KICK ONLINE PRIVACY POLICY

Last modified: May 2026

1. Introduction

This Privacy Policy describes how Kick collects and uses Personal Data about you through the use of our Sites, mobile applications, and through email, text, and other electronic communications between you and Kick.

Kick Health, Inc. (“Kick” or “We”) respect your privacy and are committed to protecting it through our compliance with this policy.

This Privacy Policy (our “Privacy Policy”) describes the types of information we may collect from you or that you may provide when you visit the website www.gokick.com or use our mobile app (each, a “Site”) and our practices for collecting, using, maintaining, protecting, and disclosing that information.

This policy applies to information we collect:

It does not apply to information collected by:

Certain health-related information collected in connection with telehealth consultations may constitute “protected health information” (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). PHI is governed by the Notice of Privacy Practices of Kick Health Medical Group and applicable healthcare laws rather than this Privacy Policy. This Privacy Policy primarily applies to information collected through the Sites and related services that is not subject to HIPAA. Where applicable, Kick Health Medical Group will handle PHI in accordance with its Notice of Privacy Practices and applicable law.

Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Sites. By accessing or using the Sites, you agree to this Privacy Policy. This Privacy Policy may change from time to time (see Changes to Our Privacy Policy). Your continued use of the Sites after we make changes is deemed to be acceptance of those changes, so please check this Privacy Policy periodically for updates.

If you’re a resident of California or Nevada or visiting us from the European Economic Area (“EEA”), you should read this policy and the applicable sections below for residents of California and Nevada and visitors from the UK and EEA.

2. Data Controller, Data Protection Officer, and Representative

Kick is the data controller of the Personal Data you provide on the Sites. Kick is not currently required to appoint a Data Protection Officer, and has elected not to do so at this time. Kick will update this Privacy Policy if its DPO obligations change.

Kick is the data controller of your Personal Data. At this time, Kick is not required to appoint a Data Protection Officer or a representative in the EU, and has elected not to do so. Kick may be contacted in any manner set forth below in the "Contact Information" Section of this Privacy Policy.

3. Children Under the Age of 18

Our Sites are not intended for children under the age of 18 and children under the age of 18 are not permitted to use our Sites. We will remove any information about a child under the age of 18 if we become aware of it.

No one under age 18 may provide any information to or on the Sites. We do not knowingly collect Personal Data from children under 18. If you are under 18, do not use or provide any information on our Sites or on or through any of its features/register on the Sites, make any purchases through the Sites, use any of the interactive or public comment features of our Sites or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received Personal Data from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have any information from a child under 18, please contact us at support@gokick.com.

4. Information We Collect About You and How We Collect It

We collect different types of information about you, including information that may directly identify you, information that is about you but individually does not personally identify you, and information that we combine with our other users. This includes information that we collect directly from you or through automated collection technologies.

Generally

We collect several types of information from and about users of our Sites, specifically information (“Personal Data”):

We collect this information:

Information You Provide to Us

The information we collect on or through our Sites may include:

The Personal Data we collect from you is required to enter into a contract with Kick, for Kick to perform under the contract, and to provide you with our products and services. If you refuse to provide such Personal Data or withdraw your consent to our processing of Personal Data, then in some cases we may not be able to enter into the contract or fulfill our obligations to you under it.

You also may provide information to be published or displayed (hereinafter, “posted”) on public areas of the Site, or transmitted to other users of the Site or third parties (collectively, “User Contributions”). Your User Contributions are posted on and transmitted to others at your own risk. Although we take measures to ensure the security of our Sites, and any information we collect, please be aware that no security measures are perfect or impenetrable. Additionally, we cannot control the actions of other users of the Sites with whom you may choose to share your User Contributions. Therefore, we cannot and do not guarantee that your User Contributions will not be viewed by unauthorized persons.

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with our Sites, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, specifically:

Third-Party Analytics and Advertising Technologies

We may use third-party analytics, advertising, and measurement tools to help us understand how users interact with the Sites and to measure the effectiveness of our marketing efforts. These tools may include technologies such as pixels, tags, cookies, SDKs, and similar technologies provided by third-party providers such as Meta (Facebook), Google, or other analytics and advertising partners.

The specific third-party tracking technologies currently in use on our Sites include, without limitation: (a) "Analytics": Google Analytics, PostHog, and any other analytics tools currently deployed; (b) "Advertising and Attribution": Meta (Facebook) Pixel, Google Ads conversion tracking, and any other advertising or attribution pixels currently deployed; (c) "Email Tracking": pixel-based email open-tracking and click-tracking tools integrated with our communications platform. We do not currently use session-replay or heat-mapping tools on the portions of our Sites where telehealth consultations, prescriptions, or other protected health information is collected or displayed. These technologies may collect information such as:

This information may be used to analyze usage of the Sites, improve the functionality of our services, and deliver advertising that may be relevant to you.

These technologies are not intended to collect or transmit protected health information related to telehealth consultations, diagnoses, prescriptions, or other medical interactions conducted through our telehealth platform. We have implemented technical and contractual measures to segregate our telehealth platform from marketing and analytics tracking.

We also may use these technologies to collect information about your online activities over time and across third-party websites or other online services (behavioral tracking). Click here for information on how you can opt out of behavioral tracking on this Site and how we respond to web browser signals and other mechanisms that enable consumers to exercise choice about behavioral tracking.

The information we collect automatically is statistical data and may include Personal Data, or we may maintain it or associate it with Personal Data we collect in other ways or receive from third parties. It helps us to improve our Sites and to deliver a better and more personalized service by enabling us to:

Details about the automated data collection technologies and the specific cookies that we use can be found in our Cookie Policy.

5. Lawful Basis for Processing Your Personal Data

We have a lawful basis for our processing of your Personal Data, including processing for our legitimate interests (when balanced against your rights and freedoms), to fulfill our obligations to you under a contract with you, and required by law, and with your consent.

If you are in the European Union, the processing of your Personal Data is lawful only if it is permitted under the applicable data protection laws. We have a lawful basis for each of our processing activities (except when an exception applies as described below):

6. Special Categories of Information

We may process some Personal Data considered sensitive and subject to special protections.

Personal Data collected and processed by Kick may be considered sensitive, including personal data that reveals your racial or ethnic origin, and personal data concerning your mental and physical health. Kick processes this information only to the extent necessary to carry out its obligations under the law or to the extent necessary to protect Kick’s legitimate interests.

7. Automated Decisions Making

We generally do not use your Personal Data with any automated decision making processes.

Kick does not use your Personal Data with any automated decision making process, including profiling, which may produce a legal effect concerning you or similarly significantly affect you.

8. How We Use Your Information

We use your Personal Data for various purposes described below, including to:

We use information that we collect about you or that you provide to us, including any Personal Data:

With your consent, we may also use your information to contact you about our own and third-parties' products and services that may be of interest to you. If you wish to consent to this use, please check the relevant box located on the form on which we collect your data. If you wish to change your choice, you may do so at any time by logging into the Sites and adjusting our user preferences in your account profile by checking or unchecking the relevant boxes or by sending us an email stating your request at support@gokick.com. For more information, see Choices About How We Use and Disclose Your Information.

We may use the information we have collected from you to enable us to display advertisements to our advertisers’ target audiences. Even though we do not disclose your Personal Data for these purposes without your consent, if you click on or otherwise interact with an advertisement, the advertiser may assume that you meet its target criteria. We are not selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, your personal information and data to any persons or entities.

We may de-identify or aggregate personal information so that it can no longer reasonably identify an individual. De-identified or aggregated data may be used by Kick for lawful business purposes, including analytics, research, service improvement, and development of new products or technologies.

8A. Artificial Intelligence and Machine Learning Use of Data

Kick may use de-identified or aggregated data for artificial-intelligence and machine-learning model training and analytics related to drug development, real-world evidence generation, service improvement, and the development of new pharmaceutical formulations and therapeutic products. Our de-identification methodology aligns with the Health Insurance Portability and Accountability Act (HIPAA) Safe Harbor standard at 45 CFR § 164.514(b)(2) or Expert Determination at § 164.514(b)(1).

Kick does NOT use individually-identifiable protected health information for AI or machine-learning model training without a HIPAA-compliant authorization from the affected patient or in accordance with the Notice of Privacy Practices of Kick Health Medical Group.

Kick does not currently use automated decision-making that produces legal or similarly significant effects concerning users (such as automated eligibility determinations or automated pricing). If we begin doing so, we will update this Privacy Policy and provide the disclosures required by applicable law.

If we begin offering a separate program for users to contribute identifiable data to specific research projects, we will obtain affirmative opt-in consent from participants and provide a separate notice describing the program.

9. Disclosure of Your Information

We do not share, sell, or otherwise disclose your Personal Data for purposes other than those outlined in this Privacy Policy. We disclose your Personal Data to a few third parties, including:

We do not sell personal information for monetary consideration. However, certain uses of cookies or similar technologies for advertising or analytics purposes may be considered “sharing” under applicable privacy laws. Where required by law, we provide users with the ability to opt out of such sharing. We do not share, sell, or otherwise disclose your Personal Data for purposes other than those outlined in this Privacy Policy. However, we may disclose aggregated information about our users, and information that does not identify any individual, without restriction. Some content or applications, including advertisements, on the Sites may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We may disclose Personal Data that we collect or you provide as described in this privacy policy:

We may also disclose your Personal Data:

10. Choices About How We Use and Disclose Your Information

We offer you choices on how you can opt out of our use of tracking technology, disclosure of your Personal Data for third-parties to advertise to you, our advertising to you, and other targeted advertising.

We do not control the collection and use of your information collected by third parties described above in Disclosure of Your Information. When possible, these organizations are under contractual obligations to use this data only for providing the services to us and to maintain this information strictly confidential. These third parties may, however, aggregate the information they collect with information from their other customers for their own purposes.

In addition, we strive to provide you with choices regarding the Personal Data you provide to us. We have created mechanisms to provide you with control over your Personal Data:

You can learn more about interest-based advertisements and your opt-out rights and options from members of the Network Advertising Initiative (“NAI”) on its website (www.networkadvertising.org) and from members of the Digital Advertising Alliance on its website (www.aboutads.info). We do not control third parties’ collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can also opt out of receiving targeted ads from members of the NAI on its website.

California residents may have additional personal information rights and choices. Please see “Your California Privacy Rights” below for more information.

Nevada residents who wish to exercise their sale opt-out rights under Nevada Revised Statutes Chapter 603A may submit a request to this designated address: support@gokick.com. However, please know we do not currently sell data triggering that statute’s opt-out requirements.

11. Your Rights Regarding Your Information and Accessing and Correcting Your Information

You may have certain rights under applicable data protection laws, including the right to access and update your Personal Data, restrict how it is used, transfer certain Personal Data to another controller, withdraw your consent at any time, and the right to have us erase certain Personal Data about you. You also have the right to complain to a supervisory authority about our processing of your Personal Data.

Applicable data protection laws may provide you with certain rights with regards to our processing of your Personal Data.

11A. California Notice at Collection (Summary)

This subsection summarizes our collection and use of personal information for California residents at the point of collection, as required by the California Consumer Privacy Act (as amended by the California Privacy Rights Act, "CCPA"). For full details, see Sections 4 (Information We Collect About You) and 8 (How We Use Your Information).

11B. Right to Limit Use of Sensitive Personal Information

If you are a California resident, you have the right to limit our use and disclosure of your sensitive personal information ("SPI"), as defined by the CCPA, to the purposes specified in California Civil Code § 1798.121 (generally: providing the goods or services you requested, and other narrowly defined purposes). To exercise this right, please visit our Cookie Policy and "Your Privacy Choices" page or contact us at support@gokick.com.

We do not use sensitive personal information for purposes other than those for which it was provided, except as permitted by applicable law.

12. State Privacy Rights

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, you may have certain rights in relation to the personal information we collect from you. However, these rights are not absolute, and we may decline your request as permitted by law. These rights include:

Depending on the state you live in, you may also have the following rights:

To exercise these rights, please contact us at: support@gokick.com.

Your California Privacy Rights

If you are a California resident, you have the right to request that the Company discloses the specific personal information and categories we have collected about you. To request this information, please contact us at: support@gokick.com. You can also request to have your personal information deleted that has been collected about you. To submit a deletion request, please contact us at: support@gokick.com.

Pursuant to California Civil Code § 1798.83 ("Shine the Light"), California residents may request, once per calendar year, information identifying any third parties to whom Kick has disclosed personal information for those third parties' direct-marketing purposes during the prior calendar year. To make such a request, contact us at support@gokick.com with "Shine the Light Request" in the subject line. Kick does not currently share personal information with third parties for their direct-marketing purposes outside the cookie-and-pixel "sharing" described in Section 4.

13. Browser Opt-Out Preference Signals (Global Privacy Control)

We honor user-enabled opt-out preference signals (such as Global Privacy Control, or "GPC", and any successor opt-out preference signal recognized by the California Attorney General) as a valid request to opt out of the "sale" and "sharing" of your personal information for cross-context behavioral advertising in U.S. states whose laws require us to do so. Our implementation of this honor signal applies across our advertising stack, including pixel-based advertising integrations.

We may use automated data collection technologies to collect information about your online activities over time and across third-party websites or other online services (behavioral tracking). You can control or limit these activities through (i) your browser settings, (ii) our Cookie Policy and cookie preferences interface, (iii) the GPC and similar opt-out preference signals as described above, and (iv) the third-party opt-out resources referenced in Section 10.

We do not currently respond to legacy "Do Not Track" browser signals, which lack a uniform standard. The Global Privacy Control signal, which is a legally recognized opt-out preference signal under California and other applicable state laws, is the supported and preferred mechanism for browser-based opt-out.

14. Data Security

Information transmitted over the Internet is not completely secure, but we do our best to protect your Personal Data. You can help protect your Personal Data and other information by keeping your password to our Sites confidential.

We have implemented measures designed to secure your Personal Data from accidental loss and from unauthorized access, use, alteration, and disclosure. The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Sites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We urge you to be careful about giving out information in public areas of the Sites like message boards. The information you share in public areas may be viewed by any user of the Sites.

Unfortunately, no method of transmission of information via the internet is completely secure. Although we do our best to protect your Personal Data, we cannot guarantee the absolute security of your Personal Data transmitted to our Sites. Any natural or legal person who processes the data on behalf of the Company may have access to your personal information or data. These third-party vendors collect, store, use, process and transfer information about your activity on our platform in accordance with their privacy policies. Any transmission of Personal Data is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Sites.

Payment card information processed through our payment processor partners is handled in accordance with the Payment Card Industry Data Security Standard (PCI DSS). Kick does not store full payment card numbers on its servers; payment card data is tokenized through our payment processor.

Kick does not currently offer any "financial incentive" programs as defined by the California Consumer Privacy Act (Cal. Civ. Code § 1798.125). We will update this Privacy Policy if we begin offering one.

15. Consent to Processing of Personal Data in the United States/In Other Countries Outside the European Economic Area

Your personal information and data is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction. We only do this when we are legally permitted to do so and when we have appropriate safeguards in place to protect your Personal Data. Your consent to this privacy policy followed by your submission of such information represents your agreement to that transfer.

By using the Sites, users understand and agree that the Company will transfer data to the United States and other global jurisdictions. By choosing to visit the Sites, utilize the services or otherwise provide information to us, you agree that any dispute over privacy or the terms contained in this Privacy Policy will be governed by the laws of Delaware, United States and the adjudication of any disputes arising in connection with the Company or the Website will be in accordance with the Terms & Conditions.

If you are a resident of the European Economic Area (“EEA”) or other regions with laws governing data collection and use, in order to provide our Sites, products, and services to you, we may send and store your Personal Data outside of the EEA or those applicable regions, including to the United States. Accordingly, your Personal Data may be transferred outside the country where you reside or are located, including to countries that may not or do not provide an equivalent level of protection for your Personal Data. By visiting and using the Sites, you are agreeing to the transfer of your information to the United States and to processing of your data globally. By providing your personal information, you consent to any transfer and processing in accordance with this Privacy Policy.

Your Personal Data is transferred by Kick to another country only if it is required or permitted under applicable data protection law and provided that there are appropriate safeguards in place to protect your Personal Data. By using our Sites, you represent that you have read and understood the above and hereby consent to the storage and processing of Personal Data that you provide directly to us on our Sites. To ensure your Personal Data (other than Personal Data you provide directly to us on our Sites) is treated in accordance with this Privacy Policy, Kick uses Data Protection Agreements between Kick and all other recipients of your data that include, where applicable, the Standard Contractual Clauses adopted by the European Commission (the "Standard Contractual Clauses"). The European Commission has determined that the transfer of Personal Data pursuant to the Standard Contractual Clauses provides for an adequate level of protection of your Personal Data. Under these Standard Contractual Clauses, you have the same rights as if your data was not transferred to such third party. You may request a copy of the Data Protection Agreement by contacting us through the Contact Information below.

16. Data Retention Periods

Kick retains personal data only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, including providing our services, complying with legal obligations, resolving disputes, enforcing agreements, and maintaining business records. Retention periods may vary depending on the type of information and applicable legal requirements.

We retain your Personal Data for as long as you keep your account open. In some instances, we may keep it after you close your account, for example we may keep it:

Kick will retain your Personal Data for the entire time that you keep your account open. After you close your account, we may retain your Personal Data:

17. Changes to Our Privacy Policy

We will post any changes to our Privacy Policy on our Sites. If we make material changes to our Privacy Policy, we may notify you of such changes through your contact information and invite you to review (and accept, if necessary) the changes.

We may change this Privacy Policy at any time. It is our policy to post any changes we make to our Privacy Policy on this page with a notice that the Privacy Policy has been updated on the Sites’ home page. If we make material changes to how we treat our users’ Personal Data, we will notify you through a notice on the Sites’ home page. The date this Privacy Policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our Sites and this Privacy Policy to check for any changes.

18. Tracking Technology Consent and Explicit Disclosure

By accessing the Sites and continuing to use them, you expressly acknowledge and consent to the use of the tracking technologies described in Section 4 of this Privacy Policy ("Third-Party Analytics and Advertising Technologies"), including without limitation the specific technologies enumerated in that Section. Your continued use of the Sites after viewing this disclosure constitutes your informed consent to the collection, transmission, and processing of data by such tracking technologies. This disclosure is made pursuant to applicable privacy laws, including the California Invasion of Privacy Act (CIPA), the California Consumer Privacy Act (CCPA/CPRA), and any other applicable state or federal privacy statutes. If you do not consent to the use of these tracking technologies, you must discontinue use of the Sites immediately and may exercise the opt-out rights described in Section 10 of this Privacy Policy.

Nothing in this Section, and no consent given by your continued use of the Sites, shall constitute an authorization for the use or disclosure of "protected health information" under HIPAA. PHI is governed exclusively by Kick Health Medical Group's Notice of Privacy Practices, which controls regardless of any consent expressed in this Privacy Policy or in the Terms of Use.

19. Disputes Regarding Data Handling; Claim Substantiation Requirements

Any dispute, claim, or controversy arising under or relating to the collection, use, sharing, processing, or retention of data under this Privacy Policy is governed exclusively by the dispute-resolution provisions of our Terms of Use, including the pre-dispute notice requirements, informal resolution period, principal-level meeting obligations, arbitration agreement, class-action waiver, governing law, and venue provisions set forth therein. By using the Sites, you agree that any such dispute will proceed in accordance with those Terms of Use provisions and will not be brought as a class, collective, consolidated, or representative action.

If you believe your data has been collected, used, shared, or processed in violation of this Privacy Policy or applicable law, you must include all of the following as part of your pre-dispute notice under our Terms of Use: (a) a complete, unedited copy of the data or records forming the basis of your claim; (b) a detailed written explanation specifying the nature of the alleged violation, the date(s) on which it occurred, the URL(s) accessed, the device and browser used, and the IP address(es) used to access the Site if known; (c) the legal theory or theories on which the claim is based; (d) a description of the actual harm alleged; (e) your fee arrangement with counsel, if any, as described in the Terms of Use notice requirements; and (f) a list of all prior similar claims filed by you or your counsel within the preceding 24 months. This requirement is intended to enable a meaningful investigation of any alleged violation and to screen for fraud and abuse. It shall not be construed to limit any rights you have under applicable law to bring a good-faith claim.

20. Consumer Health Data (Washington, Nevada, and Connecticut)

If you are a resident of Washington, Nevada, or Connecticut (or another state with a consumer-health-data regime that becomes effective after the date of this Privacy Policy), certain information collected through our Sites may constitute "consumer health data" under the applicable state law:

Our handling of consumer health data under each of these regimes is governed by our separate Consumer Health Data Privacy Policy, available at https://www.gokick.com/consumer-health-data-privacy. That policy describes the categories of consumer health data we collect, the sources and purposes of collection, the categories of recipients, your rights of access, correction, deletion, and consent withdrawal, and the consent and authorization mechanisms applicable to collection, sharing, and any sale of consumer health data.

This Privacy Policy and the Consumer Health Data Privacy Policy operate together. Where the laws of Washington apply, the more protective provision controls. Nothing in this Section affects the application of HIPAA to protected health information, which continues to be governed by Kick Health Medical Group's Notice of Privacy Practices.

21. Contact Information

You may contact our Data Protection Officer through the contact information below. If you wish to contact us, you must contact both us and our representative through the contact information below or through the “Contact Us” page on our Sites.

If you have any questions, concerns, complaints or suggestions regarding our Privacy Policy, have any requests related to your Personal Data pursuant to applicable laws, or otherwise need to contact us, you can contact us at the contact information below or through the “Contact Us” page on our Sites.

Kick Health, Inc.
1111B S Governors Ave
Ste 48267
Dover, DE 19904-6903
United States
support@gokick.com