Last Updated: March 21, 2024

This Privacy Policy informs you about how Design Reactor, Inc. (“DRI”, “we”, “us”) will process your information on behalf of Comprehensive Mental Health Center of Tacoma-Pierce County d/b/a Comprehensive Life Resources (“Client”) as it relates to Client’s deployment of the Comprehensive Life Resources (CLR) App workplace mobile application and other related services (collectively the “Platform”).

By accessing and using the Platform, you signify you have read and understand the terms of this Privacy Policy. If you do not agree with or you are not comfortable with any aspect of this Privacy Policy, you should immediately discontinue access or use of the Platform.

We may change this Privacy Policy in response to changing legal, technical, and business developments. If we make material changes to this Privacy Policy, we will take appropriate measures to inform you in a manner that is consistent with the significance of the changes we make and in accordance with applicable law.

1. Information We Collect Using the Platform

Personal information is typically data that identifies an individual or relates to an identifiable individual. This may include information you provide to us, information which is collected about you automatically, and information we obtain from third parties. The definition of personal information depends on the applicable law based on your physical location. Only the definition that applies to your physical location will apply to you under this Privacy Policy. Described below are the types of personal information we may collect from and about you through the Platform.

• Information You Provide: You may give us your personal information by:

a. Filling Out Optional Fields in Your Personal Profile, including telephone number, biographical information, department, business unit or BU number, Building where you are assigned, photo, or job title.

b. Using Certain Platform Features. Selecting a location or using navigation in the app, provides us information about where you work when you use the Platform.

c. Opting In. If you opt in to provide us your phone’s GPS location, you will share geolocation information with us regarding your position either away from or within an office or venue. When you opt in to push notifications, you share your consent to receive alerts and notifications from the Client on your phone.

• Information We Collect Automatically: As you interact with the Platform, we may collect technical data about your equipment, browsing actions, and patterns, such as how long you spend using different Platform features. For more information, please refer to the Tracking Technologies section of this Privacy Policy.

• Information from Third-Party Integrations: The Platform allows us to integrate with various third-party service providers that we may use for various purposes at the Client’s direction. This primarily includes access control or single sign-on platforms, along with Google Maps which

powers the Platform’s navigation feature by providing you with turn-by-turn directions from your current GPS location (if opted in) to your destination.

2. How We Process Your Information

Our primary purpose in collecting information is to provide you with a secure, smooth, and efficient experience. Through the Platform, we may process your information as you use features of the app that may include the following:

• To provide information about your Platform-enabled workplace, including layout, transportation, and more

• To provide you a directory of your coworkers

• To provide you, if opted in, with Client alerts based on your real-time location in your Platform-enabled workplace

• To help you navigate your Platform-enabled workspace through mapping and real-time location services

• To allow you to search all of the various Platform features and information

• To manage visitors to your workplace, including notification upon their arrival and their location within your Platform-enabled workplace

• To provide you with news and alerts from Client

• To perform analytics on how you and your coworkers use the workplace and the Platform, including information about most-used workspaces based on time and location and most-used Platform features

• To improve the Platform

• Other similar, compatible purposes

3. How We Share Your Information

By using the Platform, we may share information about you in the following ways:

• With Other Platform Users: Certain information shared on the Platform is available to other Platform Users through the Platform’s directory features, such as contact information, biographical information (if you provide it in your profile), and the location you work. If you post content to the Platform, such as through the news section of the app, that content will be shared with other users.

• With Third-Party Integrations: In the same way that the Platform may collect information you share through Third-Party Integrations, the Platform may also share information you provide with the Third-Party Integrations that we enable.

• With Client: We process your information on the Platform so that we can offer the Platform services to our Client, and we are bound by a data processing agreement to that effect whereby we can only process your information as Client directs and in order to improve the Platform. Client processes your information in accordance with this Privacy Policy.

• With Platform Subprocessors: We may share your information with our subprocessors who are necessary to provide the Platform services, namely cloud service and mapping providers along with our affiliated companies as necessary, that will only process your information in order to provide the Platform and must do so in accordance with this Privacy Policy.

• Compliance with Laws and Law Enforcement Requests; Protection of Our Rights. We may disclose information about you to third parties when we have a good faith belief that disclosure is reasonably necessary to: (i) comply with a law, regulation or legal request including to meet national security or law enforcement requirements; (ii) protect the safety of any person from death or serious bodily injury; (iii) prevent fraud or abuse of us or our users, or (d) protect our property rights.

• Business Transfers. If we are involved in a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction, but we will notify you (for example, via a prominent notice on our website) of any change in control or use of your information.

4. How We Protect and Retain Information

No method of transmission over the internet, or method of electronic storage, is fully secure. While we use reasonable efforts to protect your information on the Platform from unauthorized access, use, or disclosure, we cannot guarantee the security of your information. In the event that we, or our Client, are required by law to inform you of a breach to your information, we may notify you electronically, in writing, or by telephone, if permitted to do so by law.

We retain your information for only as long as necessary to fulfill the purposes outlined in this Privacy Policy, including for the purposes of satisfying any legal, accounting, or reporting requirements, unless a longer retention period is required or permitted by law. To determine the appropriate retention period for your information from the Platform, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we obtained the information and whether we can achieve those purposes through other means, as well as applicable legal requirements.

5. Your Rights and Choices

Depending on the applicable law in your jurisdiction, you may have some or all of the choices identified below regarding your information. Your choices are not absolute. Depending upon the applicable law, access to your rights under the applicable law may be denied: (a) when denial of access is required or authorized by law; (b) when granting access would have a negative impact on another's privacy; (c) to protect our rights and properties; (d) where the request is frivolous or vexatious, or for other reasons. We will not discriminate against individuals who exercise their privacy rights under applicable law.

• Access To Your Information. You may request access to your information on the Platform or confirmation that we have information about you on the Platform. In certain limited circumstances, you may also request to receive access to your data on the Platform in a portable, machine-readable format.

• Changes To Your Information. We rely on you to update and correct your information on the Platform. You may ask us to correct information on the Platform that is inaccurate or incomplete. Note that we may keep historical information in our backup files as permitted by law.

• Deletion of Your Information. You may request that we delete your information on the Platform. If required by law, we will grant a request to delete information on the Platform, but you should note that in many situations we must keep your information to comply with our legal obligations, resolve disputes, enforce our agreements, or for another business purposes.

• Objection to Certain Processing. You may object to our use or disclosure of your information on the Platform by contacting us at the address described below.

• Automated Individual Decision-Making. In some jurisdictions, you have the right not to be subject to a decision based solely on automated processing of your information, including profiling, which produces legal or similarly significant effects on you, save for the exceptions applicable under relevant data protection laws.

• Revocation of Consent. Where we process your information using the Platform based upon consent, you may revoke consent. Please note, if you revoke your consent for the processing of information using the Platform then we may no longer be able to provide you with the Platform services.

You may exercise the rights described above by contacting Client as indicated in the Contact Information section below. Only you or a person you formally authorize to act on your behalf, may make a verifiable consumer request related to your information. Your identity may be verified by phone call, email, or other similar means. Depending on your request, you may be asked for information such as your name, email address, and phone number, or other information verifying your identify. If you use an authorized agent to submit such a request, such authorized agent may be required to provide written proof that the authorized agent has been authorized to act on your behalf or a copy of the power-of-attorney document granting that right.

If you disagree with how a request has been handled, you may appeal the decision by contacting Client with the subject line “Appeal.” Note that, as required by law, you will be required to prove your identity prior to receiving a response to your request.

6. Children

We do not knowingly collect information from children, and the Platform is not intended for anyone under the age of 18. Individuals under the age of 18 should not use the Service or provide their information to us.

7. Tracking Technology

We, and third parties on our behalf, use cookies, web beacons, and similar tracking technologies (collectively, “Tracking Technologies”) to collect information automatically as you interact with the Platform, to help us customize your experience and better manage content on the Platform, including to:

• Analyze our web traffic using an analytics package

• Identify whether you already visited our Platform

• Store information about your preferences

• To recognize when you return to our Platform

Cookies. When you use our Platform, we (or third-party data networks we work with) may send one or more “cookies” to your computer or other devices. Cookies are alphanumeric identifiers stored on your computer through your web browser and are used by most websites to help personalize your web experience. Some cookies may facilitate additional site features for enhanced performance and functionality such as remembering preferences, allowing social interactions, analyzing usage for site optimization, providing custom content, allowing third parties to provide social sharing tools, and serving images or videos from third-party websites. Some features on the Platform will not function if you do not allow cookies. The following types of cookies may be used on our Platform:

(1) Essential Cookies. These cookies are essential because they enable you to use our Sites as you reasonably expect. For example, strictly necessary cookies allow you to access secure areas on our Sites and provide necessary security functions. Without these cookies, some features cannot be provided. This category of cookies is essential for our Platform to work and they cannot be disabled.

(2) Personalization Cookies. We use functional cookies to remember your choices so that we may tailor our Platform to provide you with enhanced features and personalized content. While these cookies can be disabled, this may result in less functionality during your use of our Platform.

(3) Analytics Cookies. These cookies allow us to collect passive information about your use of our Platform, for example, count page visits and traffic sources so we can measure and improve the performance of our Platform and/or our marketing activities.

Managing Cookies. In our web applications, you have the right to decide whether to accept cookies. If you do not want us to deploy cookies in your browser, you may exercise your preference by modifying your web browser setting to either (1) refuse some or all cookies or (2) notify you and ask for your permission when a website tries to set a cookie. If you want to learn the correct way to modify your browser settings, please use the “Help,” “Tools” or “Edit” menu in your browser or review the instructions provided by the following browsers: Internet Explorer, Google Chrome, Mozilla Firefox, Safari Desktop, Safari Mobile; and Android browser. If you choose to disable cookies in your browser, you can still use our Platform, although your ability to use some of the features may be affected. If you want to exercise your rights regarding information collected via cookies and similar tracking technologies, please see the Your Rights and Choices section above.

Analytics. We use Google Analytics and PostHog, which use cookies and other similar tracking technologies to collect and analyze information about your use of our Platform and report on activities and trends. These services may also collect information regarding your use of other websites, apps and online resources. You consent to the processing of data by these analytics providers in the manner and for the purposes set out in this Privacy Policy. You can learn about Google’s practices by going to www.google.com/policies/privacy/partners/, and opt out of them by

downloading the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout.

8. Contact Information

If you have any questions, comments, or complaints concerning the privacy practices with respect to the Platform, please contact Client at the appropriate address below.

communications@cmhshare.org

Comprehensive Life Resources

737 Fawcett Ave.

Tacoma, WA 98402

1 253-396-5800