Kindred Privacy Statement

Kindred Global Inc. and its related bodies corporate, affiliates, and regional operating entities (“Kindred”, “we”, “us”, “our”) respect your privacy and are committed to handling personal information responsibly and in accordance with applicable law.

This Privacy Statement explains how we collect, use, disclose, store, and otherwise process personal information when you use Kindred’s websites, applications, marketplace platform, APIs, and related services (collectively, the “Platform”).

Kindred operates a platform that helps qualified professionals and organisations discover, arrange, administer, and pay for professional supervision sessions and related professional support services. Supervisors provide the professional supervision services independently; Kindred provides the marketplace platform and related facilitation, administration, and payment collection functions.

By accessing or using the Platform, you acknowledge and accept the practices described in this Privacy Statement.

This Privacy Statement applies to personal information we process when you:

• visit our websites or use our applications;
• create or maintain a Kindred account;
• act as a Supervisor, Supervisee, Corporate Client, or authorised user of a Corporate Client;
• book, manage, pay for, or administer Sessions through the Platform;
• contact us, request support, or otherwise communicate with us.

This Privacy Statement does not govern third-party websites, payment processors, video-conferencing providers, or other third-party services linked to or integrated with the Platform. Those third parties maintain their own privacy notices and practices, and we encourage you to review them.

Kindred is a professional supervision marketplace and administration platform. It is NOT a clinical records system, patient health record, or electronic health record.

Unless Kindred expressly agrees otherwise in a separate written agreement (such as a Business Associate Agreement or equivalent), the Platform is not intended to receive, store, or process:

• protected health information (PHI) or equivalent regulated health data;
• patient or client names or directly identifying case materials;
• medical records, treatment records, diagnoses, or therapy notes;
• any sensitive data you are not authorised to disclose.

Where users choose to discuss case material during supervision, they are solely responsible for ensuring the information is appropriately de-identified and lawfully shared in accordance with their professional and legal obligations.

US-specific note: In the United States, some digital health-related services not subject to HIPAA may still be subject to the Federal Trade Commission’s Health Breach Notification Rule if they handle covered identifying health information. Kindred’s position is to avoid receiving regulated health information through the Platform unless separately agreed in writing with appropriate safeguards.

4.1 Information You Provide Directly

Depending on how you interact with the Platform, this may include:

• full name, email address, phone number, and account login details;
• country, time zone, and language preferences;
• billing and payout details (including bank account or payment card information provided to our payment processor);
• organisation or employer details;
• professional profile information, including biography, profession, specialties, qualifications, licences, registrations, memberships, professional experience, and insurance details;
• documents uploaded for onboarding, identity verification, compliance, or support purposes;
• communications you send to us or through the Platform;
• information you provide when booking, rescheduling, cancelling, or administering Sessions.

4.2 Information Collected Automatically

When you use the Platform, we may automatically collect:

• IP address, browser type, device information, and operating system;
• application and website usage data, referring URLs, pages viewed, and interactions;
• dates and times of access;
• log files, diagnostic data, and error reports;
• cookie and similar technology data (see Section 8 below).

4.3 Information From Third Parties

We may receive personal information from:

• payment processors (e.g., Stripe) in connection with transaction processing and onboarding;
• identity verification and compliance providers;
• video and meeting providers integrated with the Platform;
• analytics and performance monitoring providers;
• fraud prevention and security providers;
• Corporate Clients administering access for their authorised users;
• publicly available professional registration databases or similar sources used to verify qualifications or professional standing.

4.4 Sensitive Information

We seek to minimise collection of sensitive information. Where we do collect sensitive information that is reasonably necessary for Platform operation or legal compliance—for example, professional registration details, identity verification documents, or limited accessibility and support information—we handle it with additional care and in accordance with applicable law.

Australia: Under the Privacy Act 1988 (Cth), sensitive information receives additional protections and we will only collect it with your consent or as otherwise permitted by law.

5.1 To Provide and Operate the Platform

• creating and managing accounts and user profiles;
• facilitating discovery, booking, scheduling, rescheduling, and cancellation of Sessions;
• processing payments, commissions, refunds, and payouts;
• providing corporate administration features for Corporate Clients;
• providing customer support and responding to enquiries;
• delivering service communications, notifications, and reminders.

5.2 To Verify Users and Maintain Trust and Safety

• verifying identity, qualifications, licences, and professional status;
• monitoring compliance with our Terms of Service and platform rules;
• detecting and preventing fraud, abuse, misconduct, and security incidents;
• investigating complaints, disputes, or suspected breaches.

5.3 To Administer Commercial Relationships

• managing Corporate Client accounts and authorised users;
• issuing receipts, invoices, remittance records, and payout statements;
• maintaining financial records and complying with legal, tax, and accounting requirements.

5.4 To Improve and Develop the Platform

• analysing usage patterns and platform performance;
• troubleshooting, debugging, and resolving technical issues;
• improving functionality, reliability, security, and usability;
• developing new features and services;
• generating aggregated, de-identified analytics and operational insights.

5.5 To Communicate With You

• sending service notices, booking confirmations, reminders, and support responses;
• sending legal, security, administrative, and transactional communications;
• sending marketing or product updates where permitted by law and subject to your preferences (see Section 14).

5.6 To Comply With Law and Protect Rights

• complying with legal, regulatory, professional, taxation, and compliance obligations;
• responding to lawful requests from courts, regulators, law enforcement, or professional bodies;
• enforcing our agreements and Terms of Service;
• protecting our rights, the safety of users and personnel, and the integrity of the Platform.

Depending on your location and the circumstances, we process personal information on one or more of the following grounds:

• performance of a contract with you, or to take steps at your request before entering into a contract;
• compliance with legal obligations;
• our legitimate interests, including operating, securing, improving, and administering the Platform, provided those interests are not overridden by your rights;
• your consent, where consent is required by applicable law;
• as otherwise permitted or required by applicable law.

6.1 Australia

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), we collect and handle personal information in accordance with the APPs, including the requirement under APP 1 to maintain a clearly expressed and up-to-date privacy policy, and the requirement under APP 6 to use or disclose personal information only for the purpose for which it was collected or a related secondary purpose that a reasonable person would expect.

6.2 Canada

Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation, we generally collect, use, and disclose personal information with consent (express or implied as appropriate), subject to exceptions permitted by law. PIPEDA’s fair information principles guide our practices.

6.3 United States

There is no single comprehensive federal privacy law in the United States. However, users in states with consumer privacy legislation—including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and others—may have specific rights regarding their personal information. See Section 13 for details.

7.1 Other Users and Corporate Administrators

Depending on Platform function and permissions:

• Supervisors may see information reasonably necessary to administer Sessions with Supervisees;
• Supervisees may see information reasonably necessary to identify and engage a Supervisor;
• Corporate Clients and their authorised administrators may access account, usage, booking, attendance, and related administrative information relating to their authorised users, to the extent enabled by the Platform and consistent with contractual arrangements and applicable law.

7.2 Service Providers and Processors

We engage third-party service providers who process personal information on our behalf, including providers of:

• cloud hosting and infrastructure;
• authentication and identity verification;
• payment processing (e.g., Stripe);
• communications, email, and notification services;
• analytics and performance monitoring;
• customer support tools;
• document storage;
• security, logging, and fraud prevention;
• video and meeting integrations.

These service providers are bound by contractual obligations to process personal information only as instructed and to maintain appropriate security measures.

7.3 Professional Advisers

We may disclose personal information to lawyers, accountants, auditors, insurers, financiers, or transaction advisers where reasonably necessary for professional advice, compliance, or corporate transactions.

7.4 Regulators and Authorities

Where required or permitted by law, we may disclose personal information to courts, regulators, law enforcement agencies, tax authorities, privacy regulators, professional registration bodies, or similar agencies.

7.5 Corporate Transactions

If Kindred undergoes or considers a merger, acquisition, restructure, financing, or sale of assets, personal information may be disclosed to relevant parties subject to appropriate confidentiality protections.

7.6 No Sale of Personal Information

We do not sell personal information in the ordinary commercial sense. We do not use personal information for unrelated third-party advertising. For California residents, see Section 13.3 regarding the CCPA’s specific definitions.

We may use cookies, pixels, SDKs, local storage, and similar technologies to:

• maintain your logged-in session;
• remember your preferences and settings;
• understand how the Platform is used;
• measure and improve platform performance;
• support security and fraud prevention;
• support communications and marketing where permitted by law.

You may be able to control cookies through your browser or device settings. Disabling certain technologies may affect Platform functionality. We will publish a separate Cookie Notice with additional detail where required by applicable law.

Kindred operates internationally and may process or store personal information in multiple countries, including Australia, the United States, Canada, and other jurisdictions where our group entities or service providers operate.

As a result, your personal information may be transferred to, stored in, or accessed from countries outside the country where it was collected. Where we do so, we take reasonable steps to ensure appropriate safeguards are in place, having regard to the sensitivity of the data and applicable legal requirements.

Australia (APP 8): Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the overseas recipient does not breach the APPs, or we otherwise comply with the requirements of APP 8.

Canada: We may use service providers located outside Canada. We remain accountable for personal information under our control, including information transferred to third parties for processing.

United States: Where applicable state laws impose requirements on international transfers, we comply with those requirements.

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Statement, including to:

• provide and operate the Platform;
• maintain business, financial, and tax records;
• comply with legal, regulatory, dispute resolution, and audit obligations;
• enforce agreements and our Terms of Service;
• investigate incidents and protect the Platform.

Retention periods vary depending on the type of information and the reason we hold it. When personal information is no longer reasonably required, we delete it, de-identify it, or securely destroy it, subject to any lawful retention requirements.

We implement technical, administrative, and organisational measures designed to protect personal information against unauthorised access, loss, misuse, interference, alteration, or disclosure. These measures may include:

• role-based access controls and multi-factor authentication;
• logging, monitoring, and incident response procedures;
• vendor and third-party security management;
• regular security reviews and assessments.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account or data has been compromised, contact us immediately at contact@kindredclinical.com.

Your rights depend on where you are located and the circumstances of processing. Subject to applicable law, you may have the right to:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion or de-identification of certain personal information;
• request information about how we use or disclose your information;
• withdraw consent where processing is based on consent;
• object to or restrict certain processing;
• request portability of certain data in a structured, commonly used format;
• opt out of certain marketing communications.

To exercise a rights request, contact us using the details in Section 18. We may need to verify your identity before actioning a request. We will respond within the timeframes required by applicable law.

13.1 Australia

If you are located in Australia, the following additional provisions apply:

• You may request access to, and correction of, personal information we hold about you under APPs 12 and 13, subject to exceptions under the Privacy Act 1988 (Cth).
• We will respond to access and correction requests within a reasonable period (generally 30 days).
• If you are dissatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
• We are required under APP 1 to maintain this privacy policy and make it available free of charge.

13.2 Canada

If you are located in Canada, the following additional provisions apply:

• Under PIPEDA and applicable provincial legislation, you may request access to and correction of personal information we hold about you, subject to lawful exceptions.
• We will respond to access requests within 30 days or as otherwise required by applicable law.
• You may withdraw consent to the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions and on reasonable notice. Withdrawal may affect our ability to provide the Platform.
• If you are dissatisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

13.3 United States

If you are located in the United States, the following additional provisions may apply depending on your state of residence:

California (CCPA/CPRA):

• California residents may have rights to know what categories and specific pieces of personal information we collect, to request deletion, to request correction, and to opt out of the sale or sharing of personal information.
• We do not sell personal information as defined by the CCPA. We do not share personal information for cross-context behavioural advertising.
• We will not discriminate against you for exercising your privacy rights.
• To make a request, contact us using the details in Section 18. We may verify your identity using information already on file.

Other US states: Residents of Virginia, Colorado, Connecticut, and other states with consumer privacy laws may have similar rights regarding access, deletion, correction, and opt-out. We will honour rights requests in accordance with the applicable state law. Contact us using the details in Section 18.

We may send you service-related communications as part of operating the Platform (including booking confirmations, reminders, and transactional notices). These are not marketing and are necessary for service delivery.

We may also send marketing or promotional communications where permitted by law. You can opt out of marketing at any time by using the unsubscribe link in any marketing email or by contacting us. Opting out of marketing does not affect essential transactional or service communications.

• Australia: We comply with the Spam Act 2003 (Cth) regarding commercial electronic messages.
• Canada: We comply with Canada’s Anti-Spam Legislation (CASL) regarding commercial electronic messages.
• United States: We comply with the CAN-SPAM Act and applicable state laws regarding commercial electronic messages.

The Platform is intended for adults and professional users. It is not directed to children. We do not knowingly collect personal information from children in connection with the Platform.

If you believe a child has provided personal information to us, please contact us immediately and we will investigate and take appropriate steps, including deletion of the information.

We may create aggregated or de-identified data from personal information for analytics, research, product improvement, and operational purposes. Such data does not identify you and is not treated as personal information under this Privacy Statement. We maintain reasonable measures to prevent re-identification.

If you have a privacy concern or complaint, please contact us first so we can try to resolve it (see Section 18).

If you are not satisfied with our response, you may have the right to complain to the relevant privacy regulator, including:

• the Office of the Australian Information Commissioner (OAIC) in Australia — www.oaic.gov.au;
• the Office of the Privacy Commissioner of Canada — www.priv.gc.ca;
• the applicable state attorney general or privacy regulator in the United States.

For privacy requests, complaints, or questions, contact:

Privacy Officer
Kindred Global Inc.
43 Baxter Street, Fortitude Valley QLD 4006

Email: contact@kindredclinical.com

We may update this Privacy Statement from time to time to reflect changes in our services, legal requirements, or privacy practices. We will post the updated version on the Platform and update the “Last Updated” date above.

Where changes are material, we will provide additional notice as required by applicable law (for example, by email or prominent in-app notification). Your continued use of the Platform after the effective date of changes constitutes acceptance, subject to applicable law.