Privacy Policy

Introduction

Glace, operated by Glace Technologies Inc. ("we", "us", "our"), values your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, protect, and disclose information gathered from users ("you", "user") through our website https://glace.sh and all its subdomains (including demo.glace.sh and app.glace.sh) or through any personal customer support interactions you may have with Glace.

Information We Collect

We may collect the following types of information:

• Personal Information: Information that identifies you personally, such as your name, email address, account credentials, gender, age, and contact details provided during account registration or customer support interactions.
• Usage Information: Non-personal information regarding your interaction with our platform, such as access dates, session durations, device type, browser type, IP address, operating system, and pages visited.
• Content Information: Brand assets, media, patient-facing content, and other materials you upload, provide, or approve on the platform, along with the campaign, scheduling, and attribution data generated as the platform operates.
• Patient and Appointment Information: Where you use features such as our AI voice agents, AI receptionists, or scheduling and attribution integrations, the platform may receive and process information about your patients, including names, contact details, appointment and booking details, call recordings or transcripts, and, in some cases, protected health information. We process this information on your behalf as a business associate under HIPAA, as described under "Information Sharing and Disclosure" below.

Use of Information

We use collected information to:

• Provide, maintain, and enhance our services
• Process transactions and manage user accounts
• Respond to user inquiries and provide customer support
• Monitor usage trends and analyze platform performance
• Develop new products, services, and features
• Communicate with you about updates, security alerts, and promotional offers

Cookies, Analytics, and Advertising

Our website uses cookies and similar technologies. In particular, we use the Google tag (gtag.js) and Google Ads conversion tracking to measure how visitors reach our site and whether they take actions such as booking a call. These tools may set cookies and collect device identifiers, IP address, and page interaction data, and Google may use this data as described in its own privacy policy. We use this information to measure and improve our marketing. Some laws treat this kind of advertising measurement as targeted advertising. You can control it in the following ways:

• Adjust your browser settings to block or delete cookies. Parts of the website will still work without them.
• Opt out of Google's personalized advertising at adssettings.google.com.
• Use the industry opt-out tools of the Network Advertising Initiative and the Digital Advertising Alliance.
• Email us at contact@glace.sh to ask that we exclude your information from advertising measurement.

We do not use cookies or tracking technologies on our website to collect health information about visitors, and we do not use advertising trackers inside the logged-in platform or on any patient-facing experience that involves protected health information.

Data Retention

We only retain the information we collect for as long as is necessary to provide our services or for our legitimate interests, such as accounting and legal compliance. At the end of that period, the collected information is either deleted or de-identified.

Data Protection and Security

We implement commercially reasonable, industry-standard security measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Information Sharing and Disclosure

We do not sell or rent your personal information to third parties. We may share your information under these conditions:

• With trusted service providers who assist us in operating, hosting, analyzing, or optimizing our platform, under strict confidentiality agreements and, where the service providers handle protected health information, a Business Associate Agreement
• In response to legal obligations or valid requests from authorities
• To protect our rights, property, safety, or the integrity of our services
• We may share anonymized, aggregated, or de-identified usage insights publicly or with third parties for research, analytics, or promotional purposes; such insights never include protected health information. We will not attempt to re-identify de-identified data, and we contractually require anyone who receives de-identified data from us to make the same commitment.

HIPAA and protected health information. Many of our clients are healthcare practices. When Glace creates, receives, maintains, or transmits protected health information ("PHI") on a practice's behalf, Glace generally acts as a "business associate" and the practice as a "covered entity" (or an upstream business associate) under the U.S. Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, "HIPAA"). In those cases, the applicable Business Associate Agreement ("BAA") governs our handling of PHI and controls over anything to the contrary in this Privacy Policy. In general:

• We enter into a BAA with the practice before receiving or processing PHI, and we use and disclose PHI only as permitted by that BAA and by HIPAA, such as to provide the services requested by the practice, as directed by the practice, or as required by law. We do not sell PHI, and we do not use or disclose PHI for our own advertising or marketing. Our standard form BAA is published on our website.
• We limit access to PHI to workforce members who need it to provide the services and apply the minimum-necessary standard.
• We maintain commercially reasonable administrative, physical, and technical safeguards designed to protect PHI, consistent with our obligations under the applicable BAA and HIPAA.
• Where subcontractors create, receive, maintain, or transmit PHI on our behalf, we require them to agree in writing to protections consistent with those in our BAA.
• If we become aware of a breach relating to PHI, we will notify the affected practice in accordance with the applicable BAA and the HIPAA Breach Notification Rule.

If you are a patient of a practice that uses Glace, your health information is controlled by that practice as the covered entity. Please direct any requests regarding your PHI, such as access or amendment, to your practice, who may then coordinate with us.

Consumer Health Data

Our website is intended for healthcare practices and their staff, not for patients, and it is not designed to collect consumer health data as defined by the Washington My Health My Data Act, Nevada's consumer health data law, or other similar state laws. Health information that we process on behalf of a practice under HIPAA and a BAA is exempt from those laws and is handled as described above. To the extent we ever collect consumer health data outside of HIPAA, for example if you voluntarily include health details in a message to us, our supplemental Consumer Health Data Privacy Notice (Annex A) describes that data and your rights, including for Washington and Nevada residents.

Children's Privacy

Our website and platform are not directed to children under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us at contact@glace.sh so that we can take appropriate measures.

International Visitors

We are a United States company and process information in the United States. If you access our website from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction.

Your Rights and Consent

By using our platform, you consent to our collection and use of your data as described in this Privacy Policy. You have the right to:

• Know and access the personal data we hold about you
• Request correction or update of your personal data
• Request deletion of your personal data, subject to legal or contractual obligations
• Withdraw consent or object to certain types of data processing
• Opt out of targeted advertising, as described under "Cookies, Analytics, and Advertising" above; we do not sell your personal information
• Right to appeal a failure to act on the part of Glace within the time set forth in the applicable consumer data privacy law; if your appeal is denied, you may contact your state Attorney General

To exercise these rights, contact us at contact@glace.sh.

Requests Made Through Agents

You may have the option to designate, through the use of a proper legal instrument, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf.

Discrimination Based on the Exercise of Rights

While Glace would never discriminate against anyone who chooses to exercise their statutory rights, it is important to note that our provision of services to you may be completely related to our ability to collect data. Therefore, if you have asked us to stop collecting data about you, then we may be unable to provide you with services.

Policy Updates

We may update this Privacy Policy periodically to reflect changes in our data practices or applicable laws. All revisions will be posted prominently on our website, along with the effective date. Your continued use of our platform after changes signifies your acceptance of the updated Privacy Policy.

Contact Us

If you have any questions, concerns, or feedback regarding our privacy practices, please reach out to us at contact@glace.sh.