POL-0002 : v3.0 - Effective Aug 04 2026

1. Introduction

Welcome to Evolution Devices, Inc. ("Evolution Devices," "we," "us," or "our"). Our mission is to enhance human movement through innovative technology. The EvoWalk™ System is an FDA-cleared functional electrical stimulation device designed to help individuals with mobility impairments improve their walking ability using real-time movement analysis and precise muscle activation.

This Privacy and Data Usage Policy ("Policy") explains how we collect, use, share, and protect information in connection with the EvoWalk™ System, its companion mobile and web applications, and related services (collectively, the "Services"). Please read this Policy carefully.

If you do not agree with it, please do not use the Services.

2. Information We Collect

We collect the following categories of information when you use the Services:

• Account and registration information: Name, email address, date of birth, contact information, and account credentials you provide when registering.

• Device and sensor data: Step count, gait patterns and metrics, walking speed, stimulation parameters, session duration, and frequency of use, collected by the EvoWalk™ device’s sensors during use.

• Health and therapy information: Information related to your mobility condition, therapy goals, and progress, including data entered by you or, where applicable, by your authorized clinician or care provider.

• Feedback and survey data: Written feedback, survey responses, and behavioral or patient-reported outcome data you choose to provide.

• Technical and usage information: Device identifiers, serial numbers, firmware versions, app version, operating system, log files, diagnostic data, and usage analytics from our mobile and web applications.

• Communications: Records of your communications with our support, clinical, and sales teams.

We are committed to continuous improvement of our Services. The types of data we collect and how we display that data may evolve over time, and we may introduce new metrics or more detailed analyses as our technology advances. When you visit our website, we and our service providers may collect information through cookies and similar technologies. We will notify you of significant changes to our data collection practices by email and/or in-app notification.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the EvoWalk™ System and Services;

• Support your care, including sharing progress information with your authorized healthcare providers with your consent;

• Provide customer, technical, and clinical support, including troubleshooting and device servicing;

• Improve the functionality, safety, and performance of our devices and software;

• Conduct research and development to advance our technology, including as described in Section 4 below;

• Comply with legal and regulatory obligations, including FDA medical device requirements such as complaint handling, adverse event reporting, and post-market surveillance;

• Communicate with you regarding software updates, safety information, and other relevant service information.

• With your consent, to determine whether you may be eligible for research studies or clinical trials, and to contact you about opportunities to participate;

4. De-Identified Data and Product Development

We may de-identify the information we collect so that it can no longer reasonably be used to identify you, in accordance with applicable legal standards, including the de-identification standards of the Health Insurance Portability and Accountability Act ("HIPAA").

We may use and retain de-identified data for any lawful purpose, including to conduct research, generate aggregate insights and statistics, and develop, train, test, validate, and improve our products, software, and machine-learning or artificial-intelligence models that power features such as movement analysis and stimulation timing. We do not use identifiable personal information to train machine-learning models. We may share or license de-identified data to third parties, including academic institutions, research organizations, and companies, for research, development, and commercial purposes. Where we maintain de-identified data, we commit to not attempting to re-identify it, and we require the same of any third party with whom we share such data.

5. Data Storage and Security

All data collected by the EvoWalk™ System is stored on encrypted servers located in the United States. We use industry-standard administrative, technical, and physical safeguards - including encryption in transit and at rest, access controls, and audit logging - to protect your data from unauthorized access, alteration, and disclosure. No method of transmission or storage is completely secure, but we regularly review and update our security practices to protect your information.

6. How We Share Your Information

We do not sell your personal information, and we do not share your personal information with third parties for cross-context behavioral advertising. We may share your information with:

• Authorized healthcare providers: With your consent, to support your evaluation, treatment, and care.

• Research opportunities: With your explicit authorization, we may share your information with clinical trial sponsors or research organizations for the purpose of determining your eligibility for, or enrolling you in, a research study. We will not share identifiable information with a research sponsor without your specific consent for that study.

• Service providers: Vendors who assist us in operating our business and providing the Services (such as cloud hosting and analytics providers). Where these providers handle protected health information, they do so only under Business Associate Agreements ("BAAs") requiring them to protect your data in accordance with HIPAA standards.

• Legal and regulatory authorities: Government agencies, regulators (including the U.S. Food and Drug Administration), courts, or law enforcement, where required by law or to protect the rights, safety, or property of our users, the public, or Evolution Devices.

• Business transfers: In connection with a merger, acquisition, financing, or sale of all or part of our business, your information may be transferred as part of that transaction, subject to this Policy or an equivalent level of protection.

• De-identified data: As described in Section 4, we may share de-identified or aggregated data that cannot reasonably be used to identify you.

7. Your Rights and Choices

You have the right to:

• Access and receive a copy of your personal data;

• Request correction of inaccurate or incomplete data;

• Request deletion of your personal data, subject to legal and regulatory retention obligations;

• Request confidential communications;

• Request restrictions on the use or sharing of your health information;

• Request an accounting of certain disclosures of your health information;

• Withdraw consent to optional data uses at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at support@evolutiondevices.com. We will respond to your request within 30 days. You will not be discriminated against for exercising your privacy rights.

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer at support@evolutiondevices.com or with the U.S. Department of Health andHuman Services Office for Civil Rights.

8. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), may provide you with additional rights regarding personal information that is not covered by HIPAA, including the right to know what personal information we collect, the right to delete, the right to correct, and the right to limit the use of sensitive personal information. Much of the information we handle is protected health information governed by HIPAA and/or medical information governed by the California

Confidentiality of Medical Information Act, which is generally exempt from the CCPA/CPRA. To the extent the CCPA/CPRA applies to information we hold about you, you may exercise your rights by contacting us at support@evolutiondevices.com. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months.

9. Washington and Other State Consumer Health Data Rights

If you are a resident of Washington or another state with a consumer health data law (such as Nevada or Connecticut), you may have additional rights with respect to "consumer health data" that is not protected health information under HIPAA. These rights may include the right to know what consumer health data we collect and share, the right to withdraw consent, and the right to have your consumer health data deleted. We collect and share consumer health data only as described in this Policy, and we do not sell consumer health data. To exercise these rights, contact us at support@evolutiondevices.com.

Washington residents who believe their request has been improperly denied may appeal by responding to our decision, and may contact the Washington Attorney General if the appeal is unsuccessful.

10. Children's Privacy

The EvoWalk™ System is not cleared, marketed, or sold for use by individuals under 18 years of age, and our Services are not directed to children. We do not knowingly collect personal information from children. If a healthcare provider or other third party causes the Services to be used by a minor notwithstanding the foregoing, responsibility for obtaining any required parental or guardian consent rests with that provider or third party. If we become aware that we have collected personal information from a child without verified parental or guardian consent, we will delete that information or obtain the required consent. Parents or guardians who believe we may have collected a child's information may contact us at support@evolutiondevices.com.

11. Data Retention

We retain your personal data for as long as necessary to provide the Services, support your

care, and comply with our legal and regulatory obligations. As an FDA-regulated medical device

manufacturer, we are required to retain certain records - including device history, complaint, and

servicing records - for defined periods under FDA regulations, generally at least two years from

the date of release for commercial distribution or the expected life of the device, whichever is

longer. When data is no longer needed for these purposes, it is securely deleted or de-

identified.

12. HIPAA Compliance

Depending on how you obtain and use the EvoWalk™ System, your health information may be protected under HIPAA. When we receive protected health information from or on behalf of a healthcare provider or other covered entity, we act as a business associate and handle that information in accordance with HIPAA and the terms of our Business Associate Agreements. In all cases, our data handling practices are designed to meet or exceed applicable HIPAA privacy and security standards.

13. Consent and Notifications

By using the EvoWalk™ System and Services, you consent to the collection, use, and disclosure of your information as described in this Policy. We will notify you of significant changes to this Policy by email and/or in-app notification, and where required by law, we will obtain your consent before applying material changes to previously collected information.

14. Data Breach Procedures

In the event of a data breach, we will promptly investigate, take measures to contain and mitigate the impact, and notify affected individuals and relevant authorities as required by applicable law, including HIPAA’s breach notification requirements. Please report any potential security concerns or suspected breaches directly to our Privacy Officer at support@evolutiondevices.com.

15. Device-Specific Privacy Considerations

The EvoWalk™ System includes features such as real-time movement analysis and sensor- based data collection that have specific privacy implications. These features are designed to process data securely and in compliance with applicable privacy laws and regulations. Sensor data is transmitted from the device using encrypted connections.

16. Updates to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or legal requirements. The updated Policy will be posted on our website with a revised effective date, and we will notify you of significant changes by email and/or in-app notification.

17. Contact Information

Evolution Devices, Inc.

ATTN: Legal Department / Privacy Officer

1231 Stevenson Street, STE 201

San Francisco, CA 94103, USA

Email: support@evolutiondevices.com

By using the EvoWalk™ System, you acknowledge that you have read and understood this Privacy and Data Usage Policy and consent to the collection, use, and disclosure of your information as described herein.