Privacy Policy — Cove Teams Inc.

I. Privacy Policy

A. Acceptance of Terms

Cove Teams Inc. (“Cove”) is committed to protecting Your privacy when You visit the Cove website located at https://covetherapysystem.com/, the Cove mobile application, and other websites owned by Cove (collectively, the “Cove Website”). This Privacy Policy explains how we collect and use Your information. This document should be read in conjunction with the Cove Terms of Use.

B. Term Definitions

• “Cove Website” refers to the Cove website at https://covetherapysystem.com/, the Cove mobile application, and other websites owned by Cove.
• “Cove” refers to Cove Teams Inc.
• “Cove Mobile App” refers to the iOS and Android application that provides parents access to their child’s assigned therapy programs and caregiving tools.
• “Platform” (also “Cove Platform”) refers to the Cove Website and Cove Mobile App collectively, through which Cove provides its services.
• “User Profile” refers to a profile posted by a User on the Cove Website.
• “You,” “Your,” and “User” refer to any individual or entity visiting or otherwise accessing the Cove Website.
• “Content” refers to all information, data, text, photographs, graphics, video, messages, or other materials posted on the Cove Website.
• “Personal Information” includes any information that identifies or describes an individual, including name, date of birth, health status, medical or employment history, and related information.
• “Protected Health Information” or “PHI” means individually identifiable health information as defined under HIPAA, including, without limitation, all health data about a minor child submitted through the Platform.
• “RTM Data” refers to caregiver-generated activity logs, feed posts, monitoring day counts, timestamps, and therapist review records generated through the Cove Platform when a clinic has enabled the Remote Therapeutic Monitoring (RTM) feature.
• “Authorized Caregiver” refers to any individual, other than the Primary Account Holder, who has been explicitly invited by the legal guardian to access the child’s account and contribute activity logs through the Cove Platform.
• “Primary Account Holder” refers to the parent or legal guardian who accepts the clinic’s invitation or directly enrolls and is the primary controller of the child’s health record within Cove.

C. Collection of User Data

Cove collects User data during registration and use of the Cove Website and associated services, with the consent of the User, for the legitimate business purpose of providing the services offered by the Cove Website.

II. Your Personal Information

A. Information Collected by Cove

By voluntarily creating a User Profile on the Cove website, You agree to the Cove Terms of Use and consent to Cove’s collection of Personal Information.

Within the last twelve months, Cove has collected the following categories of personal information:

Personal Information is provided at Your own risk. By providing Your Personal Information, You communicate Your consent to Cove’s collection, use, and disclosure of such information as described in this Privacy Policy.

B. Data Controller

For the majority of the information maintained, collected, or used by Cove, Cove is the data controller. For healthcare data relating to a specific child and their treatment, the treating clinic and/or the child’s legal guardian may be the data controller for whom Cove holds and processes data as a Business Associate. Inquiries can be directed to [email protected].

Clinic as Data Originator. When a therapist creates a home program, assigns therapy goals, or generates activity assignments within the Platform, the treating clinic is the data originator and retains responsibility for the clinical accuracy of that content. Cove processes this content on behalf of the clinic as a Business Associate under HIPAA.

C. Using Your Information

Information is collected about You in order to establish and enhance its relationship with You. Cove’s use of this information includes: (i) clinical care coordination between therapists, families, and caregivers; (ii) personalizing Your experience; (iii) improving the Platform through Your feedback; (iv) responding to customer service requests; (v) processing transactions; (vi) contacting You; (vii) insurance billing support, including RTM claims where applicable; (viii) collecting anonymized, aggregated usage data to understand how families use the Platform and to improve the product experience over time; and (ix) any other purpose disclosed to You at the time we collect Your information.

D. Updating and Deleting Your Information

On the Cove Website You are able to correct, update, review, or delete information You have submitted. If you are unable to make changes on the Cove Website, contact us at [email protected] or (630) 335-3583. You have the right to withdraw consent to Cove’s use or processing of Your Personal Information at any time; doing so may limit your ability to use certain services.

E. Retention of Information

Cove stores and retains Personal Information for the period specified by applicable legal and regulatory requirements. RTM evidence packets and associated monitoring data are retained for a minimum of six (6) years from the date of creation, as required by applicable law and payer record-retention requirements. Clinics in states with longer retention requirements are responsible for ensuring compliance.

F. Information Sharing and Disclosure

We may share Your information with trusted third parties who assist us in operating the Cove Website, as long as those parties agree to keep this information confidential consistent with applicable laws.

Authorized Caregiver Access. When a Primary Account Holder invites an Authorized Caregiver, that caregiver is granted access to the child’s full home program content (therapy goals, activity assignments, therapist instructions), the child’s activity log history, and other health record data within the Platform. The Authorized Caregiver may also submit activity logs and feed posts on the child’s behalf. By inviting an Authorized Caregiver, the Primary Account Holder consents to this access.

RTM-specific disclosure pathway. When a clinic has enabled RTM and a guardian has provided active RTM Billing Consent, the following disclosure pathway applies to that child’s RTM Data:

• Caregiver activity logs are transmitted from the Cove app to Cove’s HIPAA-compliant servers
• The treating clinic’s therapist and billing staff access RTM evidence packets for clinical review and insurance claim preparation
• The child’s insurance plan receives PHI as required to process and adjudicate RTM billing claims
• Cove’s HIPAA-compliant subprocessors handle secure storage and transmission under Business Associate Agreements

No other parties receive RTM Data without separate written authorization from the legal guardian.

G. Sale of Personal Information

In the past twelve months, Cove has not sold any collected Personal Information to third parties. Cove does not sell PHI.

H. Changes in Cove Teams Inc.

If Cove is sold, merged, or otherwise transferred, Personal Information may be transferred along with it.

I. Information Use — Cove Mobile App

You may opt into receiving Push Notifications from the Cove Mobile App. If you wish to stop receiving push notifications, you may turn off this feature in your device settings. When you delete the Cove mobile application, information saved on your device will be deleted, but information collected and stored on Cove’s servers will remain.

J. Additional Information Use

We may use Your email for transactional purposes (account confirmations, notifications) and promotional purposes (newsletters, feature announcements). You may unsubscribe at any time using the Unsubscribe link at the bottom of any promotional email.

K. Access to Information

Users may request access to their information collected or processed by Cove by contacting [email protected]. Upon verification of Your identity, we will provide a copy of the data we process about You. For sensitive healthcare data, we may need to coordinate with your healthcare provider.

L. International Privacy Laws

If You are accessing the Cove Website from outside the United States, please be aware that You are sending information to the United States where Cove’s servers are located. If You reside within the European Union, You may have the right to file a complaint with your local supervisory authority.

M. California Residents’ Rights

This section applies only to Users who reside in the State of California. Under the CCPA, California consumers have the right to know, access, and request deletion of Personal Information, and the right not to be discriminated against for exercising these rights. To submit a request, email [email protected] with your name, email address, and California postal address. You may also call (630) 335-3583. You may only submit a request to know twice within a 12-month period.

N. Illinois Biometric Information Privacy Act (BIPA) Disclosure

Cove may offer device-level biometric authentication (Face ID / Touch ID) as an optional method to secure account login. The following disclosures apply to Users who enable this feature:

• What is collected: Cove does not collect, store, or transmit biometric identifiers. Biometric authentication is processed entirely by the Apple iOS or Android operating system on the user’s device. Cove receives only a pass/fail authentication signal from the operating system.
• Purpose: Authentication only. Biometric data is not used for advertising, profiling, or clinical monitoring.
• Retention: Because Cove does not store biometric data on its servers, there is no Cove-side retention schedule. Biometric data stored on your device is governed by Apple’s or Google’s privacy policies.
• Disclosure: Cove does not sell, lease, trade, or profit from any biometric data.
• Consent: By enabling biometric login, You consent to the device-level authentication described above. You may disable biometric login at any time in your device settings or Cove account settings.
• Complaints: Illinois residents may contact [email protected] or file a complaint with the Illinois Attorney General’s office.

O. Remote Therapeutic Monitoring (RTM) Data

This section applies only to accounts where the treating clinic has enabled RTM and the legal guardian has provided active RTM Billing Consent. If RTM is not enabled for your child’s account, this section does not apply.

What RTM is. RTM is a Medicare- and insurance-recognized service that allows physical therapists, occupational therapists, and speech-language pathologists to monitor therapy activity between clinic visits using digital tools.

Data collected under RTM. When RTM is enabled, Cove collects and stores the following on behalf of the treating clinic:

• Caregiver-generated activity logs (exercises completed, therapy tasks recorded), with date and time stamps
• Free-text feed posts and caregiver notes submitted in the app
• The count of days in a calendar month on which at least one caregiver-generated signal was recorded (monitoring day count)
• Therapist review time and live interaction logs

How RTM data is used for billing. The monitoring record above is used to generate an RTM evidence packet, which the clinic’s billing staff uses to prepare and submit insurance claims each month. Your child’s insurance plan will receive the evidence packet as part of the claims process and will issue an Explanation of Benefits (EOB) for any month RTM is billed.

Consent required. RTM data collection and billing use requires a separate, active RTM Billing Consent signed by the legal guardian before monitoring begins. The legal guardian may revoke RTM consent at any time by contacting [email protected] or notifying the clinic directly. Revocation stops future data collection and billing but does not affect prior claims.

Medicaid note. RTM coverage under Medicaid varies by state and managed care plan. If RTM is not covered by the child’s insurance plan, the clinic will confirm this before submitting any RTM claim.

P. Minor and Child Health Data

Who submits child health data. The Cove Platform is designed for use by adults — parents, legal guardians, licensed therapists, and Authorized Caregivers — acting on behalf of minor children. Cove does not permit children to create accounts or submit data directly.

What child health data includes. For purposes of this Policy, child health data includes: the child’s full legal name and date of birth; diagnoses and therapy types; treatment plan content (therapy goals, home program activity assignments, therapist instructions); activity engagement and completion data; caregiver-submitted media (photos, videos) documenting home program activities; caregiver feed posts and free-text notes; and scheduling and documentation records. All such data is treated as PHI under HIPAA where Cove is acting as a Business Associate.

Legal guardian as Primary Account Holder. The legal guardian who accepts the clinic’s invitation or directly enrolls is the Primary Account Holder for that child. The Primary Account Holder is the primary data controller for the child’s health record within Cove and may invite Authorized Caregivers to access the child’s account.

Authorized Caregivers. An Authorized Caregiver is any individual explicitly invited by the legal guardian through the Cove Platform to access the child’s account and contribute data. By accepting an invitation, an Authorized Caregiver agrees to Cove’s Terms of Use and acknowledges that their contributions become part of the child’s health record, which may be used for clinical and billing purposes including RTM (if enabled). The legal guardian may revoke any Authorized Caregiver’s access at any time through account settings.

Data contributed by Authorized Caregivers. Activity logs, feed posts, and other data submitted by Authorized Caregivers are attributed to the child’s account and treated as PHI. Authorized Caregivers do not have independent data rights over the child’s health record; those rights remain with the legal guardian.

HIPAA and COPPA. All child health data is treated as PHI under HIPAA where Cove is acting as a Business Associate of the treating clinic. Cove also complies with COPPA and does not knowingly collect personal information directly from children under 13.

Guardian data rights. The legal guardian may at any time: request a copy of all data held about their child; request correction of inaccurate entries; request deletion (subject to HIPAA retention obligations); and revoke access for any Authorized Caregiver. To exercise these rights, contact [email protected].

III. Automatically Collected Information

As You use Cove, certain information may also be passively collected, including Your Internet protocol address, browser type, and operating system. Cove uses Cookies and navigational data to gather information regarding the date and time of Your visit and the solutions and information for which You searched and viewed. Cove uses third-party analytical tools on both public and password-restricted pages of the Cove Website to improve the Platform.

IV. Safety Measures

A. Internet Security

We use a variety of security measures to maintain the safety of Your Personal Information, including: a secure server; TLS-encrypted data transmission; AES-256 encryption of all stored data including PHI, treatment plan content, and media files; data stored behind a secure firewall; role-based access controls limiting data to authorized users; and credit card information not stored on our servers after transactions.

B. Security Limitations Disclaimer

Cove cannot and does not guarantee that Personal Information will not be accessed by unauthorized persons. Despite Cove’s efforts to safeguard Your personal information, there is always a risk of security breach. Cove is not responsible for circumvention of any privacy settings or security measures.

C. Changes to this Privacy Policy

Cove reserves the right to make changes to this privacy policy at any time by giving notice to its users on this page. It is strongly recommended to check this page often, referring to the date of the last modification listed at the bottom.

Questions?

For questions about this Privacy Policy, email us at [email protected].