Riot IQ Privacy Notice

1. Introduction

PSYCH LABS, LLC (“Riot IQ”, “we”, “our”, or “us”) respects your privacy and are committed to protecting it through our compliance with this Privacy Notice (“Notice”). We are committed to being transparent in our handling and processing of Personal Information in accordance with applicable privacy and data protection laws. This Privacy Notice and our WMHMD Notice are incorporated into our Terms of Service, which are available at https://www.riotiq.com/terms-of-service.

This Notice applies to you (“you” or “your”) and anyone who accesses or uses our any iteration of our online Reasoning and Intelligence Online Test or its accompanying data visualization and analytical utilities (“RIOT Test(s)”) through https://www.riotiq.com (our “Website(s)”), and any related software, platforms, and applications (collectively, the “Services”); whether as a guest or registered user (“User(s)”). Users include: (i) individuals who access or complete a RIOT Test, either by self-registering through the Website or on behalf of a Test Administrator (“Examinee(s)”); and (ii) healthcare providers, researchers, clinicians, or other professionals who administer a RIOT Test (“Test Administrators”).

This Notice may change from time to time (see Changes to This Notice). Your continued access of our Services after we make changes is deemed to be acceptance of those changes, so please check the Last Modified Date at the top of this Notice, to ensure that you are viewing the most current version of this Notice.

2. Children's Privacy

The Services are general audience and intended for users 18 and older. We do not knowingly collect Personal Information from anyone younger than age 18.

3. Information We Collect About You and How We Collect It

We collect several types of information from you and about users of our Services, such as Contact Information when you sign up for an account (“Account”) or Test Data when you complete a RIOT Test. Personal information means information that identifies (whether directly or indirectly) a particular individual, such as the individual's name, postal address, email address, and telephone number (“Personal Information”).

Other types of information we collect is information related to how you use our Website and applications, which helps us improve our Services. You expressly consent to receiving communications from Riot IQ through the information you provided to us. For more information on how to access and control your communication preferences, please see the Your Rights Regarding Your Information and the Your Choices Regarding Your Information, sections of this Notice below.

When you provide us with information in connection with a particular activity or otherwise sign up for or order our products and Services or provide your contact information to us, including your email address or telephone number in connection with that activity, product or service, you agree that such action constitutes a purchase or inquiry establishing a business relationship with us.

4. HIPAA and PHI

Certain demographic, health and/or health-related information that Riot IQ collects about Users on behalf of the licensed medical professions that we partner with (“Healthcare Provider(s)”) as part of providing the Services may be protected health information (“Protected Health Information” or “PHI”) governed by the Health Insurance Portability and Accountability Act (“HIPAA”). Specifically, this may be true when (i) Riot IQ is providing administrative, operational, or other services to a Healthcare Provider that is a “Covered Entity” (as defined by HIPAA); and (ii) in order to provide those services, Riot IQ receives identifiable information about a User on behalf of the Healthcare Provider, where Riot IQ is acting as a “Business Associate” (as defined by HIPAA); and (iii) this identifiable information is regulated as PHI.

With respect to any PHI in our possession, you have certain rights under HIPAA as described in the Notice of Privacy Practices provided to you by your Healthcare Provider. Please refer to the applicable Notice of Privacy Practices of your Healthcare Provider for more information.

5. Information Provided by You or On Your Behalf

The following outlines the types of Personal Information we collect from or on your behalf when using our Services, including Personal Information collected when registering for an Account, completing RIOT Test, or contacting support.

Account Information:
Full name. Email address.

How / When Personal Information is Collected:
You input this information when filling out a questionnaire or a webform on our Services. You input this information when you create an Account.

Purpose for Personal Information Collection:
To provide the Services requested by you. To provide you with customer support. To comply with applicable legal or regulatory requirements and law enforcement requests. To comply with and enforce our Terms of Service.

Demographic Information:
Date of birth. Biological sex. Country of birth. Country and/or State of residence. Native language(s). Race(s). Neurological Condition(s). Occupation. Education level. Educational program(s).

How / When Personal Information is Collected:
You input this information when filling out a questionnaire or a webform on our Services. Under certain jurisdictions, certain Demographic Information may be considered “sensitive” or “special” category of data. We only collect Demographic Information with your consent.

Purpose for Personal Information Collection:
To provide the Services requested by you; Demographic Information is used to calculate norms and provide you with your RIOT Test results. For internal analysis and research to help us provide and improve our Services, which includes product refinement, fundamental and applied psychological inquiry, and the research and development of novel offerings.

RIOT Test Information:
Test responses. Test results, including psychometric data and analysis of Test responses.

How / When Personal Information is Collected:
You input this information when you complete a Test. Test Results are provided after completion of a Test.

Purpose for Personal Information Collection:
To provide the Services requested by you. For internal analysis and research to help us improve our Services, which includes product refinement, fundamental and applied psychological inquiry, and the research and development of novel offerings. To comply with applicable legal or regulatory requirements and law enforcement requests. To comply with and enforce our Terms of Service.

Payment Information:
Full Name. Banking Information (i.e., credit/debit card number). Shipping/Billing address.

How / When Personal Information is Collected:
You provide Payment Information to purchase a Test. Note that we do not store Payment Information. We use third-party payment processors to process your Payment Information. For more information, see the How We Disclose and Share Your Information section.

Purpose for Personal Information Collection:
To provide the Services requested by you. To fulfill your purchase. To provide you with customer support. To comply with applicable legal or regulatory requirements and law enforcement requests. To comply with and enforce our Terms of Service.

Test Administrator Information:
Full Name. Email Address. Licensure Information. Professional Background.

How / When Personal Information is Collected:
You input this information when filling out a questionnaire or a webform on our Services. You input this information when you create an Account.

Purpose for Personal Information Collection:
To provide you with an Account and to provide the Services requested by you. To verify your identity and professional background. To communicate with you about the Services you have requested. To provide you with customer support. To comply with applicable legal or regulatory requirements and law enforcement requests. To comply with and enforce our Terms of Service.

6. Information Collected Automatically

As you navigate through and interact with our Services, we and our third-party service providers may automatically collect certain information from you whenever you access or interact with the Services. We may combine this automatically collected log information with other information we collect about you. We do this to improve Services we offer you, analytics, and site functionality.

Usage information:
Details of your visits to our Website or Services (e.g. links you've clicked on, content response times, location data, logs, and other similar communication data and statistics about your interactions)

How / When Personal Information is Collected:
This information is automatically collected when you visit our Services.

Purpose for Personal Information Collection:
To analyze your use of the Services. To improve and develop our Website and Services and to enable us to offer new features and material. To comply with applicable legal or regulatory requirements and law enforcement requests. To comply with and enforce our Terms of Service.

Device Information:
Information about your computer and internet connection, including your device type, operating system, and browser type.

How / When Personal Information is Collected:
This information is automatically collected when you visit our Services.

Purpose for Personal Information Collection:
To analyze your use of the Services. To protect the Services, our company, our employees, and our users from malicious attacks, hacking, fraud, or other illegal or unauthorized activity. To investigate and take steps to prevent potential fraud or other wrongdoing. To comply with and enforce our Terms of Service.

7. Tracking Technologies

We, as well as third parties that provide content, advertising, or other functionality on the Services, may use cookies, pixel tags, local storage, and other technologies (“Tracking Technologies”) to automatically collect information through our Services. Tracking Technologies are essentially small data files placed on your computer, tablet, mobile phone, or other devices that allow us to record certain pieces of information whenever you visit or interact with our Services. Depending on the specific Tracking Technology, we, our online data partners, or vendors may use Tracking Technologies to associate these activities with other Personal Information they or others have about you, including by association with your email or online profiles. We (or service providers on our behalf) may then send communications and marketing to these emails or profiles.

8. Pixel Tags/Web Beacons

A pixel tag (also known as a web beacon) is a piece of code embedded on the Website that collects information about users' engagement on that web page. The use of a pixel allows us to record, for example, that a user has visited a particular web page or clicked on a particular advertisement.

9. Cookies

A cookie is a small text file that can be stored on and accessed from your device when you visit and use our Website. We use cookies to analyze trends, administer the Website, and track users' movements around the site.

Please review your web browser settings to modify your cookie settings, to disable the use of cookies, or to delete cookies. Please note that third parties such as advertisers or analytics providers may also use cookies and similar technologies while you are browsing or using the Website. We unfortunately have no control over such third parties' use of these technologies.

Cookies can be categorized as first-party or third-party cookies. As the name implies, first-party cookies are put on your device by Riot IQ. Third-party cookies are placed on your device not by Riot IQ, but by a third-party. We do not use Third-party cookies.

10. Analytics

You can generally opt-out of receiving personalized ads from third-party advertisers and ad networks who are members of the Network Advertising Initiative (NAI) or who follow the Digital Advertising Alliance's Self-Regulatory Principles for Online Behavioral Advertising (DAA) by visiting the opt-out pages on the NAI website (http://optout.networkadvertising.org) and DAA website (http://www.aboutads.info/choices).

11. Do Not Track Signals

While some browsers offer a “Do Not Track” (DNT) signal, we do not currently respond to such signals.

12. Personal Information Provided by Third Parties

When you connect with us through a third-party platform we may, depending on your privacy settings, receive some information from your third-party account, and what we collect depends on your privacy settings with that service.

You may register to join the Services directly via the Website or by logging into your account with a third-party service (“TPS”) via our Services (e.g., Facebook, Google, Apple, and other third-party services that let you sign in using your existing credentials with those services). If you choose to register via a TPS, or to later link your account with the Services to your account with an TPS, we will use the Personal Information you have provided to the TPS (such as your name, email address, and other information you make available via the TPS) to create your account. Note that the information we collect from and through a TPS may depend on the privacy settings you have set with the TPS and the permissions you grant to us in connection with linking your account with the Services to your account with an TPS. Other than what we may share with the TPS as described below, the Personal Information a TPS has about you is obtained by the TPS independent of our Services, and Riot IQ is not responsible for it.

13. Legal Bases for Collection and Processing of Personal Information

This section describes the legal basis we use for each particular purpose of processing, where such legal basis may be applicable under data protection laws such as the EU General Data Protection Regulation (“GDPR”). To process your Personal Information, as described above, we rely on the following legal basis:

14. How We Disclose and Share Your Information

We may share information we receive about you as follows or as otherwise described in this Privacy Notice. When we disclose Personal Information, the recipient is required to keep that Personal Information confidential, secure and process the Personal Information only for the specific purpose for which they are engaged:

15. Your Choices Regarding Your Information

You have several ways to exercise control over your information:

Please be aware that if you do not allow us to collect Personal Information from you, we may not be able to deliver certain experiences, products, and services to you, and some of our Services may not be able to take account of your interests and preferences.

16. Your Rights Regarding Your Information

Depending on where you are located, you may have certain rights regarding your Personal Information (also known as “personal data” under applicable data protection laws). Residents of certain jurisdictions may access, correct, update or delete your Personal Information; object to our processing of this information, ask us to restrict our processing of your Personal Information, or request portability of your Personal Information. Please see Your Rights Regarding Your Information and the Your Choices Regarding Your Information, sections of this Notice to learn more about exercising your rights.

Upon request, Riot IQ will provide you with information about whether we hold any of your Personal Information. You are responsible for maintaining the accuracy of the information you submit to us, such as your contact information. If you submit a request to access all Personal Information you've submitted, we will respond to your request to access within 30 days or as otherwise required by law.

We will use commercially reasonable efforts to honor your requests for deletion; however, certain residual information may actively persist on the Services even if you close your account. In addition, the rights described above may be limited, for example, if fulfilling your request would reveal Personal Information about another person, or if you ask us to delete information, we are required by law to keep or have compelling legitimate interests in keeping (such as for fraud prevention purposes). Your Personal Information may remain in our archives and information you update or delete, or information within a closed account, may persist internally for our administrative purposes, to the extent permitted by law. It is not always possible to completely remove or delete information from our databases. In addition, we typically will not remove information you posted publicly through or on the Services. Bear in mind that neither you nor Riot IQ can delete all copies of information that has been previously shared with others on the Services. If your information is deleted, then your account may become deactivated. If your account is deactivated or you ask to close your account, you will no longer be able to use the Services.

Please note that our Services require a minimum amount of Personal Information in order to function. Individuals who do not provide Personal Information (e.g., by not filling out a profile) may not be able to access the full functionality of features found on Riot IQ.

17. European Residents

Under the GDPR, Riot IQ is a data controller with respect to Users who are Examinees who access and use the Services on their own behalf, and to the Personal Information of Test Administrators.

European residents may access, rectify or delete their Personal Information via their online account settings as described above. Additionally, European residents may contact the Privacy Officer at privacy@riotiq.com to access, correct, update or delete your Personal Information; object to our processing of this information, ask us to restrict our processing of your Personal Information, or request portability of your Personal Information.

Under the GDPR, Riot IQ is also a data processor with respect to Examinees who access and use the Services on behalf of a Test Administrator. If you are such an Examinee, you should contact the applicable Test Administrator to exercise any applicable rights under the GPDR.

18. California Residents – Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (“CCPA”) and California Consumer Privacy Rights Act, amending the CCPA (“CPRA”) (collectively the CCPA and CPRA are the “California Privacy Laws”) provide you with additional privacy rights with respect to our collection, use and disclosure of your Personal Information, including:

For more information on how to exercise any applicable rights you may have under California Privacy Laws, please contact us at privacy@riotiq.com Please note that we may require you to verify your credentials, by matching your e-mail address, or other account information to the information in our systems, before you can submit a request to exercise any of these rights. If you authorize another person to act as your agent to submit requests on your behalf, then unless you provide the agent with power of attorney under the California Probate Code, we will ask the agent to provide us the written and signed authorization that you provided to the agent, we will confirm with you that you did provide the authorization, and we will verify your identity.

19. Washington My Health My Data Act

To the extent that the Washington My Health My Data Act (“MHMD”) applies to the Services, Riot IQ provides a My Health My Data Act Notice (“MHMD Notice”), hereby incorporated into this Privacy Notice by reference, for residents of the State of Washington in accordance with the My Health My Data Act of 2023 and sets out how Riot IQ collects, uses and discloses Consumer Health Data (as defined in the MHMD) that we collect from you when you use our Services. The MHMD Notice is available at: https://www.riotiq.com/wmhmd-notice.

20. International Jurisdictions

Our Services are hosted and offered in the United States of America (US), and are subject to, and comply with all applicable US laws. You agree to abide by applicable laws as they concern your use of the Services and your agreements with us. Any persons accessing our Services from any jurisdiction with laws or regulations governing the use of the Internet, including the collection, use, or disclosure of personal information, different from those of the jurisdictions mentioned above may only use the Services in a manner lawful in their jurisdiction. If your use of the Services would be unlawful in your jurisdiction, you may not use our Services.

21. Security

We use physical, technical and organizational measures designed to protect your information against unauthorized access, theft and loss. We restrict access to your Personal Information to those employees who need to know that information to service your account or perform their job functions.

Although we take precautions intended to help protect information that we process, no system or electronic data transmission is completely secure. Any transmission of your Personal Information is at your own risk and we expect that you will use appropriate security measures to protect your Personal Information. You are responsible for maintaining the security of your account and the information in your account. We may suspend your use of all or part of the Services without notice if we suspect or detect any breach of security. You understand and agree that we may deliver electronic notifications about breaches of security to the email address on record on your account.

22. Data Retention

Unless you request that we delete certain information (see Your Rights Regarding Your Information and the Your Choices Regarding Your Information), We will retain your Personal Information for the period necessary to fulfill the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by law.

The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide services to you (for example, for as long as you have an account with us or keep using the Website);

• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them)

• Whether retention is advisable; and considering our legal position (such as, for statutes of limitations, litigation or regulatory investigations).

23. Changes to This Notice

Riot IQ may update this Privacy Notice at any time and any changes will be effective upon posting. In the event that there are material changes to the way we treat your Personal Information, we will update the Last Modified date at the top of this Notice upon becoming effective. We may also notify you by email, in our discretion.

24. How to Contact Riot IQ

If you have any questions about this Privacy Notice, please contact us at privacy@riotiq.com.