Effective Date: April 3, 2005
Updated: August 28, 2026

Soleran, Inc. ("Soleran," "we,""us," or "our") respects the privacy of individuals whointeract with Soleran and recognizes the importance of protecting personalinformation.

This Customer Privacy Policy ("Privacy Policy")describes how Soleran collects, uses, discloses, and protects personalinformation in connection with Soleran websites, cloud-based softwareapplications, mobile applications, customer and prospective-customerinteractions, and related services (collectively, the "Services").

This Privacy Policy also explains the distinction betweenpersonal information that Soleran collects for its own business purposes andinformation that Soleran processes on behalf of customers through our Services.

1. Scope

This Privacy Policy applies to personal informationcollected by Soleran through:

• Soleran-operated websites;
• Soleran cloud-based software and SaaS applications;
• Soleran mobile applications;
• Customer support and service interactions;
• Sales and prospective-customer interactions;
• Security and Trust Center interactions;
• Training,     demonstrations, and events;
• Communications     with Soleran; and
• Other Soleran services or interactions that reference this Privacy Policy.

Certain Soleran Services may be subject to additionalcontractual privacy and security requirements, including customer agreements,Business Associate Agreements ("BAAs"), Data Processing Addendums("DPAs"), or other agreements.

Where those agreements establish specific requirementsconcerning Customer Data, the applicable contractual terms govern.

2. Soleran's Role and Customer Data

An important distinction exists between information Solerancollects directly and Customer Data that customers submit to or processthrough Soleran Services.

Information Soleran Collects Directly

Soleran may determine the purposes and means of processingcertain information collected through our websites, sales activities, customerrelationships, security operations, and other business activities.

Depending upon applicable law, Soleran may be considered adata controller, business, or similar responsible party for this information.

Customer Data

Customers use Soleran Services to create, upload, import,store, manage, and process information for their own business purposes.

Customer Data remains the property of the customer.

For personal information contained within Customer Data, thecustomer generally determines why the information is collected, how it is used,who is permitted to access it, and how long it should be retained.

Soleran processes such information on behalf of the customerto provide, secure, maintain, support, and operate the Services and to fulfillapplicable contractual and legal obligations.

Depending upon applicable law, Soleran may act as a dataprocessor, service provider, contractor, or similar party with respect to thisinformation.

If you have a privacy request concerning information that anorganization maintains about you within a Soleran Service, you should generallydirect that request to the organization that collected or controls theinformation. Soleran will assist our customers with appropriate requests asrequired by applicable law and contractual obligations.

3. Information We Collect

The personal information Soleran collects depends upon howan individual interacts with us.

Account and Identity Information

We may collect information such as:

• Name;
• Business email address;
• Business telephone number;
• Employer or organization;
• Job title;
• Username or account identifier;
• Authentication and identity information;
• Assigned roles and permissions; and
• Other information associated with the administration of an account.

Customer and Business Information

When individuals interact with Soleran regarding a customeror prospective-customer relationship, we may collect:

• Business contact information;
• Organization information;
• Communications and correspondence;
• Contract and account information;
• Support requests;
• Product interests;
• Training and implementation information; and
• Other information necessary to manage the business relationship.

Technical and Usage Information

When individuals use Soleran websites or Services, we mayautomatically collect certain technical information, including:

• Internet Protocol (IP) address;
• Browser and device information;
• Operating system;
• Date and time of access;
• Pages or features accessed;
• Application activity;
• Authentication events;
• Session information;
• Error and diagnostic information;
• Security events;
• Referring information; and
• Other technical information necessary to operate, secure, monitor, and improve     the Services.

Communications

If you communicate with Soleran through email, telephone,support systems, forms, surveys, demonstrations, or other channels, we mayretain the information you provide and information associated with thecommunication.

Customer Data

The information customers place within Soleran Services isdetermined primarily by the customer and the configuration and intended use ofthe applicable Service.

Customer Data may include personal, confidential, or otherinformation about employees, contractors, patients, vendors, facilities,equipment, visitors, or other individuals or entities.

Customers are responsible for determining what informationis appropriate to submit to the Services and for complying with applicablelegal, regulatory, and contractual requirements.

4. Cookies and Similar Technologies

Soleran websites and Services may use cookies and similartechnologies to support functionality, authentication, security, preferences,performance, and analytics.

These technologies may be used to:

• Maintain authenticated sessions;
• Remember user preferences;
• Provide requested functionality;
• Protect against unauthorized or fraudulent activity;
• Understand how websites and Services are used;
• Diagnose technical issues; and
• Improve performance and usability.

Some cookies are necessary for the operation and security ofthe Services.

Browser settings may allow users to restrict or disablecertain cookies. Disabling necessary cookies may prevent some Services orfunctionality from operating correctly.

Where required by applicable law, Soleran will provideappropriate choices regarding non-essential cookies or similar trackingtechnologies.

5. How We Use Personal Information

Soleran may use personal information as reasonably necessaryto:

• Provide and operate the Services;
• Authenticate users and manage accounts;
• Provide customer support;
• Implement and configure customer environments;
• Maintain customer and business relationships;
• Process transactions and administer agreements;
• Communicate regarding Services, accounts, support, security, and administrative     matters;
• Monitor Service performance and availability;
• Protect the security and integrity of Soleran, our customers, and the Services;
• Detect, investigate, and respond to fraud, abuse, vulnerabilities, and security     incidents;
• Maintain audit, security, and operational records;
• Improve and develop Soleran products and Services;
• Conduct appropriate analytics;
• Comply with applicable laws and legal obligations;
• Enforce applicable agreements and policies;
• Establish, exercise, or defend legal claims; and
• Send marketing or promotional communications where permitted by law.

Soleran does not use Customer Data for purposes materiallyunrelated to providing, securing, maintaining, supporting, and improving theServices except as authorized by the customer, permitted by applicableagreements, or required by law.

6. Marketing Communications

Soleran may communicate with customers, prospectivecustomers, and other business contacts regarding Soleran products, Services,events, and related information where permitted by applicable law.

Recipients may unsubscribe from marketing communicationsusing the unsubscribe mechanism included in applicable communications or bycontacting:

privacy@soleran.com

Unsubscribing from marketing communications does not preventSoleran from sending necessary transactional, administrative, security,support, or account-related communications.

7. How We Disclose Personal Information

Soleran does not sell Customer Data.

Soleran may disclose personal information when reasonablynecessary to the following categories of recipients.

Service Providers and Subprocessors

Soleran uses selected third parties to provideinfrastructure, hosting, communications, security, analytics, support, andother services necessary to operate our business and Services.

These providers may process information on Soleran's behalfaccording to their function and applicable contractual requirements.

Information concerning applicable subprocessors may be madeavailable through the Soleran Trust Center or other customer resources.

Customer-Directed Disclosures

Customer Data may be disclosed or made accessible accordingto customer configuration, customer instructions, integrations, permissions, orother actions authorized by the customer.

Legal and Regulatory Requirements

Soleran may disclose information when we reasonably believedisclosure is necessary to:

• Comply with applicable law or legal process;
• Respond to lawful requests from governmental or regulatory authorities;
• Protect the rights, property, security, or safety of Soleran, our customers,     users, or others;
• Investigate suspected fraud, abuse, or illegal activity;
• Respond to or investigate security incidents; or
• Establish, exercise, or defend legal claims.

Business Transactions

Information may be disclosed or transferred in connectionwith a merger, acquisition, financing, reorganization, sale of assets, orsimilar corporate transaction, subject to applicable legal and contractualrequirements.

8. Customer Data, Analytics, and De-IdentifiedInformation

Soleran may generate aggregated, statistical, orde-identified information from operation and use of the Services wherepermitted by applicable agreements and law.

Such information may be used to:

• Operate and improve the Services;
• Understand usage and performance;
• Improve security and reliability;
• Develop product functionality;
• Perform capacity planning;
• Analyze trends; and
• Support business and product planning.

Where information is de-identified, Soleran does notintentionally attempt to re-identify it except where necessary to evaluate theeffectiveness of de-identification or as otherwise permitted by applicable law.

9. Artificial Intelligence and Automated Technologies

Soleran may use artificial intelligence ("AI"),machine learning, or automated technologies in connection with certain Servicesor business operations.

Soleran does not use identifiable Customer Data to traina general-purpose third-party AI model for the benefit of unrelated customersunless the customer expressly opts in.

Where permitted by applicable agreements, Soleran may useappropriately de-identified information and operational usage data to evaluate,secure, operate, develop, and improve Soleran Services.

Third-party AI providers used by Soleran are subject tosecurity and data-handling review appropriate to their intended use.

AI providers and models may be restricted according to thetype and sensitivity of information they are permitted to process.

Additional information regarding Soleran's approach to AIsecurity and governance may be available through the Soleran Security &Trust documentation.

10. Protected Health Information

Certain Soleran Services may be used by customers operatingin healthcare environments.

Protected Health Information ("PHI") subject tothe Health Insurance Portability and Accountability Act ("HIPAA") mayonly be submitted to Services that Soleran has expressly authorized for thatpurpose and where an applicable Business Associate Agreement has been executedwhen required.

When Soleran acts as a Business Associate, PHI is handledaccording to the applicable BAA and HIPAA requirements.

Customers are responsible for determining whetherinformation submitted to a Service constitutes PHI and for appropriatelyconfiguring and using the Service according to their obligations, includingapplicable minimum-necessary requirements.

11. Information Security

Soleran maintains administrative, technical, and physicalsafeguards designed to protect personal information and Customer Data againstunauthorized access, use, alteration, loss, or disclosure.

Our security program includes controls addressing areas suchas:

• Identity and access management;
• Encryption;
• Network and infrastructure security;
• Application security;
• Secure software development;
• Vulnerability management;
• Security logging and monitoring;
• Incident response;
• Business continuity;
• Disaster recovery;
• Personnel security; and
• Third-party risk management.

No internet-connected system can guarantee absolutesecurity. Soleran maintains a risk-based security program designed to prevent,identify, reduce, detect, and respond to security risks.

Additional information is available through the SoleranCustomer Security Statement, Soleran Security & Trustdocumentation, and the Soleran Trust Center powered by Drata.

12. Data Retention

Soleran retains personal information for periods appropriateto the purposes for which it was collected and as necessary to:

• Provide the Services;
• Fulfill contractual obligations;
• Maintain business and security records;
• Comply with legal and regulatory requirements;
• Resolve disputes;
• Enforce agreements; and
• Protect Soleran's legitimate business and security interests.

Customer Data is retained according to applicable serviceconfigurations, customer agreements, legal obligations, and Soleran retentionpolicies.

Following termination or expiration of a customerrelationship, Customer Data is handled according to the applicable agreementand retention requirements.

Information contained within backups may remain until theapplicable backup-retention period expires.

13. Data Location and International Processing

Soleran is based in the United States.

Customer Data is processed and stored according to thearchitecture of the applicable Service and any data-residency commitmentsestablished in the applicable customer agreement, Order Form, BAA, or DPA.

Soleran and its service providers may process certainbusiness, support, technical, or other personal information in locations wherethey operate, subject to applicable contractual and legal requirements.

Where applicable law requires a mechanism for internationaltransfer of personal information, Soleran will use an appropriate transfermechanism.

14. Privacy Rights and Choices

Depending upon where an individual resides and applicablelaw, individuals may have rights concerning their personal information, whichmay include the right to:

• Request access to personal information;
• Request correction of inaccurate information;
• Request deletion of certain information;
• Request restriction of certain processing;
• Object to certain processing;
• Request portability of certain information;
• Withdraw consent where processing is based upon consent; and
• Opt out of certain marketing communications.

These rights are subject to applicable legal limitations andexceptions.

Requests concerning personal information that Soleranmaintains for its own purposes may be submitted to:

privacy@soleran.com

Soleran may need to verify the identity and authority of theperson submitting a request before fulfilling it.

Requests Concerning Customer Data

When Soleran processes personal information on behalf of acustomer, the customer generally controls that information.

Individuals seeking to exercise privacy rights concerningCustomer Data should contact the applicable customer organization directly.

If Soleran receives a request relating to Customer Data forwhich a customer is responsible, Soleran may refer the request to that customerand assist the customer as required by applicable law and contractualobligations.

15. Children

Soleran's business Services are not directed to children andare intended for use by organizations and their authorized users.

Soleran does not knowingly collect personal informationdirectly from children through its business websites or Services for consumermarketing purposes.

Customers are responsible for determining whetherinformation concerning minors may appropriately be processed through a SoleranService and for complying with applicable legal and regulatory requirements.

16. Third-Party Websites and Services

Soleran websites and Services may contain links to orintegrate with third-party websites, applications, or services.

Soleran is not responsible for the independent privacypractices of third parties when those parties process information for their ownpurposes.

Users should review the privacy practices of applicablethird-party services before providing information to them.

Third parties acting as Soleran subprocessors or serviceproviders are addressed through Soleran's third-party risk-management andcontractual processes.

17. Changes to This Privacy Policy

Soleran may update this Privacy Policy periodically toreflect changes in our Services, technologies, business practices, legalrequirements, or privacy practices.

The current version will identify the date on which it wasmost recently updated.

When required by applicable law or contractual obligation,Soleran will provide appropriate notice of material changes.

18. Contacting Soleran

Questions regarding this Privacy Policy or Soleran's privacypractices may be directed to:

Soleran, Inc.
7500 College Blvd., Suite 500
Overland Park, Kansas 66210
United States

Privacy: privacy@soleran.com
Security: security@soleran.com

Customers and qualified prospective customers may alsoobtain additional security and privacy information through the Soleran TrustCenter powered by Drata.

‍