AMI COLLECTIVE, INC. PRIVACY POLICY

1. Who We Are

AMI Collective, Inc. ('AMI,' 'we,' 'us,' or 'our') is a Delaware corporation registered to do business in the Commonwealth of Puerto Rico, operating a women's health platform accessible at joinami.io and through our mobile application (collectively, the 'Services'). This Privacy Policy describes how we collect, use, store, and share your personal information when you use our Services.

If you have questions about this Policy at any time, you can reach us at admin@joinami.io.

2. A Note on HIPAA

AMI Collective is a wellness platform. While HIPAA's specific regulatory framework is designed for healthcare providers, health plans, and clearinghouses — and doesn't technically apply to a platform like ours - we believe the spirit of that protection matters regardless of the label. That's why we built our own standards around data minimization, transparency, and security from day one.

Because we operate in the women's health space, we know exactly how sensitive the information you share with us is — your cycle dates, symptoms, mood patterns, and self-reported health history deserve real care, not a checkbox. We do not sell your personal Health Data to third parties. Ever.

We are committed to collecting only the personal information reasonably necessary to provide and improve our Services. We encourage you to share only the information you are comfortable providing.

3. Information We Collect

The personal information we collect depends on how you interact with our Services. This may include:

3.1 Information You Provide Directly

• Contact data: name, email address, and password when you create an account.
• Profile data: date of birth, location, and any preferences you set within the app.
• Health Data: menstrual cycle dates, flow, symptoms, mood, energy levels, sleep patterns, and any other health information you choose to log. This data is voluntary — you control what you share.
• Self-reported health history: conditions, medications, or other background health information you choose to provide to personalize your experience.
• AMI chat interactions: questions and prompts ('Inquiries') you submit to our AI-powered chat, and the responses generated. See Section 4.2 for how this data is handled.
• Lab Results: laboratory test results you choose to upload, including hormone panels, metabolic markers, and any other diagnostic data. Lab Results are treated as a distinct and especially sensitive category of Health Data. They are used solely to personalize your in-app experience and inform AMI chat responses. Lab Results are never shared with third parties without your explicit written consent.
• Communications: messages you send us via email, feedback forms, or support channels.
• Payment data: billing information processed through our third-party payment processor, Stripe. AMI does not store your full payment card details.

You are responsible for ensuring that the information you choose to provide to AMI is accurate and kept reasonably up to date. The quality and personalization of the Services, including AMI Chat, may depend on the accuracy and completeness of the information you provide.

3.2 Information Collected Automatically

• Device data: device type, operating system, browser type, and IP address.
• Usage data: pages visited, features used, session duration, and interaction patterns within the app.
• Mobile app data: if you download our iOS or Android app, we may collect device identifiers and app usage data in accordance with Apple App Store and Google Play Store policies.
• Cookies and similar technologies: used to maintain your session, remember preferences, and understand how the Services are used. You may manage cookie preferences through your browser settings.

3.3 Information from Third Parties

If you connect a third-party service (such as a wearable device or health app) to your AMI account, we may receive data from that service as authorized by you and subject to that service's own privacy terms.

If you log in using a third-party account (such as Google or Apple), we receive limited profile information from that service as permitted by your settings.

4. How We Use Your Information

We use your personal information only for the purposes described below:

4.1 To Deliver and Personalize the Services

• Create and maintain your account.
• Provide cycle tracking, phase-based insights, and personalized wellness recommendations.
• Remember your preferences and personalize your experience.

Certain features of the Services depend on your providing specific personal information or Health Data. If you choose not to provide certain information, some features, insights, or personalized recommendations may not function as intended or may be less accurate.

4.2 AMI Chat Interactions

When you use AMI Chat, the questions and prompts you submit ('Inquiries') are shared with third-party AI service providers that process your Inquiries solely for the purpose of generating responses on our behalf. By using AMI Chat, you consent to this sharing. Your Inquiries may also be reviewed internally to improve the accuracy, safety, and quality of the feature. We do not use your Inquiries to build advertising profiles or share them with third parties for any purpose other than generating your response.

All responses generated by AMI Chat are for informational purposes only and do not constitute medical advice. Any insights, recommendations, or responses generated through AMI Chat are informational only and are not intended to make decisions on your behalf. See the Medical Disclaimer section of our Terms of Service for the full AMI Chat disclaimer.

4.3 To Communicate with You

• Send transactional messages such as account confirmations, receipts, and security alerts.
• Send product updates, educational content, or wellness resources — only where you have opted in to receive them. As required by DACO Regulation 9158, we will obtain your explicit written consent before using your personal data for marketing purposes.
• Respond to your support requests and feedback.

4.4 To Improve the Services

• Analyze usage patterns to understand how the Services are being used and where they can be improved.
• Conduct internal research and development to build new features.
• Create aggregated, de-identified data sets that cannot be traced back to you, which may be used for research, publishing, or improving our platform.

4.5 To Protect AMI and Our Users

• Detect and prevent fraud, abuse, or unauthorized access.
• Comply with applicable legal obligations, including Puerto Rico Act 111-2005 and DACO reporting requirements.
• Enforce our Terms of Service.

4.6 What We Will Never Do

We will never sell, rent, or license your personal information or Health Data. We will never use your menstrual cycle data, symptoms, or health history for advertising or marketing purposes — not our own, and not a third party's. Your most sensitive data exists to serve you, not to profile you.

4.7 Legal Bases for Processing

Where applicable under data protection laws, we process your personal information based on one or more of the following legal grounds: your consent (for example, when you voluntarily provide Health Data or choose to upload Lab Results); performance of our contract with you to provide the Services; compliance with applicable legal obligations; and our legitimate interests in operating, improving, securing, and maintaining the Services, provided those interests are not overridden by your rights and freedoms.

5. How We Share Your Information

We do not sell your personal information. We share your information only in the following limited circumstances:

5.1 Service Providers

We work with trusted third-party vendors who help us operate the Services, including hosting providers, payment processors (Stripe), AI Tools that power AMI Chat, analytics tools providers (such as Google Analytics, Mixpanel, PostHog, or similar providers), and customer support platforms. These vendors are contractually bound to use your information only to provide services to us and in accordance with this Privacy Policy.

5.2 App Store Platforms

If you download the AMI mobile app through the Apple App Store or Google Play Store, those platforms may collect certain data about your download and device in accordance with their own privacy policies. AMI does not control the data practices of Apple or Google. We encourage you to review their respective privacy policies.

5.3 With Your Consent

If you explicitly authorize us to share your information with a third party — for example, by connecting an integration or participating in a research study — we will share only what you have authorized, for the purpose you authorized.

5.4 Legal Compliance and Safety

We may disclose your information if required by law, court order, or government request, or where we believe disclosure is necessary to protect the rights, property, or safety of AMI, our users, or others. This includes compliance with requests from DACO or other Puerto Rico regulatory authorities.

5.5 Business Transactions

If AMI is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice within the Services before your information is transferred and becomes subject to a different privacy policy. Any successor entity will remain bound to protect your personal information in a manner substantially consistent with this Privacy Policy unless you are notified otherwise.

5.6 Aggregated or De-Identified Data

We may share aggregated or de-identified information — data that cannot reasonably be used to identify you — with partners, researchers, or the public for educational or product development purposes.

5.7 International Transfers

Your information may be stored or processed in Puerto Rico, the United States, or other jurisdictions where our service providers operate. When we transfer personal information internationally, we take reasonable steps to ensure that appropriate safeguards are in place and that your information receives a level of protection consistent with this Privacy Policy and applicable law.

6. Data Retention

We retain your personal information for as long as your account is active or as otherwise necessary to provide the Services.

Deleting the AMI mobile application from your device does not automatically delete your account or the information associated with it. To permanently delete your account, you must use the account deletion feature within the Services or contact us directly at admin@joinami.io.

You may also request deletion of your Health Data at any time, independently of closing your account, by contacting admin@joinami.io.

If you delete your account, we will delete or anonymize your personal information within thirty (30) days.

Certain limited information may be retained after account deletion where required or permitted by applicable law, including to comply with legal obligations, resolve disputes, detect fraud, enforce our agreements, or establish, exercise, or defend legal claims.

We use reasonable administrative and technical measures designed to securely delete or anonymize personal information from our active systems. Certain backup copies may remain for a limited period before being securely overwritten as part of our normal backup retention processes.

7. Your Rights and Choices

We respect your right to control your personal information. You have the following rights:

• Access: request a copy of the personal information we hold about you.
• Correction: request that we correct inaccurate or incomplete information.
• Deletion: request that we delete your personal information, subject to limited legal exceptions.
• Portability: request your data in a structured, commonly used format.
• Opt-out of marketing: unsubscribe from marketing communications at any time using the link in any email we send, or by contacting us directly.
• Withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

Puerto Rico residents additionally have rights under the Puerto Rico Constitution (Article II, Section 8), which establishes privacy as a fundamental right enforceable between private parties, and under applicable DACO regulations. To exercise any of your rights, contact us at admin@joinami.io. We will respond as quickly as possible. We will never penalize you for exercising your privacy rights.

8. Children's Privacy

Our Services are not directed at or intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected information from a person under 18, we will delete it promptly. If you believe we have collected information from a minor, please contact us at admin@joinami.io.

9. Data Security & Breach Notification

We implement reasonable and appropriate administrative, technical, and physical safeguards designed to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit and at rest, access controls, and regular security reviews.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. If you have reason to believe your interaction with us is no longer secure, please contact us immediately at admin@joinami.io.

You are responsible for maintaining the confidentiality of your account credentials and for restricting access to your account. If you believe your account has been compromised or accessed without authorization, please notify us immediately at admin@joinami.io.

9.1 Data Breach Notification — Puerto Rico Act 111-2005

In the event of a security breach affecting personal information of Puerto Rico residents, AMI will comply with the Puerto Rico Citizen Information on Data Banks Security Act (Act 111-2005). This means:

• We will notify affected Puerto Rico residents by email, through the Services, or by other legally permitted means, as promptly as possible following discovery of a breach;
• We will report the breach to the Puerto Rico Department of Consumer Affairs (DACO) within 10 days of discovery, as required by law;
• DACO may issue a public announcement within 24 hours of our report where individual identification is not possible;
• Where required by law, our notification will describe the nature of the incident, the categories of personal information involved, the measures we have taken in response, and any steps you may take to protect yourself.

For users outside Puerto Rico, we will provide breach notification in accordance with applicable federal and state law. In all cases, we will notify you promptly and clearly about what happened, what data was affected, and what steps we are taking.

Additional information regarding any security incident may be obtained by contacting us at admin@joinami.io or through our website at joinami.io.

10. Third-Party Links and Integrations

The Services may contain links to third-party websites or offer integrations with third-party services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access through the AMI platform. AMI is not responsible for the privacy practices of third parties.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated Policy within the app, on our website, or via email, and we will update the 'Last Updated' date at the top of this document.

Your continued use of the Services after any changes become effective constitutes your acceptance of the updated Privacy Policy. If you do not agree to the changes, please stop using the Services and contact us to request deletion of your data.

12. Governing Law

This Privacy Policy is governed by the laws of the State of Delaware with respect to matters of corporate governance, intellectual property, and general contract interpretation.

With respect to the privacy rights of users located in the Commonwealth of Puerto Rico, this Policy shall also be interpreted in accordance with applicable Puerto Rico privacy and consumer protection law, including the Puerto Rico Citizen Information on Data Banks Security Act (Act 111-2005), the Puerto Rico Privacy Policy Notification Act (Act 39-2012), DACO Regulation 9158, and Article II, Section 8 of the Puerto Rico Constitution. Nothing in this Policy limits any rights Puerto Rico residents may have under applicable local law.

13. Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy or the way we handle your data, please reach out:

Your trust is the foundation of everything we build. Thank you for being part of AMI.

© 2026 AMI Collective, Inc. All rights reserved.