Privacy Policy

1.Who We Are

Sensory Solutions LLC (“Sensory Solutions,” “Merfi,” “we,” “our,” or “us”) provides the Merfi comfort companion device and mobile application (the “App”) designed to help families support sensory regulation and behavioral transitions.

For privacy inquiries, contact us at:

2.Scope of This Policy

This Privacy Policy applies to:

• The Merfi mobile application (iOS and Android)
• Our website and any related online services
• Information collected through the Merfi companion device
• Communications between you and Sensory Solutions

This Policy does not apply to third-party websites or services linked from our App. Please review the privacy policies of those services separately.

3.Information We Collect

3.1 Information About Parents and Caregivers (Adults)

When you create an account or use our services, we collect:

• Your first and last name, email address, and account password
• Your telephone number, if you provide it
• The clinic enrollment code you used to register
• Device type, operating system, and app version
• Usage data: features accessed, session duration, app interactions
• Customer support communications

3.2 Information About Children Under 13 (COPPA-Protected)

With verifiable parental consent (described in Section 5), we collect a limited set of information generated by your child's use of the device and App. We do not collect your child's name. This information is stored under a pseudonymous account identifier rather than your child's identity:

• Caregiver-reported observations you choose to record about transitions — for example, how smoothly a transition went, how long it took, and the type of activity involved
• Device and app interaction data: cues triggered, countdowns started and completed, connection events, and battery level
• Session timestamps and duration
• Responses to surveys and feedback instruments, if and when we offer them

3.3 Automatically Collected Information

Our App automatically collects certain technical information to operate the service:

• App crash reports and diagnostic data
• Aggregate, anonymized usage statistics

4.How We Use Your Information

4.1 To Provide and Improve the Service

• Operate, maintain, and improve the Merfi App and device
• Deliver the transition cues and reminders you configure
• Provide customer support and respond to inquiries

4.2 Internal Analysis

Most program data we hold is pseudonymous — it is stored under an account identifier rather than your child's name. Because we maintain the link between an account and the parent who created it, we can still associate this data with your family, so we treat it as identifiable information and protect it accordingly.

Before we describe results outside the company, we aggregate and strip the data so it cannot reasonably be used to identify any individual child or family. We use such aggregated, de-identified data for:

• Product development and improvement
• Understanding broad patterns in sensory-support effectiveness
• Describing platform outcomes in aggregate form

We do not currently conduct human-subjects research and we do not publish research findings from your data. If that changes, we will ask for your separate written consent first. Any de-identified data we share externally will not contain information that identifies your child or your family.

4.3 Communications

• Send you service-related notifications (account updates, security alerts)
• Send you optional newsletters or product updates (you may opt out at any time)

We never send communications to children.

5.COPPA Compliance — Children's Privacy

5.1 Parental Consent Process

Before we collect any personal information about a child under 13, we obtain verifiable parental consent directly from the child's parent or legal guardian. Our consent process includes:

• You create your account with your own email address, and review and accept our Terms of Use and Privacy Policy
• You complete email verification by clicking the link we send to that address

Both steps must be complete before any data is collected, stored, or processed. We record which version of each document you accepted, and when.

If you receive a Merfi device, you also sign a separate Parent & Guardian Agreement before the device ships. That agreement covers your use of the device and your continued participation.

Where a therapy clinic or school introduces a family to Merfi, the clinic simply refers the parent to us — the parent still contracts and provides consent directly with Sensory Solutions. Clinics do not provide us with information about your child, and clinical staff do not have access to your child's data through the App.

5.2 Parental Rights Under COPPA

As a parent or guardian, you have the right to:

• Review the personal information we have collected about your child
• Request that we delete any or all personal information about your child
• Refuse to permit further collection of your child's information (by deleting your account)
• Consent to collection and use of your child's information without agreeing to disclosure to third parties

To exercise these rights, contact us at contact@getmerfi.com with the subject line “COPPA Request.” We will respond within 10 business days.

5.3 No Behavioral Advertising to Children

We do not use children's personal information for behavioral advertising, targeted marketing, or any commercial purpose beyond providing and improving the Merfi service.

6.How We Share Information

6.1 We Do Not Share Your Data With Your Clinic

Your participating clinic does not have access to your account, your child's behavioral data, your survey responses, or your device records. A clinic coordinator can see only their own clinic's enrollment record and reports the coordinator writes themselves. This is enforced by our database access rules, not just by policy. We will not give any clinic or clinician access to your data without first obtaining your separate written authorization.

6.2 Service Providers

We work with trusted third-party service providers who process data on our behalf. All service providers are contractually required to protect your information and may only use it to provide services to Sensory Solutions. These include:

• Google Firebase (authentication, database, hosting, and push notifications)
• Our online store provider for device purchases — we do not store payment card data
• Customer support and email delivery tools

6.3 Legal Requirements

We may disclose information if required by law, court order, or government request, or to protect the rights, property, or safety of Sensory Solutions, our users, or the public.

6.4 Business Transfers

If Sensory Solutions is involved in a merger, acquisition, or sale, user information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

6.5 We Do Not Sell Data

We do not sell, rent, or trade personal information — including any information relating to a child — to any third party for any commercial purpose. Period.

7.Data Security

We implement technical and organizational safeguards to protect your information:

• Encryption in transit (TLS 1.2+) for all data transmitted between the App, device, and our servers
• Encryption at rest for all data stored in our databases
• Access controls: behavioral records are readable only by you and by authorized Sensory Solutions administrators, enforced by server-side database rules rather than by the app alone
• Identifying account information is stored separately from behavioral records
• Incident response plan: we will notify affected users within 72 hours of discovering a confirmed data breach

No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

8.Data Retention

We retain personal information for as long as necessary to provide our services and comply with legal obligations:

• Identifying account information (name, email, telephone number): deleted within 30 days of account closure, revocation of your authorization, or expiration of that authorization
• Behavioral and device data: retained in pseudonymous form, separated from your identifying information, for up to 3 years from the date of collection, then deleted or permanently de-identified
• Signed consent forms: retained only as long as needed to document consent, and securely destroyed upon revocation or expiration of consent
• De-identified aggregate data: may be retained indefinitely for product improvement
• Records we are required by law to retain: kept for the required period

9.Your Choices and Controls

9.1 Account and Data Deletion

You may delete your account at any time through the App settings, by using our account deletion request page, or by emailing contact@getmerfi.com. Upon account deletion, we will delete or anonymize your personal information within 30 days, except where retention is required by law.

9.2 Marketing Communications

You may opt out of marketing emails at any time by clicking “Unsubscribe” in any marketing email or by contacting us directly.

9.3 Device Permissions

Our App may request access to certain device features (e.g., Bluetooth for device pairing, notifications). You may revoke these permissions at any time through your device settings, though doing so may affect App functionality.

10.Notice Regarding HIPAA

Sensory Solutions is not a Covered Entity under the Health Insurance Portability and Accountability Act (HIPAA), and in our current program we do not act as a HIPAA Business Associate. Merfi is a consumer behavioral-support tool, not a medical device.

We contract directly with parents and guardians, and the therapy clinics that introduce families to Merfi do not share protected health information (PHI) with us or through our platform. As a company that handles children's information outside of HIPAA, we apply strong safeguards and follow applicable federal and state privacy and breach-notification requirements, including COPPA.

11.California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: request disclosure of personal information we have collected about you
• Right to Delete: request deletion of your personal information
• Right to Correct: request correction of inaccurate personal information
• Right to Opt-Out: we do not sell personal information, so no opt-out is required
• Right to Non-Discrimination: we will not discriminate against you for exercising your rights

To exercise California privacy rights, contact us at contact@getmerfi.com with the subject line “CCPA Request.”

12.User Feedback, Suggestions, and Data Ownership

12.1 Assignment of Feedback and Suggestions

If you provide us with any suggestions, ideas, feedback, recommendations, bug reports, enhancement requests, or other input regarding the App, device, or Services (collectively, “Feedback”), you hereby irrevocably assign to Sensory Solutions, LLC all right, title, and interest throughout the world in and to such Feedback, including all intellectual property rights therein. This assignment is effective immediately upon submission. We may use, incorporate, modify, and commercialize Feedback without restriction, compensation, or obligation to you. We have no obligation to implement any Feedback or to attribute it to you as its source.

12.2 Ownership of Collected Data

As between you and Sensory Solutions, LLC, we exclusively own all right, title, and interest in and to all data collected through the App and Services, including behavioral and sensor data, device usage data, survey responses, report data, and aggregate or de-identified analytics derived from use of the App. This ownership applies to data collected during any pilot program and on an ongoing basis, and survives termination of your account. Our ownership does not override the retention and deletion commitments in Section 8 or in any Parent & Guardian Agreement you have signed. We collect and use this data as described in Sections 3, 4, and 6 of this Privacy Policy. We will handle all personal information, including information about children, in accordance with COPPA and other applicable law as described herein.

12.3 Survey and Report Data

All data collected through surveys, questionnaires, assessments, or feedback instruments administered through the App or by Sensory Solutions (whether in-App, via email, or in connection with a pilot or research program) is owned exclusively by Sensory Solutions, LLC. By submitting survey responses or completing assessment instruments, you irrevocably assign to us all rights in and to such data. We may use and analyze survey and report data for the purposes described in Section 4, and may describe results only in de-identified or aggregate form.

12.4 Improvements and Derivative Works

Any improvements, modifications, or derivative works of the App or Platform developed by or on behalf of Sensory Solutions, whether or not incorporating Feedback from users, are owned exclusively by Sensory Solutions, LLC. Users do not acquire any ownership, license, or rights in improvements to the App arising from their participation or Feedback.

13.Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Sending an email to the address associated with your account
• Displaying a prominent notice in the App

For changes that expand how we collect or use information relating to children, we will obtain fresh parental consent before the new practices take effect. Continued use of the App after notice of changes constitutes acceptance of the updated Policy.

14.Contact Us

For questions, requests, or concerns about this Privacy Policy or our data practices, contact:

Sensory Solutions LLC · Privacy Policy · Version 1.1 · Effective August 2026.