How G-Tech handles information in the app and the Gut Insight platform.

Effective Date: October 21, 2026. This policy covers the Gut Insight LongView platform, the Clinician Interpretation Module and the app. The public informational website is covered by the website privacy policy.

Scope and Roles

G-Tech Medical, Inc. (“G-Tech,” “we,” or “us”) provides Gut Insight LongView (“LongView”), the Clinician Interpretation Module (“CIM”), and the application for personal health tracking and, where enabled, invited patient and GutTracker companion functions (“App”), together the “Services.” This policy explains how we handle information about patients, adult representatives, clinicians, Practice staff, and people who contact us about the Services. The public informational website is covered by its own privacy policy, except where it expressly incorporates this policy.

Your healthcare practice (“Practice”) provides your care. Where G-Tech handles protected health information (“PHI”) on a Practice’s behalf, applicable law and the business associate agreement (“BAA”) govern that processing. This policy does not replace your Practice’s Notice of Privacy Practices, a HIPAA authorization, or research consent, or expand permissions under a BAA.

Information We Collect

Patients and adult representatives provide health histories, conditions, symptoms, bowel movement entries, medicines and therapies, test information, notes, and optional menstrual period dates and flow. They may upload reports and other documents. The Services also receive GutTracker reports and measurements and clinicians’ interpretations, plans, signatures, and amendments. App information supplied to LongView can include pain scores, symptoms, bowel movement entries, and their times.

Once you enter a valid Patient ID and activate the connected App functions, information you record is encrypted on your phone and uploaded to G-Tech’s AWS servers every 20 minutes, including before you confirm a Practice’s access. Transmission depends on connectivity and device operation. These uploads do not mean that a clinician is monitoring your entries. Removing an entry changes the next complete log supplied to LongView; it does not itself erase earlier uploads, signed reports, or other retained records. Earlier uploads remain subject to the applicable retention and deletion rules.

If a personal tracking function is made available without a connected patient service, its setup screen identifies whether entries remain on your device or are uploaded. Device-only entries are not received by G-Tech through that function unless you export or otherwise submit them. Connecting a patient service or enabling a new upload or sharing function requires the applicable setup and permissions.

Account and identity information includes names, email addresses, patient and Practice references, patient date of birth and sex, and representative information. We record the Practice’s confirmation of a representative’s authority and the patient’s confirmation of Practice access. Names and other identifiers may also appear in uploaded files and agreement records. Information containing identifiers remains subject to applicable protections and permissions.

For clinicians and staff, we collect contact information, Practice affiliation, role, professional credentials, and National Provider Identifier, where applicable. Acceptance and signature records include the text or version accepted, identity and authentication information, time, choices, and relevant audit evidence. Some acceptance records also include the originating IP address.

Technical information includes IP addresses, access and request logs, browser and device information, access times, errors, and screen and control activity. The usage monitor records screen and control names, actions, time spent, and event times rather than typed or displayed health content. Console activity identifies the signed-in user; LongView activity uses a patient reference. Those records may still be associated with an individual, and screen names may reveal health-related activity.

Support reports may include your description, study reference, screen and build information, browser details, recent errors, and an optional screenshot. You can preview and redact a screenshot before submitting it. The description or image may still contain health information. Reports suggesting an effect on care or results are reviewed through the complaint process.

We receive information from you, your representative, your Practice, authorized clinicians, connected GutTracker functions, submitted documents, and use of the Services.

How We Use Information

We use information to provide the functions requested, authenticate users, administer accounts, organize histories, support authorized clinical review and reporting, preserve signed records and amendments, deliver communications and exports, secure and troubleshoot the Services, address complaints and product safety, and meet legal obligations. Access is limited by role, the patient-Practice relationship, representative authority, and applicable permissions.

Date of birth supports identification, record matching, age-related functions, and appropriate access. Sex is used to characterize patterns of gastrointestinal function (phenotypes), account for physiological differences associated with sex, and evaluate trends across those patterns. Analysis across patients and product development use properly de-identified information as described below unless another lawful basis and any required permissions apply. Where full birth date is not needed in approved analytics, we use age in years; ages over 89 are grouped as 90 or older. Those fields remain protected where they identify or can be linked to a person.

Practice Access and Sharing Choices

G-Tech issues LongView invitations, normally at a Practice’s request. Before enabling access to shared patient history, we identify the Practice and request the patient’s or authorized representative’s confirmation. Authorized Practice personnel may also receive reports and signed records for an ordered service as permitted by law and the governing arrangements. Practices receive App information through reports or authorized LongView access. Shared history may include App log entries, such as symptoms, pain scores, bowel movements, and event times. The App does not provide messaging to your clinician; contact your Practice through its usual clinical channels.

Structured menstrual period entries are excluded from history sharing unless you select the option to include them. This setting does not remove information you separately include in an uploaded document or send to another person yourself. You may request changes to future Practice access through available controls or support. A change does not recall information already supplied or erase lawful Practice records. The control to stop LongView reading the App log stops new reads and hides that log in the patient and clinician LongView views. It does not itself stop App uploads, delete stored information, or recall reports and copies already supplied.

Providers and Other Disclosures

Amazon Web Services provides hosting, storage, authentication, message delivery, logs, and related technical functions. The platform is hosted in the United States. Microsoft 365 provides email hosting for our support and information inboxes. Other providers process information for service and support functions, subject to applicable contractual protections, including business associate agreements where required.

Invitations may name the Practice and clinician and disclose a care relationship to someone who can read the message. We also send agreement records and account notices. Ordinary email is not an appropriate channel for unnecessary detailed health information; contact support for a secure way to provide it.

We may disclose information to authorized professional advisers, to address lawful safety or security needs, as required by law, and in a business transfer subject to continuing legal and contractual protections. A transfer does not authorize a new use requiring separate permission.

Product Development and Research

We do not sell or rent personal information, share it for cross-context behavioral advertising, supply it to data brokers, or build advertising profiles. Service acceptance does not authorize training a general-purpose AI model on identifiable health information.

Where the governing agreements and applicable law permit, G-Tech may create properly de-identified information and retain, correlate, combine with other lawfully obtained information, use, and share it for lawful research, analysis across patients, product and service development and improvement, statistical evaluation, identification of clinical or usage trends and patterns, development, validation, and training of algorithms, models, and reporting, and other lawful business purposes. We may retain and use that de-identified information after an account closes or a Practice relationship ends. We do not attempt to identify people from de-identified information. These permissions apply to information that meets the applicable de-identification standard and do not authorize re-identification.

G-Tech’s independent model development and training use properly de-identified information. Any future independent research using identifiable information requires a separately established legal and contractual basis and any required authorization or consent; ordinary service acceptance does not itself provide that basis. Service use does not enroll you in CONCORD or another research registry. Research enrollment uses separate approved materials and applicable health information permissions.

Pediatric Patients and Adult Representatives

An adult operates a pediatric patient’s account; the child does not sign in. The Practice confirms the adult’s authority, and G-Tech records that confirmation. The adult accepts the applicable terms for themselves and on the patient’s behalf within their authority. Representative access remains subject to confidential minor care protections and changes in authority. A patient’s birth date does not itself verify the adult’s identity or authority.

Retention Security and Your Requests

We use administrative, technical, and physical safeguards appropriate to the Services and applicable law. No system is completely secure.

Usage records are retained for up to 400 days from creation, and ordinary support screenshots for up to 400 days from upload, subject to applicable legal requirements, governing contractual log retention requirements, and preservation obligations. Screenshots preserved as part of a complaint or investigation file may be retained longer. We retain clinical records, histories, uploaded files, signed records, identity and agreement evidence, complaints, and logs for as long as reasonably necessary to provide the services, meet applicable legal and contractual requirements, address safety or security issues, and establish or defend legal claims. Retention periods depend on the type of information, its purpose, and applicable requirements. Account closure ends ordinary access but does not automatically delete retained records. Retained information remains protected and is used only for permitted purposes.

You may request access, a copy, correction, deletion, a change of permissions, or other applicable privacy rights at info@gtechhealth.com. We verify identity and authority, coordinate with the responsible Practice where appropriate, and respond within applicable legal periods. We explain lawful restrictions and available appeal routes. To appeal, reply to the decision or email us with “Privacy Appeal” in the subject. You may contact your state attorney general where applicable. We do not discriminate for exercising applicable rights.

If your account closes or the service is discontinued, we provide at least 30 days of read-only access beginning when ordinary access ends, except where law or an immediate security or safety risk restricts access. During that period, you may request a complete export of available patient records held by G-Tech. Your statutory access rights are not limited to that window. Closing an account does not itself withdraw research consent.

Changes and Contact

We identify this policy’s effective date and notify affected users of material changes through the Services or account email. We obtain separately required consent before a new collection, sharing, or use; posting an updated policy does not substitute for that consent.

G-Tech Medical, Inc., Fogarty Innovation, 2495 Hospital Drive, Suite 300, Mountain View, CA 94040. Privacy: info@gtechhealth.com. Support: support@gtechhealth.com or (650) 960-7519. Contact your clinician for care; call 911 in an emergency.