Privacy Notice — Regain, Inc.

Effective: 21 October 2026

This Notice explains how Regain, Inc. ("Regain", "we", "us") handles personal data on:

• regained.tech, our website, including its data room, and its mirror www.regain.ai;
• demo.regained.tech, the public demo of MISS, our medical information system;
• app.regained.tech, the MISS staff app that clinics use;
• health.regained.tech, the MISS patient portal.

The Instagram and WhatsApp messages that MISS receives for clinics have their own policy, the Regain MISS Messaging Privacy Policy.

1. Who we are

Regain, Inc. is a Delaware corporation. Its registered address is 651 N Broad St, Suite 201, Middletown, DE 19709, United States (the address of our registered agent). Contact for anything in this Notice: anton@regain.ai.

Salomatic, LLC, a company of the Republic of Uzbekistan, is our affiliate in Uzbekistan. It licenses MISS to Regain, Inc. and employs the engineering team that builds and runs MISS.

2. Our role: for clinics, and on our own account

Data in MISS belongs to the clinic. When a clinic or other healthcare organisation (a "customer") uses the staff app or the patient portal, the customer decides why and how its staff's and patients' data is used. We, or Salomatic, LLC where it is the party to that customer's contract, process that data for the customer, on its instructions and under our agreement with it. If you are a patient of a clinic that uses MISS, the clinic's own privacy notice applies to your record; please ask the clinic first, and we will help it answer you.

On our own account, Regain is responsible for the data of visitors to regained.tech and the public demo, for the people who write to us, and for the accounts of our own staff.

3. What we collect, and why

The website, regained.tech

• Server logs. Our web servers record the address your browser connects from, the page requested, the time and the browser's own description of itself, to run and secure the site. We keep these logs only as long as needed for that purpose, then delete them.
• Forms and e-mail. If you send us a form, such as the pricing page's request for a proposal, or write to us, we receive what you enter, such as your name, e-mail address, organisation and message, and use it to answer you. Form requests are kept in our own customer records in MISS.
• Pricing page measurement. On the pricing page our own code counts page views and which calculator controls and buttons are used, to see how the page works. It sets no cookie and keeps no lasting identifier: its identifiers live in your browser tab and end with it. It sends no text you type. We keep the country your connection comes from, but not your IP address or your browser's description. It switches off when your browser sends Do Not Track or Global Privacy Control. The measurement goes to our own MISS server, not to an analytics company.
• Asking the audio briefing a question. The site's audio briefing lets you "Ask the studio". The question you type is sent to an AI model to write an answer, and the answer to a speech service to read it aloud; those providers are listed in section 5. If you speak your question, your browser turns your speech into text with its own speech service, which some browsers run through their maker. We use your question only to answer it and do not store its text; we record that a question was asked, for our AI costs. Our servers use your IP address, for up to a day, to limit how many questions can be asked.
• Videos. Some pages, such as the demo videos and the patient app page, show videos hosted on YouTube. When a page shows a YouTube player or its preview image, your browser connects to YouTube (Google), which receives your IP address and your browser's description and handles them under its own privacy policy. The players load from YouTube's privacy-enhanced domain, youtube-nocookie.com.
• The data room. A short-lived cookie (section 4) remembers whether the data room is open. We do not ask who you are to read it.

Apart from the YouTube videos above, the website uses no advertising, analytics or tracking service from another company.

The public demo, demo.regained.tech

• The demo holds synthetic data only. Every clinic, patient and record in it is invented. Please do not enter real personal or health data into it.
• You enter the demo with a demo account we provide; we do not ask who you are.
• We record how the demo is used, to improve the product. On demo.regained.tech and app.regained.tech, while you use a demo account, we record the pages you open, what you click, the time you spend on each page, the site that referred you and the language, and a replay of the screen as you use it. Everything you type into form fields, text editors and the AI assistant's panel is masked in the replay. With each event we store your IP address, the country it belongs to and your browser's description. A random visitor identifier is kept in your browser's local storage, so that we can tell return visits apart; you can clear it in your browser at any time. Browsers that identify themselves as automated are not recorded, and the patient portal records none of this. The recordings are kept in our own database, not sent to an analytics company.
• How long: screen recordings are deleted after 90 days. The other usage records are kept only as long as needed to improve the product, then deleted.

The staff app, app.regained.tech

• Staff accounts: name, work e-mail, role, the organisation you belong to, sign-in credentials and second-factor settings, and a security log of actions taken in MISS. We use them to let you in, to show you only what your role allows, and to keep a record of who did what.
• Clinic data: whatever the clinic puts in MISS, such as patient records, appointments, laboratory results and payments. We process it for the clinic, as section 2 says.

The staff app's sign-in page also opens the public demo; while you are in a demo account, the demo section above applies.

The patient portal, health.regained.tech

The portal shows a patient their record at a clinic that uses MISS. It is offered by the clinic, and we process its data for the clinic (section 2). You sign in with the method your clinic has set up.

4. Cookies and browser storage

We use these cookies:

• The sign-in session (staff app, patient portal, demo): keeps you signed in. It expires 7 days after it was last renewed; using the app renews it.
• The sign-in cache (staff app, patient portal, demo): holds a copy of your session so that each page loads faster, for 5 minutes.
• NEXT_LOCALE (staff app, patient portal): remembers your language, until you close the browser.
• dataroom_state (the data room on regained.tech): remembers whether the data room is open, for 10 minutes.
• regain_edition (regained.tech): if the site suggests our site for your region and you answer, it remembers your answer, for 1 year.
• patient_tz and patient_launch_locale (patient portal): remember your time zone and the language the portal opens in, for 1 year.
• Short-lived technical cookies (staff app, demo): for example, one that links the AI assistant to the browser tab you use it in, until you close the browser, and one that stops a redirect loop when you open the demo, for 1 minute.

And this browser storage:

• Visitor and visit identifiers in local and session storage (demo), which tell demo visits apart (section 3), until you clear them or the visit ends.
• Visit identifiers in session storage (the pricing page), which end with the browser tab.
• Settings and working data in the staff app and the patient portal, kept on your device in your browser's storage: for example your display preferences, unsent work, and the data they keep so that they can keep working when the connection drops. Clearing your browser's data for the site removes it.

None of these is used for advertising. They are needed for the services to work, except the demo identifiers and the pricing page's visit identifiers, which serve product measurement.

5. Who else processes the data

We use these companies to run the services. Each processes data to provide its service to us, under its terms with us.

• Amazon Web Services hosts the website, the demo, the staff app and the patient portal in its Europe (Frankfurt) region, eu-central-1, Germany. It also runs some of the AI models (Amazon Bedrock) and speech services that MISS uses.
• AI and speech providers, used by MISS's AI features and by the audio briefing. The current list, with the region each one processes in, is on our subprocessors page.
• Providers that deliver e-mail and text messages, when a feature sends you one, for example a sign-in code.
• Telegram, only if you choose to sign in or receive messages through it, under Telegram's own terms.
• YouTube (Google), for the videos on the website (section 3).

We do not sell personal data and we do not use it for advertising.

6. International transfers

Our servers are in Germany. Some providers process requests in the United States or in other regions, as our subprocessors page says. Our engineering team works in Uzbekistan and may access data from there to build, run and support the services. Your data may therefore be processed outside the country where you live. Where the law that applies requires safeguards for such a transfer, we put them in place as that law requires. You can ask us about them at anton@regain.ai.

7. How long we keep data

We keep personal data only as long as needed for the purpose we collected it for, then delete it. In particular:

• Clinic data: for as long as the customer's contract says, then deleted or returned as the customer instructs.
• Messages and form requests to us: as long as needed to answer them and follow up, then deleted.
• Demo screen recordings: 90 days (section 3).
• Deleted data may remain for a limited time in backup copies, until those copies expire.

8. Your choices and rights

You can contact us at anton@regain.ai to exercise your rights under the law that applies to you, for example to ask for a copy of your data, to correct it or to delete it. If the data is part of a clinic's record, we pass your request to the clinic, which decides, and help it answer. Depending on where you live, you may also have the right to complain to a data protection authority.

9. Children

The website and the demo are not meant for children. A clinic may hold records of children in MISS; it decides how they are handled, including whether a child's legal guardian may use the patient portal for them.

10. Security

Data is encrypted in transit. Access is limited by role and by organisation, so that each clinic and each user sees only what they are allowed to see, and actions in MISS are logged. No system is completely secure. If a security incident affects personal data, we tell the people and authorities we must tell, as the law and our contracts require.

11. Changes to this Notice

When this Notice changes, we update it on this page and change the effective date. Customers with a contract are told of changes as their contract says.