Privacy Policy

Last updated: September 29, 2026

This Privacy Policy governs your use of www.composedperformance.com and our application (collectively, the "Product"). It explains what data we collect, how we store it, how we use it, with whom we may share it, and the choices you have. Please read this Privacy Policy in full when using the Product.

Composed Performance is a professional performance product. It is designed solely to help you improve your professional work performance. It does not provide medical, clinical, therapeutic, or mental-health services or advice, and it does not diagnose, treat, monitor, or improve any health condition or promise any health improvement. We do not guarantee any result or success from using the Product. Some of the data described in this Privacy Policy may nevertheless be treated as health-related data under privacy laws, and we protect it as such.

Scope. This Privacy Policy currently addresses users in the United States and in Europe (the EEA and the United Kingdom). If you use the Product from another country, local law may give you additional rights, and we will handle your data as that law requires.

Definitions

• "GDPR" means the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

• "EEA" includes all current Member States of the European Union and the European Economic Area. For the purposes of this Privacy Policy, references to the EEA and the GDPR also cover the United Kingdom and the UK GDPR, which apply in a similar way.

• "CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations.

• "CPA" means the Colorado Privacy Act, Colo. Rev. Stat. § 6-1-1301 et seq., and its implementing rules.

• "Process", in respect of personal data, includes to collect, store, use, and disclose to others.

• "Organization" means an employer or other corporate client that makes the Product available to its personnel (see Section 8).

Please check the Composed Performance Terms of Use & Service (the "Terms") for the meaning of defined words (those with capital letters) not explicitly defined in this Privacy Policy.

Features that are not yet available. Some features described in this Privacy Policy, including AI chat, wearable and health data import, in-app purchases and refunds, payments, and personalized advertising, are not currently offered. They are marked "Possibly coming soon". If Composed Performance introduces any of them, this Privacy Policy describes how we would handle your data. We will not process data for a feature until that feature is available. Where the law requires your consent, we will ask for it at that time (see Section 4.5).

1. Personal data controller

Composed Performance Inc. will be the controller of your personal data.

If you access the Product through an Organization, the roles of Composed Performance and the Organization are set out in Section 8.

2. What categories of personal data do we collect?

We collect data you make available to us voluntarily (for example, email address, name, date of birth). We also collect data automatically when you use the Product (for example, your IP address, device type).

2.1. Data you give us

You provide us data about yourself when you register for and/or use the Product, for example, when you create a user profile ("Profile"), complete assessments or self-ratings, respond to our emails, or report a problem. The data that you give us includes:

• Profile data. This includes your email address and password.

• Assessment and self-rating data. This includes your responses to in-app assessments, reflections, and self-ratings about your composure, focus, stress, and performance, and your use of the exercises in the Product. Some of this data may reveal information about your physical or mental state and may be treated as health data or another special category of personal data under applicable law. See Section 4.5 and Section 5.

2.2. Data we collect automatically

• Data about how you found us. We collect data about your referring URL (that is, the place on the Web where you were when you tapped on our ad).

• Cookies and other similar technologies. As further described in our Cookie Policy, our Product uses cookies that record data about the use of our Product to distinguish you from other users. You can control cookies through your browser settings.

• Browser and Device data. We collect data from or about the devices from which you access the Product, depending on the permissions you've granted. We may associate the data we collect from your different devices, which helps us provide consistent services across your devices. Examples of such data include language settings, IP address, location, time zone, type and model of a device, device settings, operating system, Internet service provider, mobile carrier, hardware ID, and your social media account identifier (where you interact with the Product through a social media platform).

• Advertising identifiers. We also collect the advertising identifier assigned to your device by its operating system (depending on the operating system of your device). You can typically reset this identifier through the settings of your device's operating system (but we do not control this).

• Transaction data. Possibly coming soon: if we introduce paid features, then when you make payments through the Product, you need to provide financial account data, such as your credit card number, to our third-party payment service providers. We do not collect or store full credit card number data, though we may receive credit card-related data and data about the transaction, including date, time and amount of the transaction, and the type of payment method used.

• Usage data. We record how you interact with our Product. For example, we log the features and content you interact with, how often and how long you use the Product, what sections you use, and other interactions.

2.3. Third-party services (including wearables)

Possibly coming soon: if we introduce wearable and health data import, then, with your permission, we can connect to third-party services such as your device's health and activity data platform. This allows us to automatically import your health and activity data into the app, so you don't have to log it yourself. The imported data may include fitness activities, heart rate, heart rate variability, steps taken, sleep patterns, active energy burned, and other data that you choose on the consent screen.

This information helps provide insights into your activities and improves our ability to provide you with more personalised suggestions and solutions. We process this data to enhance the app's features and functionality.

Importing data is subject to the privacy policies and terms of the third-party health data platform. If you use a wearable device to connect to Composed Performance, please review its terms and privacy policies as well. Your device provider may collect usage data for its own purposes, such as improving its services.

User data collected from your device's health data platform will never be used for marketing, advertising purposes, or other use-based data mining purposes.

You can withdraw our access to data from the third-party health data platform at any time directly in that platform's settings.

3. For what purposes do we process your personal data?

We process your personal data:

3.1. to provide services to you

This includes enabling you to use the Product in a seamless manner and preventing or addressing Product errors or technical issues. For example, we use your data to authenticate you and authorize access to our Product.

Possibly coming soon: if we introduce an AI assistant, then, to provide personalized support and enhance your experience with it, we process general information about how you interact with the chat. This includes details on which features you access, such as chat refresh actions, popups viewed and responded to, prompt clicks, exit actions, and the frequency of use, helping us better understand overall engagement patterns, including your feedback. Importantly, we do not collect or store the specific content of your messages.

If we introduce AI chat functionality, we may use a third-party AI service provider to support it. The provider does not use chat data to train or improve its models, and it implements security measures, including data encryption and audit controls, to protect data on its end.

Possibly coming soon: if we introduce in-app purchases, then by requesting a refund for a consumable in-app purchase, you acknowledge that we may share relevant consumption data with the operator of the app store through which you made the purchase, as part of our efforts to resolve refund requests. This data helps the app store operator assess your refund request and may include details about your usage of the purchased content. We ensure that such data sharing is done in compliance with the app store operator's policies and only as necessary to process your requests.

3.2. to research and analyze your use of the Product

This helps us to better understand our business, analyze our operations, maintain, improve, innovate, plan, design, and develop the Product and our new products. We conduct surveys, research, and test features in development. We analyze the data we have to evaluate our Product, and conduct audits and troubleshooting activities to improve our Product content and layouts. As a consequence, we often decide how to improve the Product based on the results obtained from this processing. For example, if we discover that users do not often use a certain section of the Product, we may focus on improving this section.

Where we use assessment, self-rating, or health data for research, benchmarking, or publication, we do so only in aggregated and de-identified form, and only where you have consented (where consent is required by law).

3.3. to customize the Product for you

If we introduce paid features, we select the payment processor available to you; we may also use your data to determine your eligibility for promotions, sweepstakes, and contests.

3.4. to process your payments

Possibly coming soon: if we introduce paid products and/or services within the Product, the following applies. For this purpose, we use third-party services for payment processing (for example, payment processors). As a result of this processing, you will be able to make a payment for paid features of the Product.

3.5. to enforce the Terms and to prevent, detect, investigate, and resolve disputes and/or remediate malicious activities, fraud, other cybercrimes, take legally-required actions, or make sure you are a real person and avoid the creation of fake accounts

We use personal data to enforce our agreements and contractual commitments, and to detect, prevent, and combat fraud. As a result of such processing, we may share your information with others, including law enforcement agencies (in particular, if a dispute arises in connection with the Terms).

3.6. to communicate with you regarding your use of our Product

We may communicate with you, for example, by email or directly on the Product, including through push notifications. As a result of such processing, we may send you messages about your statistics.

3.7. to show and/or send you marketing communications

We process your personal data for our marketing campaigns. We may add your email address to our marketing list. As a result, you will receive information about our Product, features, offers, promotions, contests, and events, or other news or information about third-party services that may be of interest to you. You can opt out of marketing communications by clicking the "Unsubscribe" button in one of the received emails.

3.8. to provide you customer service and support

As a result of such processing, we will send you messages about the availability of our Product, security, payment transactions, status of your orders, legal notices, or other Product-related information.

3.9. to personalize our ads

Possibly coming soon: if we introduce personalized advertising, we and our partners may use your personal data to tailor ads and possibly even show them to you at the relevant time. We do not use health data, wearable data, or the content of your assessments or AI chat interactions for this purpose.

3.10. to comply with legal obligations

We may process, use, or share your data when the law requires it, in particular, if a law enforcement agency requests your data by available legal means.

3.11. for participation in surveys

From time to time, we may start surveys/feedback for research purposes and we may contact you to find out if you would like to take part. Such activities are optional. If you do not wish to be contacted to take part in a survey or marketing campaign, please contact our support team. If you do not want to contact us but you also do not want to participate in our activities, please ignore our messages.

4. Legal basis for data processing (EEA and UK only)

In this section, we let you know what legal basis we use for each particular purpose of processing. For more information on a particular purpose, please refer to Section 3. This section applies only to users based in the EEA or the United Kingdom.

We process your personal data under the following legal grounds:

4.1. Your consent

We rely on your consent (Article 6(1)(a) GDPR) for optional processing, including marketing communications where consent is required, non-essential cookies and similar technologies, personalized advertising where consent is required, and the special category processing described in Section 4.5.

4.2. To perform our contract with you

Under this legal basis (Article 6(1)(b) GDPR) we:

• Provide the services

• Customize your experience

• Communicate with you regarding your use of the Product

• Verify your identity

• Manage your account and provide you with customer support

• Provide you customer service and support

• Process your payments

4.3. For our (or others') legitimate interests, unless those interests are overridden by your interests or fundamental rights and freedoms that require protection of personal data

We rely on legitimate interests (Article 6(1)(f) GDPR):

• to communicate with you regarding your use of our Product. This includes, for example, sending you notifications. The legitimate interest we rely on for this purpose is our interest to encourage you to use our Product more often. We also take into account the potential benefits to you.

• to research and analyze your use of the Product. Our legitimate interest for this purpose is our interest in improving our Product so that we understand users' preferences and are able to provide you with a better experience (for example, to make the use of the Product easier and more enjoyable, or to introduce and test new features).

• to send you marketing communications. The legitimate interest we rely on for this processing is our interest to promote our Product in a measured and appropriate way. Depending on your jurisdiction, we may rely on your consent for this processing instead.

• to personalize our ads. The legitimate interest we rely on for this processing is our interest to promote our Product in a reasonably targeted way. Depending on your jurisdiction, we may rely on your consent for this processing instead.

• to enforce the Terms and to prevent and combat fraud. Our legitimate interests for this purpose are enforcing our legal rights, preventing and addressing fraud and unauthorized use of the Product, and non-compliance with the Terms.

We do not rely on legitimate interests to process special category data (Section 4.5).

4.4. To comply with legal obligations

Under this legal basis (Article 6(1)(c) GDPR) we, in particular, verify your identity.

4.5. Special category data: your explicit consent (Article 9 GDPR)

What this covers. Some of the data you give us or that we collect may be "data concerning health" or may reveal information about your physical or mental state, which Article 9(1) GDPR treats as a special category of personal data. This includes data imported from wearables or a device health data platform (for example heart rate, heart rate variability, sleep patterns), and assessment, self-rating, and reflection data about stress, composure, focus, and similar states (see Sections 2.1 and 2.3). We do not ask you to provide, and do not intend to process, any other special category data. Please do not enter such data in free-text fields or AI chat.

Our legal basis. We process special category data only where you have given your explicit consent under Article 9(2)(a) GDPR, together with your consent under Article 6(1)(a) GDPR. We do not process special category data on the basis of legitimate interests.

How we ask for it.

• We ask separately from the Terms and this Privacy Policy, at the point where the data is first collected, through an unticked opt-in that you must actively select.

• We ask separately for each purpose (for example, assessments and self-ratings; wearable and health data import; AI chat features), so you can accept some and decline others.

• We tell you before you consent what data is involved, why we process it, which providers receive it, and that you can withdraw consent at any time.

• We keep a record of when and how you consented, and to which version of this Privacy Policy.

• Your consent is voluntary. Where a feature depends on special category data, we tell you which features are unavailable if you decline. Other features of the Product remain available where technically possible.

Wording of the consent request. The consent screen will state, in substance:

"I explicitly consent to Composed Performance processing my assessment and self-rating data, which may reveal information about my physical or mental state, for the purpose of providing my personalised composure training, insights, and suggestions within the app. I understand that I can withdraw this consent at any time in the app settings or by contacting info@composedperformance.com, and that withdrawal will not affect processing carried out before withdrawal."

Possibly coming soon: if we introduce wearable or health data import, its consent screen will use the same wording, with "assessment and self-rating data" replaced by "health and activity data imported from my connected device or wearable".

Withdrawing consent. You can withdraw your consent at any time, as easily as you gave it, in the app settings or by contacting us at info@composedperformance.com. Where you withdraw consent for a specific purpose, we stop that processing and, unless another lawful basis requires us to retain it, delete the related special category data. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Access through an Organization. If you access the Product through an Organization, your consent is given to Composed Performance and not to the Organization. The Organization does not receive your special category data, and your participation and your decision to give or withhold consent are voluntary and have no consequence for your employment or engagement. See Section 8.

5. United States privacy rights

This section gives additional information about how we process personal data of residents of the United States, and the rights available to them under the CCPA, California's Shine the Light law, the CPA, and other applicable U.S. federal and state privacy and consumer health data laws. We apply this section in line with the CPA and the other laws of the State of Colorado, the CCPA, and the other U.S. federal and state privacy laws that apply, and we extend the rights below to all U.S. residents, whether or not a particular law's thresholds are met. Nothing in this section limits the rights described in Section 14.

5.1. Our role and health data status

Composed Performance is a professional performance product. It is not a healthcare provider, health plan, or healthcare clearinghouse, it does not provide medical or health services, and it does not offer any health improvement. It is not a HIPAA covered entity or business associate, so data you give us is generally not protected health information under HIPAA. Some data may still be treated as sensitive data, sensitive personal information, or consumer health data under state law, even though we do not provide health services, and we handle it accordingly. We use it only for the purposes described in Section 3, and we do not sell it or use it for advertising.

5.2. California: categories of personal information (CCPA)

In the past 12 months we collected, and disclosed for a business purpose, the categories of personal information below. The sources are you, your devices, and (if you use a connected wearable or health data platform) that third-party service. The business purposes are those in Section 3. We disclose these categories to the service providers and other recipients described in Section 7.

Retention. We keep each category for the period in Section 6.

Sale and sharing. We do not sell personal information for money. We do not sell or share sensitive personal information, including health-related data. Whether any of our data flows count as a "sale" or "sharing" for cross-context behavioral advertising under the CCPA, or as a sale or targeted advertising under the CPA, depends on our final advertising and analytics setup and cookie tooling, which is not yet final. Protecting your privacy comes first. We configure these tools to collect only what is needed, we do not enable any tool that would receive your health-related data, and before we turn on any tool that would count as a sale or sharing, we will update this Privacy Policy and give you a way to opt out (see Section 5.4). We do not knowingly sell or share the personal information of anyone under 18.

5.3. California: your rights (CCPA)

If you are a California resident, you have the right to:

• Know the categories of personal information we collected about you, the categories of sources, the business or commercial purpose, and the categories of third parties to whom we disclosed it.

• Access the specific pieces of personal information we hold about you, and receive it in a portable, readily usable format.

• Delete personal information we collected from you, subject to legal exceptions (for example, to complete a transaction, detect fraud, or comply with law).

• Correct inaccurate personal information.

• Opt out of the sale or sharing of your personal information.

• Limit the use and disclosure of sensitive personal information to what is necessary to provide the Product you requested and the other purposes permitted by law. We use sensitive personal information only for those permitted purposes.

• Not be discriminated against for exercising your rights. We will not deny you the Product, charge different prices, or provide a different quality of service because you exercised a right, except where the difference is reasonably related to the value of your data.

We do not use automated decision-making technology to make significant decisions about you (see Section 10).

5.4. Opting out of sale, sharing, and targeted advertising

To opt out, contact us at info@composedperformance.com. If we introduce a "Do Not Sell or Share My Personal Information" link or cookie settings in the Product, you will be able to use them too. We also honor opt-out preference signals, such as Global Privacy Control, that we are able to detect, as required by California and Colorado law. Where we can identify you, we apply the signal to your account. Otherwise we apply it to the browser or device that sent it.

5.5. Colorado (Colorado Privacy Act)

If you are a Colorado resident acting in an individual or household context, you have the right to:

• Know whether we are processing your personal data, and access it.

• Correct inaccuracies in your personal data, taking into account the nature of the data and our purposes.

• Delete personal data concerning you.

• Data portability: obtain your personal data in a portable and, where technically feasible, readily usable format that you can transmit to another entity without hindrance.

• Opt out of (i) the processing of your personal data for targeted advertising, (ii) the sale of your personal data, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. We do not currently engage in profiling of that kind.

Sensitive data. Under the CPA, sensitive data includes personal data revealing a mental or physical health condition or diagnosis, and biological data and neural data. Some of the data described in Section 2 may fall within that definition. We process sensitive data only with your prior affirmative, opt-in consent, which is freely given, specific, informed, and unambiguous, and we do not obtain it through dark patterns or by accepting general terms of use. You may withdraw consent at any time as easily as you gave it, and we will stop the processing within the time required by law. We conduct data protection assessments for processing that presents a heightened risk of harm, including processing sensitive data.

Response time and appeals. We respond to a Colorado request within 45 days of receiving it. We may extend that period by 45 days where reasonably necessary, and we will tell you why within the first 45 days. If we decline to act on your request, we will tell you why and how to appeal. To appeal, reply to our decision or email info@composedperformance.com with "Colorado privacy appeal" in the subject line. We will respond in writing within 45 days of receiving the appeal (extendable by 60 days where reasonably necessary), with our reasons and the result. If we deny your appeal, you can contact the Colorado Attorney General at coag.gov/file-complaint or (720) 508-6000.

Universal opt-out. We recognize universal opt-out mechanisms as required by the CPA, as described in Section 5.4.

5.6. Other U.S. states and consumer health data

Residents of other states with comprehensive privacy laws (for example Connecticut, Virginia, Oregon, Texas, and others) may have rights similar to those in Section 5.5, including access, correction, deletion, portability, and opt-out, and a right to appeal a refusal. We honor those rights for residents of those states as their laws require, and you may use the process in Section 5.7.

Some states have separate laws for consumer health data (for example Washington's My Health My Data Act, Nevada's SB 370, and Connecticut's consumer health data provisions). Where they apply to you, we:

• collect and share consumer health data only with your consent or as otherwise permitted by law, and never sell it without your valid authorization;

• give you the right to confirm whether we collect your consumer health data, access it (including a list of third parties and affiliates with whom we shared or sold it), withdraw consent, and have it deleted;

• limit access to that data to those who need it to provide the Product; and

• do not use geofencing around health facilities to track or target you.

If we experience a breach of security affecting your unsecured health information, we will notify you and, where required, regulators, as required by law, including the Federal Trade Commission's Health Breach Notification Rule and state breach notification laws.

5.7. How to make a request

Email us at info@composedperformance.com or use the privacy controls in the app settings. To help us find your record, include your name, the email address on your Profile, and the right you wish to use.

• Verification. We need to verify your identity before acting on a request to know, access, delete, or correct. We match the information you give us to the information in your Profile, and may ask for more if needed. Where you have an account, we may require you to log in. We will not ask for more sensitive information than needed.

• Timing. We confirm receipt of a California request within 10 business days and respond within 45 days, which we may extend once by up to 45 more days with notice to you. Access requests for the specific pieces of personal information are limited to twice in a 12-month period.

• Authorized agents. You may use an authorized agent to make a request. We will ask for your written permission for the agent, and may verify your identity directly with you.

• Fees. We do not charge a fee unless requests are manifestly unfounded, excessive, or repetitive, in which case, where the law allows, we may charge a reasonable fee or decline, and we will tell you why.

• Marketing communications. You can opt out of marketing emails and text messages at any time using the unsubscribe link or by replying STOP, in line with the CAN-SPAM Act and the Telephone Consumer Protection Act.

5.8. California Shine the Light

If you are a resident of California, you may request that we provide you with the information that we have shared with third parties for their electronic/online direct marketing purposes, if such sharing has occurred. Such information can be provided to you once a year free of charge and will cover information shared during the past twelve (12) months. Information will be provided within forty-five (45) days of your request, or we will inform you that we need additional time to fulfill your request.

If you are a California resident and wish to make such a request, please provide sufficient information for us to determine if this applies to you, attest to the fact that you are a California resident, and provide a current California address for our response. You may make this request in writing to us at info@composedperformance.com. Any such request must include "California privacy rights request" in the first line of the description and include your name, street address, city, state and ZIP code. Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through this address.

Information shared for purposes other than direct marketing will not necessarily be included in our response to such request. We reserve the right to request and confirm proof of identity as we determine necessary in our sole discretion, and to retain your request for at least two years for auditing and user management purposes.

6. Data retention

We will retain personal data for the period necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law.

Please note that we have a variety of obligations to retain the data that you provide to us, including to ensure that transactions can be appropriately processed, settled, refunded, or charged-back, to help identify fraud and to comply with anti-money laundering and other laws and rules that apply to us and to our financial service providers. Accordingly, even if you disable/delete your Profile, we will retain certain data to meet our obligations.

Special category and other health-related data (Sections 2.1, 2.3 and 4.5) is deleted or irreversibly de-identified when you withdraw consent for the relevant purpose or delete your Profile, unless we are required by law to keep it. In line with standard practice, we apply the following retention periods:

• Profile and account data: for as long as your Profile is active, and deleted or de-identified within 30 days after you delete your Profile.

• Assessment, self-rating, and other health-related data: for as long as your Profile is active and you have not withdrawn consent, and deleted or de-identified within 30 days after you withdraw consent for the relevant purpose or delete your Profile.

• Usage, device, and cookie data: up to 24 months from collection, then deleted or aggregated.

• Transaction and payment-related records: for as long as tax, accounting, and financial laws require (typically up to seven years).

• Marketing preferences: until you unsubscribe, after which we keep a minimal record so we can honor your opt-out.

• Consent and rights-request records: for as long as we need to show compliance, and at least two years.

• Backups: copies in backups are overwritten in the normal backup cycle, generally within 90 days.

• Data we must keep by law, or to resolve disputes or enforce the Terms: for as long as the law or the dispute requires.

7. With whom do we share your personal data?

We share information with third parties that help us operate, provide, improve, integrate, customize, support, and market our services. We may share some sets of personal data, in particular, for purposes indicated in Section 3 of this Privacy Policy. The types of third parties we share information with include, in particular:

7.1. Service providers

We share personal data with third parties that we hire to provide services or perform business functions on our behalf, based on our instructions. We may share your personal information with the following types of service providers (for AI, payment, and advertising-related providers, only if and when the related feature is introduced):

• cloud hosting and storage providers;

• data analytics providers;

• AI service providers (see Section 3.1);

• marketing partners (in particular, social media networks, marketing agencies, email delivery services);

• payment processing contractors.

We do not share health data, wearable data, or the content of your assessments with marketing partners.

7.2. Law enforcement agencies and other public authorities

We may use and disclose personal data to enforce the Terms, to protect our rights, privacy, safety, or property, and/or that of our affiliates, you or others, and to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, or in other cases provided for by law.

7.3. Third parties as part of a merger or acquisition

As we develop our business, we may buy or sell assets or business offerings. Customers' information is generally one of the transferred business assets in these types of transactions. We may also share such information with any affiliated entity (e.g. parent company or subsidiary) and may transfer such information in the course of a corporate transaction, such as the sale of our business, a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy.

7.4. Organizations (employers and corporate clients)

We share information with an Organization only in the limited, non-individual form described in Section 8.

8. Access through an employer or corporate client

Organizations never receive data about you as an individual. We give an Organization only aggregate data or team-level data, and never data about any single, isolated User.

8.1. When this section applies

This section applies if your employer or another corporate client (an "Organization") arranges for you to use the Product, for example by paying for access, inviting you, or providing you an access code or email domain sign-up.

8.2. Roles of Composed Performance and the Organization

• Your Product data. For the data you create and we collect when you use the Product (Section 2), including your assessments, self-ratings, usage, device, and any health data, Composed Performance is an independent controller. We decide why and how this data is processed. The Organization does not act as our controller, joint controller, or processor for this data, and it has no access to it, except as described in Section 8.3.

• Enrollment data from the Organization. The Organization may give us limited information to invite you and confirm you are eligible, such as your name, work email address, and team or department. For this data the Organization is the controller and we act as its processor, under a data processing agreement that meets Article 28 GDPR and the applicable U.S. state law requirements. We use this data only to provide access, create your team grouping (Section 8.3), and to bill the Organization. If you create an account, the information you provide in your Profile becomes part of your Product data.

• Aggregate and team-level reports. We create these ourselves, as controller, from Product data, in the manner described below.

8.3. What the Organization can receive

We give an Organization only:

• Aggregate data: statistics that combine the data of many Users and cannot reasonably be linked to any individual (for example, overall enrollment rate and average engagement across the whole Organization); and

• Team-level data: statistics about the performance, engagement, or progress of a defined team or group, where the team is large enough that no individual can be identified from it.

We apply these rules to every report, dashboard, export, and communication we give an Organization:

• We never provide data specific to a single User. This includes names, email addresses, IDs, individual scores, responses, ratings, usage logs, or the fact that a particular person did or did not enroll, sign in, complete an assessment, or use a feature.

• We show team-level data only for teams that are large enough that no individual can be identified. We set the minimum team size case by case, for each Organization and team, and apply it strictly. We suppress or combine any group, category, or period that falls below the minimum we set, and we do not allow filters, comparisons, or repeated reports that could isolate one person or reveal one person's data by subtraction.

• We report team-level data as totals, averages, ranges, or percentages, never as a list of individual values.

• We do not include health data, data from wearables, the content of AI chat, free-text responses, or special category data in any report to an Organization, even in aggregate form.

• We do not accept an Organization's request to re-identify, single out, rank, or monitor any User. Our contracts prohibit the Organization from attempting to re-identify anyone from the data we give it, and from combining it with other data for that purpose.

In addition, to keep this as strict as possible:

• We release a report only after we assess it for re-identification risk. We release it only if we conclude that no individual can be identified from it, directly or by combining it with other information the Organization holds (for example team rosters, attendance, or earlier reports). If we are not sure, we do not release it.

• We do not release team-level data so often, or for so many overlapping teams or periods, that one person's data could be worked out by comparing reports.

• We do not provide row-level data, exports of underlying records, or direct access to our systems or databases to an Organization.

• We maintain and use this data only in de-identified form, and we publicly commit not to attempt to re-identify it.

We do not give an Organization individual data through audits, integrations, single sign-on, or support requests. If an Organization asks us for individual data, we will decline.

8.4. Your participation is voluntary and private

Your Organization cannot require you to use the Product, or to give consent under Section 4.5. Our contracts prohibit the Organization from using anything we provide to it to make or influence decisions about your employment or engagement, such as hiring, promotion, pay, discipline, or termination. Because we do not tell the Organization who uses the Product or how they use it, your Organization cannot see whether you have chosen to take part.

8.5. Your rights and how to exercise them

You can exercise all your rights in Sections 5 and 14 directly with us, without going through the Organization. Where a request concerns enrollment data that the Organization controls, we will refer you to the Organization or pass the request on as its processor, and we will tell you when we do. If your Organization stops using the Product, we will handle your Product data as described in Section 6. You may choose to keep or close your Profile, and if you keep it, you will be treated as an individual User.

8.6. Organization commitments

Before we provide the Product through an Organization, the Organization agrees in writing to: provide notice to its personnel about the enrollment data it gives us; have a lawful basis for giving us that data; not ask us for, or seek by any other means from us, individual Product data; keep any aggregate or team-level reports we give it confidential and use them only to understand group needs and improve support for its teams; and comply with the limits in Section 8.4.

9. Security of your data

We protect your personal data with technical and organizational measures that are appropriate to the risk, as required by Article 32 GDPR and applicable U.S. law. Depending on the data and the feature, these measures include:

• encryption of data in transit and at rest;

• access controls that limit access to personal data to authorized personnel who need it, with stronger controls for health-related and other special category data;

• pseudonymisation or de-identification where practicable, and keeping special category data separate from directly identifying data;

• logging and monitoring of access to systems that hold personal data;

• written data protection terms with, and security review of, our service providers (Section 7);

• confidentiality obligations, and privacy and security training, for people who handle personal data; and

• regular testing and review of our security measures, and a documented process to identify, contain, and respond to incidents.

No system is completely secure, and we cannot guarantee absolute security. You can help protect your data by keeping your password confidential and using devices you trust.

If a personal data breach is likely to put your rights and freedoms at risk, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33 GDPR). We will notify you where the law requires it (Article 34 GDPR and applicable U.S. state breach notification laws).

10. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). The insights and suggestions in the Product are generated for your own use in your professional development. Neither we nor any Organization uses them to make decisions about your employment, pay, promotion, credit, insurance, housing, education, or access to healthcare.

If we ever introduce automated decision-making of that kind, we will first tell you, explain the logic involved and its consequences, obtain your explicit consent or rely on another basis the law allows, and give you the right to obtain human intervention, to express your point of view, and to contest the decision. For U.S. residents, this section also reflects the profiling opt-out and automated decision-making rules under Colorado and California law (Section 5).

11. International data transfers

We may transfer personal data to countries other than the country in which the data was originally collected in order to provide the Product set forth in the Terms and for purposes indicated in this Privacy Policy. If these countries do not have the same data protection laws as the country in which you initially provided the information, we deploy special safeguards.

In particular, if we transfer personal data originating from the EEA or the United Kingdom to countries without an adequate level of data protection, we rely on one of the following: (i) Standard Contractual Clauses approved by the European Commission (and, for transfers from the United Kingdom, the UK International Data Transfer Agreement or the UK Addendum to those clauses); (ii) the EU-U.S. Data Privacy Framework (and its UK Extension), where the recipient is certified under it; or (iii) European Commission adequacy decisions about certain countries.

12. Changes to this Privacy Policy

We may modify this Privacy Policy at any time. If we decide to make material changes to this Privacy Policy, you will be notified through our service or by other available means and will have an opportunity to review the revised Privacy Policy. Where a change affects how we process special category data, we will ask for your explicit consent again before applying it to that data. By continuing to access or use the Product after those changes become effective, you agree to be bound by the revised Privacy Policy, except where the law requires your fresh consent.

13. Age limitation

We do not knowingly process personal data from persons under 18 years of age. If you learn that anyone younger than 18 has provided us with personal data, please contact us at info@composedperformance.com.

14. Privacy rights

To be in control of your personal data, you have the following rights:

• Accessing / reviewing / updating / correcting your personal data. You may review, edit, or change the personal data that you had previously provided to us. You control your Profile; thus, you may access your Profile data at any time and correct or update it at any time by logging in to the Product. You may also request a copy of your personal data collected during your use of the Product at info@composedperformance.com.

• Deleting your personal data. You can request erasure of your personal data by sending us an email at info@composedperformance.com. When you request deletion of your personal data, we will use reasonable efforts to honor your request. In some cases, we may be legally required to keep some of the data for a certain time; in such event, we will fulfill your request after we have complied with our obligations.

• Objecting to or restricting the use of your personal data. You can ask us to stop using all or some of your personal data or limit our use thereof by sending a request to info@composedperformance.com.

• Withdrawing your consent. Where we process your data on the basis of consent, including explicit consent for special category data (Section 4.5), you can withdraw it at any time as described in that section.

• The right to lodge a complaint with a supervisory authority. We would love you to contact us directly, so we could address your concerns. Nevertheless, you have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the EU Member State where you reside, work or where the alleged infringement has taken place.

• The right to data portability. If you wish to receive your personal data in a machine-readable format, you can send a respective request to info@composedperformance.com.

You may submit requests through an authorized agent, in which case we will need to verify the agent's identity, your identity, and their authority to act on your behalf before we can process the request. Additional rights for residents of the United States are described in Section 5.

15. How do we handle "Do Not Track" requests?

Except as otherwise stipulated in this Privacy Policy, the Product does not support "Do Not Track" requests. We do, however, honor opt-out preference signals such as Global Privacy Control, as described in Section 5.4. To determine whether any of the third-party services we use honor "Do Not Track" requests, please read their privacy policies.

16. Contact us

If you have any questions or concerns about this Privacy Policy or our collection, use, or storage of your data, please do not hesitate to contact us at:

E-mail: info@composedperformance.com