Effective Date: July 1, 2026

This Privacy Policy will help you understand how PainSight (“PainSight,” “we,” “us,” or “our”) uses and protects the information you provide when you visit our website, use our mobile application, access clinician tools, or use related PainSight services.

PainSight is designed to help patients, clinicians, and researchers better understand pain history over time through patient-reported check-ins, voice-based inputs, summaries, trends, and related reports.

We reserve the right to update this Privacy Policy from time to time. If we make material changes, we will update the effective date and may provide additional notice where appropriate. We encourage you to review this page periodically.

What User Data We Collect

When you visit our website or use PainSight services, we may collect the following information:

• Name, email address, organization, role, and contact information

• Account information, including login information and user role

• Clinician or patient profile information where applicable

• Pain scores, symptoms, body areas, function, mood, activities, check-ins, voice or text inputs, transcripts, summaries, reports, and related patient-reported information

• Clinical or care-related information entered, reviewed, or shared by clinicians or healthcare organizations using PainSight

• Device type, browser type, operating system, log data, app interactions, security events, diagnostic information, and other technical information

• Information submitted through website forms, demo requests, meeting bookings, or support inquiries

Please do not submit protected health information or detailed medical information through general website contact forms unless specifically instructed through an approved PainSight workflow.

Why We Collect Your Data

We may collect and use information for the following reasons:

• To provide, operate, and improve PainSight services

• To generate pain history summaries, trends, reports, and clinician-facing insights

• To support patient tracking, clinician review, research workflows, or care coordination where applicable

• To authenticate users and manage accounts

• To maintain security, audit logs, backups, and system integrity

• To provide support and respond to inquiries

• To improve product performance and user experience

• To comply with legal, contractual, regulatory, and security obligations

PainSight does not sell protected health information.

HIPAA and Protected Health Information

When PainSight is used by or on behalf of a healthcare provider, clinic, research organization, or other covered entity, certain information may be considered protected health information under HIPAA.

In those cases, PainSight acts according to applicable agreements, including Business Associate Agreements where required. PainSight maintains HIPAA Security and Privacy policies, has completed a Security Risk Assessment through Medcurity, and maintains supporting documentation for access controls, vendor management, workforce training, incident response, backup and contingency planning, and ongoing remediation tracking.

This Privacy Policy does not replace any agreement PainSight may have with a healthcare provider, clinic, research organization, or other customer.

How We Share Information

PainSight may share information only as reasonably necessary to provide and support the service, including with:

• Healthcare providers, clinics, or organizations connected to a user’s care or authorized workflow

• Authorized clinicians, researchers, administrators, or users within an approved organization

• Service providers and infrastructure vendors that help us operate PainSight

• Business associates or subcontractors under appropriate agreements where required

• Regulators, authorities, or other parties when required by law

• Other parties with authorization, consent, or as permitted by applicable law

PainSight does not use or disclose protected health information for marketing purposes without appropriate authorization where required by law.

Safeguarding and Securing the Data

PainSight is committed to protecting information handled through approved PainSight workflows. We use administrative, technical, and physical safeguards designed to protect information against unauthorized access, disclosure, alteration, or destruction.

These safeguards may include:

• Access controls and unique user accounts

• Multi-factor authentication where available

• Encryption in transit using HTTPS/TLS

• Vendor-managed encryption at rest for approved cloud systems

• Audit logging and activity review

• Backup and contingency planning

• Incident response procedures

• Vendor and Business Associate Agreement tracking

• Workforce training and confidentiality controls

• Device security and approved system inventories

No system can guarantee absolute security. If we identify a security incident involving information handled by PainSight, we will investigate and respond according to applicable law, contracts, and our incident response procedures.

Our Cookie Policy

PainSight’s website may use cookies or similar technologies to support basic website functionality, understand website usage, improve user experience, and analyze performance.

Cookies may collect information such as browser type, device type, pages visited, time spent on the website, and general usage patterns. We do not use website cookies to intentionally collect protected health information.

You can choose to disable cookies through your browser settings. Disabling cookies may affect how certain parts of the website function.

Links to Other Websites

Our website may contain links to other websites or third-party services. If you click on these links, PainSight is not responsible for the privacy practices, security, or content of those external websites.

We encourage you to review the privacy policies of any third-party websites or services you visit.

Third-Party Services

PainSight may use third-party services to host, process, secure, analyze, or support the platform. These may include cloud infrastructure, authentication, AI processing, logging, security, backup, communication, and administrative tools.

PainSight maintains Business Associate Agreements with relevant vendors where required for HIPAA-regulated workflows.

Data Retention

PainSight retains information only as long as reasonably necessary to provide the service, comply with legal or contractual obligations, support security and audit requirements, resolve disputes, or maintain approved records.

Retention periods may vary depending on the type of information, the customer agreement, legal requirements, and whether PainSight is operating on behalf of a healthcare provider or other covered entity.

Restricting the Collection of Your Personal Data

Depending on your relationship with PainSight and applicable law, you may have rights to request access, correction, deletion, restriction, or export of certain information.

If your information is maintained by PainSight on behalf of a healthcare provider, clinic, or other covered entity, we may direct your request to that organization or coordinate with them as required.

Children’s Privacy

PainSight is not intended for use by children without appropriate involvement, authorization, or supervision from a parent, guardian, healthcare provider, or authorized organization where required.

PainSight does not knowingly collect information from children through the general website for marketing purposes.

Medical Disclaimer

PainSight is designed to support pain tracking, communication, and longitudinal history review. PainSight does not replace professional medical advice, diagnosis, or treatment.

Users should contact their clinician for medical questions and call emergency services for urgent or emergency concerns.

Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us:

PainSight LLC

admin@painsight.co