PrivacyPolicy

Last Updated: 16 September 2025

October Health LLC operates and maintains a website (located at https://october.health) (the “Site”) and the October online platform, which provides predictive and proactive mental health support and resources for high performing staff and human resource teams (the “Platform”). The Platform includes a 24/7 live data platform that provides real-time business intelligence on employee mental wellness, team and corporate culture and performance with actionable insights (the “Data Portal”), employee-facing mobile application (the“Mobile App“) which includes self-guided content, live, audio-only, proactive, interactive, digital, psycho-educational and support group sessions and other coaching and companionship services generated by artificial intelligence (collectively with the Site, the “Services” or “Service”).

October Health licenses the use of our Services to third parties, including ReviveHealth, Inc. or one of its affiliates or subsidiaries (“Revive”), an unaffiliated third party who operates mental health programs on behalf of your sponsoring organization and offers services which have integrated October Health's Services into Revive's products. By using our Services, you expressly authorize (i) us to disclose information to Revive; and (ii) Revive to access and/or use your information as set forth in more detail in this Privacy Policy. Use of the Services may also be subject to Revive's terms of service and privacy policies. This Privacy Policy explains how we handle your personal information and your choices regarding our data practices. Please read it carefully.

This Privacy Policy explains what personal information we collect from individuals who use our Mobile App and other individuals, such as representatives of our business customers, whose interactions with us include browsing our Site, subscribing to our newsletters or other communications, or interacting with us on social media. We refer to all of these individuals collectively as “users” or“you”. This Privacy Policy explains how we handle your personal information and your choices regarding our data practices.

This Privacy Policy does not apply to personal information pertaining to authorized users of the Data Portal or information that your employer, insurer, or related institution provides us to verify your eligibility for and facilitate your access to the Platform (such as your name, email address, and relationship to the organization). We process this information as instructed by our customers, in our capacity as a service provider/data processor, in accordance with the terms of our customer agreements.

Any references to "October", "we", "us" or"our" in this Privacy Policy shall be to October Health LLC, a subsidiary of October Health Limited.

Personal Information We Collect

We collect the following categories of personal information about you:

Information you provide to us:

• Contact information that you provide when you sign up for our newsletter or contact us about our Services, such as your first and last name, email and mailing addresses, and phone number.
• Account information that you provide when you create an account on our Mobile App, such as your username, password, age range, selected interests, and your profile picture and gender information if you voluntarily choose to provide it.
• Health and wellness information and other user content that you may choose to provide when you use the Mobile App, including any text or audio information that you upload. For example, you may choose to provide information about your mental health and well-being when you use our AI-powered coaching tool, share comments in the Forest (being October’s core peer support community feature within the Mobile App), or write in your October journal. Where required by applicable law, we will collect this information only with your consent.
• Fitness module (opt-in). If you choose to participate, you may connect a device/app and share activity data in the Mobile App. You can also choose to provide additional health/wellness inputs for your own use in-app (e.g., weight, BMI, body composition, heart rate, location or other biometrics).
• Communications that we exchange with you, including when you contact us with questions, feedback, or otherwise.
• Marketing information such as your preferences for receiving our marketing communications and details about your engagement with them.
• Other information not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Information we obtain from cookies and other automated technologies, such as information about the devices you use to engage with our Services, and online activity data. For more details about the technologies we use, the categories of information we collect, and how we use this information, please review our Cookie Policy.

Information we obtain from other sources:

• Social media. We may maintain pages on social media platforms, such as X, LinkedIn, and other third-party platforms. When you visit or interact with our pages on those platforms, the platform provider’s privacy policy will apply to your interactions and their collection, use and processing of your personal information. You or the platforms may provide us with information through the platform, and we will treat such information in accordance with this Privacy Policy.
• Connected health platforms (opt-in). If you link health data from your device, we receive activity data, including steps, exercise minutes, and sleep duration for delivery of the Services. We may also receive limited technical metadata (e.g., device type, sync timestamps) needed to operate the connection.
• Other sources. We may obtain personal information from other third parties, such as marketing partners, publicly available sources, and data providers.

How We Use Personal Information

We use personal information for the following purposes or as otherwise described at the time of collection:

To provide our Services. We use personal information to operate, maintain, and provide you with our Services. In particular, we use personal information to perform our contractual obligations under our terms of service, except where consent is required under applicable law.

To communicate with you about our Services. It is in our legitimate business interests to use personal information to respond to your requests, provide customer support, and communicate with you about our Services, including by sending announcements, updates, security alerts, and support and administrative messages.

To improve, monitor, personalize, and protect our Services. It is in our legitimate business interests to improve and keep our Services safe for our users, which includes:

• Understanding your needs and interests, and personalizing your experience with the Services and our communications.
• Troubleshooting, testing and researching, and keeping the Services secure.
• Investigating and protecting against fraudulent, harmful, unauthorized, or illegal activity.

Employer-Mandated Learning & Development (L&D) Activities. For certain employer-mandated activities—such as coaching courses, assessments, or training sessions—October Health may track attendance and provide a list of participating company email addresses to the employer strictly for verification purposes. This applies only to designated L&D or engagement activities. No usernames, pseudonyms, engagement details, health information, or personal insights will be disclosed.

Gamification & Public Display. At October Health, we use a few fun features like leaderboards, streaks, and activity highlights to help make wellness feel more engaging and motivating. These are all about celebrating small wins and encouraging friendly interaction—not about competition or pressure. To keep things social, your chosen display name (nickname) might be visible to others in features like leaderboards, Forest sessions, and friend suggestions. You’re always in control: you can set a nickname that feels comfortable and there's no need to use your real name if you prefer not to. Plus, joining in on these features is completely up to you. We’re here to create a positive, supportive space where everyone can feel good about showing up for their mental health—however it suits them best.

For research and development. We may use personal information for research and development purposes where it is in our legitimate business interests, including to analyze and improve the Services and our business. As part of these activities, we may create or use aggregated, de-identified, or other anonymized data from personal information we collect. We make personal information into anonymized data by removing information that makes the data personally identifiable to you. We may use this anonymized data and share it with third parties, such as your employer or related institution, for our lawful business purposes, including to analyze and improve the Services and promote our business.

For marketing and advertising, including for:

• Direct marketing. We may send you direct marketing communications as permitted by law, including by email. You may opt-out of our marketing communications as described in the Opt-out of marketing communications section below. Except where consent is required, we undertake such marketing on the basis of our legitimate business interests. Where we seek your consent, you may withdraw your consent at any time.
• Interest-based advertising. We use cookies and similar technologies to engage in interest-based advertising. Please review our Cookie Policy for more information. Where required by applicable law, we will engage in interest-based advertising only with your consent.

For compliance and protection. We may use personal information to comply with legal obligations, and it is in our legitimate business interests to enforce our terms of service and to defend our business against legal claims or disputes, including to:

• Protect our, your, or others’ rights, privacy, safety, or property (including by making and defending legal claims).
• Audit our internal processes for compliance with legal and contractual requirements and internal policies.
• Enforce the terms and conditions that govern the Services.
• Prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity, including cyberattacks and identity theft.
• Comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.

Personal Information Disclosure

How We Disclose Personal Information

We may disclose personal information to the following individuals or entities:

Service providers. Companies and individuals that provide services on our behalf or help us operate the Services of our business (such as hosting, information technology, customer support, email delivery, and website analytics services).

October Health licenses the use of our Services to third parties, including ReviveHealth, Inc. or its affiliates or subsidiaries (“Revive”), an unaffiliated third-party who operates mental health programs on behalf of your sponsoring organization and offers similar services which have integrated October Health's Services into Revive's products.
By using our Services, you expressly agree to permit (i) October Health to disclose to Revive information provided by you, collected via our Services, and through other means as outlined in this Privacy Policy; and (ii) Revive to access and use your information, including without limitation personal information, for purposes as outlined in this Privacy Policy and Revive's privacy policy. . Such information disclosed to and accessed by Revive may include, without limitation, personal information, aggregated and identifiable data about your interactions with the Services, including survey responses, assessment responses and results, interactions with coaching modules, and all other data types submitted by and collected from you while utilizing the Services. By using our Services, you expressly agree that Revive may access and use your personal information collected via our Services, including to contact you directly for treatment, payment, and operations purposes or to communicate about Revive's services and such benefits that may be available to you under your sponsoring organization’s program. Revive will not share personal information accessed by Revive with your sponsoring organization. Please note that all information provided by us to Revive may be subject to Revive’s terms of service and privacy policies. For more information, please see Revive’s Terms of Service and Privacy Policy. If you wish to opt out of the sharing of your data to Revive, or if you have any additional questions regarding Revive’s use of your information, please contact Revive at 1-888-220-6650.

Advertising vendors. Third-party advertising companies, including for the interest-based advertising purposes described above, that can collect information on our website through cookies and other automated technologies. Please review our Cookie Policy for more information.

Professional advisors. Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.

Employers. If you access our Services as part of an employer-sponsored business package, we may need to verify your employment status to ensure your eligibility for continued access. To facilitate this, we may share your company email address with your employer or its designated representative for the sole purpose of confirming your active employment status. In addition, we may share information in the following instances:

• Aggregated and Anonymized Data: October Health shares aggregated and anonymized data with employers for purposes such as organizational insights and wellness tracking. This may include usage trends, feature engagement, or redemption activity. Such data does not identify any individual user.
• Leaderboard Data: If an employee user opts into the leaderboard, their name and related utilization metrics (e.g., sessions attended, coaching courses completed, assessments completed, and features utilized) will be visible on company-wide leaderboards accessible to other users and administrators of the employer organization. No underlying engagement content or individual input data is shared. Leaderboard data is kept wholly separate from any health-related or engagement-derived insights. We do not correlate session content or user responses with leaderboard standings.
• Employer Mandated Activities. October Health does not disclose personal information to your employer, insurer, or a similar related institution. In the case of employer-mandated Learning & Development (L&D) or engagement activities, such as coaching courses, assessments, pulse surveys, or training sessions, we may provide attendance or completion records associated with company email addresses to confirm participation. No pseudonyms, usernames, health data, or engagement details will be shared—only confirmation of attendance or completion for the required activity.
• Fitness Competitions & Top Performers (Opt-In; Limited Disclosure)
  • Definitions. “Fitness Metrics” means: (i) Daily Steps (count); (ii) Exercise Minutes (total active minutes per day); and (iii) Sleep Duration (hours/minutes per night). “Top Performers” means the top percentile cohort for a given competition period, as defined in the program rules.
  • Scope of sharing (Top Performers only). If you opt in to the fitness module and participate in an employer-run competition, October may disclose to your employer, for Top Performers only and limited to the applicable competition period:
    • the Fitness Metrics; and
    • the company email addresses of such Top Performers solely to verify results and administer rewards.
  • No other disclosures. October does not disclose any other health metrics (e.g., weight, BMI, body composition, heart rate, location, or other biometrics), engagement content, personal insights, or underlying session data for this purpose. Leaderboard data remains segregated from health-related insights and is not correlated with session content or user responses.
  • Consent & withdrawal. By connecting your device/app and opting in, you consent to the processing and limited disclosures above. You may withdraw at any time by disconnecting your device/app or disabling fitness participation in settings; upon withdrawal you will be removed from leaderboards/competitions and will not be eligible for awards tied to shared metrics.

Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above. While October may choose to make such a disclosure to law enforcement when requested or required by law, you acknowledge and agree that October as no obligation to disclose information regarding a user who is at high risk of committing suicide or harming others.

Business transferees. Acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, our business (including, in connection with a bankruptcy or similar proceedings).

How You Disclose Personal Information

Other users. You may disclose personal information to other users of the Services. For example, you may participate in digital group sessions where you can learn, ask questions, and listen to others on topics from parenting to depression. You only disclose the personal information you voluntarily choose to provide.

Third-Party AI Technology

Our Platform leverages third-party AI technology provided by our service providers in connection with our website chatbot and AI coaching tool. The AI coaching technology is trained on real-world data to generate intelligent and personalized coaching and companionship. To enable us to provide you with these personalized services, we will share your personal information with the AI service providers that power our products. We require these providers to use your information only for the purpose of allowing us to provide our Services to you, and we do not allow the providers to train their AI models using your data.

Privacy Rights and Choices

Opt out of marketing communications. You may opt out of marketing-related emails and other communications by following the opt-out or unsubscribe instructions in the communications you receive from us or by contacting us as provided in the How to Contact Us section below. You may continue to receive Services-related and other non-marketing emails.

Opt out of push notifications. If you opt in to receive push notifications within the Mobile App, we may send push notifications or alerts to your mobile device from time to time. You can deactivate push notifications and alerts at any time by changing your device settings, changing the push notification settings within the application, or deleting the App.

Personal information requests. We also offer you choices that affect how we handle the personal information that we control. Depending on your location and the nature of your interactions with our Services, you may request the following in relation to personal information:

• Information about how we have collected and used personal information. We have made this information available to you without having to request it by including it in this Privacy Policy.
• Access to a copy of the personal information that we have collected about you. Where applicable, we will provide the information in a portable, machine-readable, readily usable format.
• Correction of personal information that is inaccurate or out of date.
• Deletion of personal information that we no longer need to provide the Services or for other lawful purposes.
• Withdrawal of consent, where we have collected and processed your personal information with your consent. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
• Additional rights, such as to object to and request that werestrict our use of personal information.

Employee Rights and Choices

Employees participating in employer-mandated L&D activities acknowledge that their attendance or completion rates may be recorded and shared with their employer via their company email address for verification purposes. Employees will be clearly informed in advance if a session, course, or assessment falls under this requirement. Participation in all other October Health services remains fully anonymous and confidential.

To make a request, please email us or write to us as provided in the How to Contact Us section below. We may ask for specific information from you to help us confirm your identity. Depending on where you reside, you may be entitled to empower an authorized agent to submit requests on your behalf. We will require authorized agents to confirm their identity and authority, in accordance with applicable laws. You are entitled to exercise the rights described above free from discrimination.

Limits on your privacy rights and choices. In some instances, your choices may be limited, such as where fulfilling your request would impair the rights of others, our ability to provide a service you have requested, or our ability to comply with our legal obligations and enforce our legal rights. If you are not satisfied with how we address your request, you may submit a complaint by contacting us as provided in the How to Contact Us section below. Depending on where you reside, you may have the right to complain to a data protection regulator where you live or work, or where you feel a violation has occurred.

Other Sites and Services

Our Services may contain links to websites and other online services operated by third parties, including Revive. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites or online services operated by third parties, and we are not responsible for their actions. This Privacy Policy does not apply to such third-party sites or services.

Security

We use reasonable organizational, technical, and administrative measures designed to protect against unauthorized access, misuse, loss, disclosure, alteration, and destruction of personal information we maintain. Unfortunately, data transmission over the Internet cannot be guaranteed as completely secure. Therefore, while we strive to protect your personal information, we cannot guarantee the security of personal information.

Retention of Personal Information

Where required under applicable laws, we retain personal information only for as long as is necessary to fulfill the purposes for which it was collected and processed, in accordance with our retention policies, and in accordance with applicable laws and regulatory obligations or until you withdraw your consent (where applicable).

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of personal information, the purposes for which we use personal information and whether we can achieve those purposes through other means, and the applicable legal and regulatory requirements.

Job Applicants

When you visit the Careers portion of our Site, we collect the information that you provide to us in connection with your job application. This includes but is not limited to business and personal contact information, professional credentials and skills, educational and work history, and other information of the type that may be included in a resumé. This may also include diversity information that you voluntarily provide and that we process on the basis of your consent. We use this information on the basis of our legitimate business interests to facilitate our recruitment activities and process employment applications, such as by evaluating a job candidate for an employment activity, to monitor recruitment statistics, and to respond to surveys. We may also use this information to provide improved administration of the Services and as otherwise necessary (i) to comply with relevant laws or to respond to subpoenas or warrants served on us, (ii) to protect and defend our or others’ rights or property, (iii) in connection with a legal investigation and (iv) to investigate or assist in preventing any violation or potential violation of the law, this Privacy Policy or our terms.

Children

The Services are not intended for use by children under 16 years of age. Children between the ages of 16-18 affirm that they have obtained the approval of their parent or guardian to utilize the Mobile Application, where required by law. If we learn that we have collected personal information through the Services from a child without the consent of the child’s parent or guardian as required by law, we will delete it.

Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Where we do so, we will update the date of this Privacy Policy and post it on the Site. If we make material changes to this Privacy Policy, we will let you know.

How to Contact Us

Responsible entity. October is the entity responsible for the processing of personal information under this Privacy Policy (as a controller, where provided under applicable law).

Contact us. If you have any questions or comments about this Privacy Policy, our privacy practices, or if you would like to exercise your rights with respect to your personal information, please email us at help@october.health or write to us at:

October Health
2nd Floor, 168 Shoreditch High St
London, E16RA

COOKIE POLICY

This Cookie Policy explains how October (“we”, “our”, or“us”) uses cookies and similar technologies in connection with our Services. This Cookie Policy should be read in conjunction with our Privacy Policy.

If you have any questions or concerns about the Cookie Policy, please contact us at help@october.health or as otherwise described in our Privacy Policy.

What are cookies and similar technologies?

• Cookies are text files that websites store and access on a visitor’s device to uniquely identify the visitor’s browser or to store information or settings in the browser to allow us distinguish you from other users of our Services for the purpose of helping you navigate between pages efficiently, remembering your preferences, enabling functionality, helping us understand activity and patterns, and facilitating online advertising.
• Local storage technologies, like HTML5, provide cookie-equivalent functionality but can store larger amounts of data, including on your device outside of your browser in connection with specific applications.
• Web beacons, also known as pixel tags or clear GIFs, are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.

This Cookie Policy refers to all these technologies, and other types of tracking technologies used through our Services, collectively as “cookies”.

How do we use cookies and other similar technologies?

We use both persistent cookies and session cookies. Persistent cookies stay on your device for a set period of time or until you delete them, while session cookies are deleted once you close your web browser. We use persistent cookies, for example, to record your choice of language and country location. The cookies placed through your use of our Site are either set by us (first-party cookies) or by a third party at our request (third-party cookies).

We also allow our advertising partners to collect this information through our Site.

What types of cookies and similar technologies do we use?

We use the following categories of cookies:

Essential cookies: These cookies are required to enable basic website functionality. They cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the Services may not work.

Advertising cookies. These cookies are used to deliver advertising that is more relevant to you and your interests. They may also be used to limit the number of times you see an advertisement and measure the effectiveness of advertising campaigns.

Functional cookies. These cookies allow the Site to remember choices you make (such as your user name, language, or the region you are in) and provide enhanced, more personal features.

Analytics cookies. These cookies help us understand how the Site performs, how visitors interact with the Site, and whether there may be technical issues.

Analytics and Advertising

We use analytics services, such as Google Analytics, to help us understand how users access and use the Site. In addition, we work with agencies, advertisers, ad networks, and other technology services to place ads about our products and services on other websites and services. For example, we place ads through Google and Facebook that you may view on their platforms as well as on other websites and services.

As part of this process, we may incorporate tracking technologies into our own Services as well as into our ads displayed on other websites and services. Some of these tracking technologies on our Site and within our emails and advertisements may track your activities across time and services for purposes of associating the different devices you use, and delivering relevant ads and/or other content to you.

How can you control the use of cookies?

Depending on where you access the Site from, you may be presented with a cookie banner or other tool to provide permissions prior to non-Essential cookies being set. In this case, we only set these non-Essential cookies with your consent.

You can also limit online tracking by:

• Blocking cookies in your browser. Most browsers let you remove or reject cookies, including cookies used for interest-based advertising. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit www.allaboutcookies.org.

Use the following links to learn more about how to control cookies and online tracking through your browser:

• Firefox;Chrome; Microsoft Edge; Safari (Mac); Safari (Mobile/iOS)
• Blocking advertising ID use in your mobile settings Your mobile device settings can provide functionality to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.
• Using privacy plug-ins or browsers. You can block our Site from setting cookies used for interest-based ads by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, Ghostery, or uBlock Origin, and configuring them to block third party cookies/trackers.
• Advertising industry opt out tools You can also use these opt out options to limit use of your information for interest-based advertising by participating companies:
  • Digital Advertising Alliance for Websites: https://optout.aboutads.info/ and https://www.aboutads.info/appchoices (for mobile opt outs);
  • Network Advertising Initiative: optout.networkadvertising.org
• Platform opt-outs. Some of our advertising partners offer opt-out features that let you opt out of use of your information for interest-based advertising, including:
  • Google
  • Facebook
• Mobile App technologies You can stop all collection of information via our Mobile App by uninstalling the App. For Apple iOS, we will only receive access to your device's Ad ID (known as an IDFA) if you provide consent. You can reset your device's Ad Id at any time through your device settings, which is designed to allow you to limit the use of information collected about your device.

Please be aware that if you disable or remove tracking technologies some parts of the Services may not function correctly.

Note that because these opt out mechanisms are specific to the device or browser on which they are exercised, you will need to opt out on every browser and device that you use.

Do Not Track. Some Internet browsers can be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.

Legal Basis for Processing
We process personal information on the following legal grounds:

• Account registration & service delivery
  Data: Contact information, account details, health/wellness inputs
  Purpose: To create and maintain your account, provide access to our app, personalize support
  Legal basis: Contract (Art. 6(1)(b) GDPR)
• AI-powered coaching, journaling, Forest sessions
  Data: Health and wellness information, user content, audio/text inputs
  Purpose: To provide proactive mental health support, workplace support
  Legal basis: Explicit Consent (Art. 9(2)(a))
• Connected devices / fitness data
  Data: Activity, biometrics, device metadata
  Purpose: To deliver optional fitness tracking and competitions
  Legal basis: Consent (Art. 6(1)(a); Art. 9(2)(a))
• Communications (support, service updates)
  Data: Contact details, account info
  Purpose: To respond to enquiries, send security or admin notices
  Legal basis: Legitimate Interests (Art. 6(1)(f)) or Contract
• Marketing & newsletters
  Data: Contact details, engagement metrics
  Purpose: To send promotional communications
  Legal basis: Consent (opt-in) or Legitimate Interests (opt-out model, where permitted)
• Employer-mandated learning & development reporting
  Data: Company email, attendance/completion records
  Purpose: To verify participation in mandatory training
  Legal basis: Legitimate Interests (employer verification)
• Analytics & service improvement
  Data: Usage data, device data, anonymized insights
  Purpose: To maintain, secure, and improve services
  Legal basis: Legitimate Interests
• Compliance & legal obligations
  Data: All categories where relevant
  Purpose: To comply with laws, respond to authorities, enforce rights
  Legal basis: Legal Obligation (Art. 6(1)(c))

Categories of Data Collected

• Identity & Contact: name, email, phone, address
• Account Information: username, password, age range, preferences
• Special Categories (sensitive data): health and wellness information, mental health disclosures, biometrics (if opted in)
• Device & Technical: device IDs, IP addresses, cookies, activity logs
• Employment-Linked: company email, attendance in employer-mandated activities
• Engagement Data: journaling entries, group participation, leaderboard stats (optional)

International Data Transfers

October Health primarily stores and processes personal information in the United States, with limited processing in the United Kingdom and South Africa. This means that your information may be transferred outside of your home country.

When we transfer personal information internationally, we take steps designed to ensure that it receives an appropriate level of protection, including through:

• Requiring our service providers to implement contractual commitments and security safeguards consistent with applicable privacy laws
• Using encryption, access controls, and monitoring to protect information during transfer and storage
• Where applicable, relying on frameworks such as Standard Contractual Clauses (SCCs) or other legally recognized mechanisms for cross-border data transfers
• POPIA Section 72 measures for South African data transfers, ensuring the recipient jurisdiction has adequate protection or that appropriate contractual safeguards are in place
• Technical safeguards such as encryption at rest and in transit, strict access controls, and audit logging

You can request a copy of the relevant transfer safeguards by contacting us at legal@october.health