OurPack Health — Privacy Policy

Version: 2.5 Effective Date: August 9, 2026 Change (2.5): Section 7 gains the one case where something you create is published rather than kept private — a photograph or video of a product package you contribute to our catalogue. It is optional, it is checked by a person first, and it can be taken down on request. Includes the plain caution that a picture of a package can catch a face, a name on a label, or an address. Matches Section 9B of the Terms. Change (2.4): Section 11 updated — a child now holds their own account rather than a profile inside a parent's. Nothing collected changes: still a display name and what they recorded, still no date of birth, no age, no credentials and no advertising identifiers. Adds that the account has no email address, which is what makes the parent's code the only way in, and covers switching an account off as distinct from deleting it. Operator / Data Controller: OurPack Health, Inc., a Nevada corporation ("Company," "we," "us," or "our") Service: OurPack Health (the "Service")

---

1. Overview

This Privacy Policy explains what information OurPack Health collects, how we use and share it, and the choices and rights you have. It applies to our mobile apps, websites, and related features. By using the Service you also agree to our Terms of Service.

Licensed veterinarians and their staff use the Service under the separate Veterinary Professional Terms. This Policy describes how we handle information for everyone; where a veterinary account is involved, that document sets out the additional professional obligations that attach to it.

A note about health data: OurPack Health stores pet-health information. Pet (veterinary) records are not covered by the U.S. Health Insurance Portability and Accountability Act ("HIPAA"), which protects certain human health information. We do not claim to be a HIPAA-covered entity or that the Service is "HIPAA compliant." Even so, we have chosen to operate the Service to a HIPAA-grade security posture (see Section 6). This is a design and security choice, not a legal certification.

2. Information we collect

2.1 Information you provide

• Account information: name, email address, password, and account settings.
• Mobile phone number (optional): if you choose to give one, we use it as a delivery contact and — only if you separately turn text messages on — to send the text messages described in Section 5B. The Service works completely without a phone number.
• Pet-health data: pet profiles (name, species, breed, age, weight, etc.), symptoms and observations, conditions, medications, vaccination and visit history, care plans, notes, documents, and images you add.
• Cases and questions: the questions you ask the AI assistant and the "cases" or summaries you prepare for your veterinarian.
• Household and sharing data: the people you invite to help with a pet, the display name you give each of them, and the individual permissions you grant each one.
• Children's accounts (only if you create one): a display name you choose for your child, and what they record about an animal. No email address, ever. Nothing else — see Section 11, which sets out in full what we do and do not collect.
• Voice data (if you use voice features): audio you record or speak, which is processed to provide the feature and may be transcribed to text.
• Support and communications: messages you send us.

2.2 Information collected automatically

• Usage and analytics: features used, actions taken, pages/screens viewed, and diagnostic events, used to operate and improve the Service.
• Device and technical data: device type, operating system, app version, identifiers, approximate location derived from IP, and log data.
• Cookies and similar technologies (web) and referral/affiliate identifiers — see Section 5.

2.3 Payment information

Subscriptions are billed through a third-party billing provider. You provide your card details directly to that provider; we do not store your full payment-card number. We receive limited billing information such as subscription status, billing period, the last four digits and card brand, and transaction results, which we use to manage your subscription. The provider handles your card details under its own terms and privacy policy, and we will tell you who it is on request at privacy@ourpackhealth.com.

3. How we use information

We use information to:

• provide, operate, and maintain the Service, including your pet-health records and household/sharing features;
• provide the AI assistant so you can ask general pet-health questions and prepare cases for your veterinarian (see Section 4);
• process subscriptions, trials, renewals, and billing through our billing provider;
• secure the Service, prevent fraud and abuse, and enforce our Terms;
• provide customer support and send service-related communications;
• understand and improve the Service through analytics;
• improve the Service, including training and evaluating our own models, unless you turn that off — see Section 4; and
• comply with legal obligations and protect legal rights.

4. AI processing, and how we improve the Service

How your information is processed today

• General questions you ask the AI assistant may be processed by a third-party AI model provider. That processing is performed under terms that do not permit the provider to use your data to train its models.
• Clinical-case reasoning — the deeper analysis that organizes your pet's information into a case for your veterinarian — is processed on the Company's own systems.
• Voice features, if you use them, process your audio to deliver the feature (for example, transcription).
• Reaffirming the Terms of Service: the AI provides general educational information only and does not provide veterinary diagnosis, prescription, or treatment. AI outputs may be inaccurate and are not veterinary advice.

Improving our own models — and how to say no

We use information from the Service to improve it, including to train and evaluate our own models. This is how the Service gets better at recognising what matters in a pet's history and at preparing you for a veterinary visit.

You can turn this off at any time, for your whole account, in Settings → Privacy → Improving OurPack Health. Turning it off does not reduce the Service in any way, and we do not charge you differently for it.

When we do use your information this way:

• Direct identifiers are removed first. Your name, email address, postal address, phone number and payment details are not used to train models.
• We do not use it to build a profile of you, and we do not use it for advertising or sell it to anyone.
• Records from your veterinarian are treated differently. Information that reaches us from a veterinary practice, rather than from you, is not used to train our models. That information belongs to a relationship you have with your vet, not with us.
• Turning it off stops future use. It takes effect from the moment you turn it off. A model that has already been trained cannot be made to un-learn, and we will not pretend otherwise — but nothing of yours will be used in any training after that point, and the underlying information remains yours to export or delete under Section 10.

If you would prefer we had never used it, write to privacy@ourpackhealth.com. We will exclude your account from all future training and confirm when it is done.

5. Cookies, analytics, and affiliate/referral tracking

• Cookies and similar technologies. On our websites we use cookies and similar technologies for essential functionality, preferences, security, and analytics.
• Affiliate / influencer referrals. We operate a referral and affiliate program that pays approved affiliates for qualifying signups. To attribute signups, we use referral codes and tracking identifiers (for example, a ref code in a signup link or a cookie) that record which affiliate or partner practice referred you. This attribution may also determine partner-referred pricing (see the Terms of Service, Section 7). We do not sell your pet-health records to affiliates.

5A. Store orders, shipping, and affiliate links

This Section describes information handled when you buy from the OurPack Store at shop.ourpackhealth.com or through the Marketplace in our apps.

What we collect when you order. Your shipping name and address, email address, order contents and amounts, and the loyalty points earned or redeemed. You may also give us a phone number for delivery contact.

Card details. We never receive or store your full card number. Payment is taken by our payment processor on their own hosted checkout; we receive only a payment identifier, the amount, the outcome, and the last four digits and brand of the card.

Who your address goes to. Store products ship directly from our authorized distributors, so fulfilling your order means sharing your name, shipping address, and the items in that shipment with the distributor shipping them, and with the carrier. Distributors receive what they need to ship the box and nothing about your pet's health record. If your order contains items from more than one distributor, each receives only the items it is shipping.

Sales tax. Your shipping address is used to calculate sales tax and is shared with our tax-calculation provider for that purpose.

Browsing the store. You can browse and buy without an account. If you shop without signing in, we use a cart identifier stored in a cookie on your device to remember what is in your cart. If you later sign in, that cart is attached to your account.

Affiliate and comparison links. Some listings link to other retailers, and we may earn a commission if you buy through one. Following such a link takes you to that retailer, whose own privacy policy then applies; we do not send them your pet-health record. Where a listing carries a commercial relationship, that is disclosed on the listing.

What we do not do. We do not sell your personal information, we do not sell or share your pet's health records with distributors, brands, or affiliates, and we do not use your pet's health record to target advertising to you.

5B. Text messages (SMS and MMS)

All text messaging is opt-in only. We send you a text message only after you have done both of these things:

1. given us a mobile number in Account → Profile, and
2. turned text messaging on for a message type in Account → Notification preferences.

Text messaging is off by default for every message type, and giving us a number as a delivery contact is not consent to be texted. If you never give us a number, or you give one and leave text messaging off, we never text you. Consent to receive text messages is not a condition of purchase or of using any part of the Service — everything works without it, because the in-app feed, push notifications, and email carry the same information.

What we send. Only messages about your own account and your own pets — for example an emergency alert about your pet, or a lost-pet alert. You control text messaging separately for each type of message in Account → Notification preferences. A message may be sent as MMS where a picture forms part of it. We do not send marketing or promotional text messages.

Message frequency. Message frequency varies. Texts are sent in response to events in your own account rather than on a schedule or a campaign, so many accounts receive none at all in a given month; in typical use it is fewer than 5 messages per month.

Message and data rates may apply. Your mobile carrier's standard message and data rates apply to messages you send and receive. Carriers are not liable for delayed or undelivered messages.

Stopping them. Reply STOP to any message to opt out, or HELP for help. You can also turn text messaging off — for one message type or all of them — in Account → Notification preferences at any time, and you can remove your number entirely in Account → Profile. Opting out of texts removes no other notification and changes nothing about your plan, your price, or what the Service does for you.

We do not share your mobile number. No mobile information is sold, rented, or shared with third parties or affiliates for marketing or promotional purposes. That covers both the number itself and the fact that you consented to text messaging; neither is disclosed to anyone for their own marketing, and neither is ever sold or rented to anyone for any purpose.

There are two narrow exceptions, and neither is marketing:

• The provider that delivers the message. A third-party messaging provider transmits the text on our behalf, under contract and confidentiality obligations, and may not use your number for any purpose of its own. A text message cannot be delivered without one.
• A number you publish yourself. If you put a contact number on a lost-pet flyer, it appears on the flyer you asked us to produce, because the point of the flyer is that a finder can reach you. That is your choice at the moment you make it, and it is the only circumstance in which a number of yours is shown to anyone else.

Your mobile number is covered by the rest of this Policy as well: it is a direct identifier, so it is never used to train our models (Section 4), it is deleted with your account (Section 8 and the Data Deletion Policy), and you can see, correct, or delete it under Section 10.

The Terms of Service, Sections 23 and 24, set out the contract terms for electronic communications and text messages.

6. Data security posture

We protect your information using administrative, technical, and physical safeguards, including:

• Encryption at rest using customer-managed encryption keys (CMEK) and encryption in transit;
• Access controls, including row-level security so that data is accessible only to authorized accounts and roles;
• Audit logging of access to sensitive data; and
• least-privilege access, monitoring, and other controls consistent with a HIPAA-grade security posture adopted by choice (see Section 1 — this is not a HIPAA legal certification).

No system is perfectly secure, and we cannot guarantee absolute security. We will notify affected users and regulators of security incidents as required by applicable law.

7. How we share information

We do not sell your pet-health records. We do not sell, rent, or share mobile phone numbers, or the fact that you opted in to text messaging, with any third party or affiliate for marketing or promotional purposes — see Section 5B for the two narrow, non-marketing exceptions. We share information only as described here:

• At your direction — your veterinarian. When you choose to send a case, summary, or record to your own licensed veterinarian, we transmit it as you direct. Your veterinarian's handling of that information is governed by their own policies and applicable law.
• Within a pet's household. Information is visible to the people you have authorized for a pet, according to their role (owner, sitter, walker, viewer).
• Service providers (processors). We share information with vendors who process it on our behalf under contract and confidentiality obligations, including our billing provider (payments), a third-party AI model provider (general questions, under no-training terms), and hosting, infrastructure, analytics, and communications providers. You can ask us who they are at privacy@ourpackhealth.com.
• Legal and safety. We may disclose information to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, safety, and security of users, the public, or the Company.
• Business transfers. If the Company is involved in a merger, acquisition, financing, or sale of assets, information may be transferred subject to this Policy and applicable law.
• With your consent. For any other sharing, we will ask first.

One thing you create is published rather than kept private, and only if you choose to send it. When you scan a product we do not recognise, we may ask you to photograph the package, or record a short video of it, so we can read the label. If you do, a person on our team checks it, and then the information we read goes into our product catalogue and your photographs may appear on that product's page, where anyone using the Service can see them. Declining changes nothing about the Service.

Two things follow from that, and they are worth reading before you take the picture. A photograph or video of a package can pick up more than the package — a face, a name on a prescription label, a mailing address on a delivery box, or the room you are standing in. Our team rejects anything showing more than the product, but you are the only person who sees the frame before the shutter. And you can change your mind: ask us and we will take your photographs down from the product page. What we read from the label stays in the catalogue, because it is a fact about the product rather than information about you, and because other people rely on it. The full terms are in Section 9B of the Terms of Service.

8. Data retention

We keep information for as long as your account is active and as needed to provide the Service, then delete or de-identify it, except where longer retention is required for legal, tax, accounting, fraud-prevention, or dispute-resolution purposes. When you delete your account, we follow the process — including the 30-day grace period and post-grace purge — described in the Data Deletion Policy. Certain financial and transaction records associated with subscriptions may be retained by us and by our billing provider as required by law.

9. Notice at collection — what we collect and why

This table sets out what we collect, why, and who receives it. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

On "sensitive" data. Your pet's health record is not "personal health information" about a human under HIPAA, and we are not a HIPAA-covered entity. We treat it as sensitive anyway, because it is the most personal thing you keep here. We use it only to provide and improve the Service — never to infer anything about you as a person, and never for advertising.

Retention is described in Section 8 and the Data Deletion Policy.

10. Your privacy rights

Depending on where you live, you have some or all of these rights. We give them to everyone in the United States, regardless of your state, rather than sorting people by address:

• Know and access — what we hold about you, where it came from, why we have it, and who we have disclosed it to.
• Portability — get your pet-health records in a portable format. This one is self-service: export any time in the app.
• Correct — fix anything inaccurate.
• Delete — your account and the data you control, subject to the multi-owner rules and legal retention in the Data Deletion Policy.
• Opt out of sale, sharing, or targeted advertising — there is nothing to opt out of, because we do none of them. The right is stated so you know where you stand.
• Limit use of sensitive information — we use it to provide the Service and, unless you turn it off, to improve it. We do not use it for advertising, profiling, or any purpose you would not expect from a pet-health app.
• Opt out of model training — turn off Settings → Privacy → Improving OurPack Health and nothing of yours is used to train our models from that point on. See Section 4.
• Opt out of text messages — reply STOP to any text, or turn text messaging off in Account → Notification preferences. Texts are opt-in in the first place, so there is nothing to switch off unless you switched it on. See Section 5B.
• Withdraw consent where we relied on consent, and object to or restrict certain processing.
• Appeal — if we refuse a request, you can ask us to reconsider (see below).
• No retaliation. Exercising any of these changes nothing about your price, your plan, or the quality of what you get.

10.1 How to exercise them

Use the in-app controls, or email privacy@ourpackhealth.com from the address on your account. We verify requests before acting — that protects your records from someone else asking for them. We respond within 45 days and may extend once by another 45 days where the law allows, telling you if we do.

Authorized agents may submit a request with written permission from you; we may still verify with you directly.

Appeals. If we decline, reply to our response or email privacy@ourpackhealth.com with the subject "Privacy Appeal". We will review and respond within 45 days with a written explanation. If you disagree with the outcome, you may contact your state attorney general.

10.2 Global Privacy Control and Do Not Track

Our website honours the Global Privacy Control (GPC) signal. Because we do not sell or share personal information, GPC does not change what we do with your data — we honour it regardless so the signal is meaningful.

There is no common standard for Do Not Track browser signals, so we do not respond to them differently. GPC is the signal we act on.

10.3 Automated decision-making

The Service is built around an AI assistant, so it is worth being explicit about what it does and does not decide.

• The AI produces information, not decisions about you. It organises your pet's record, answers general questions, and prepares material for your veterinarian.
• Automated safety rules may change what the Service shows you — for example, routing you toward veterinary care instead of answering a symptom question. These are safety measures, not assessments of you or your animal (see the Terms of Service, Section 8.1).
• We do not use automated processing to make decisions about you that produce legal or similarly significant effects — we do not use it to set your price, score you, decide your eligibility, or profile you.
• A person will look at it. If an automated decision affects your account, write to privacy@ourpackhealth.com and a human will review it and explain the outcome.

10.4 Nevada

Nevada residents may direct us not to sell covered information. We do not sell it, and will honour any such direction regardless.

11. Children

Only adults hold accounts. You must be 18 or older to register, and no part of the Service invites a child to sign up. If a child creates an account by misrepresenting their age, tell us at privacy@ourpackhealth.com and we will delete it and the information in it.

A parent may create an account for their own child, so the child can help look after the family's animals. Terms of Service, Section 4B governs those accounts. This Section explains what we collect through one — and, just as importantly, what we do not.

The child never signs up. The parent creates the account and the child signs in with a code the parent makes. The account has no email address, which is why that code is the only way in: there is no password to guess, no reset link, and no way to reach it from outside the household.

11.1 What we collect through a child's account

A display name, and what the child recorded about an animal. That is the whole list.

The display name is chosen by the parent and does not need to be the child's real or full name — a first name or a nickname works, and we suggest one. What the child records is care information about the animal: that a task was done and when, or that they think something seems wrong with the animal.

11.2 What we do not collect

• No date of birth, and no age. We hold no date of birth for any person, and we never calculate anyone's age.
• No email address, phone number or password for the child. The child never registers, and their account deliberately has no address of any kind — so we cannot contact them, and neither can anyone else.
• No device identifiers used to build a profile of the child, and no advertising identifiers.
• No behavioural advertising, ever, on any part of the Service. We do not serve targeted advertising to anyone, and we do not build advertising profiles.
• Nothing collected for marketing to the child. We do not send children messages of any kind.

11.3 How consent works

The parent or guardian gives consent, and only the parent. They create the profile, decide what it may do, and accept the Terms and this Policy on the child's behalf from inside their own account. We record that acceptance against the parent's account with the time it was given, so there is always a record of who consented and when.

We do not ask a child to agree to anything, because a child's agreement would not be binding and asking for it would imply otherwise.

A parent can withdraw consent at any time by deleting the child's account, and can switch it off immediately without deleting anything — the child's device is signed out and told that a grown-up has turned the account off. Section 11.5 explains what deletion removes and what stays.

A parent may see everything the child's account holds and may ask us for a copy or for deletion at any time, using the contacts in Section 9.

11.4 COPPA

The U.S. Children's Online Privacy Protection Act applies to online services directed to children under 13 and to operators who knowingly collect personal information from them. We do not direct the Service to children and children cannot register on it. Where a parent chooses to create an account for their child, we treat the information collected through it as subject to COPPA's protections regardless of the child's age — which we do not ask for and do not know.

Accordingly: the parent gives verifiable consent from an authenticated adult account before the child's account exists; the information collected is limited to what the feature actually needs, as listed in Section 11.1; we do not condition the child's participation on collecting more than that; nothing collected is used for advertising, profiling or marketing; and the parent may review, export or delete it at any time.

11.5 What deletion removes, and what stays

Deleting a child's account removes the account, its display name going forward, its permissions and its sign-in. Switching it off instead suspends access and keeps everything, and it can be switched back on.

What the child recorded about an animal stays on that animal's record. That a dose was given or a task completed is part of the animal's health history, other people rely on it, and removing it would leave a gap that reads as "this did not happen". The display name stays attached to those entries so the record says who did what — the same rule that applies to every other person who contributes to an animal's record, set out in our Data Deletion Policy.

If you want that history removed as well, deleting the pet, or the account, does remove it — the Data Deletion Policy sets out both.

Contact privacy@ourpackhealth.com with any question about a child's information.

12. International users and data transfers

The Service is operated from the United States and, as set out in the Terms of Service, Section 4A, is offered only to United States residents. If you nonetheless access the Service from another country, you understand your information will be processed in the United States, which may have different data-protection laws from your own.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new version number and effective date and, for material changes, provide additional notice as required by law. Your continued use after the effective date means you accept the updated Policy.

14. Contact

• Privacy inquiries and rights requests: privacy@ourpackhealth.com
• General support: support@ourpackhealth.com
• Data controller: OurPack Health, Inc., 732 South 6th Street # 5497, Las Vegas, NV 89101

---

OurPack Health, Inc. · 732 South 6th Street # 5497, Las Vegas, NV 89101 · legal@ourpackhealth.com