01Introduction

Leading Indicator Systems, Inc., doing business as AgileBrain (“LIS,” “we,” “us,” or “our”), is a Delaware corporation headquartered in Boston, Massachusetts. LIS respects the privacy rights of individuals and is committed to handling Personal Data and Personal Information (collectively, “PDPI”) in a manner consistent with applicable law and the highest ethical standards.

This Privacy Policy (“Policy”) describes how LIS collects, uses, discloses, and protects PDPI in connection with its assessment services and platform, including AgileBrain assessment exercises and any associated mobile applications. “Data Subject” refers to any identified or identifiable natural person whose PDPI is processed by LIS.

The AgileBrain platform is designed to run both fully anonymous and identified assessments, and operates on a fully anonymous basis in many organizational deployments. In many implementations, no Personal Data is collected during the assessment process. Where PDPI is collected — as described in this Policy — LIS processes it in one of two capacities:

• As a Data Processor: Where LIS processes PDPI on behalf of a Customer, or on behalf of a Practitioner acting as an independent Data Controller pursuant to a direct agreement with LIS, LIS acts as a Data Processor. In deployments where a Practitioner accesses the platform as an employee or authorized agent of a Customer under that Customer’s Master Services Agreement, LIS processes PDPI solely on behalf of the Customer, which remains the Data Controller. In all such cases, LIS processes PDPI strictly in accordance with the applicable Controller’s documented instructions and the governing contractual terms.
• As a Data Controller: LIS acts as a Data Controller where it processes PDPI for its own operational purposes, including managing its website, conducting research, administering marketing communications, managing direct Subscriber relationships, operating mobile applications offered directly to individual users, and providing assessment services directly to individual Subscribers who access the platform outside of an organizational or Practitioner-directed deployment. In these contexts, LIS determines the purposes and means of processing.

02Scope of This Policy

This Policy applies to PDPI that LIS collects, receives, processes, or stores in connection with the delivery of its assessment services and platform to Customers, Practitioners, and Subscribers, the operation of its website, digital properties, and mobile applications, and the conduct of its business relationships. For the purposes of this Policy: “Customer” means any organization or business that has entered into a Master Services Agreement or equivalent services agreement with LIS to deploy the platform to its own employees, members, or participants. “Practitioner” means any individual professional — including coaches, counselors, and consultants — who accesses the platform to administer assessments to participants. A Practitioner may access the platform either (a) pursuant to a direct agreement with LIS, in which case the Practitioner acts as an independent Data Controller with respect to deployments initiated and controlled by that Practitioner, or (b) as an employee or authorized agent of a Customer, in which case the Practitioner operates solely within the scope of that Customer’s Master Services Agreement and the Customer remains the Data Controller for that deployment. Practitioners operating under a Customer’s Master Services Agreement do not act as independent or joint Data Controllers in relation to that deployment. “Subscriber” means any individual who has entered into a direct subscription agreement with LIS for personal or professional use of the platform, including Practitioners who subscribe directly.

This Policy does not apply to assessment data that is processed on a fully anonymous basis. Where an assessment is conducted without the collection of any Personal Data — meaning no participant is identified, no contact information is gathered, and results are reported only at the group or aggregate level — this Policy does not apply to that assessment, as LIS does not process Personal Data attributable to any identifiable individual in that context. This anonymous model is the standard operating practice for many AgileBrain deployments.

This Policy also does not apply to aggregate or anonymized data derived from assessment results, which LIS may use without restriction for reporting, benchmarking, and service development purposes.

03Personal Data We Collect

Where a specific deployment or engagement requires the collection of Personal Data, LIS may collect or receive the following categories of PDPI:

• Contact Information: First name, last name, mobile phone number, and email address, where required to deliver assessment invitations or communicate results.
• Demographic Information: Optional demographic data — such as age range, location, or education level — agreed in advance with the applicable Customer for segmented reporting purposes.
• Assessment Response Data: Image selections made during the AgileBrain exercise, from which emotional need scores and profiles are derived, and any other assessment inputs, if applicable. Where a deployment is configured to provide individual feedback to participants, this response data may be associated with an identifiable individual and constitutes PDPI; in such cases it is handled in accordance with this Policy and any applicable contractual terms. This data and any resulting feedback do not constitute clinical, health, or diagnostic information.
• Account and Administrative Data: Contact details, subscription or account information, and communications relating to Customer, Practitioner, and Subscriber relationships, billing, and business operations.
• Mobile Application Data: Where individuals access LIS’s services through a mobile application, LIS may collect certain device and usage data necessary for the operation and improvement of the application. This may include device type and model, operating system version, application version, and general usage and performance data. LIS collects only the data necessary for the functionality and security of the application and does not collect precise geolocation data through its mobile applications unless expressly disclosed at the point of collection and consented to by the user.

LIS does not intentionally collect special categories of Personal Data as defined under applicable law, including data relating to health or medical conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sexual orientation, or criminal convictions or offenses. The AgileBrain assessment exercise is a subclinical emotional needs measurement tool and does not generate health, clinical, or diagnostic data. AgileBrain is not intended to diagnose, treat, cure, or prevent any medical or psychological condition. Where a specific engagement requires the processing of special category data — for example, in a healthcare, research, or clinical context — this will be identified in the applicable Statement of Work, and the parties will agree on additional safeguards in accordance with applicable law prior to any such processing.

04Lawful Basis for Processing

To the extent that EU GDPR, UK GDPR, or equivalent legislation applies to a deployment, LIS processes PDPI on the following lawful bases:

• Performance of a Contract: Processing necessary to deliver assessment services pursuant to a Customer agreement, a Subscriber’s subscription, or to provide a directly requested service. In direct subscription deployments where LIS provides assessment services directly to individual Subscribers, processing of PDPI is generally necessary for the performance of the Subscriber’s contract with LIS.
• Legitimate Interests: Processing necessary for LIS’s legitimate business interests, including security monitoring, service improvement, and business development, where such interests are not overridden by the rights and freedoms of Data Subjects.
• Compliance with Legal Obligations: Processing required to comply with applicable law or lawful requests from public authorities, including national security and law enforcement requirements.
• Consent: Where LIS relies on consent as a lawful basis — including for certain marketing communications or optional data collection — such consent will be obtained through a clear, affirmative action by the Data Subject and may be withdrawn at any time without detriment.

Where LIS acts as a Data Processor on behalf of a Customer, or on behalf of a Practitioner acting as an independent Data Controller under a direct agreement with LIS, that Controller is responsible for establishing and documenting the applicable lawful basis for processing under its own privacy obligations. Where a Practitioner operates under a Customer’s Master Services Agreement, the Customer remains the Data Controller and is solely responsible for establishing the lawful basis for processing.

05How We Use Personal Data

Where PDPI is collected, LIS uses it only for the purposes for which it was collected or for compatible purposes, including:

• Delivering assessment invitations and communicating results to participants where required by the applicable deployment configuration;
• Providing individual emotional need profiles and personalized feedback to participants where the applicable deployment has been configured to do so;
• Producing group or aggregate reports and analyses for Customers in accordance with agreed reporting configurations;
• Managing Customer, Practitioner, and Subscriber accounts and contractual or subscription obligations;
• Improving and developing LIS’s services and methodologies, using anonymized or aggregated data only; and
• Complying with applicable legal and regulatory requirements.

The purpose of AgileBrain assessment outputs depends on the deployment model. In organizational and institutional deployments, assessment outputs are designed primarily to provide insight at the group or organizational level in accordance with the applicable Customer’s configuration and instructions. In deployments initiated by a Practitioner acting as an independent Data Controller, assessment outputs may include individual-level profiles delivered to participants under that Practitioner’s direction. In direct subscription deployments where individuals access the platform independently, assessment outputs are provided directly to the individual user for personal insight and reflection.

LIS does not use assessment outputs to make decisions with legal effects or similarly significant consequences about individual participants. Where a Customer, or a Practitioner acting as an independent Data Controller, intends to use assessment outputs in ways that affect individual participants, that party is solely responsible for ensuring such use is lawful, proportionate, and consistent with its own obligations under applicable law. Where a Practitioner operates under a Customer’s Master Services Agreement, responsibility for any use of assessment outputs remains with the Customer as Data Controller. In educational deployments involving student participants, the Customer is responsible as Data Controller for implementing appropriate safeguards, including compliance with any legal requirements applicable to individuals under the age of 16.

Where PDPI is transferred to LIS by a Customer, Practitioner, or Subscriber, that party retains responsibility for its accuracy, completeness, and currency.

06Automated Processing

The AgileBrain platform uses automated processing of assessment response data to generate emotional need scores and profiles. The nature of this processing depends on the deployment model.

In organizational deployments, automated processing is generally configured to generate group-level or aggregated insights for the applicable Customer. In deployments initiated by a Practitioner acting as an independent Data Controller, automated processing may generate individual-level profiles delivered under that Practitioner’s direction. In direct subscription deployments where individuals access the platform independently, automated processing generates individual-level assessment outputs provided directly to the Subscriber for personal use.

LIS does not use automated processing to make decisions that produce legal effects or similarly significant consequences for individual Data Subjects. Assessment outputs are designed to provide informational insight and are not intended to be determinative, diagnostic, or binding.

Where a Customer, or a Practitioner acting as an independent Data Controller, incorporates assessment outputs into broader programs, initiatives, or decision-making processes, that party is responsible for ensuring that any such use complies with applicable law and its own obligations to participants. Where a Practitioner accesses the platform as an employee or authorized agent of a Customer, the Customer remains solely responsible as Data Controller for any such use.

6.1 AI-Based Tools

As part of its service offerings, LIS provides access to AI-based tools, including chatbots designed to support user reflection and deliver insights about emotional needs. These tools are not intended to provide medical, clinical, or diagnostic advice, and do not constitute a substitute for professional support.

LIS uses large language model service providers to power these AI-based features. LIS does not permit its LLM service providers to use interaction data for the purpose of training or improving their own models. A current list of LIS’s AI service providers is available upon request by contacting privacy@leadingindicator.com.

Where individuals interact with these tools, interaction data may be temporarily retained for the limited period necessary to maintain system functionality, ensure service stability, and improve service quality, after which such data is deleted or de-identified in accordance with Section 9 (Data Retention). LIS does not use AI interaction data for advertising or marketing purposes, and does not sell or share such data for commercial purposes. LIS processes AI interaction data on the basis of its legitimate interests in maintaining a secure and functional platform, and retains such data for no longer than is necessary for those purposes.

LIS’s AI-based tools are intended for general reflective use. Users are responsible for the information they choose to submit when interacting with such tools.

07Disclosure and Onward Transfer

LIS does not sell, rent, or otherwise transfer PDPI to any third party for their independent marketing, commercial, or other purposes.

LIS may disclose PDPI in the following limited circumstances:

• Authorized Sub-Processors: LIS engages third-party service providers, including cloud infrastructure, productivity, and technical development service providers, to support the delivery of its services. Each sub-processor is bound by contractual data protection obligations at least as protective as those in this Policy and, where applicable, in any executed DPA. A current list of LIS’s authorized sub-processors is available upon request by contacting privacy@leadingindicator.com.
• Customer and Independent Practitioner Controllers: Where LIS acts as a Data Processor, it may disclose PDPI to the applicable Customer acting as Data Controller, or to a Practitioner acting as an independent Data Controller under a direct agreement with LIS, in accordance with that Controller’s documented instructions and the terms of any applicable agreement. Where a Practitioner operates under a Customer’s Master Services Agreement, LIS discloses PDPI to the Customer as Data Controller, and any Practitioner access to such data is governed by the Customer’s authorization and internal controls.
• Legal and Regulatory Requirements: LIS may disclose PDPI to the extent required by applicable law, regulation, legal process, or lawful request by a governmental or regulatory authority, including to meet national security or law enforcement requirements.

LIS remains accountable for the onward transfer of PDPI to third parties acting on its behalf. Where LIS transfers PDPI to a third party acting as its agent, LIS will ensure by contract that such party processes PDPI only for limited and specified purposes consistent with this Policy. LIS remains liable under applicable data protection frameworks, including the EU-U.S. DPF, if such an agent processes PDPI in a manner inconsistent with those frameworks, unless LIS can demonstrate that it was not responsible for the act or omission giving rise to the harm.

08International Data Transfers

LIS is based in the United States and may transfer PDPI to countries outside the European Economic Area (“EEA”) or the United Kingdom (“UK”). LIS relies on the following mechanisms to ensure that any such transfers comply with applicable law:

• EU-U.S. Data Privacy Framework (EU-U.S. DPF): Leading Indicator Systems complies with the EU-U.S. DPF as set forth by the U.S. Department of Commerce and has certified its adherence to the EU-U.S. DPF Principles with respect to PDPI received from the European Union. If there is any conflict between this Policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more and to view LIS’s certification, please visit https://www.dataprivacyframework.gov/.
• UK Extension to the EU-U.S. DPF: Leading Indicator Systems has similarly certified its adherence to the UK Extension to the EU-U.S. DPF with respect to PDPI received from the United Kingdom (and Gibraltar).
• Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF): Leading Indicator Systems has certified its adherence to the Swiss-U.S. DPF Principles with respect to PDPI received from Switzerland.
• Standard Contractual Clauses (“SCCs”): For transfers not covered by the DPF, LIS relies on the European Commission’s Standard Contractual Clauses and, for UK transfers, the UK Addendum to the SCCs, as incorporated into any applicable DPA.

09Data Retention

Because AgileBrain operates on a fully anonymous basis in many deployments, the volume of PDPI retained by LIS is limited by design. Where PDPI is collected, LIS retains it for no longer than is necessary to fulfill the purpose for which it was collected, to comply with applicable legal obligations, or as otherwise agreed with the relevant Customer, Practitioner, or Subscriber.

In the context of Customer engagements governed by a Master Services Agreement, including deployments in which Practitioners access the platform as employees or authorized agents of the Customer, PDPI is retained in accordance with the terms of that agreement and, where executed, the applicable Data Processing Addendum. Upon termination or expiration of such agreement, or upon written request from the Customer, LIS will return or securely delete PDPI in accordance with the applicable DPA within thirty (30) days.

In the context of deployments governed by a direct subscription or services agreement between LIS and a Practitioner acting as an independent Data Controller, PDPI is retained in accordance with the applicable subscription or services terms. Independent Practitioner Controllers, Subscribers, and individuals whose data was processed in connection with such deployments may submit a request for deletion of individual assessment data by contacting privacy@leadingindicator.com. LIS will process such requests in accordance with applicable law and its contractual obligations.

LIS may retain PDPI for a longer period to the extent required or permitted by applicable law, including for the purposes of establishing, exercising, or defending legal claims. Where PDPI is retained beyond the standard retention period for such purposes, access to that data will be restricted accordingly.

10Security

LIS implements and maintains appropriate technical and organizational security measures designed to protect PDPI from unauthorized access, disclosure, alteration, loss, or destruction, taking into account the nature of the data, the risks involved in its processing, and the state of the art in data security practices. These measures include, but are not limited to, encryption at rest and in transit, access controls, authentication mechanisms, and regular security assessments. Further detail on LIS’s security program is available in its Security & Compliance documentation.

LIS’s primary cloud infrastructure is hosted within the European Economic Area, providing a secure and resilient environment for the storage and processing of PDPI relating to EU and UK Customers. LIS’s authorized sub-processors are subject to equivalent security obligations by contract.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of Data Subjects, LIS will notify affected Customer Controllers and, where required by applicable law, the relevant supervisory authority, without undue delay and within the timeframes required by applicable law. Where the parties have executed a Data Processing Addendum, the specific notification procedures and timelines set out therein shall apply.

11Age Requirements

LIS’s services and platforms, including the AgileBrain assessment tool and any associated mobile applications, are intended for use by individuals who are at least 16 years of age. LIS does not knowingly collect, solicit, or process Personal Data from individuals under the age of 16, except where the platform is deployed by or on behalf of a Customer under a written agreement that expressly permits such use.

Where the platform is deployed to participants under the age of 16 under a Customer agreement, LIS processes Personal Data in accordance with the applicable agreement, any applicable Data Processing Addendum, and this Privacy Policy. The Customer is responsible for the deployment choices, participant communications, and use of the platform that are within the Customer’s control. Each party remains responsible for the obligations allocated to it under the applicable agreement and applicable law.

If LIS becomes aware that it has inadvertently collected Personal Data from an individual under the age of 16 outside of an authorized Customer deployment, it will take prompt steps to delete that data. If you believe LIS may have collected such data in error, please contact privacy@leadingindicator.com.

12Data Subject Rights

Subject to applicable law and any limitations set out therein, Data Subjects may have the following rights with respect to their PDPI held by LIS:

• Right of Access: The right to obtain confirmation as to whether LIS processes PDPI about you and, if so, to receive a copy of that data and information about how it is processed.
• Right to Rectification: The right to request correction of inaccurate or incomplete PDPI.
• Right to Erasure: The right to request deletion of your PDPI where it is no longer necessary for the purpose for which it was collected, where consent has been withdrawn, or where processing is otherwise unlawful.
• Right to Restriction of Processing: The right to request that LIS restrict the processing of your PDPI in certain circumstances.
• Right to Data Portability: The right to receive your PDPI in a structured, commonly used, and machine-readable format and, where technically feasible, to request its direct transfer to another controller.
• Right to Object: The right to object to processing of your PDPI based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Rights in Relation to Automated Decision-Making: The right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to applicable exceptions under law.

How to exercise these rights depends on the context in which your PDPI was processed. If your PDPI was processed in connection with an assessment administered by an employer, educational institution, or other organization on whose behalf LIS was acting, including where a Practitioner accessed the platform as an employee or authorized agent of that organization, your rights request should be directed to that organization as the Data Controller. If your PDPI was processed in connection with a Practitioner acting as an independent Data Controller pursuant to a direct agreement with LIS, you may direct your request to that Practitioner or to LIS at privacy@leadingindicator.com, and LIS will respond or assist as appropriate under applicable law. For all other requests — including those relating to LIS’s own marketing communications or website — please contact LIS directly using the details in Section 16.

Please note that where an assessment was conducted on a fully anonymous basis, LIS holds no Personal Data attributable to any individual, and individual data subject rights cannot be exercised in respect of that assessment.

13Choice and Opt-Out

LIS does not disclose PDPI to third parties for their independent marketing or commercial purposes. Where LIS processes PDPI for its own marketing communications, individuals may opt out at any time by following the unsubscribe instructions in any such communication or by contacting LIS at the address in Section 16.

In organizational and educational deployments, the Customer is responsible for communicating to participants the nature and purpose of the assessment and any applicable participation choices, in accordance with its own privacy obligations and applicable law. LIS administers the assessment as instructed by the Customer.

In deployments involving professional or coaching services provided by a Practitioner acting as an independent Data Controller, the Practitioner is responsible for informing their clients about how assessment data will be used and for obtaining any necessary consents prior to administering an assessment. Where a Practitioner operates under a Customer’s Master Services Agreement, the Customer remains responsible as Data Controller for communicating with participants regarding the nature and purpose of the assessment and any applicable participation choices.

Individuals who believe their PDPI has been handled in a manner inconsistent with this Policy may contact the LIS Data Privacy Officer to raise a complaint.

14Cookies and Tracking Technologies

LIS’s website(s) and digital platforms use cookies and similar tracking technologies to support site functionality, measure traffic and usage patterns, and improve the user experience. Individuals are presented with a cookie consent notice when visiting the AgileBrain website and, where required by applicable law, are given the opportunity to accept or decline non-essential cookies prior to their use.

Individuals may also manage cookie preferences through their browser settings at any time. Please note that disabling certain cookies may affect the functionality of LIS’s website or platform. To the extent that LIS’s use of cookies constitutes processing of Personal Data under applicable law, such processing is conducted in accordance with this Policy.

Do-Not-Track Signals: Some web browsers and mobile operating systems include a Do-Not-Track (“DNT”) feature that signals a user’s preference not to have browsing activity monitored. There is currently no uniform technical standard for recognizing or implementing DNT signals, and LIS does not currently alter its data collection or use practices in response to DNT signals. If a uniform standard is adopted in the future, LIS will update this Policy accordingly. Where required by applicable US state privacy law, LIS recognizes universal opt-out preference signals such as the Global Privacy Control (“GPC”) as a valid request to opt out of the sale or sharing of personal information; because LIS does not sell or share personal information, no additional action is taken in response to such signals.

15Compliance and Enforcement

15.1 Data Privacy Framework Dispute Resolution

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, LIS commits to resolve complaints about its collection and use of PDPI transferred to the United States pursuant to those frameworks. EU, UK, and Swiss individuals with inquiries or complaints should first contact LIS at: privacy@leadingindicator.com.

LIS has further committed to refer unresolved DPF complaints to BBB National Programs, a U.S.-based independent dispute resolution mechanism. If your complaint is not satisfactorily addressed by LIS, please visit www.bbbprograms.org/dpf-complaints for further information and to file a complaint. This service is provided free of charge.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, LIS commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs), the UK Information Commissioner’s Office (ICO), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning human resources data received in reliance on those frameworks.

If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration. Please see Annex I of the DPF Principles at https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf for further information.

15.2 Regulatory Oversight

LIS is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC) and other authorized U.S. statutory bodies with respect to its compliance with applicable data protection law and the DPF Principles.

EU citizens who do not receive timely acknowledgment of a complaint, or whose complaint is not satisfactorily resolved by LIS, may contact the European Data Protection Board (EDPB) via the supervisory authority of their Member State. A list of EU supervisory authorities and their contact details is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en.

15.3 United States Residents — State Privacy Rights

Residents of certain US states have specific rights regarding their personal information under applicable state privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act (California), the Colorado Privacy Act, the Connecticut Data Privacy Act, the Virginia Consumer Data Protection Act, the Texas Data Privacy and Security Act, and equivalent laws in other states where LIS does business or where participants and users are located.

Depending on your state of residence, these rights may include the right to know what personal information LIS collects about you and how it is used and shared; the right to access and obtain a copy of your personal information; the right to request correction of inaccurate personal information; the right to request deletion of your personal information; the right to opt out of the sale or sharing of personal information or its use for targeted advertising; the right to non-discrimination for exercising your privacy rights; and, where applicable, the right to appeal a decision by LIS regarding a rights request.

LIS does not sell personal information to third parties and does not use personal information for targeted advertising purposes. LIS does not use assessment response data to create behavioral advertising profiles.

To exercise any of these rights, please contact LIS at privacy@leadingindicator.com or via https://agilebrain.com/contact-us/. LIS will respond within the timeframe required by applicable law, and in any event within thirty (30) days of receipt of a verifiable request, with a possible extension of a further thirty (30) days where reasonably necessary and permitted by applicable law.

LIS does not disclose personal information to third parties for their own direct marketing purposes. California residents who wish to confirm this or make a request under California Civil Code Section 1798.83 (the “Shine the Light” law) may contact LIS using the details in Section 16.

16Contact Information

Questions, concerns, or requests relating to this Policy — including requests to exercise Data Subject rights — should be directed to the LIS Data Privacy Officer:

EEA and UK Residents: If you are located in the European Economic Area or the United Kingdom and have questions about this Policy or LIS’s handling of Personal Data, you may contact LIS directly at privacy@leadingindicator.com or via https://agilebrain.com/contact-us/.

LIS will acknowledge receipt of all privacy-related requests promptly and will respond within the timeframes required by applicable law, and in any event within thirty (30) days of receipt.

17Changes to This Policy

LIS reserves the right to modify or amend this Policy at any time to reflect changes in applicable law, LIS’s business practices, or the services LIS provides. Where changes are material, LIS will provide reasonable advance notice by posting the updated Policy to its website and, where appropriate, notifying affected Customers, Practitioners, Subscribers, or individuals directly. The “Last Updated” date at the top of this Policy reflects the date of the most recent revision.