Last revised on: October 1, 2025

This Privacy Policy explains the privacy practices of Futuro, Inc. dba Kyma and its affiliates (collectively, “Kyma,” “we,” “our,” “us”) for users of its Dynamic Intervention System (the “Dynamic Intervention System” and information therein accessed via www.kyma.app and Kyma’s website located at kyma.health (the “Site” and collectively, the “Services”). As used herein, “you” or “your” refers to you, the individual accessing the Dynamic Intervention System as a patient (the “User”). 

By using the Dynamic Intervention System you agree to the use, including transfer, of Personal Information, including personal medical information, as described in this Privacy Policy.

OUR COMMITMENT TO PRIVACY

Kyma understands that your privacy is important. Your ability to make informed choices about the uses of your information is important to us. Kyma is committed to protecting your privacy and the information that can identify you (“Personal Information”) that you provide as you access and use the Services. This Privacy Policy explains our policy regarding the collection, use, disclosure, and protection of Personal Information. By accessing and using the Services, you agree and consent to the collection, use and disclosure of your Personal Information as outlined in this privacy statement, unless different terms are specified as part of a special offer or in another form or contract we provide you in which case such terms will apply. The Dynamic Intervention System connects patients and health care providers by harnessing the data from wearable fitness tracking accessories (“Wearables”) to allow health care providers to send messages about that data to the patient to better monitor and achieve health goals. We are not a health care provider and Kyma does not provide healthcare services or medical advice of any type.

WHAT IS PERSONAL INFORMATION?

Personal Information is any information relating to a natural person who is, or can be, identified either directly or indirectly from such information and includes information such as a user’s name, address, telephone number, email address, Internet activity (such as browsing history), or other information directly linked to that person. Personal Information that we collect may also include the personal medical information which Users provide to us to use the Dynamic Intervention System. You are not legally required to provide Personal Information to us, but if you refuse to provide such information, we may not be able to register you to use the Dynamic Intervention System.

HEALTH RELATED PERSONAL INFORMATION

Certain demographic, health and/or health-related information that Kyma collects about Users as part of providing the Services may be considered “protected health information” (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”). Specifically, when Kyma, acting as a “Business Associate” (as such term is defined in HIPAA) receives identifiable information about a User from or on behalf of a Covered Entity such as a User’s physician (“Healthcare Provider”), this information is considered PHI. All rights under HIPAA remain with the individual about whom the PHI relates. Personal data that a User provides to Kyma outside of the foregoing context is not PHI. For example, when you provide information directly to us, such as when creating an account or using our interactive tools and services and completing medical history forms (“Medical History Forms”); or when you voluntarily provide information in free-form text boxes through the Services or through responses to surveys and questionnaires, or post reviews; or when you send us an email or otherwise contact us, that information is not PHI.  In order for us to provide the full suite of Services to Users, Users must sign a HIPAA Authorization Form which will be presented upon Account registration, upon which point the information will no longer be considered Protected Health Information subject to HIPAA restrictions.

COLLECTION OF PERSONAL DATA

During your use of the Services, Kyma collects Personal Data about you in various ways, including:

• Directly from you when you provide it to us

• Direct integration with wearables upon your approval

• Integration with electronic health records upon your approval

INFORMATION PROVIDED BY YOU

We may collect the following types of Personal Data and other information directly from you.  For example, when you use the Services to upload and analyze data, create an account or profile, or communicate with our team.  We may collect the following types of Personal Data:

• Registration information, including name, email address, phone number, occupation, age, gender, location, and a password.

• Information in Customer Records, including name, postal address, phone number, customer code;

• SMS/Text Message Program: If you enroll in our SMS/Text Messaging Program, we collect your mobile phone number, your message category selections, and program metadata (e.g., opt‑in/opt‑out status, timestamp, source, and HELP requests). We use this information solely to deliver the message categories you selected (e.g., authentication codes, reminders, tips), to administer the program (including responding to HELP and honoring STOP), and to comply with carrier and legal requirements.

Notwithstanding anything to the contrary in this Privacy Policy, text messaging (SMS/MMS) originator opt‑in data and consent will not be shared with any third parties or our affiliates. We do not sell or share this information. You can opt out at any time by replying STOP to any message. 

DATA PROVIDED FOR ANALYSIS VIA THE AI GENERATED SERVICES

You control what information you provide. We will not knowingly pass any identifying information to our AI models. You acknowledge and agree that you will only upload or provide data to us lawfully, in accordance with our Terms and Conditions, and will obtain all necessary consents to allow us to process provided data. All data will be processed in accordance with generally applicable laws and privacy laws, including, but not limited to, HIPAA.

STORAGE OF DATA

We will only store Personal Information for as long as it is needed to fulfill the purposes for which it was collected, subject to applicable data retention periods imposed upon us by applicable law. This may mean that your Personal Information is stored by us for a number of years, depending on the purpose and need for that data to be processed. In addition, the data we collect may be stored in databases owned by the providers of the Third Party Services. Providers of Third Party Services may use such data for promotion and marketing purposes. Procedures for opting out of marketing communications from these third parties are governed by the privacy policies and terms of use policies of the third parties.

RETENTION

Subject to any applicable business, legal, or regulatory requirements, we retain Personal Information only to provide Services and to fulfill the intended purposes under the Terms and Conditions and Privacy Policy.  Thereafter, we securely destroy Personal Information when it is no longer required to fulfill the Services, our commitments to you, or to enforce our rights or meet our legal obligations.

AGGREGATE AND DE-IDENTIFIED INFORMATION

We sometimes aggregate or de-identify information we collect, and the types of systems and browsers of users for internal purposes, so that we may better understand the Kyma User population. Personal Information does not include “aggregate” or “de-identified” information. Aggregate or de-identified information is data we collect about a group of users, from which individual identities have been removed. In other words, information about how you use the Services, or the results of such use, may be collected and combined with similar information from others, but no Personal Information will be included in the resulting aggregate or de-identified data. We can extract statistical data from your content in order to provide it to other users or partners without connecting it to any personal data such as name or email address. Aggregate or de-identified data helps us understand trends and user needs so that we can better consider new products and services, and tailor existing products and services to customer desires. You understand that we may commercialize aggregate or de-identified information by any and all means, and that you will receive no payment or other consideration in respect of such use. In addition, we may share and disclose aggregate or de-identified information for any purpose.

PURPOSE OF COLLECTION

We use your Personal Information in our normal course of business to provide Services to you. Specifically, Kyma uses this information in connection with: 

• Operating the Services;

• Maintaining reasonable security;

• Helping to diagnose problems with our servers, administer and troubleshoot the Services, calculate usage levels, analyze industry standards, and analyze transactions, trends, and statistics regarding the use of the Services;

• Responding to your inquiries and to fulfill your requests for information;

• Sending emails, texts, and updates to you about the Services;

• Improving the Services; 

• Enforcing our rights and resolving disputes.

You acknowledge and agree that we may use, track, store, copy, distribute, broadcast, transmit, publicly display and perform, reproduce, digitally perform, modify, create derivative works of, and otherwise use and commercially exploit any feedback or other information that you provide to us via the Site in accordance with this Privacy Policy. If you are deemed to have retained, under applicable law, any right, title, or interest in or to any portion of such information or materials, you agree to and hereby do assign solely and exclusively to us all of your right, title and interest in and to such information or materials, without additional consideration, under applicable patent, copyright, trade secret, trademark and other similar laws or rights, in perpetuity. If such assignment is ineffective under applicable law, you hereby grant us the sole and exclusive, irrevocable, sub-licensable, transferable, worldwide, royalty-free license to reproduce, modify, create derivative works from, publish, distribute, sell, transfer, transmit, publicly display, use, and practice such information or materials, and to incorporate the same in other works in any form, media, or technology now known or later developed.

DISCLOSURE OF PERSONAL DATA

Kyma will not sell, rent, share or otherwise disclose the Personal Information you provide or we collect through your use of the Platform to any unaffiliated organization without your permission, with the following exceptions:

• We may disclose Personal Information about you to our subsidiaries and affiliates. for business purposes to help us provide the Services, underlying services, and to support our internal and business operations, including marketing, analytics, security, and advertising.

• To help us provide superior service, your Personal Information may be shared with our service providers, contractors, and other third parties we use to support our business and who will safeguard it in accordance with this Privacy Policy. Such third parties may help us with security, providing customer service, maintaining and analyzing data, and sending customer communications.

• Kyma may use third-party tools to provide Services or to track and optimize your experience, in which case your Personal Information may be governed by applicable third-party privacy policies.

• We may share your Personal Information with our lawyers, auditors, and other professional advisors to comply with applicable legal and regulatory requirements, and to support us with the purposes described in this Policy.

• We may share your information for other purposes pursuant to your consent or at your direction. 

• Other Disclosures. We may disclose your Personal Data if we have a good faith belief that disclosure of such information is helpful or reasonably necessary to: (i) comply with the law or respond to legal process or lawful requests; (ii) protect the rights, property, safety or security of Kyma, our employees, Platform visitors or the public; (iii) as part of a corporate transaction such as a merger or sale of assets; (iv) to respond to an emergency or when Kyma believes in good faith that access or disclosure is necessary to protect the public; or (v) to enforce any terms of use agreement governing use of Kyma Services controlled or operated by us.

We may share and disclose de-identified and/or aggregate analytics that are not personally identifiable for any legally permissible purpose without restriction and may also disclose such data to third-parties for any legally permissible purposes. 

CONSENT TO COMMUNICATIONS

By using the Services and providing your contact information, such as your name, phone number, and email address, you consent to receiving in-app messages as well as email and text messages to tell you about the Services, such as communications from your participating health care provider, important information about the Services, and reminders to log back in to complete surveys and forms that you left incomplete. These communications may include messages sent through the use of text messages (including SMS and MMS) or email. Your carrier’s standard rates and charges may apply. We may share your information with partner organizations whose products or services are important Kyma objectives, such as third parties that assist Kyma by hosting our databases, for data processing services, or so they can contact you with information that you requested as part of the Services. However, we do not exchange, trade, rent, or give phone or email lists to unaffiliated third parties, and third parties that receive your information from Kyma are restricted from using this information in any way other than to provide services to Kyma, or services for a collaboration in which they and Kyma are engaged. 

COOKIES

A cookie is a small piece of information that a website can store on a computer and sometimes later use to recognize a user. The purpose of cookies is to enhance your ability to receive the information you want. In the future, Kyma may use cookies to enhance the experience of users. A “session” cookie expires when the user closes the browser in which the website was viewed. A “persistent” cookie may be used to help save your settings and customizations. As with all cookies, you can personalize you web browser settings to reject session cookies. Though some cookies, that are strictly necessary for site operation, cannot be toggled off.

Some of our business partners with whom we contract to carry out the Services (e.g., website providers) may use their cookies on our Dynamic Intervention System. Although we may not have direct access to or control over such cookies, this Privacy Policy governs the use of cookies by us and such business partners on our Dynamic Intervention System. We may also allow social media companies (e.g., Facebook) to put “widgets” on our websites. These third-party tools may also be used to track you across websites. For example, so long as you are logged in to Facebook, every time you land on a webpage that has a Facebook widget, Facebook will know you are on that webpage. We do not control the privacy practices of these third parties.

Some browsers have a “Do Not Track” (“DNT”) feature that lets you tell websites and online services that you do not want to have your online activities tracked. Such browser features and industry standards are not uniform. As such, Kyma does not monitor or respond to DNT browser requests.  If a standard is adopted that we must follow in the future, then we will inform you about that practice in a revised version of this Privacy Policy.

MARKETING

From time to time if you have supplied your email address, we may send you marketing or informational emails. If you prefer not to receive any or all of our marketing and promotional communications, you may opt-out of these communications by following the opt-out prompts on these communications. You also may ask us not to send you other marketing or informational communications by contacting us as specified in the Contact Information section below, and we will honor your request. Please note that even after you are removed from our marketing lists, we may still send you non-promotional communications, such as responding to your support requests.

CONSUMER RIGHTS

If you are a resident of a state with consumer privacy rights, you may have specific rights regarding your Personal Data.  

COMPLIANCE WITH STATE LAWS.

To the extent that there are applicable state laws, Kyma will comply with all applicable state laws. 

THIRD-PARTY LINKS AND WEBSITES

The Services may contain links to third-party services, websites, mobile applications, and/or contain advertisements from third parties that are not affiliates with us and which may link to other websites, services, or applications. While we endeavor to work with third parties that share our respect for user privacy, we are not responsible for the privacy policies or privacy practices of such third parties. Any information collected by third parties are not covered by this Privacy Policy. You are responsible for knowing when you are leaving the Services to visit a third-party website, service, or application and for reading and understanding the terms of use and privacy policy statements for each such third party. This Privacy Policy only governs information collected through the Services. 

CHILDREN

The Services are not intended for children, and we encourage parents and guardians to be aware of and monitor the websites visited by their children. Kyma does not knowingly collect any Personal Data from children under 16 years of age. If you believe a child under age 16 has directly provided us with Personal Data, please contact us as specified in the Contact Information section below. 

RETENTION PERIOD 

Kyma may retain your Personal Data for the period necessary to fulfill the purposes outlined in this Privacy Policy, including for as long as you have unless a longer retention period is required or permitted by applicable law. We are under no obligation to store such Personal Data indefinitely and, to the extent permitted by law, disclaim any liability arising out of, or related to, the destruction of such Personal Data.  Upon cancellation and deletion of your account with us, we will proceed with complete deletion of your data.  If you maintain an active account with us, unless requested to be deleted earlier, we will retain all data in perpetuity. 

SECURITY

Kyma has put into place commercially reasonable security measures in an effort to protect Personal Information from loss, misuse, or alteration while it is under our control. We use standard technical, contractual, administrative, and physical measures in an effort to protect against unauthorized access. Please note, however, that security incidents can occur even if reasonable steps are taken to prevent such incidents; for example, we cannot guarantee that information provided through our sites will not be illegally accessed on our servers or intercepted while being transmitted to us over the internet. Additionally, we have absolutely no control over the security of other third-party sites you might visit, interact with, or do business with.

BREACH OF PERSONAL INFORMATION

If your Personal Information is altered, destroyed, acquired, accessed, used, or disclosed in a manner not outlined by this Privacy Policy that compromises the privacy or security of the Personal Information, you agree to receive any required notifications of this breach from Kyma or its delegate via electronic mail in lieu of first-class mail. The notification may be provided in one or more electronic mailings as information becomes available. To the extent required by applicable law, Kyma may report the breach of information to governmental authorities or other third parties.

CONTACT INFORMATION

If you have any questions or concerns about this Privacy Policy or our privacy practices, you can contact us via: 

Email: support@kyma.appsupport@kyma.app

Mail: 269 Vassar Street Unit 712 Cambridge MA 02139

Phone: 916-580-9167

MODIFICATIONS AND REVISIONS

We may update this Privacy Policy from time to time to reflect changes to our privacy practices. We will notify you of any changes to this Privacy Policy by posting the revised or updated Privacy Policy and its “Last Revised” date on the Services. If the revision or modification is material, we will provide you notification via email or via the Site. Your continued use of the Services after the “Last Revised” date constitutes your acceptance of and agreement to the Privacy Policy and its revisions or updates. You should periodically read this Privacy Policy to learn of any revisions or updates.