1. About This Policy

1.1 Purpose. This Privacy Policy (the "Policy") explains how LiLo Health Ltd. ("LiLo Health," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information in connection with the LiLoHome™ passive wellness service ("LiLoHome™" or the "Service"). It applies to information about Account Owners, Residents, Care Team Members, Organization Members, and people who interact with LiLo Health's applications and support channels.

This Policy is a separate document, and consent to it is always given separately from acceptance of any other document:

• The Customer expressly consents to it on the signature page of the Customer Contract. Where a Customer Contract does not carry that consent on its signature page, the Customer gives it by separate written acknowledgment.
• Residents expressly consent to it through the Resident Participation Consent signed before activation. That document sets out a summary of this Policy and a separate express consent to the collection, use, and sharing of the Resident's information as described in it; this Policy governs. Residents consent again, in respect of their own account, by a discrete control in LiLoHome™ at sign-up.
• Care Team Members expressly consent to it by a discrete control in LiLoHome™ at sign-up, distinct from acceptance of the LiLoHome™ App Terms of Use.
• Organization Members expressly consent to it by a discrete control in LiLoCare™ at sign-up, distinct from acceptance of the LiLoCare™ Terms of Use.

In each case the version of this Policy displayed is recorded with the consent.

1.2 Governing Law and Framework. LiLo Health Ltd. is governed by the laws of British Columbia, Canada. This Policy is written to the Personal Information Protection Act (British Columbia) ("PIPA") and the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA") where applicable.

1.3 How to Read This Policy. In this Policy:

"Customer Contract" means the agreement between LiLo Health and the Customer under which LiLoHome™ is supplied.

"LiLoCare™" means LiLo Health's operator-facing web application, governed by the LiLoCare™ Terms of Use.

"Organization" means an organization that is a party to a Customer Contract with LiLo Health. An Organization reaches a Resident's insights only where that Resident has authorized it in their Resident Participation Consent, and reaches them in LiLoCare™.

"Organization Member" means a person employed or engaged by an Organization who holds a named individual account in LiLoCare™.

Unless otherwise defined here, this Policy uses the same defined terms as the Customer Contract: Account Owner, Resident, Care Team Member, Authorized Representative, and LiLoHome™.

1.4 Updates to This Policy. We may update this Policy from time to time. The current version number and effective date are shown at the top of this page. Material changes will be communicated to Account Owners by email, and in LiLoHome™ and in LiLoCare™, and posted here. Updates are effective when posted, unless we specify a later effective date in the notice.

Where an update would materially change how we collect, use, or disclose your personal information, continued use is not treated as your consent. We will ask for your express consent again, through the same discrete control by which you gave it. Otherwise, continued use of the Service after the effective date of an update constitutes acceptance of the update.

Each version of this Policy is identified by a version number and an effective date, and supersedes all earlier versions. Earlier versions are retained internally as audit evidence under the retention rules in Section 6.

2. Who We Are and How to Reach Us

2.1 The Organization. LiLo Health Ltd. is a company established in Kelowna, British Columbia, Canada. LiLo Health develops and operates LiLoHome™ and LiLoCare™, and operates from the domain lilohealth.care, including the corporate website, this Policy, customer-facing pages, application endpoints, and email communications.

2.2 Privacy Contact. The dedicated channel for all privacy-related inquiries, requests, and complaints is privacy@lilohealth.care. LiLo Health's Privacy Officer may be contacted at that address.

2.3 Complaints. If you believe LiLo Health has not handled your personal information appropriately, please contact us first at privacy@lilohealth.care. We will acknowledge your complaint and work with you to resolve it.

If you are not satisfied with our response, subject to applicable laws you may escalate to:

• the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC), at oipc.bc.ca, for matters governed by PIPA; and/or
• the Office of the Privacy Commissioner of Canada (OPC), at priv.gc.ca, for matters governed by PIPEDA.

3. What We Collect

3.1 From the Resident's Home. LiLoHome™ collects information relating to patterns of daily living through devices installed in the Resident's home. This may include:

• Activity and presence in the home, such as movement and doors opening and closing.
• Home environment readings, such as temperature and humidity.
• Sleep and rest indicators (in bed, out of bed, restlessness signals).
• Physiological indicators including heart rate, breathing rate, heart rate variability, and sleep stages.
• Weight readings.
• Plain-language summaries our software generates from these indicators. These are estimates based on sensor patterns, not clinical determinations.
• Operational state of the hub and each sensor, used to surface system health to the Care Team, to the Organization operating the residence, and to our operations team.

3.2 About Account Owners, Care Team Members, and Organization Members.

• Account data: name, email address, phone number, postal address, the home address where LiLoHome™ is installed, the role of each person on the account, and any preferred communication settings. For an Organization Member, this also includes the Organization that person is employed or engaged by, the role that organization has given them, and the tier of administrative authority they hold, and any profile picture they add, which is deleted when they replace or remove it.
• Application use data: sign-in events, the IP address and browser used, application settings, notification preferences, acceptance records of this Policy, the Customer Contract, the LiLoHome™ App Terms of Use, and the LiLoCare™ Terms of Use, and the version of each document accepted.
• Billing data: payment history, payment method tokens (we do not store full credit card numbers; tokenization is performed by our payment processor), and refund and adjustment records.
• Customer support records: correspondence with our support team and notes from sales calls.

3.3 About Residents.

• Identity and contact information (name, date of birth where voluntarily provided, preferred contact method).
• Consent records (which version of the Resident Participation Consent was signed, when, where, through what channel, whether it was signed by the Resident or by an Authorized Representative, and the answer given to the organizational access question within it).
• Sensor patterns and derived indicators under §3.1.
• Where the Resident is also the Account Owner, the categories listed in §3.2.

3.4 Content Entered by Users. LiLoHome™ and LiLoCare™ allow Account Owners, Residents, Care Team Members, and Organization Members to enter and share tasks, reminders, notes, and messages. We store that content, together with who entered it, when, and who it was addressed to. It is written by users, not generated by LiLoHome™, and we do not review, verify, or act on it. It may include information about the Resident — such as health, appointments, or medications — that LiLoHome™ does not collect itself.

Content about a Resident is personal information of that Resident, regardless of who entered it. The Resident may request a copy of it, and may exercise the other rights in Section 7 in respect of it, including deletion, whether or not they entered it and whether or not the author agrees.

Where a Care Team Member's or an Organization Member's access is removed, what that person entered remains in the Resident's record and visible to their current Care Team, unless the Resident asks us to remove it. LiLoHome™ is not a clinical record, and this content is not a medical record.

3.5 What LiLoHome™ Does Not Collect. LiLoHome™ does not collect video, audio, still images, or GPS location data from the home. The hub and the qualified sensor fleet do not include cameras or microphones. The cellular weight scale does not transmit GPS coordinates to us.

3.6 Children's Data. LiLoHome™ is designed for adult Residents who choose to participate in the Service in their own homes, and for adult Account Owners, Care Team Members, and Organization Members. The Service is not directed to children, and we do not knowingly collect personal information from children, other than the limited circumstance in which a child may incidentally appear on a sensor reading (for example, a grandchild visiting, whose presence may be reflected in a motion event). If you believe a child's personal information has been collected outside that limited circumstance, contact us at privacy@lilohealth.care.

4. Why We Collect It

We use personal information to:

• Provide the Service. Operate the LiLoHome™ system, present the activity timeline and the information and analysis generated from gathered information, and deliver awareness notifications to authorized Care Team Members and to Organization Members of an organization the Resident has authorized.
• Support Care Team coordination. Store and display the tasks, notes, and messages users enter so the Resident, their Care Team, and any organization they have authorized can coordinate support. We do not review, verify, or act on that content.
• Operate and support the account. Bill the Account Owner, answer support requests, dispatch service visits, and run the operational processes that keep the system working.
• Safeguard the Service. Detect and respond to security incidents, fraud, abuse, misuse, and unauthorized access, and preserve audit records demonstrating consent and operational integrity.
• Improve the Service. Analyze operational performance, identify defects, and improve the qualified device fleet, consistent with this Policy and applicable law.
• Comply with our legal obligations under PIPA, PIPEDA, the BC consumer-protection framework, applicable tax law, and lawful requests from authorities with jurisdiction.

We do not sell personal information. We do not use personal information for advertising. We do not share personal information with data brokers.

5. Your Consent

5.1 Consent-Based Operation. LiLoHome™ operates on the basis of express, informed consent. The following consents are recorded for every active Service relationship:

• Customer consent to this Policy is captured on the signature page of the Customer Contract, or by separate written acknowledgment where that signature page does not carry it. It is given expressly and separately, in addition to agreeing to the Customer Contract itself.
• Resident Participation Consent is signed by the Resident (or, where §5.2 applies, by an Authorized Representative) before activation. It authorizes the collection, processing, storage, and sharing of the categories described in §3.1 and §3.3 with the Care Team Members the Resident has named or subsequently authorizes.
• Organization access is authorized by the Resident's answer to a discrete question within the Resident Participation Consent, which names the Organization and is answered separately from every other consent in that document. That answer is given and withdrawn on its own, and refusing it does not affect the Resident's participation, their Care Team, or anything else in that document.
• Resident consent to this Policy in LiLoHome™ is given by a discrete control at sign-up, in respect of the Resident's own account and use of LiLoHome™. It is separate from, and does not replace or restate, the Resident Participation Consent.
• Care Team Member consent is given as a separate, express consent through a discrete control in LiLoHome™ at sign-up, distinct from acceptance of the LiLoHome™ App Terms of Use. It authorizes the processing of that Care Team Member's own personal information described in §3.2.
• Organization Member consent is given as a separate, express consent through a discrete control in LiLoCare™ at sign-up, distinct from acceptance of the LiLoCare™ Terms of Use. It authorizes the processing of that Organization Member's own personal information described in §3.2. It is not consent on any Resident's behalf.

We maintain the list of Organization Members currently holding access through an Organization, and provide it to a Resident that organization can see on request.

5.2 Capacity and Authorized Representatives. LiLo Health expects the Resident to have the legal capacity required to give informed consent to participate. Where a Resident does not have that capacity, an Authorized Representative — a person holding legal authority to make decisions of this kind, for example under a representation agreement, a power of attorney covering personal matters, or a court appointment — may sign the Resident Participation Consent on the Resident's behalf. Authority over a Resident's property or financial affairs alone is not authority to consent to the collection and use of the Resident's personal information.

LiLo Health collects signatures. LiLo Health does not assess capacity and does not determine who holds decision-making authority. We may decline to activate data collection where, in our reasonable judgment, valid consent has not been established.

6. Where We Store It, and How Long We Keep It

6.1 Primary Location: Canada. LiLoHome™ personal information is stored in Canada, on Amazon Web Services (Canada) infrastructure. Our primary records, consent records, audit logs, and operational logs reside in Canada.

6.2 Cross-Border Transfers. Some of the service providers we use to operate LiLoHome™ and LiLoCare™ are located outside Canada, and some information passes through them in the course of delivering the Service. Information held outside Canada may be subject to the laws of the jurisdiction where the provider operates, which may differ from Canadian law, including laws permitting government access in circumstances that differ from Canadian law.

6.3 How Long We Keep It. We keep personal information only as long as necessary to provide the Service and for the purposes described in Section 4, and as required by law — including legal and tax obligations, and the limitation periods that apply to legal claims. When information is no longer needed for those purposes, we delete or de-identify it.

Sensor information, derived indicators, and insights are kept for twelve (12) months after a Resident's participation ends, and are then deleted or de-identified.

Two further periods are fixed by law or by our obligation to demonstrate lawful operation: billing and payment records are kept for seven (7) years to meet Canada Revenue Agency requirements, and signed consent records are kept for the duration of the customer relationship plus ten (10) years as evidence that consent was properly obtained.

Where a Resident leaves a home or suite. A new occupant is a new person. When we are told that the occupant of a home or suite has changed, we reset that home's data environment before collection resumes for the incoming Resident. The outgoing Resident's sensor patterns, derived indicators, established baseline, insights, notifications, and user-entered content are separated from that home and are not carried forward. No incoming Resident, no Care Team Member of an incoming Resident, and no Organization has access to any prior Resident's insights, history, or baseline. The outgoing Resident's information is retained under this Section and is available to that Resident under Section 7, and is deleted or de-identified when it is no longer needed for the purposes described in Section 4, subject to legal hold.

7. Your Rights

7.1 Rights Available. Subject to applicable law, you have the following rights in respect of your personal information held by LiLo Health:

• Access. Request a copy of the personal information we hold about you, and an explanation of how we use it.
• Correction. Request that we correct information you believe is inaccurate or incomplete.
• Withdrawal of consent. Withdraw your consent to ongoing processing.
• Deletion or de-identification. Request that we delete or de-identify your personal information, subject to §7.4.

7.2 How to Make a Request. Send your request to privacy@lilohealth.care. We will acknowledge it promptly and respond within thirty (30) days, subject to any extension permitted under PIPA or PIPEDA. We may need to verify your identity first, typically by confirming information already on file or technical details of your installation. We generally do not request additional personal information in order to verify identity.

7.3 Effect of Withdrawing Consent.

Resident — withdrawing from the Service. Withdrawal stops new insights being generated and ends all access to the Resident's insights, by their Care Team and by any organization they have authorized. Withdrawal does not, by itself, terminate the Customer Contract. Under the Customer Contract, a Resident's withdrawal does not cause the Account Owner to incur an early-exit fee.

Resident — withdrawing an organization's access only. A Resident may take away an Organization's access on its own, at any time, without giving a reason and without going through that organization. Doing so ends access for every Organization Member of that organization. It does not stop collection, does not affect the Care Team Members the Resident has named, and does not affect the Resident's tenancy, care, or any service they receive.

Resident — withdrawing LiLoHome™ consent only. Withdrawing the consent given at LiLoHome™ sign-up ends the Resident's own access to LiLoHome™. It does not withdraw the Resident Participation Consent, does not stop collection, and does not affect the Resident's Care Team.

Care Team Member. Withdrawal ends that person's LiLoHome™ access. It does not, by itself, terminate other contractual relationships.

Organization Member. Withdrawal ends that person's LiLoCare™ access. It does not affect their employment, and it does not affect their Organization's authorization from any Resident.

Account Owner billing. Withdrawal of a Care Team Member's, an Organization Member's, or a Resident's consent does not, by itself, terminate the Account Owner's billing obligations, which are governed by the Customer Contract.

7.4 Effect of a Deletion Request. Where we accept a deletion request, we delete the personal information we hold about you, including tasks, notes, and messages. A Resident may request deletion of content about the Resident whether or not the Resident entered it, and the person who entered it cannot prevent that deletion.

Signed consent records and related audit records are de-identified rather than deleted, and kept as anonymous evidence that consent was obtained and the Service was operated lawfully. We do not attempt to re-identify them. Deletion may be delayed or limited where the law requires us to retain specific records. Where a request affects information held by a service provider, we will instruct that provider to give effect to it so far as the contract and applicable law permit.

8. Who We Share It With

8.1 Service Providers. We share personal information with service providers that perform functions on our behalf — including cloud hosting, payment processing, device data processing, electronic signature, and message delivery. They may use personal information only to perform those functions for us, and not for their own purposes.

8.2 Financing Parties. LiLo Health may assign, pledge, or grant a security interest in the amounts payable by the Customer under the Customer Contract to a financing party. Where it does, we share personal information with that financing party only to establish and administer that arrangement.

What is shared is limited to what the financing party requires for those purposes: the Customer's identity and contact information, the address where LiLoHome™ is installed, and the amounts payable and paid under the Customer Contract. LiLoHome™ sensor information, Resident insights, and the categories described in §3.1 and §3.3 are never shared with any financing party.

A financing party is an independent organization, not a service provider acting on our behalf. The Customer does not enter into any credit agreement with a financing party, and no financing party acquires any right in the LiLoHome™ equipment or in the Resident's personal information. If we add or replace a financing party, this Policy will be updated as described in §1.4.

8.3 Organizations. Where the Resident has authorized an organization — for example, a home-care agency or the operator of the residence where they live — as an Organization, that organization's Organization Members reach the Resident's insights in LiLoCare™, and may enter the content described in §3.4.

An Organization Member is not a Care Team Member. Their access comes from the Resident's authorization of their employer together with their own employment, rather than from being named by the Resident, and it is governed by the LiLoCare™ Terms of Use rather than the LiLoHome™ App Terms of Use. Access is delivered only to named individual accounts, never to a shared or generic account, and ends when the Resident's authorization ends, when the person leaves that organization or ceases to hold a role that needs it, or at the Resident's request.

Paying for the Service is not access. An organization does not see a Resident's insights because it is a LiLo Health customer or because the Resident lives in a building it operates. It sees them because that Resident said yes.

An Organization is a recipient authorized by the Resident, not a service provider acting on our behalf. Once that organization or its Organization Members see or record information, the organization is responsible for how it collects, uses, retains, and discloses that information, under its own privacy policy and applicable law. The Resident may withdraw the organization's access, or that of any individual it has named, at any time and without giving a reason, as described in §7.3.

8.4 Disclosures Required by Law. We may disclose information where required by law, by a valid court order, by a regulator, or to investigate and respond to suspected violations of our agreements, fraud, or threats to the security or integrity of the LiLoHome™ system or any person who uses it.

9. Security and Breach Notification

9.1 Security. We maintain reasonable physical, organizational, and technological security arrangements to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, alteration, or destruction, appropriate to the sensitivity of the information. Personal information is encrypted in transit, and at rest in our cloud systems, and access within LiLo Health is restricted to personnel with an operational need. No system is completely secure, and we cannot guarantee that personal information will be secure from every attempt to circumvent our protections. Contact us immediately at privacy@lilohealth.care if you believe the security of your personal information has been compromised.

9.2 Breach Notification. If we determine that personal information has been compromised in a way that creates a real risk of significant harm to an affected individual, we will notify the affected individual(s) and the appropriate regulator (the OIPC BC and/or the OPC, as applicable) as soon as possible, and in any event within the timeframes required by PIPA and PIPEDA.

10. Text Messaging (SMS) Notifications

10.1 What This Section Covers. LiLo Health Ltd. offers Account Owners, Residents, Care Team Members, and Organization Members the option to receive certain transactional notifications by SMS text message. This Section explains how that option works and how we handle the mobile information you provide for it. It supplements, and does not replace, the rest of this Policy.

10.2 The Messages We Send. When you enable text messaging, we send transactional activity and account notifications related to the Service — for example, no-activity and other wellness notifications, and account or security notices. We do not send marketing or promotional text messages. Message frequency varies and depends on activity in the Resident's home. Message and data rates may apply.

10.3 How You Opt In. Text messaging is off by default. To receive texts, you turn on the "Text messages" setting in the application, provide a mobile number, and confirm that number by entering a one-time code we send to it by SMS. Consent to receive text messages is given for each mobile number and is never a condition of purchasing or using the Service. You can continue to use LiLoHome™ and receive notifications through other channels without enabling text messages.

10.4 How You Opt Out or Get Help. You can stop text messages at any time by replying "STOP" to any message; we will send one confirmation and then send no further texts to that number. Reply "HELP" for help, or contact us at privacy@lilohealth.care. You can also turn the "Text messages" setting off in the application.

10.5 How We Handle Your Mobile Information. Mobile information and SMS opt-in consent are not shared with, sold to, or rented to any third parties or affiliates for marketing or promotional purposes. We share your mobile number only with the messaging service providers that deliver these texts on our behalf, and only to deliver them, as described in §8.1.

LiLo Health Ltd. · Kelowna, British Columbia, Canada · privacy@lilohealth.care

End of LiLoHome™ Privacy Policy · Version 1.5