Privacy Policy

01 / 19

Who We Are

ARCH is a consumer wearable technology company. Our product, ARCH V1, is a below-the-knee wearable that mechanically simulates the calf muscle pump to support leg circulation during periods of inactivity. ARCH V1 is positioned as a consumer wellness product. It is not a medical device, is not intended to diagnose, treat, cure, or prevent any disease, and is not subject to medical device regulation.

The data controllers responsible for your personal information are:

Which entity acts as your data controller depends on the service and your location. The two entities operate under shared privacy practices.

02 / 19

Our Privacy Principles

Before listing what we collect and why, here is what shapes our approach:

We collect as little as possible. The ARCH V1 device is designed so that sensor data (pulse, oxygen saturation, bioimpedance, motion) remains on the device and on your paired mobile phone. ARCH does not operate a centralized server that stores your sensor data.

Mobile application accounts use Apple Sign-In or Google Sign-In. ARCH receives only your name and email address through this authentication process and does not maintain a separate user database for these credentials.

Where data must leave the device for purposes such as anonymous statistical analysis to improve the product, it is aggregated and stripped of identifiers before transmission.

We do not sell your personal information. We do not share your personal information with advertising networks. We do not build profiles of you for commercial targeting.

03 / 19

Information We Collect

Information You Provide Directly

Newsletter subscription. If you subscribe to email updates through our website, we collect your email address. Subscription form submissions are stored on Netlify Forms infrastructure.

Pre-orders through our website. When you place a pre-order at archtechnology.co, our payment processor Stripe collects your name, billing address, shipping address, email address, telephone number (where required for delivery), and payment card information. Stripe processes the payment and stores the transactional record. ARCH receives the order confirmation and the information necessary to fulfill your order, but does not store your payment card information.

Crowdfunding backers. If you backed our Kickstarter campaign, Kickstarter and its payment processor handled your payment and shipping data. Kickstarter then provided ARCH with a list of backers containing names and email addresses so that we may communicate with you about fulfillment. For shipping logistics, we use PledgeBox, which collects your shipping address, telephone number, calf measurement, and product configuration preferences. PledgeBox transmits this information to ARCH for fulfillment.

Distributor and partnership inquiries. If you submit an inquiry through our distributor or contact form, you provide your name, company, email address, and any additional information you include in your message. These inquiries are delivered to our info@archtechnology.co inbox.

Business and investor communications. When you contact us regarding investment opportunities, partnerships, press inquiries, or other business matters, we receive the information you choose to share, generally in the form of emails and attached documents.

Customer support. When you contact our support team, we receive your name, email address, and the content of your inquiry.

Information Collected Through the ARCH Mobile Application

When you sign into the ARCH mobile application using Apple Sign-In or Google Sign-In, we receive your name and email address as part of the authentication handshake.

The ARCH V1 device, when paired with the application, captures pulse, oxygen saturation, bioimpedance, and motion sensor readings. These readings are processed on the device and on your mobile phone. The data does not, as a default behavior, leave your phone.

In future releases of the application, we may offer optional fields for you to provide additional information such as biological sex and body weight, which would allow the device to better calibrate its performance for your physiology. Where such fields are introduced, providing the information will be optional, and we will request your explicit consent before using it.

Where the application requires limited anonymous telemetry to support product improvement (for example, aggregate session counts or device performance metrics), the data transmitted is statistical, aggregated, and stripped of identifiers before leaving your device.

Information Collected Automatically When You Visit the Website

Server logs. When you visit archtechnology.co, our hosting provider Netlify automatically receives standard web server log information, including your IP address, browser type, operating system, the pages you visit, and the time of your visit. This information is used for security, troubleshooting, and basic operational analytics.

Cookies and analytics. Our website uses Google Analytics to understand how visitors interact with our pages. Google Analytics sets cookies on your device that collect information such as your approximate location, the pages you view, and the time you spend on the site. Visitors located in jurisdictions requiring consent (including the European Union, the United Kingdom, Switzerland, and certain U.S. states) are presented with a cookie consent banner upon first visit. Analytics cookies are only loaded if you grant consent. For full details, see our Cookie Notice.

04 / 19

Sensitive and Special Category Information

Under data protection laws including GDPR Article 9, UK GDPR, and Türkiye's KVKK Article 6, certain categories of personal information receive heightened protection. These include health information, biometric data, and genetic data.

The pulse, oxygen saturation, and bioimpedance readings captured by the ARCH V1 device may, under these laws, be classified as a special category of personal information regardless of how ARCH characterizes the product. We treat this data accordingly.

Where this information is processed, we rely on your explicit consent, which you provide at the time you set up the device and the application. You may withdraw this consent at any time by uninstalling the application or contacting us. As described above, this information is, by design, processed on your device and your phone rather than stored on ARCH's servers.

ARCH does not request, collect, or store information about medical history, prescribed medications, pregnancy, or any medical condition.

05 / 19

How We Use Your Information

We use your personal information for the following purposes:

To deliver the products and services you have requested. This includes processing your orders, shipping your device, providing customer support, and operating the mobile application that pairs with your device.

To communicate with you. We send service updates, shipping notifications, product information, and responses to your inquiries.

To improve our products. Where anonymous and aggregated data is generated through use of the device and application, we analyze it to improve performance, accuracy, and user experience.

To comply with legal obligations. We process tax records, accounting records, and similar information as required by applicable laws in the United States and Türkiye.

To protect our legitimate interests. This includes detecting and preventing fraud, securing our systems, and responding to legal claims.

For business-to-business communications. Where you have contacted us as a distributor, partner, journalist, or investor, we process your professional contact information to maintain the business relationship.

We do not use your personal information for purposes incompatible with those listed above without first informing you and, where required by law, obtaining your consent.

06 / 19

Legal Bases for Processing (EU, UK, Switzerland)

Under the General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss Federal Act on Data Protection, we rely on the following legal bases:

Performance of a contract. To deliver the products and services you have ordered, including ARCH V1 device fulfillment, account authentication, and customer support.

Consent. For the processing of sensor data that may fall within the special category of personal information under applicable law, for newsletter subscriptions, and for non-essential cookies. You may withdraw consent at any time.

Legal obligation. To retain tax, accounting, and regulatory records.

Legitimate interests. To operate and improve our website, communicate with business contacts, detect fraud, and secure our systems. Where we rely on legitimate interests, we have considered whether our interests are overridden by your rights and freedoms.

07 / 19

How We Share Your Information

We share information only as necessary to operate our business and only with parties who are bound by appropriate contractual protections.

Service providers acting on our behalf:

• Stripe (payment processing for archtechnology.co orders)
• PledgeBox (Kickstarter backer survey and fulfillment logistics)
• Netlify (website hosting and form submission storage)
• Google (Google Analytics, Google Sign-In)
• Apple (Apple Sign-In)
• Email and communication tools as we adopt them; this policy will be updated when material providers are added

Public authorities where disclosure is required by law, court order, or regulatory request.

Business transfers. If ARCH undergoes a merger, acquisition, financing, or asset sale, your personal information may be transferred to the resulting entity. Where this happens, we will inform you and ensure continued protection consistent with this policy.

We do not share your personal information with advertising networks, data brokers, or marketing partners. We do not "sell" your personal information as defined under California or other U.S. state privacy laws.

08 / 19

International Transfers of Personal Information

ARCH Innovation Corp. is based in the United States. ARCH Teknoloji A.Ş. is based in Türkiye. Our service providers (including Stripe, Netlify, and Google) are also primarily based in the United States. As a result, your personal information may be transferred to, stored in, and processed in countries outside the European Economic Area, the United Kingdom, Switzerland, and Türkiye.

Where required by law, such transfers are protected through one or more of the following:

• Standard Contractual Clauses approved by the European Commission
• The EU-U.S. Data Privacy Framework, where the recipient is certified
• Your explicit consent for the specific transfer
• Other lawful transfer mechanisms recognized by applicable law

Within Türkiye, transfers abroad are conducted in accordance with Article 9 of the KVKK.

09 / 19

How Long We Keep Your Information

We retain personal information only for as long as necessary for the purpose for which it was collected, unless a longer period is required by law.

After these periods, we delete or fully anonymize the information.

10 / 19

How We Protect Your Information

We use technical and organizational measures appropriate to the nature of the information we process. These include encrypted communications between our services and providers, access controls on our internal systems, careful selection of service providers with strong security practices, and ongoing review of our practices.

No system is perfectly secure, and we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authorities within 72 hours where required by law and, where appropriate, inform you directly.

11 / 19

Your Rights

You have rights regarding your personal information. The specific rights available to you depend on the laws of your jurisdiction.

Right of access. You may request a copy of the personal information we hold about you.

Right to rectification. You may request that we correct inaccurate or incomplete information.

Right to erasure. You may request that we delete your personal information. This right is not absolute; we may retain information where required by law or for legitimate business purposes.

Right to restrict processing. You may request that we limit how we use your information in certain circumstances.

Right to data portability. You may request your information in a structured, machine-readable format.

Right to object. You may object to processing based on our legitimate interests, including direct marketing.

Right to withdraw consent. Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Right to lodge a complaint. You may complain to your local data protection authority. For the EU, this is your member state authority. For the UK, this is the Information Commissioner's Office. For Switzerland, this is the Federal Data Protection and Information Commissioner. For Türkiye, this is the Kişisel Verileri Koruma Kurumu (KVKK).

To exercise any of these rights, contact us at privacy@archtechnology.co. We will respond within 30 days. We may need to verify your identity before fulfilling your request. If we cannot fulfill a request, we will explain why.

12 / 19

United States Residents

If you are a resident of California, Colorado, Connecticut, Virginia, Texas, or another U.S. state with a comprehensive privacy law, you have rights similar to those described above, including the right to know, the right to delete, the right to correct, the right to opt out of certain processing, and the right to non-discrimination for exercising your rights.

We do not sell personal information or share it for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

To exercise your rights, contact us at privacy@archtechnology.co. We will respond within 45 days. You may designate an authorized agent to submit a request on your behalf, subject to verification.

California residents may also request, once per year and free of charge, information about categories of personal information disclosed to third parties for direct marketing purposes under the California "Shine the Light" law. We have not disclosed personal information for third-party direct marketing purposes.

13 / 19

Türkiye Residents

If you reside in Türkiye, your personal information is processed in accordance with the Law on the Protection of Personal Data No. 6698 (KVKK). A separate Aydınlatma Metni (Information Notice) and Açık Rıza Metni (Explicit Consent Form) prepared in Turkish, in accordance with KVKK terminology and requirements, is available at archtechnology.co/gizlilik-politikasi. The Turkish version is the authoritative version for residents of Türkiye.

14 / 19

Children

ARCH products and services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from individuals under 18. If you believe a person under 18 has provided us with personal information, please contact us at privacy@archtechnology.co and we will take appropriate steps to delete that information.

15 / 19

Automated Decision-Making

The ARCH V1 device automatically adjusts its operation based on sensor readings. This automatic adjustment is a technical process internal to the device and does not produce legal or similarly significant effects regarding you.

The mobile application, in future releases, may use on-device machine learning to personalize how the device operates for you. This processing is performed locally on your device, does not transfer your personal information to ARCH's systems for that purpose, and can be turned off by uninstalling the application.

We do not use automated decision-making to make decisions about you that have legal effects or similarly significant effects.

16 / 19

Important Safety Information

This is not a privacy notice in the strict sense, but it is information you should know. The ARCH V1 device contains a bioimpedance sensor that passes a small electrical current through your skin to measure tissue resistance. Individuals with cardiac pacemakers, implantable cardioverter defibrillators, or other implanted electronic medical devices should not use the ARCH V1 device. This restriction is independent of how we process personal information and applies to all users.

17 / 19

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you directly. We encourage you to review this policy periodically.

18 / 19

Contact Us

For questions about this Privacy Policy or to exercise your rights, contact us at:

19 / 19

Governing Law

For users in Türkiye, this Privacy Policy is governed by the laws of the Republic of Türkiye, and the Istanbul Çağlayan Courts shall have jurisdiction.

For users in the United States and all other jurisdictions not separately addressed, this Privacy Policy is governed by the laws of the State of Delaware, and the courts of the State of Delaware shall have jurisdiction, except where applicable law requires otherwise.

For users in the European Union, the United Kingdom, and Switzerland, mandatory consumer protection and data protection laws of your country of residence apply, and the rights granted under those laws are not diminished by this Privacy Policy.