HUB PLATFORM PRIVACY POLICY

Last Updated: February 1, 2026

This Privacy Policy explains how Hub Public Benefit Corp. (“Hub,” “we,” “us”) collects, uses, discloses, and otherwise processes information when you use Hub’s websites, apps, and services that link to this Privacy Policy (the “Services”), including PHapp®, Wehealth®, Hub Portal, Hub Access (accounts), and our support channels.

1. Scope and roles (controller vs. processor)

1.1 When Hub is a controller

This Privacy Policy applies where Hub acts as a “controller” (or equivalent) — meaning we decide why and how personal information is processed. Examples include:

• when you browse our public websites,
• when you subscribe to PHapp Alert (SMS),
• when you contact us or submit support tickets,
• when you create or manage a Hub Account for your own use, and
• when you participate in Wehealth community spaces.

1.2 When Hub is a processor/service provider

Some Organization Services (for example, agency programs run through Portal) may involve Hub processing personal information on behalf of an organization (“Customer”). In those cases, the Customer may be the controller, and the Customer’s privacy notices may apply. Hub processes that information according to Customer instructions and applicable agreements.

2. Information we collect

2.1 Information you provide

We aim to design the Services so that many features can be used without an account or direct identification. When we collect personal information, we seek to collect it in a limited way that is reasonably necessary to provide the Services or a specific feature you request, maintain security, comply with law, and improve reliability and performance.

Depending on the Services you use, we may collect:

• Account information (name, email, authentication details, organization affiliation where provided)
• Contact and communications (emails, support requests, ticket content)
• Program information you provide (for example, SMS enrollment preferences such as language and location)
• User Content you submit (reports, posts, feedback)

2.2 Information collected automatically

We may collect:

• Device and network data (IP address, device type, browser type, OS)
• Usage and interaction data (pages viewed, clicks, timestamps, referrers)
• Logs and diagnostic data (crash reports, error logs)
• Cookie and similar technology data (see Section 6)

2.3 PHapp privacy-first mode (data minimization)

PHapp is designed to work without requiring traditional identity information in its default mode. For example:

• you may select a community/location to tailor alerts you see,
• we may measure privacy-preserving, anonymous signals (e.g., aggregate interactions),
• optional opt-in analytics may collect anonymous usage and performance information to improve PHapp.

If you use PHapp features that require an account or contact information (for example, SMS enrollment or other identity-linked features), we collect the information needed to provide those features.

2.4 Information from third parties

We may receive information from:

• service providers that help us operate the Services (hosting, support tooling, communications delivery)
• Customers/organizations that provision accounts or invite you to programs
• public/official sources used to provide alerts and informational content

3. How we use information

We use information to:

• provide, operate, and maintain the Services
• deliver alerts and notifications you request
• administer Hub Accounts and authenticate users
• provide support and respond to inquiries
• secure the Services, prevent abuse, and debug problems
• improve the Services (including through aggregated analytics)
• comply with legal obligations and enforce our terms

We do not sell your personal information.

3.1 AI-assisted support and human review

When you message Hub support in the app, we use artificial intelligence to help draft a response and to decide when a message needs a person. This processing runs on Google Cloud’s Vertex AI, inside our own secured Google Cloud environment, under strict contractual data-protection terms that meet healthcare-grade privacy standards. Your message is used only to generate that response; it is not used to train any AI model, is not retained by the AI service beyond the time needed to process it, remains in a United States region, and is encrypted in transit and at rest.

Hub support is handled by people. Authorized Hub support staff can read the content of your messages in order to understand, triage, and respond to your request; access is limited to authorized staff and is permission-controlled. We do not write the content of your messages to our operational logs, analytics, or audit records, and we do not sell or share it. You can export or delete your data at any time.

4. How we disclose information

We may disclose information:

4.1 To service providers

We share information with vendors that process data on our behalf to provide the Services (e.g., hosting, support systems, communications delivery). They are permitted to use information only for the purpose of providing services to Hub (or to a Customer where applicable). For AI-assisted support, that provider is Google Cloud (Vertex AI), which processes support-message content solely to generate a draft response under contractual data-protection terms and does not use it to train its models.

4.2 To Customers/organizations (programs and organization services)

If you use Organization Services or participate in a Customer’s program, we may share relevant information with that Customer so they can operate the program (for example, program administration, responding to constituent inquiries, or compliance).

4.3 For legal and safety reasons

We may disclose information if we believe in good faith it is necessary to:

• comply with law or legal process,
• protect the rights, safety, and security of Hub, users, Customers, or the public,
• prevent fraud or address security issues.

4.4 Business transfers

If Hub is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to appropriate safeguards.

5. Aggregated and de-identified information

We may create and use aggregated or de-identified information for analytics, research, and improving the Services. We maintain such information in de-identified form where feasible.

6. Cookies and similar technologies

We use cookies and similar technologies to:

• enable essential site functionality,
• remember preferences,
• measure performance and improve security.

You can manage cookies through browser settings. Some features may not work without certain cookies.

7. Your rights and choices

Depending on your location and applicable law, you may have rights such as:

• access, correction, and deletion,
• opting out of marketing emails,
• managing notification preferences,
• withdrawing consent where processing is based on consent.

If you are an end user in a Customer program and Hub processes your information on behalf of that Customer, you may need to direct certain requests to the Customer.

8. Data retention

We retain information for as long as reasonably necessary to:

• provide the Services,
• comply with legal obligations,
• resolve disputes,
• enforce agreements,
• maintain security and prevent abuse.

Retention periods vary depending on the type of data and the context (individual vs. organization services).

9. Security

We implement reasonable technical and organizational safeguards designed to protect information. No system is 100% secure.

10. International users

Hub is based in the United States. If you access the Services from outside the U.S., your information may be processed in the U.S. and other locations where Hub or its service providers operate.

11. Children’s privacy

The Services are not directed to children under 13 (or under 16 where applicable). We do not knowingly collect personal information from children.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will update the “Last Updated” date above and provide additional notice if required by law.

13. Contact us

Hub Public Benefit Corp.
5325 Elkhorn Blvd Ste 7011, Sacramento, CA 95842
Email: contact@hub.inc