Privacy Policy for Serena Sleep Solutions

Effective Date: March 5, 2026

Serena Sleep Solutions (“we,” “us,” or “our”) is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (SerenaSleep.com), use our services, purchase our products (such as dental appliances for Sleep Apnea, Orthotics, Nightguards, accessories, and related sleep health solutions), or interact with us in any other way. This policy applies to all users, including patients, healthcare providers, and visitors.

We operate in the field of sleep health solutions, manufacturing dental appliances for Sleep Apnea, Orthotics, and Nightguards, which may involve handling sensitive health information. As such, we comply with applicable laws, including the Health Insurance Portability and Accountability Act (HIPAA) in the United States, where we handle protected health information (PHI). If you are a covered entity under HIPAA, our interactions may be governed by a separate Business Associate Agreement (BAA).

By using our website, services, or products, you consent to the practices described in this Privacy Policy. If you do not agree with this policy, please do not access or use our services.

1. Information We Collect

We collect various types of information to provide and improve our services. This includes:

a. Personal Information

• Contact Information – Name, email address, phone number, mailing address, and other details you provide when creating an account, placing an order, or contacting us.
• Account Information – Username, password, and preferences for our online portal or services.
• Payment Information – Credit card details, billing address, and other financial data processed through secure third-party payment processors (we do not store full credit card numbers).

b. Health and Medical Information (Protected Health Information – PHI)

• Patient Data – Medical history, sleep study results, prescriptions, impressions, models, digital scans, bite registrations, and other health-related information provided by you or your healthcare provider for customizing sleep appliances or providing treatment recommendations.
• Treatment Data – Information about your use of our products, such as device usage logs (if applicable to connected devices) or feedback on treatment outcomes.

This information is collected only with your explicit consent or as necessary to provide our services and is handled in compliance with HIPAA.

c. Automatically Collected Information

• Usage Data – IP address, browser type, device information, pages visited, time spent on pages, and referral sources when you interact with our website.
• Cookies and Tracking Technologies – We use cookies, web beacons, and similar technologies to track user behavior, personalize content, and analyze website performance. You can manage cookie preferences through your browser settings.

d. Information from Third Parties

• Data from healthcare providers, partners, or affiliates (for example prescriptions from doctors or data from integrated sleep tracking apps).
• Aggregated or anonymized data from public sources or analytics providers.

We do not collect information from children under 13 years of age. If we become aware that we have collected such information, we will delete it promptly.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing Services – To process orders, customize and manufacture sleep appliances, fulfill prescriptions, and deliver products.
• Healthcare and Treatment – To support sleep health treatments, including device fitting, warranty claims, and follow-up care in compliance with HIPAA.
• Communication – To send order confirmations, shipping updates, appointment reminders, newsletters, or marketing materials (you can opt out at any time).

By providing your contact information such as your email address or phone number, you consent to our use of this data for promotional purposes, including sending you information about our products, services, special offers, and updates related to sleep health solutions. This consent allows us to inform you about advancements in dental appliances for Sleep Apnea, Orthotics, Nightguards, and related products. You may withdraw this consent at any time by opting out as described in the “Your Rights and Choices” section below.

• Payments and Billing – To process transactions and manage accounts.
• Improvement and Analytics – To analyze usage patterns, improve our products and services, and conduct research using anonymized data where possible.
• Compliance and Legal Obligations – To comply with laws, regulations, audits, or legal processes, report adverse events to regulatory bodies such as the FDA, or respond to government requests.
• Security and Fraud Prevention – To protect against unauthorized access, fraud, or security threats.

We may use de-identified or aggregated data for research, educational, or promotional purposes, ensuring that it cannot be linked back to you.

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share information in the following limited circumstances:

• Service Providers – With trusted third-party vendors such as payment processors, shipping companies, cloud storage providers, or manufacturing partners who assist us in operating our business.
• Affiliates and Partners – With our affiliates or healthcare partners such as doctors or laboratories to provide integrated services.
• Legal and Regulatory Requirements – To comply with laws, subpoenas, court orders, or regulatory requirements such as FDA reporting for medical devices.
• Business Transfers – In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new entity.
• With Your Consent – For any other purpose with your explicit permission.

For protected health information, we share data only as permitted under HIPAA, including treatment, payment, and healthcare operations.

4. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your information from unauthorized access, loss, or alteration. These measures include encryption, secure servers, access controls, and regular security audits.

However, no system is completely secure, and we cannot guarantee absolute security. In the event of a data breach involving protected health information, we will notify affected individuals and authorities as required under HIPAA.

5. Your Rights and Choices

You have certain rights regarding your information:

• Access and Correction – Request access to, correction of, or a copy of your personal information including protected health information.
• Deletion – Request deletion of your information, subject to legal retention requirements such as warranty or regulatory obligations.
• Opt-Out – Unsubscribe from marketing communications by clicking the unsubscribe link in emails or contacting us directly.
• Do Not Track – We do not respond to browser “Do Not Track” signals, but you may disable cookies through your browser settings.
• HIPAA Rights – If we hold your protected health information, you may request record amendments, restrictions on disclosures, or an accounting of disclosures under HIPAA.

To exercise these rights, contact us using the details below. We may verify your identity before processing requests. Requests are generally processed within 30 days or as required by law.

6. International Data Transfers

If you are located outside the United States, your information may be transferred to and processed in the United States. We implement appropriate safeguards for such transfers, including standard contractual clauses where required.

7. Retention of Information

We retain personal information only for as long as necessary to fulfill the purposes described in this policy or as required by law. For example, HIPAA requires retention of certain protected health information for at least six years. After that period, information is securely deleted or anonymized.

8. Children’s Privacy

Our services are not intended for children under the age of 18. We do not knowingly collect personal information from children. If you believe we may have collected such information, please contact us so that it can be removed.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Updates will be posted on our website with the revised effective date. Continued use of our services after changes indicates acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy, our privacy practices, or wish to exercise your rights, please contact our Privacy Officer:

• Email – info@serenasleep.com
• Mail – Serena Sleep Solutions, 592 Outpost Circle, Hudson, WI 54016, USA

For HIPAA-related inquiries, you may contact our HIPAA Compliance Officer at the same address.

This Privacy Policy is governed by the laws of the State of Wisconsin, United States.