if your data request or request for deletion of data is rejected, you will receive a notification with the details of reason for rejection and instructions about how to make an appeal. Pursuant to this section, for our Colorado, Virginia, and Connecticut residents and other states where it is permitted, you have the right to appeal our decision on data subject requests and deletion requests within sixty (60) days of receiving our rejection notice. If you choose to appeal, please provide any necessary documentation, communication, and your reason for appeal to Company's primary contact as provided in this Policy. Please state that your request is an "Appeal" and describe the date and nature of your original request. We will respond to you within 60 days of receipt of your appeal.

Non-Discrimination

Pursuant to this section, Company will not discriminate against you for exercising any of your privacy rights. Unless permitted by applicable law, Company will not:

Deny you goods and services or provide you a different level or quality of goods or services, except however, that you may not be able to use some or all of the features of the Platform if your Information is deleted, nor will your provider be able to provide you services using the Platform.
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Opt Out Requests for Email

If for any reason you would no longer like to receive email marketing messages from us, you may follow the instructions contained within our promotional emails or update your preferences on your account. Please allow up to ten (10) days for Wilma to process your request. If your opt-out is limited to certain types or categories of emails the opt-out will be so limited. If you have questions or concerns regarding this statement, please contact Wilma using the contact information contained in this Policy.

Opt In/Express Consent for Sensitive Data

If for any reason you are required to give express consent or written consent under your state's privacy laws such as Washington's My Health My Data Act, Nevada's Consumer Health Data Privacy Law, Illinois Biometric Information Privacy Act, New Jersey Privacy Act, Texas' Data Privacy and Security Act, or Oregon's Consumer Privacy Act, we may require your additional affirmative express consent by signing your name digitally through our Platform.

California "Shine the Light" Law

Separate from CCPA, California residents may, pursuant to California Civil Code Section 1798.83 (the California "Shine the Light" law), request certain information regarding our disclosure (if any) of Personal Information to third parties for direct marketing purposes. To make such a request, please contact us, identify yourself as a California resident and provide sufficient information so we can take appropriate action, such as your name, email address or any additional information required.

13. Data Processing and Security

We have implemented measures designed to secure your Information from accidental loss and from unauthorized access, use, alteration, and disclosure. All Information you provide to us is stored on our secure servers behind firewalls.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your Information, for example by encrypting data in transit, we cannot guarantee the security of your Information transmitted to our Platform. Any transmission of Information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Platform.

14. Changes to Our Privacy Policy

We may modify the terms of this Policy and we encourage you to review this Policy regularly. We will inform you about any amendments to our Policy via email or other commercially reasonable means within 15 days of making any such modification. Continued use of our Platform shall constitute acceptance of any such amendments. We will send you an updated version of this Policy and ask for your consent to any revised practices or policies contained in the updated Policy.

15. Contact Information

Witty Wilma, Inc.

Attn: Privacy Officer

P.O. BOX 745

Diablo CA 94528

Email: privacy@wittywilma.com

16. Users Outside the United States

Wilma is based in the United States, and our Platform is hosted here. If you are using our Platform from outside of the United States, the laws governing our collection and use of your Information may be different from the laws of your country. If you decide to use our Platform or share your Information with us, you agree to be governed by the laws of the United States, and you expressly consent to the transfer of your data to the United States, to the maximum extent permissible under applicable law.