Legal & Privacy

About This Policy

Osleri, LLC ("Osleri," "we," "us," or "our") operates an AI-enabled Remote Therapeutic Monitoring (RTM) platform designed to close the care continuity gap between hospital discharge and ongoing chronic disease management. This Privacy Policy explains how we collect, use, disclose, and protect information when you interact with our platform, website, and services (collectively, the "Services").

This policy applies to patients, healthcare providers, health system partners, and any other individuals who access or use our Services. By using our Services, you acknowledge that you have read and understood this policy.

Information We Collect

We collect information necessary to deliver safe, effective remote therapeutic monitoring and to operate and improve our platform.

Information provided by healthcare partners

• Patient demographic information (name, date of birth, contact details)
• Clinical data including diagnoses, care plans, discharge summaries, and therapeutic goals
• RTM-relevant health metrics transmitted through connected devices or patient-reported outcomes
• Provider and staff information necessary to administer the platform

Information collected automatically

• Usage data and interaction logs within the platform
• Device identifiers, browser type, and IP address
• Log files and analytics data used to maintain platform security and performance

Information you provide directly

• Account registration information for providers and clinical staff
• Communications sent to our support and clinical teams
• Feedback, survey responses, and research participation data

How We Use Your Information

We use the information we collect solely for purposes consistent with our role as a healthcare technology platform and Business Associate, including:

• Delivering RTM services, generating clinical documentation, and supporting care coordination between patients and providers
• Facilitating CPT billing under applicable RTM reimbursement codes (including CPT 98975, 98976, 98977, 98980, and 98981)
• Improving clinical algorithms, platform functionality, and outcomes analytics — using de-identified or aggregated data where applicable
• Communicating with healthcare partners about platform updates, compliance changes, and service matters
• Complying with applicable legal, regulatory, and contractual obligations
• Detecting, preventing, and responding to security incidents or fraudulent activity

We do not sell personal information or PHI to third parties. We do not use PHI to train AI or machine learning models without explicit authorization and appropriate data use agreements.

HIPAA & Protected Health Information

Osleri is committed to full compliance with HIPAA and the HITECH Act. Where we process PHI on behalf of a covered healthcare entity, we do so under an executed Business Associate Agreement (BAA) that defines the permitted uses and disclosures of that information.

PHI is:

• Encrypted in transit (TLS 1.2+) and at rest using industry-standard encryption protocols
• Accessible only to authorized personnel on a need-to-know basis
• Never used for purposes beyond those specified in the applicable BAA and this policy
• Subject to breach notification procedures consistent with HIPAA's Breach Notification Rule

Patients who wish to exercise their HIPAA rights — including the right to access, amend, or request restrictions on their PHI — should contact their treating healthcare provider or health system directly, as Osleri processes PHI on behalf of those covered entities.

How We Share Information

We do not sell, rent, or trade personal information. We may share information in the following limited circumstances:

• Healthcare partners: We share information with the treating health systems, clinics, and providers who have engaged Osleri to deliver RTM services on their behalf.
• Service providers: We engage subprocessors and vendors (e.g., cloud infrastructure, secure messaging) under confidentiality obligations and, where applicable, BAAs.
• Research: De-identified or aggregated data may be used for academic research and outcomes analysis under IRB-approved protocols.
• Legal requirements: We may disclose information when required by law, court order, or government authority.
• Business transfers: In the event of a merger, acquisition, or sale of assets, information may be transferred subject to confidentiality obligations and applicable law.

Data Security

We implement administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of the data we hold. These measures include:

• End-to-end encryption for data in transit and at rest
• Role-based access controls and multi-factor authentication
• Regular security assessments and vulnerability management
• Employee training on data privacy and security practices
• Incident response and breach notification procedures

While we take reasonable steps to protect your information, no system is completely secure. We encourage healthcare partners to implement their own security controls and to report any suspected vulnerabilities promptly.

Data Retention

We retain information for as long as necessary to fulfill the purposes described in this policy, to comply with our legal and contractual obligations, and to resolve disputes or enforce our agreements.

PHI is retained in accordance with the terms of the applicable BAA and applicable federal and state medical records laws. Upon termination of a partner agreement, PHI is returned to the covered entity or securely destroyed in accordance with HIPAA requirements.

Your Rights

Depending on your location and applicable law, you may have the following rights with respect to your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Portability: Request that your information be provided in a structured, machine-readable format.
• Objection: Object to certain processing activities.

For HIPAA-related rights, please contact your treating provider or health system directly. For all other privacy inquiries, contact us at admin@osleri.com.

Residents of California may have additional rights under the California Consumer Privacy Act (CCPA). Requests may be submitted to the contact address above.

Cookies & Tracking Technologies

Our website may use cookies and similar tracking technologies to improve navigation, analyze usage, and support platform functionality. We do not use tracking technologies within the clinical platform to serve advertising.

• Strictly necessary: Required for core platform functionality and security.
• Analytics: Used in aggregate, de-identified form to understand how our website is used and to improve user experience.

You may manage cookie preferences through your browser settings. Disabling certain cookies may affect platform functionality.

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated to health system partners via email or in-platform notice at least 30 days prior to taking effect.

The "Last Updated" date at the top of this page indicates when the policy was most recently revised. Continued use of our Services after an update constitutes acceptance of the revised policy.

Acceptance of Terms

These Terms and Conditions ("Terms") constitute a legally binding agreement between you and Osleri, LLC ("Osleri," "we," "us," or "our"). By accessing, registering for, or using the Osleri platform and services (collectively, the "Services"), you agree to be bound by these Terms and our Privacy Policy, incorporated herein by reference.

If you are accessing the Services on behalf of a health system, hospital, clinic, or other organization ("Partner Organization"), you represent that you have authority to bind that organization to these Terms. In that case, "you" and "your" refer to both the individual user and the Partner Organization.

If you do not agree to these Terms, you may not use our Services.

Description of Services

Osleri provides an AI-enabled Remote Therapeutic Monitoring (RTM) platform that supports healthcare providers and health systems in delivering continuous, data-driven care to patients between clinical visits. Our Services include, but are not limited to:

• Patient enrollment and device or app-based therapeutic data collection
• AI-assisted clinical documentation and RTM note generation
• Billing support for RTM CPT codes including 98975, 98976, 98977, 98980, and 98981
• Provider-facing dashboards and outcomes analytics
• Integration support with electronic health record (EHR) systems including Epic, Cerner, eClinicalWorks, and athenahealth
• Clinical program support for high-risk patient populations including post-discharge and chronic disease management cohorts

Services are provided to health systems and clinical practices under executed service agreements. Individual patient access is facilitated through the patient's enrolled healthcare provider.

Eligibility & Accounts

Access to the Osleri platform is limited to authorized users including licensed healthcare providers, clinical staff, and health system administrators. Patient access is facilitated through the treating provider's account.

By creating or using an account, you represent that:

• You are at least 18 years of age
• You are authorized by your organization to access and use the Services
• All information you provide is accurate, current, and complete
• You will maintain the security of your account credentials and promptly notify Osleri of any unauthorized access

You are responsible for all activity that occurs under your account. Osleri reserves the right to suspend or terminate accounts that violate these Terms or engage in unauthorized or fraudulent activity.

Permitted Use

You may use the Services solely for lawful purposes and in accordance with these Terms. You agree not to:

• Use the Services in any manner that violates applicable federal or state law, including HIPAA, the False Claims Act, or anti-kickback statutes
• Access, use, or disclose patient data beyond what is authorized under your role and any applicable Business Associate Agreement
• Attempt to reverse-engineer, decompile, or otherwise access the underlying source code, algorithms, or models of the platform
• Use the Services to transmit malicious code, interfere with platform integrity, or gain unauthorized access to any system or data
• Use AI-generated clinical notes or documentation without appropriate clinician review and attestation as required by applicable billing and clinical standards
• Misrepresent RTM service delivery or patient engagement data in connection with billing or claims submission

Clinical Disclaimer

Osleri is a technology and care coordination platform. Our Services are designed to support — not replace — the professional judgment of licensed clinicians.

In the event of a medical emergency, patients should contact emergency services (911) or proceed to the nearest emergency facility. The platform is not intended for emergency use or real-time clinical intervention.

Providers bear full responsibility for ensuring that RTM services meet applicable clinical standards, that patients are appropriately enrolled and consented, and that all billing submissions accurately reflect services rendered.

Billing & Payment

Fees for the Osleri platform are governed by the applicable service agreement between Osleri and the Partner Organization. General terms include:

• Platform fees and revenue-share arrangements are as specified in the executed service agreement
• Invoices are payable within the timeframe set forth in the applicable agreement
• Osleri reserves the right to suspend Services for accounts with material overdue balances, with reasonable prior notice
• All fees are exclusive of applicable taxes, which are the responsibility of the Partner Organization

RTM reimbursement from payers (including Medicare and commercial insurers) is collected by the Provider Organization based on documented service delivery. Osleri does not guarantee specific reimbursement rates or outcomes, which are subject to payer policies and documentation requirements.

Intellectual Property

All technology, software, algorithms, documentation, branding, and content comprising the Osleri platform ("Osleri IP") is and remains the exclusive property of Osleri, LLC. Nothing in these Terms transfers any ownership interest in Osleri IP to you or your organization.

You are granted a limited, non-exclusive, non-transferable, revocable license to access and use the platform solely for the purposes set forth in your service agreement and these Terms.

Clinical notes and documentation generated through the platform using your organization's patient data are owned by the treating provider or covered entity, as applicable. De-identified, aggregated analytics derived from platform usage may be used by Osleri to improve the Services, subject to applicable law and executed data use agreements.

Confidentiality & HIPAA Compliance

Both parties agree to maintain the confidentiality of each other's proprietary and confidential information. Osleri will handle all Protected Health Information (PHI) in accordance with the terms of the applicable Business Associate Agreement (BAA), HIPAA, and the HITECH Act.

Partner Organizations are responsible for:

• Obtaining appropriate patient authorizations and consent for RTM enrollment and data collection
• Ensuring that their use of the platform complies with their obligations as a HIPAA-covered entity
• Executing a Business Associate Agreement with Osleri prior to transmitting any PHI through the platform

Use of the Services without an executed BAA where PHI is involved is prohibited and constitutes a material breach of these Terms.

Limitation of Liability

To the fullest extent permitted by applicable law, Osleri and its officers, directors, employees, and agents shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising out of or related to your use of the Services, including but not limited to:

• Clinical decisions made by healthcare providers based on platform data or documentation
• Interruptions in payer reimbursement or denied claims
• Data breaches or unauthorized access resulting from failures of third-party systems
• Platform downtime or service interruptions beyond our reasonable control

In no event shall Osleri' total aggregate liability exceed the total fees paid by the Partner Organization in the twelve (12) months preceding the claim. Nothing in these Terms limits liability for gross negligence, willful misconduct, fraud, or any liability that cannot be excluded by applicable law.

Termination

Either party may terminate the Services in accordance with the terms of the applicable service agreement. In addition, Osleri may immediately suspend or terminate access if:

• You materially breach these Terms and fail to cure the breach within 15 days of written notice
• You engage in fraudulent, illegal, or harmful activity in connection with the Services
• Continued provision of Services would expose Osleri to legal or regulatory liability

Upon termination, your right to access the platform ceases immediately. PHI and clinical data will be handled in accordance with the BAA, applicable law, and the offboarding procedures in your service agreement. Provisions that by their nature should survive termination — including confidentiality, intellectual property, limitation of liability, and governing law — shall survive.

Governing Law & Dispute Resolution

These Terms are governed by the laws of the Commonwealth of Pennsylvania, without regard to conflict of law principles. Any dispute that cannot be resolved through good-faith negotiation shall be submitted to binding arbitration administered under the American Arbitration Association (AAA) Commercial Arbitration Rules, with proceedings held in Philadelphia, Pennsylvania.

Notwithstanding the foregoing, either party may seek injunctive or equitable relief in any court of competent jurisdiction to protect confidential information or intellectual property rights. You agree to bring any claim individually and waive any right to participate in a class action lawsuit or class-wide arbitration.

Modifications to These Terms

Osleri reserves the right to update or modify these Terms at any time. Material changes will be communicated to Partner Organizations by email or in-platform notification at least 30 days before they take effect. Non-material updates take effect upon posting.

Your continued use of the Services after the effective date of any updated Terms constitutes your acceptance of those changes. If you do not agree with updated Terms, you may terminate your use of the Services in accordance with Section 10.