Legal Disclosure

Data Use, Privacy, and Jurisdictional Compliance

This Legal Disclosure governs Ionava, Inc.’s (“Ionava,” “we,” “us,” or “our”) collection, use, processing, protection, and limited disclosure of personal, financial, and health-related information. This Disclosure is legally binding and supersedes any plain-English explanations, summaries, or informational materials provided for convenience or clarity.

1. Scope and Applicability

This Disclosure applies to all applicants, users, participants, and other individuals (“you” or “your”) who access or interact with Ionava’s platform, services, or onboarding processes, regardless of geographic location.

Ionava’s data practices are intended to align with applicable requirements with applicable privacy, data protection, financial compliance, and consumer protection laws in the jurisdictions in which Ionava operates or from which its services are accessed. Where local law imposes additional or specific obligations, Ionava will comply with such requirements to the extent applicable.

2. Nature of the Platform

Ionava operates as a financial platform designed around health and wellness. Ionava is not health insurance, does not provide medical coverage, does not process insurance claims, and does not make medical decisions.

Nothing in this Disclosure shall be interpreted as creating an insurer-insured relationship, a healthcare provider-patient relationship, or any form of medical authority.

3. Categories of Information Collected

Ionava may collect the following categories of information, solely to the extent reasonably necessary for the purposes described in this Disclosure:

• Personal identifying information

• Financial information

• Health-related information, if voluntarily provided

Ionava does not collect information for unrelated or speculative purposes.

4. Purpose Limitation and Use of Information

Ionava collects and processes information exclusively for legitimate operational purposes, which may include:

• Verifying identity and eligibility

• Preventing fraud, misuse, or abuse

• Satisfying legal and regulatory obligations

• Assessing and managing financial and platform risk

• Operating, maintaining, and protecting Ionava’s financial systems and liquidity structures

Information is used only for the purposes disclosed and only to the extent necessary to operate Ionava responsibly and lawfully.

Information is collected and used solely to enable Ionava’s financial platform to function safely, responsibly, and lawfully.

5. Ethical and Operational Data Standard

Ionava treats personal, financial, and health-related information as restricted assets governed by law, not as commodities or commercial products.

Accordingly:

• Ionava does not sell personal, financial, or health information

• Ionava does not monetize personally identifiable data through resale, profiling, or third-party analytics unrelated to platform operations

If information is not required to operate Ionava, it is not collected.

6. Health-Related Information

Health-related information, when collected, is provided directly by users or accessed with user authorization for eligibility evaluation, risk integrity, and platform operations.

If you choose to provide health-related information, such information is treated as high-sensitivity restricted data and is subject to enhanced safeguards.

Health-related information is used solely for purposes that may include:

• Evaluating eligibility or participation status

• Verifying the accuracy of information provided

• Protecting the integrity, sustainability, and fairness of Ionava’s financial model

Health-related information is not used for resale.

Ionava does not provide medical advice, evaluate medical necessity, or control healthcare decisions. Users retain full autonomy over the user's own healthcare choices.

7. Information Sharing with Third Parties

Ionava may share limited, minimum-necessary information with trusted third parties only where required to:

• Verify identity or satisfy Know Your Customer (KYC) obligations

• Prevent fraud or misuse

• Comply with financial, anti-money-laundering, or other legal requirements

All such disclosures are governed by contractual, technical, and legal protections designed to restrict use, maintain confidentiality, and ensure compliance with applicable law.

Ionava does not authorize third parties to use personal health information for independent commercial purposes.

8. Security, Access, and Retention

Ionava employs reasonable and appropriate administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, or misuse.

Access to information is limited to personnel and service providers with a legitimate operational need. Access controls, logging, and review processes are implemented consistent with Ionava’s internal compliance standards.

Information is retained only for as long as necessary to fulfill disclosed purposes or to satisfy legal or regulatory obligations, after which it is deleted or anonymized in accordance with applicable requirements.

8A. Data Rights Requests

Ionava responds to legally valid data rights requests where and when required by applicable law. Such requests may be subject to identity verification and lawful limitations.

9. Governing Effect

This Legal Disclosure constitutes the sole legally binding statement regarding Ionava’s data practices. Any summaries, explanations, or plain-English descriptions are provided for convenience only and have no legal effect.

This Privacy Policy operates in conjunction with Ionava’s Interim Terms & Conditions, which govern use of the Ionava platform more broadly.