This page is designed to help you understand why and how we use your personal data.
By personal data, we mean information relating to a living individual who can be identified or is identifiable.

We are Chronity S.L., a company incorporated under Spanish law, with its registered office at
C/ Marqués de Mondéjar 5, C 4º D, 28028 Madrid, Spain, and with Tax ID (N.I.F.) B21924386,
incorporated by deed granted on April 25, 2025, before the Notary of Madrid Mr. Juan Aznar de la Haza,
and registered in the Commercial Registry of Madrid, under Sheet M-853632, IRUS Code 1000449729789,
Electronic Folio, Entry 1.

We may use your personal data to:

• allow you to access the Chronity application and website;
• provide you with information and support in relation to chronic diseases;
• provide you with information based on data from a wearable device;
• generate insights to support product development;
• generate anonymized or pseudonymized statistics (as applicable) to be shared with others for research purposes, provided you have explicitly opted in;
• enable us to improve our services and marketing efforts; and
• send you information about the application, our company, and the development of the application.

The above is a general description of how your personal data may be processed and is by no means exhaustive:
please see below for information on how specific types of personal data are collected, processed, and shared.

We have tried to provide you with as much information as possible to explain how we may use your personal data.
This means that this page contains a lot of information. To help you find the most relevant details,
we have divided it into different sections using subheadings.

You can contact us by email at info@chronity.ai.

How is your data processed to allow you to access the application?

What types of data do we collect?

When you register in the Chronity application, we obtain the following personal data directly from you:

• your username;
• your year of birth;
• a valid email address; and
• your approximate location (for example, the country in which you live).

We refer to this information as “access data.”

How do we use your access data?

We use your access data to log you into the application, verify that you are a real person, and determine whether you meet the requirements for Chronity services.
Due to language, logistics, and resource considerations, we can only offer certain Chronity services in specific geographic areas.
We use your approximate location to determine the level of services available.

Our legal basis for processing this data is contractual necessity.
Without this processing, we would not be able to authorize you to access and use the application.

How is your data processed to provide you with well-being information and support?

What types of data do we collect?

When using the website or registering in the application, and thereafter, we will ask you questions about your condition, your symptoms, and the type of activity you perform.
Subsequently, you will be able to complete records where you will enter data, including information about your symptoms, and log biometric data,
such as your heart rate, through the application.
From here on, we will refer to this personal data as “well-being data.”

How do we use your well-being data?

We use your well-being data to help you track and understand your condition, for example, by allowing you to identify trends and generate well-being reports.

Our legal basis for processing this data is your consent, which you may withdraw at any time by notifying us using the contact details
provided in the section “Your rights and how to exercise them” below, and by deleting the application.
We will ensure that such consent is explicit.

Please note that without your consent, we will not be able to provide you with access to the application.
This is because we need your well-being data to provide you with support and information.

How is your data processed to provide you with information based on data from a wearable device?

What types of data do we collect?

If you connect a wearable device to the Chronity app, we collect data such as resting heart rate, heart rate variability,
and gyroscope and accelerometer data. We refer to this information as “biometric data.”

In addition, if you use Android, we will request permission to access geolocation data and connect your wearable device to the application.
This is because the Android Bluetooth framework requires location permissions to discover nearby devices.
We refer to this information as “nearby device data.”

Together, we refer to these personal data as “wearable data.”

How do we use your biometric data?

We use your biometric data to help you track and understand your condition, for example, by allowing you to measure your heart rate over time
and receive rhythm notifications.

Our legal basis for processing this data is your consent, which you may withdraw at any time by notifying us using the contact details
provided in the section “Your rights and how to exercise them” below, and by deleting the application.
We will ensure that such consent is explicit.

Please note that without your consent to use your biometric data, we will not be able to provide you with access to certain features that require access to your biometric data.
However, you will still be able to use other features of the application that do not require access to your biometric data.

How do we use your nearby device data?

We do not store your nearby device data nor use it for any purpose other than connecting your wearable to the app.
This data is not shared with Chronity and is stored locally on your device.
We do not know your exact location when you use the app.

Our legal basis for processing this data is your consent, which you may withdraw at any time by notifying us using the contact details
provided in the section “Your rights and how to exercise them” below, and by deleting the application.
We will ensure that such consent is explicit.

Please note that without your consent to access your nearby device data, we will not be able to provide you with access to certain features that require a wearable device.
You will still be able to use other features of the application that do not require a wearable device.

How is your data processed to generate information that supports product development?

We also use your access data, well-being data, and wearable data to generate information that we may later use for product development.
This means we may use this data to better understand the needs of our users and make prioritization and design decisions based on them.
Our legal basis for processing this data is consent, which you may withdraw at any time by notifying us using the contact details provided in the section
“Your rights and how to exercise them” below, and by deleting the application.
Since some of the data involved relates to your health, we will ensure that such consent is explicit.

How is your data processed to allow anonymized or pseudonymized statistics to be shared with others for research purposes?

We also use your well-being data to generate statistics that may later be shared with third parties for research purposes.
These statistics may be based on:

• Anonymized data, processed irreversibly so that it is no longer possible to identify you, either directly or indirectly.
• Pseudonymized data, in which direct identifiers are replaced by a code or ID.
  Third parties receiving this data will not be able to identify you, but Chronity securely and separately retains the key for correspondence,
  solely for technical or security purposes.

In any case, our legal basis for processing this data is your consent, which you may withdraw at any time by notifying us
using the contact details provided in the section “Your rights and how to exercise them” below.
Since the data in question relates to your health, we will ensure that such consent is explicit.

How is your data processed to allow us to improve our services and marketing efforts?

What types of data do we collect?

For website visitors and purchasers, we collect metadata and event details through Meta and Google conversion tracking tools.
Personal identifiers such as your email, phone number, or name are not collected or transmitted through these tools.
Meta and Google retain event data for up to 180 days and process it in accordance with a Data Processing Agreement.

For users of our mobile application, if they have given explicit consent to receive advertising, we may share personally identifiable information with Meta
for advertising targeting purposes. In such cases, Meta stores your data in hashed form when processing it for added security.

In addition, our website uses both first-party and third-party cookies.

• First-party cookies are essential for the proper functioning of the website and do not collect any personally identifiable data.
• Third-party cookies help us understand website performance, track how you interact with it, enable features such as messaging with our support team,
  and deliver relevant marketing content. They also improve your overall experience and streamline future interactions with our website, and may collect personal data.

In accordance with applicable law, including the GDPR, we collect your consent for cookie collection in Spain and EU.
If you deny your consent, only necessary cookies will be collected (not functional, analytical, or performance cookies).

Together, we refer to this data as “marketing data.”

How do we use your marketing data?

Marketing data is used exclusively for conversion tracking, analysis, and optimization of our marketing strategies.
This data helps us understand user interactions, measure advertising effectiveness, and optimize the delivery of our ads to relevant audiences.

Our legal basis for processing this data is consent, which you may withdraw at any time by notifying us using the contact details
provided in the section “Your rights and how to exercise them” below.

How is your data processed so that we can send you information about the application, our company, and its development?

We will use your access data (see the previous section “How is your data processed to allow you to access the application?” for more information on this data)
to contact you and provide you with information about our activities, developments, and improvements to the application.
We do this on the basis of our legitimate interest in keeping you informed about changes in our company and products.
To this end, we will offer you the option to opt out of receiving commercial communications when we first collect your data and in subsequent messages.

Who do we share personal data with?

Internally, we only grant access to identifiable personal data to those who need it to perform their role.
Externally, we may occasionally share personal data with the following categories of recipients:

• our service providers, for example:
  • companies that manage our IT infrastructure;
  • companies that provide us with cloud-based IT systems;
  • companies that provide us with technical services, including companies that process and generate information about biometric data; and
  • our external advisors, such as IT consultants, data scientists, accountants, and lawyers,

  and when we share personal data with service providers, we will always ensure that the service provider is contractually committed to using
  personal data only in compliance with our instructions and data protection law;

• our regulators, law enforcement, intelligence services, and other government authorities, when required; and
• potential buyers or investors in our business when necessary in connection with a due diligence exercise.

Transfers of personal data outside the European Economic Area (EEA)

The EEA is a group of countries that share the same basic data protection law, and therefore the law assumes that when your personal data is transferred between these countries,
it enjoys a similar level of protection.

We store and process personal data both within the EEA and in the U.S.

In circumstances where third parties help us deliver the services (providers), personal data may be transferred outside the EEA, including to the U.S.

For data transferred to the U.S., we ensure compliance with Spain and EU data protection laws by requiring our providers to sign
Data Processing Agreements incorporating Standard Contractual Clauses (SCCs) approved by the European Union.
These clauses ensure that the level of protection for personal data is equivalent to that which would exist if the data remained within the EEA.

We can provide more information about the non-EEA countries to which we transfer your personal data upon request.

How long do we retain your data?

We will only retain your personal data for as long as necessary to fulfill the purposes for which we collected it, including compliance with any legal, accounting, or reporting requirements.
You may request that we delete your personal data by requesting deletion of your account in the application (see “Your rights and how to exercise them”).

Your rights and how to exercise them

The law gives you certain rights with respect to the personal data we hold about you.
Below is a brief summary of these rights (for more information about the rights you have in relation to your personal data, please visit the website of the
Spanish Data Protection Agency (AEPD),
or the data protection authority of your country in the European Union).

If you wish to exercise any of the rights listed below, please email us at
info@chronity.ai.
We aim to respond to all legitimate requests within one month.
Occasionally, it may take us longer than one month if your request is particularly complex or if you have made multiple requests.
In such cases, we will notify you and keep you informed.

Access

With certain exceptions designed to protect the rights of others, you have the right to a copy of the personal data we hold about you.

Access to the personal data we hold about you is free of charge; however, we may charge a reasonable fee for additional copies of such data beyond the first copy,
based on our administrative costs.

If you have provided us with your personal data (i.e., entered it into the application), you may have the right to receive a copy of this data in a commonly used electronic format.
If you wish, we can provide copies of this data to other people, if technically possible.

Correction

You have the right to have the personal data we hold about you corrected if it is inaccurate. This right does not extend to matters of opinion.

Erasure

You may request the deletion of your personal data by clicking “Delete account” in the Profile tab of the Chronity app.
This will initiate a data deletion process that will erase your access, well-being, and wearable data from our servers.

In certain cases, such as when you have opted to share your data with third parties for research purposes, the data will have been irreversibly anonymized and cannot be deleted
because it is not possible to link it to you.

Objection

You have the right to object to our processing of your personal data when we rely on “legitimate interests” as our legal basis for processing,
but we may be able to continue processing it if our interest outweighs your objection.

Marketing opt-out

You have the right to ask us to stop using your personal data to send you marketing information.
If you would like us to stop sending you marketing information, the quickest and most effective way is to use the “unsubscribe” links provided in our communications
(although you can also contact us directly if you prefer).

Last updated: August 25, 2025

© 2025 Chronity SL

Chronity is not a medical device and does not provide medical services such as diagnosis, cure, mitigation, prevention, or treatment of any disease or medical condition.
It does not replace the advice of a medical professional based on your personal circumstances.
You should always consult a doctor before making any medical decisions.