Effective Date: May 14, 2026

Miru Pulse Inc. ("Miru Pulse," "we," "us," or "our") respects your privacy. This privacy policy (the "Privacy Policy") describes how we collect, use, disclose, retain, and protect Personal Information when you access or use any and all products, applications, websites, application programming interfaces, software development kits, content, materials, and services provided by Miru Pulse, whether now existing or developed in the future (collectively, the "Services").

This Privacy Policy is designed to comply with the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable Canadian and U.S. privacy laws. "Personal Information" means information about an identifiable individual, as defined in PIPEDA. This Privacy Policy is incorporated by reference into our Terms of Use. Terms not defined here have the meanings given in our Terms of Use.

References to "you" or "Customer" refer to the individual or entity using the Services. Where a Customer is a company, organization, or other legal entity, this Privacy Policy also applies to the individuals authorized by the Customer to use the Services ("Authorized Users").

1. Accountability

Miru Pulse is responsible for the Personal Information under our control. We have designated a Privacy Officer who is accountable for our compliance with this Privacy Policy and Canadian privacy laws. The Privacy Officer may be contacted at:

Privacy Officer, Miru Pulse Inc., Penetanguishene, Ontario, Canada. Email: info@mirupulse.com. Phone: 705-305-2357.

2. Purposes for Collection

We collect, use, and disclose Personal Information only for the purposes identified at or before the time of collection, including:

• providing the Services to you and your Authorized Users, including transcription, processing, and analysis of content you choose to share with us, and the generation of personal insights and AI-assisted coaching;

• managing your account, processing payments, and providing customer support;

• communicating with you about the Services, including service-related notices and, where you have consented, marketing communications;

• improving the accuracy and quality of the Services using only de-identified, aggregated patterns;

• protecting the security of the Services, detecting fraud, and enforcing our Terms of Use; and

• complying with applicable laws, regulations, and lawful requests from authorities.

We do not use Personal Information for purposes other than those identified at the time of collection without first obtaining your consent or as otherwise permitted by law. You may opt out of our use of your Personal Information for the improvement of the Services described above by contacting our Privacy Officer using the information in Section 17.

3. Consent

We obtain your consent before collecting, using, or disclosing your Personal Information, except where permitted or required by law. Your consent may be express (such as your acceptance of our Terms of Use or a feature-specific consent screen) or implied (such as your continued use of the Services after notice of changes to this Privacy Policy).

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting our Privacy Officer. Withdrawing your consent may prevent us from continuing to provide some or all of the Services to you.

4. Limiting Collection

We collect only the Personal Information that is necessary for the purposes identified in this Privacy Policy. Depending on how you use the Services, we may collect:

• information you provide directly, such as your name, email address, account credentials, billing information, and any content you choose to submit;

• technical and usage information, such as IP address, browser or device type, operating system, the pages or features you access, and the date and time of your activity;

• information about other individuals that you choose to include in content you submit, only to the extent necessary to provide the Services to you and only for the duration described in Section 6; and

• information from third parties you authorize, such as connected applications, authentication providers, or payment processors.

Where you submit content that contains information about other individuals (including audio or video that includes their voices), you are responsible under our Terms of Use for ensuring that you have the lawful right to share that content, for notifying every other party to the conversation where notification is required or reasonably expected under applicable law, and for obtaining the consent of those individuals where required by applicable law. Miru Pulse does not contact, profile, or market to individuals identified in your content.

Audio recordings

When you record a conversation or import an audio file, the audio is uploaded securely to our servers for transcription by a third-party speech recognition provider. Once transcription is complete, the audio file is permanently deleted from our servers. Only the text transcript is retained for analysis. We do not store or retain your raw audio recordings.

AI coaching conversations

Messages you exchange with our AI coaching companion are stored to maintain conversation continuity across sessions. These messages follow the same retention schedule as other active account data described in Section 6.

Coaching preferences

During onboarding, we ask you a small number of coaching preference questions. Your answers are stored and used to personalise your coaching experience.

Health data

If you choose to enable Apple HealthKit integration, we may access heart rate and heart rate variability data from Apple Health. This data is sent alongside your conversation uploads as structured context to enhance coaching insights. Health data access is entirely optional, requires your explicit permission in iOS Settings, and can be revoked at any time. We do not sell health data or use it for advertising purposes.

5. Limiting Use and Disclosure

We use and disclose Personal Information only for the purposes for which it was collected, except with your consent or as required or permitted by law. We may disclose Personal Information in the following circumstances:

• to service providers who perform functions on our behalf, including cloud hosting, transcription, payment processing, customer support, and security services, under written agreements that require them to protect your Personal Information consistent with this Privacy Policy;

Service providers and sub-processors

We engage the following categories of service providers who may process your Personal Information on our behalf:

Speech recognition provider — transcribes audio recordings with speaker identification. Audio is not retained by the provider after processing. Located in the United States.

AI analysis provider — analyses text transcripts for communication patterns, coaching insights, and speaker detection. Located in the United States.

Cloud infrastructure provider — hosts our backend services, database, and temporary audio staging. Located in the United States.

Text-to-speech provider(s) — generates voice output for the AI coaching companion. Only the text of the response is sent to the provider. Located in the United States.

Voice cloning provider — processes an optional user-initiated voice recording to create a personalised voice. Requires separate explicit consent at activation. Located in the United States.

Authentication provider — manages account creation and sign-in. Located in the United States.

• to a successor entity in connection with a merger, acquisition, financing, sale of assets, or other corporate transaction, provided that the successor assumes our obligations under this Privacy Policy;

• to comply with applicable laws, court orders, subpoenas, or other lawful requests from authorities; and

• with your consent or at your direction.

MIRU PULSE DOES NOT SELL PERSONAL INFORMATION IN EXCHANGE FOR MONETARY OR OTHER VALUABLE CONSIDERATION. MIRU PULSE DOES NOT USE PERSONAL INFORMATION OR CUSTOMER DATA (AS DEFINED IN OUR TERMS OF USE) TO TRAIN FOUNDATION LANGUAGE MODELS, AND DOES NOT USE INDIVIDUAL TRANSCRIPTS OR USER-FACING AI CONVERSATIONS AS TRAINING DATA FOR ANY MODEL WHOSE OUTPUTS ARE MADE AVAILABLE TO OTHER USERS.

6. Retention

We retain Personal Information only as long as necessary to fulfill the purposes for which it was collected, to comply with our legal and contractual obligations, and to resolve disputes.

Our standard retention periods are:

• active account data: while your account is active;

• Personal Information after account deletion or deletion request: deleted within thirty (30) days, except where we are required by law to retain it or where it has been irreversibly anonymized;

• backups: purged within ninety (90) days of the corresponding live data deletion;

• security and audit logs: retained for up to twelve (12) months, as required for the protection of the Services;

• billing and tax records: retained as required by applicable tax and accounting laws (typically seven (7) years); and

• anonymized and aggregated information: retained indefinitely, as it is no longer Personal Information.

When Personal Information is no longer required, we securely destroy, erase, or anonymize it in accordance with industry standard practices.

7. Accuracy

We take reasonable steps to ensure that the Personal Information we hold about you is accurate, complete, and up to date for the purposes for which it is used. You may update or correct your Personal Information through your account settings or by contacting our Privacy Officer.

8. Safeguards

We protect Personal Information with administrative, technical, and physical safeguards appropriate to its sensitivity. Our safeguards are designed in alignment with the SOC 2 Trust Services Criteria and include:

• encryption of Personal Information in transit using industry standard transport-layer protocols, and at rest using AES-256 encryption;

• role-based access controls and multi-factor authentication for access to Personal Information by our personnel;

• security assessments, vulnerability testing, and code review;

• employee training and confidentiality obligations regarding the protection of Personal Information;

• written agreements with our service providers requiring them to protect Personal Information consistent with this Privacy Policy; and

• documented incident response and breach notification procedures.

No method of transmission over the Internet or method of electronic storage is completely secure. While we use commercially reasonable means to protect Personal Information, we cannot guarantee absolute security.

Breach Notification

If we become aware of a breach of security safeguards involving Personal Information that creates a real risk of significant harm to you, we will notify you and report to the Office of the Privacy Commissioner of Canada (and, where required, to other applicable regulators) as soon as feasible after our determination that a notifiable breach has occurred, consistent with applicable law. We maintain a record of every breach of security safeguards involving Personal Information for at least twenty-four (24) months as required by PIPEDA.

9. Openness

This Privacy Policy is publicly available on our website at www.mirupulse.com/privacy. You may request additional information about our privacy practices by contacting our Privacy Officer.

10. Individual Access

Subject to limited exceptions under applicable law, you have the right to access, review, correct, and, where applicable law provides, request deletion of, the Personal Information we hold about you. You may also request information about how your Personal Information is used and disclosed.

To submit a request, contact our Privacy Officer. We may require you to verify your identity before processing your request. We will respond to your request within thirty (30) days, or within a longer period if permitted by applicable law and communicated to you in writing.

In some circumstances, we may be unable to provide access to Personal Information, such as where disclosure would reveal confidential commercial information, would reveal Personal Information about another individual, is protected by legal privilege, or could threaten the safety of another person. If we refuse a request, we will explain the reasons and inform you of your right to challenge the decision.

Requests by Individuals Other Than Account Holders

If you are not a Customer or Authorized User but believe that your Personal Information may have been submitted to the Services by a Customer (for example, if you were a participant in a conversation that was shared with the Services), you may contact our Privacy Officer. We will use reasonable efforts to locate any Personal Information about you in our records, will respond to your request consistent with this Section 10 and applicable law, and will, where appropriate, refer you to the Customer who submitted the content.

11. Challenging Compliance

You have the right to challenge our compliance with this Privacy Policy and applicable privacy laws. Complaints may be directed to our Privacy Officer, who will acknowledge receipt within five (5) business days and conduct a reasonable investigation. We will inform you of the outcome of our investigation and any corrective measures taken.

If you are not satisfied with our response, you may also contact:

• the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or 1-800-282-1376;

• the Office of the Information and Privacy Commissioner for British Columbia at www.oipc.bc.ca;

• the Office of the Information and Privacy Commissioner of Alberta at www.oipc.ab.ca;

• the Commission d'accès à l'information du Québec at www.cai.gouv.qc.ca (Quebec residents); or

• the privacy authority in your state or province of residence.

12. International Transfers

Your Personal Information may be processed and stored in Canada or in the United States, where Miru Pulse or our service providers operate. Where Personal Information is transferred outside your jurisdiction, we implement contractual and technical safeguards designed to ensure it remains protected consistent with this Privacy Policy. While outside your jurisdiction, Personal Information may be subject to lawful access requests by foreign government authorities.

13. Additional or Optional Features

Certain optional features of the Services may collect categories of Personal Information not described in this Privacy Policy or may impose additional handling requirements. Where this is the case, the additional terms presented to you at the time of activation will describe the relevant collection, use, retention, and disclosure practices. You are not required to use any optional feature; if you do not accept its terms, the optional feature will not be activated and the rest of the Services will not be affected.

Voice cloning

If you choose to enable voice cloning, a recording of at least sixty (60) seconds is sent to a third-party voice cloning provider to create a personalised voice for AI coaching responses. This feature requires separate, explicit consent at the time of activation. You may delete your cloned voice at any time in Settings, which will remove it from both our records and the provider's systems.

14. Jurisdiction-Specific Privacy Rights

Quebec Residents

If you are a resident of Quebec, you have additional rights under An Act respecting the protection of personal information in the private sector, as amended by Law 25, including:

• the right to be informed of the existence of and to access, rectify, and obtain information about Personal Information we hold about you;

• the right to be informed of the use of automated decision-making in connection with your Personal Information and, where applicable, to request a review of the decision;

• the right to data portability (to receive your Personal Information in a structured, commonly used technological format);

• the right to request that your Personal Information be deindexed or no longer disseminated where the conditions of Law 25 are satisfied; and

• the right to lodge a complaint with the Commission d'accès à l'information.

To exercise any of these rights, contact our Privacy Officer.

California Residents

If you are a resident of California, you have the rights described under the California Consumer Privacy Act and the California Privacy Rights Act, including the right to know, the right to delete, the right to correct, the right to limit use and disclosure of sensitive personal information, and the right to opt out of the sale or sharing of personal information. Miru Pulse does not sell personal information for monetary consideration. California residents may submit a Do Not Sell or Share My Personal Information request by contacting our Privacy Officer. To exercise any of your rights, contact our Privacy Officer.

Other U.S. State Privacy Rights

If you are a resident of Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, Virginia, or another U.S. state that grants specific privacy rights, you have rights that may include the right to access, correct, delete, and obtain a portable copy of your Personal Information, and the right to opt out of certain uses and disclosures. To exercise your rights, contact our Privacy Officer.

15. Children

The Services are not intended for, and may not be used by, individuals under the age of majority in their jurisdiction or under 18 years of age, whichever is greater. We do not knowingly collect Personal Information from minors. If we become aware that we have collected Personal Information from a minor, we will delete it promptly. If you believe that a minor has provided Personal Information to us, please contact our Privacy Officer.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated Privacy Policy on our website with a new Effective Date and notify you through the Services, by email, or by other reasonable means. Your continued use of the Services after the Effective Date of the updated Privacy Policy constitutes your acceptance of the updates, subject to applicable law.

17. Contact

If you have any questions about this Privacy Policy or our privacy practices, please contact our Privacy Officer:

Privacy Officer, Miru Pulse Inc., Penetanguishene, Ontario, Canada. Email: info@mirupulse.com. Phone: 705-305-2357.