IntelaMetrix Holdings, Inc.

IntelaMetrix Holdings, Inc. ("IntelaMetrix," "BodyMetrix," or "the Company," collectively referred to as "we," "us," or "our") operates the BodyMetrix Ultrasound System and its integrated hardware, firmware, software, cloud services, analytics, updates, and support services (collectively, the "Platform"), together with our eCommerce storefront and associated web properties. This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and the rights you have over your data.

Use of the Platform is governed by the IntelaMetrix Master End User License Agreement (EULA), including its Privacy Notice (Schedule B) and Data Processing Addendum (Schedule C). If there is a conflict between this Privacy Policy and the Master EULA with respect to Platform data, the Master EULA controls. If there is a conflict between our Terms of Service and this Privacy Policy with respect to the collection, processing, and disclosure of personal information gathered through our storefront, this Privacy Policy controls. If you are a California resident, please see Section 9 for your CCPA / CPRA rights.

1. Information We Collect

We collect the following categories of personal information. The categories that apply to you depend on whether you interact with our eCommerce storefront, the legacy BodyView software, or the BodyMetrix App cloud platform. See Section 2 for how data practices differ between the legacy and cloud software.

Category	Examples	Purpose
Identifiers & Contact	Name, email, mailing address, phone number, account username	Order processing, account management, customer support
Commercial / Transaction	Purchase history, device orders, subscription records, items viewed or added to cart, wishlist items, and past transactions including returns, exchanges, and cancellations	Order fulfillment, dunning, subscription management
Financial Data	Payment card data processed by our Payment Platform	Payment processing. Raw card numbers are not stored by IntelaMetrix.
License Validation Data (legacy BodyView)	IP address, device/machine identifier, license key, software version, OS version, validation timestamp	License enforcement, anti-piracy, fraud prevention, software update eligibility
Customer Data (BodyMetrix App)	Identifiable raw data submitted by or on behalf of a Customer through the Platform, including body composition measurements, End User records, and assessment results	Operating, supporting, maintaining, and improving the Platform; generating aggregated, de-identified, and derived data; AI/ML model development, as set forth in the Master EULA Sections 4 and 5
Device Telemetry (BodyMetrix App)	Subscription status, device activity, error logs, performance data	License enforcement, abuse detection, security investigation, Platform operation, per Master EULA Section 7.2
Device & Usage Data (storefront)	Browser type, pages visited, click events, session data	Platform analytics, security monitoring, storefront improvement
Geolocation (IP-derived)	IP-derived location, shipping address	Shipping calculation, tax compliance, fraud prevention
Communications	Support ticket content, email correspondence, feedback	Customer service, product improvement

2. Software Data Practices: Legacy BodyView and the BodyMetrix App

IntelaMetrix is transitioning from the legacy BodyView on-premise software to the BodyMetrix App cloud platform. Data practices differ materially between the two, and it is important that you understand which applies to you.

Legacy BodyView (On-Premise)

Body composition measurement data generated through the legacy BodyView software is stored exclusively on your local PC and its local database. IntelaMetrix does not transmit, receive, access, store, or process BodyView measurement data, client records, or measurement outputs. The BodyView software makes a periodic network call to IntelaMetrix servers for license validation purposes only, transmitting the License Validation Data described in Section 1. Responsibility for the security, retention, and appropriate use of locally stored BodyView data rests with the individual or organization operating the software. BodyView is deprecated and subject to the timeline in our BodyView End-of-Life Notice.

BodyMetrix App (Cloud Platform)

When you or your organization use the BodyMetrix App, Customer Data, including body composition measurements, End User records, and assessment results, is transmitted to and processed by IntelaMetrix in the cloud as part of the integrated Platform. This processing is governed by the Master EULA, including:

Data license and ownership (EULA Sections 4.1 through 4.3). Customers retain ownership of Customer Data. Customers grant IntelaMetrix a license to process Customer Data to operate and improve the Platform. IntelaMetrix exclusively owns aggregated, de-identified, and derived data generated from Platform use.
AI and machine learning (EULA Section 5). IntelaMetrix uses Platform data, including Customer Data, as training data for artificial intelligence and machine learning models. These rights are a material basis on which the Platform is provided and are not subject to opt-out. Individual users are not identified in trained models.
Telemetry (EULA Section 7.2). Device telemetry is collected continuously as part of Platform operation and cannot be disabled.
Retention (EULA Section 4.8). Customer Data is retained for the duration of the active subscription and for thirty (30) days following termination, during which Customers may export their data. Aggregated, de-identified, and derived data are retained indefinitely as IntelaMetrix assets.

For professional and organizational Customers, the Customer, not IntelaMetrix, is the data controller for End User data submitted through the Platform, including any obligations to End Users under applicable privacy, biometric, health, or minor-protection laws.

Biometric and Health Data Notice

Body composition data collected through the Platform, including ultrasound-derived measurements, may constitute biometric information, biometric identifiers, or health data under applicable US state privacy laws, including the Illinois Biometric Information Privacy Act (BIPA) and analogous statutes in other states. As set forth in the Master EULA Schedule B, the Customer, as the data controller for End User data, is responsible for compliance with applicable state biometric and health data laws, including obtaining all required consents and providing all required notices to End Users. Our eCommerce storefront does not collect biometric or health data.

3. How We Collect Information

Directly from you when you place an order, create an account, or contact support.
Automatically via cookies, pixels, and server logs when you navigate our eCommerce storefront.
Via license validation network calls when the legacy BodyView software checks a license against our servers.
Through the BodyMetrix App when you or your organization submit Customer Data to the cloud Platform, and through continuous device telemetry, as governed by the Master EULA.
From third-party platforms we integrate with: our eCommerce Platform (storefront), our CRM (customer management), our fulfillment provider, our operations platform, and our Payment Platform.

4. How We Use Your Information

Process and fulfill device and subscription orders.
Manage your subscription, including dunning and renewal communications.
Validate and enforce software licenses to prevent unauthorized use, including remote subscription monitoring and enforcement as described in Master EULA Section 3.3.
Provide technical support and product updates.
Send transactional emails (order confirmations, shipping notifications).
Send marketing communications where you have provided consent. You may opt out of promotional emails at any time by using the unsubscribe link in any marketing email we send. Opting out of promotional emails does not affect transactional emails such as order confirmations, shipping notifications, or account-related communications, which we may continue to send.
Detect fraud, prevent unauthorized access, and maintain platform security.
Operate, support, maintain, and improve the Platform, including generating aggregated, de-identified, and derived data and developing artificial intelligence and machine learning models, as set forth in the Master EULA Sections 4 and 5. Individual users are not identified in this process.

5. How We Share Your Information

IntelaMetrix does not sell your personal information for money. We may share your information with the following service providers, which act as authorized subprocessors subject to confidentiality and data protection obligations:

eCommerce Platform: storefront and payment infrastructure.
Payment Platform: payment processing.
Fulfillment provider: order fulfillment; shipping carriers (UPS, FedEx, USPS).
CRM and marketing automation platform.
Cloud hosting and infrastructure providers supporting the Platform and license validation.
Operations platform via cloud computing middleware: operational data management.
Professional advisors under confidentiality obligations.
Law enforcement, courts, or regulatory authorities: when legally required or to protect our rights.
Successor entities: in connection with a merger, acquisition, or asset sale.

IntelaMetrix may use, license, or commercialize aggregated, de-identified, and derived data, which does not identify you or any individual, as set forth in Master EULA Section 4.3.

6. Cookies & Tracking Technologies

Essential cookies: required for storefront function (eCommerce session, cart).
Analytics cookies: page visits and behavior patterns (anonymized).
Marketing cookies: only where you have provided explicit consent.

You may control cookie preferences through your browser settings or our cookie consent banner. Disabling essential cookies may impair storefront functionality. We honor Global Privacy Control (GPC) signals as valid opt-out requests for analytics and marketing cookies. Other than GPC, we do not currently recognize or respond to Do Not Track (DNT) signals transmitted by web browsers, as there is no consistent industry standard for DNT compliance.

7. Data Retention

Category	Retention Period
Transaction records	7 years (tax and regulatory compliance)
Account data	Duration of active subscription plus 2 years
License validation data (legacy BodyView)	2 years from last validation event. Operational telemetry (device serial, OS type, last usage) retained indefinitely for platform integrity and licensing purposes.
Customer Data (BodyMetrix App)	Duration of the active subscription term plus thirty (30) days following termination, consistent with the data export window in Master EULA Sections 4.6 and 4.8. Aggregated, de-identified, and derived data are retained indefinitely as IntelaMetrix assets and are not subject to customer-requested deletion.
Marketing consent records	5 years from last interaction
Support communications	5 years from resolution
Legacy BodyView measurement data	Not retained by IntelaMetrix. Stored locally on user device only.
HIPAA Business Associate documentation	Minimum of 6 years, per Master EULA Schedule D and 45 C.F.R. § 164.530(j), where applicable

8. Children's Privacy

Our eCommerce storefront and web properties are not directed at children under 16, and we do not knowingly collect personal information from individuals under 16 through the storefront. If you believe a minor has provided us information through the storefront, contact us immediately at privacy@BodyMetrix.com and we will delete it promptly.

The Platform may be used by professional and organizational Customers in connection with minors, including in Youth Sports Compliance deployments. In those deployments, the Customer is the data controller for End User data and is responsible for compliance with all applicable child data protection laws, including COPPA, CIPA, and FERPA, and for obtaining all required parental or guardian consents, as set forth in Master EULA Section 6.4. IntelaMetrix does not knowingly collect personal information directly from children under 13.

9. California Consumer Rights (CCPA / CPRA)

If you are a California resident, you have the following rights under the CCPA as amended by the CPRA. Residents of Virginia, Colorado, Connecticut, Texas, Oregon, and Montana have similar rights under their state privacy laws. Canadian residents are entitled to rights under PIPEDA and Quebec Law 25, including access, correction, and objection to processing. EU and UK residents retain rights under GDPR and UK GDPR respectively.

Right	Description
Right to Know	Request the categories and specific pieces of personal information we have collected about you in the past 12 months, including sources, purposes, and third-party disclosures.
Right to Access	Obtain a copy of the specific personal information we hold about you, free of charge, up to twice per 12-month period.
Right to Delete	Request deletion of personal information we collected from you, subject to legal exceptions. Deletion requests cannot be processed while an active subscription is in place. For Customer Data processed through the BodyMetrix App, deletion is handled per Master EULA Sections 4.8 and 5.4: identifiable source data is deleted or de-identified, while aggregated, de-identified, and derived data, and previously trained models, are not subject to deletion.
Right to Correct	Request correction of inaccurate personal information we maintain about you.
Right to Opt-Out	IntelaMetrix does not sell your personal information for money. We may share limited analytics data with advertising platforms where you have consented. Opt out via the "Do Not Sell or Share My Personal Information" link in the footer.
Right to Non-Discrimination	Exercise any of the above rights without fear of denial of service, different pricing, or other discriminatory treatment.

If you are an End User whose body composition data was collected by a professional or organizational Customer through the Platform, that Customer is the data controller for your data. We recommend directing rights requests to that organization first; we will assist Customers in responding to valid requests as set forth in the Master EULA Schedule C.

9a. Additional Rights: EU, UK, and Canadian Residents

If you reside in the European Economic Area (EEA) or the United Kingdom, you have the following additional rights under the GDPR or UK GDPR:

Right of Portability

You have the right to receive a copy of the personal information we hold about you in a structured, commonly used, and machine-readable format and, where technically feasible, to request that we transmit that information directly to another controller.

Right to Object to Processing

You have the right to object to our processing of your personal information where we rely on legitimate interests as our legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal information in certain circumstances, such as while a correction request is being assessed.

Right to Withdraw Consent

Where we rely on your consent to process your personal information, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Right to Erasure and AI/ML Models

Where applicable law grants a right to erasure of personal data, IntelaMetrix will de-identify and suppress the underlying identifiable source data and will not make further use of it in identifiable form. To the extent that erasure of individual data points from trained model weights or aggregated datasets is not technically feasible, such infeasibility is a recognized limitation on the right to erasure consistent with applicable regulatory guidance, as set forth in Master EULA Section 5.4. IntelaMetrix's ongoing use of previously trained models does not constitute continued processing of your identifiable personal data.

Complaints

If you have concerns about how we handle your personal information, you have the right to lodge a complaint with the data protection supervisory authority in your country of residence. For EEA residents, a list of supervisory authorities is available at: edpb.europa.eu

For residents of Canada, you have rights under PIPEDA and Quebec Law 25, including the right to access, correct, and object to the processing of your personal information. You may contact the Office of the Privacy Commissioner of Canada with complaints.

10. How to Submit a Privacy Request

Email: privacy@BodyMetrix.com
Web form: https://bodymetrix.com/pages/privacy-request
Toll-free: 916-840-0096

We verify your identity before processing requests. Responses are delivered within 45 days; we may extend by an additional 45 days with prior written notice. No fee is charged unless a request is excessive or repetitive.

Authorized Agent. You may designate an authorized agent by providing written permission and the agent's identification. We reserve the right to deny requests from agents who do not provide sufficient proof of authorization.

11. International Data Transfers

IntelaMetrix Holdings, Inc. is based in the United States. If you access our Platform from outside the United States, please be aware that your personal information will be transferred to, stored, and processed in the United States, which may not provide the same level of data protection as the laws in your country of residence.

If we transfer your personal information from the European Economic Area, the United Kingdom, or Switzerland to a country not recognized as providing an adequate level of data protection, we will implement appropriate safeguards, including the use of Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent instruments approved by the relevant UK authority, or safeguards recognized under the Swiss Federal Act on Data Protection (FADP).

For customers in the European Economic Area, the United Kingdom, and Switzerland, the BodyMetrix App enforces this commitment at the software level: body composition measurements and End User records are held locally on the customer’s device and are not transmitted to United States infrastructure until the applicable transfer safeguards (such as executed Standard Contractual Clauses) are in place for that customer’s account. Limited account and registration information may be transferred where necessary to establish and administer the customer’s license, on the basis that the transfer is necessary for the performance of our contract with the customer.

By using our Platform, you acknowledge that your personal information may be processed outside of your country of residence in accordance with this Privacy Policy and the Master EULA.

12. Contact Us

IntelaMetrix Holdings, Inc. — Privacy Team
2010 Elkins Way, Suite 2, Brentwood, CA 94513
privacy@BodyMetrix.com
916-840-0096

13. Policy Updates

This policy is governed by the laws of the State of Delaware. This policy will be updated at least annually. Material changes will be communicated via email to registered account holders at least 30 days before taking effect. The effective date at the top reflects the date of the most recent revision.

Privacy Policy