Privacy Notice

Last Updated: April 30, 2025

Forian Inc. and our subsidiaries (collectively, “Forian”, “we“, “us” or “our”) prioritize the privacy and security of the information we process and maintain in the operation of our business and acknowledge the responsibility to process all Personal Data (as defined below) as described in this Privacy Notice (“Notice”). A list of Forian’s subsidiaries can be found in the List of Subsidiaries filed as Exhibit 21 to Forian’s most recent Annual Report on Form 10-K, available under the Investors tab of our website located at www.forian.com. This Notice describes how we process Personal Data about you that we collect through (i) our interactions with you, including our website located at www.forian.com as well as any other websites or applications operated and controlled by us from which you are accessing this Notice (the “Site”), or (ii) our license of data from third parties or as may be available from publicly available sources. See Section XIV.B. (CPRA) below for information about and our requirements under the CPRA with respect to California residents that we collect in the employment or independent contractor engagement contexts.

By accessing or using the Site or by interacting with us or providing your information to us, you agree to the terms and conditions of this Notice

I. Information We Collect

A. Personal Data

“Personal Data” is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual, such as: name, postal address, telephone number and email address.

We may collect and process the following Personal Data about you in the following ways:

Site. When you visit our Site, we may collect and process the following types of Personal Data:

Category of Information	Description
Personal Identifiers; Personal Records under Applicable Law	If you register to maintain an account with us, we will collect the information that you voluntarily provide when registering, which may include your username and password Information that you provide by filling in forms on the Site (contact forms) We may also ask you for information when you report a problem with the Site If you contact us, we may keep a record of that correspondence
Internet or Other Electronic Network Activity Information	IP address, approximate geographic location, browser and/or device information, access times and dates, reference site domain name when you visit the Site, information regarding customer traffic patterns and Site usage and other technical information such as protocol status and substatus, bytes sent and received and server information
Geolocation Data	Approximate geographic location

Solutions and Data Ecosystem. As part of our solutions and the data ecosystem we maintain, we process the following types of Personal Data that are licensed to us by third parties or available from publicly available sources:

FOR HEALTHCARE PROVIDERS WHOSE PERSONAL DATA (I) WE LICENSE FROM THIRD PARTIES OR (II) IS AVAILABLE FROM PUBLICLY AVAILABLE SOURCES
Category of Information	Description
Personal Identifiers	Name, email address, unique identification number assigned to your profession (such as NPI and license number)
Personal Records under Applicable Law	Name, email address, telephone number, educational background, employment, professional history
Characteristics of Protected Classifications under Applicable Law	Gender and year of birth
Professional or Employment-Related Information	Professional address, certification date, taxonomy, specialty, prescribing practices, educational background, professional history, participation in clinical trials, publications and publicly available collaborations between you and other professionals or companies in the healthcare context, the name, size and location of the company you work for and your role within it
Education Information	Educational background
Inferences	We collect inferences, such as your interests and engagement preferences, that may be drawn from the above identifiers

FOR CONSUMERS WHOSE PERSONAL DATA WE LICENSE FROM THIRD PARTIES
Category of Information	Description
Personal Identifiers	Name, postal address, unique personal identifier, email address or other similar identifiers
Personal Records under Applicable Law	Name, address, telephone number, date of birth, medical information, information about whether you’ve obtained medical insurance from a union, agent/broker, internet, whether you have long term care insurance, whether you alone have medical insurance
Characteristics of Protected Classifications under Applicable Law	Gender, racial or ethnic origin, age
Commercial Information	Products or services purchased, obtained or other purchasing or consuming histories or tendencies
Geolocation Data	Zip code
Professional or Employment-Related Information	Occupation Income/socioeconomic status
Sensitive Personal Data	Racial or ethnic origin, religious or philosophical beliefs, Personal Data collected and analyzed concerning a consumer’s health, Personal Data of a known child

Marketing. When you request to benefit from a particular feature or participate in a particular activity, such as when you sign up to receive emails from us or sign up for a newsletter, we collect the following types of Personal Data about you:

Category of Information	Description
Personal Identifiers; Personal Records under Applicable Law	Name and email address

Deidentified Data. We also process health-related information that has been certified by expert determination to meet the Health Insurance Portability and Accountability Act’s (HIPAA’s) de-identification standards such that the information is no longer considered protected health information or Personal Data subject to this Notice. We do not re-identify or attempt to re-identify any data that has been de-identified and similarly require that our customers covenant to not re-identify or attempt to re-identify any data that has been de-identified and is included in our solutions.

We may inform you of other Personal Data collected by or through the Site at the point of collection.

B. Information Collected Automatically

Traffic Data: Through your use of the Site, we may also gather certain information about your use of the Site automatically, including information that may identify your computer or device (“Traffic Data”). For example, we may collect your IP address, approximate geographic location, browser and/or device information, access times and dates, reference site domain name when you visit the Site and other technical information such as protocol status and substatus, bytes sent and received and server information. We may also collect information regarding customer traffic patterns and Site usage. We may also receive similar data from our website analytics providers. This Traffic Data is used to analyze and improve the Site and to provide our users with a fulfilling Internet experience.

Analytic Tools: We also use tools and third-party services to collect information about usage of the Site, including Google Analytics. To learn more about privacy and Google Analytics please consult the Google Analytics overview provided by Google at: https://www.google.com/intl/en/analytics/privacyoverview.html. Generally speaking, Google Analytics collects information on how often users visit the Site, what aspects of the Site they visit when they do so and what other websites users visited prior to accessing the Site. Google Analytics also collects information to allow us to analyze user purchasing activity. You may prevent your data from being collected and used by Google Analytics by opting out through the use of the Google Analytics Opt-out Browser Add-on.

We may combine your Personal Data with other information we have collected about you, whether on- or offline, including, for example, your purchase history or Traffic Data. However, please note that we do not combine Traffic Data or information about Site usage with the Personal Data of healthcare providers that are licensed to us by third parties or available from publicly available sources. We may also combine your Personal Data with information we receive about you from other sources, such as our subsidiaries, publicly available information sources and third parties from which we may license data (e.g., healthcare organizations, payers, medical claims clearinghouses, software providers, etc.). We treat the combined information as Personal Data.

II. How We Use Personal Data

We use Personal Data for the purposes described in this Notice and as otherwise described to you at the point of collection. Specifically, we may use Personal Data from or about you in the following ways:

For Site visitors:

For healthcare providers whose Personal Data (i) we license from third parties or (ii) is available from publicly available sources:

For consumers whose Personal Data we license from third parties:

III. Disclosure of Personal Data

We may disclose your Personal Data to third parties as described in this Notice or as otherwise described at the point where we collect the information about you, including:

For Site visitors:

For healthcare providers whose Personal Data (i) we license from third parties or (ii) is available from publicly available sources:
For consumers whose Personal Data we license from third parties:

Except for the Personal Data of healthcare providers that are licensed to us by third parties or available from publicly available source, Forian does not share your Personal Data with third parties for those third parties’ direct marketing purposes.

IV. Your Rights and Choices

You may opt out of receiving promotional e-mails from us by following the unsubscribe instructions provided in any such messages. Please note that if you opt out of receiving promotional messages from us, this does not impact other transactional and administrative messages which you will continue to receive (such as emails relating to changes to this Notice). If you have registered for an account with us, you may delete the account at any time by sending us an email at pr*****@****an.com.

V. Third Party Websites and Online Services

Our websites and solutions may contain links to other websites, applications, platforms and services maintained by third parties. The information practices of these third parties, including the social media platforms that host our branded social media pages, are governed by their privacy statements, which you should review to better understand their privacy practices. We do not control the use of Personal Data, cookies or the collection of information by these third parties, nor how they manage such information. The availability of, or inclusion of a link to or interface with, any third-party service on the Site does not imply endorsement of it by us or by our subsidiaries. Your use of those other sites and services is subject to the privacy policies of those sites and services and not this Notice.

VI. Do Not Track

This Site does not currently take any action when it receives a Do-Not-Track (DNT) request. DNT is a privacy preference that you can set in your web browser to indicate that you do not want certain information about your webpage visits collected across websites when you have not interacted with that service on the page. For details, including how to turn on Do Not Track, visit www.donottrack.us.

VII. Social Media

Some aspects of the Site may allow you to interface with other websites, social media and other online services. We will diligently work to identify these aspects of the Site to you, for example, by identifying them with the applicable third-party logos or trade names. By using these interfaces, you will allow us to access information about you from those other online services, including information and other content that you submit to those online services. If you interface with the Site through your social media account, we may contact you or enable you to share your experience and content via your social media account, which information may be publicly viewed by other users of those services. For a description on how such social media services and other third-party platforms, plug-ins, integrations and applications handle your information, please refer to their respective privacy policies and terms of use, which may permit you to modify your privacy settings with that service or platform.

VIII. Security

The security of your Personal Data is important to us and we are committed to handling that information carefully. We use reasonable and appropriate organizational, technical and administrative measures to protect Personal Data under our control. Unfortunately, no data transmission over the Internet or data storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you have with us has been compromised), please immediately notify us of the problem.

IX. Information Related to Minors

The Site is not intended for persons under the age of 18. We do not knowingly collect Personal Data online from persons in this age group. We reserve the right to delete any information identified as having been provided by such persons at our discretion.

X. Data Retention

We generally retain Personal Data for so long as it may be relevant for the purposes identified in this Notice or at the time the information is collected, unless a longer period of time is required by law.

XI. Changes to Our Notice

We may change this Notice from time to time. When we do, we will let you know by posting the changed Notice on this page with a new “Last Updated” date. In some cases, we may also tell you about changes by additional means, such as by posting a notice on the Site or sending an e-mail to the e-mail address we have on file for you.

XII. How to Access, Correct or Update Your Information

You can access or modify your information and modify your preferences by contacting us as indicated in Section XVI (Contact) below.

XIV. California Residents

A. Shine the Light

Certain of our solutions allow our customers to more effectively market their products and services to relevant healthcare providers. This Section XIV.A. with respect to California Civil Code Section 1798.83, also known as California’s “Shine the Light” law, shall apply solely to the Personal Data of healthcare providers that are licensed to us by third parties or available from publicly available source and that we make available to our customers as part of such solutions.

Under California’s “Shine the Light” law, California residents are entitled to request and receive, free of charge, once per calendar year, information about the Personal Data we shared, if any, with other businesses for their own direct marketing uses in the previous calendar year. To request a copy, please contact us at pr*****@****an.com. Please be aware that not all information sharing is covered by the “Shine the Light” law requirements and only information on covered sharing will be included in our response.

B. CPRA

The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CPRA”), provides California residents, including those acting in a commercial context, with specific rights regarding their Personal Data. The below applies to all California residents, including healthcare providers whose Personal Data is included in one or more of our solutions or within our internal data ecosystem, consumers whose Personal Data we license from third parties, as well as to our customers and Site visitors. The below describes such rights and how you may exercise such rights and our information practices, including the categories of Personal Data we collect, use, retain, disclose, sell or share and how and why we collect, disclose, sell or share such information.

This Notice does not apply to information about and our requirements under the CPRA with respect to California residents that we collect in the employment or independent contractor engagement contexts. Details on our privacy practices for the information about California residents that we collect in the employment and independent contractor engagement contexts can be found at: https://forian.com/caemployeeprivacynotice/.

Consumer Rights

Right to Know
You have the right to request that we disclose what Personal Data we collect, use, disclose, sell or share. Specifically, you may request that we disclose to you the following:

1. The categories of Personal Data we have collected about you.
2. The categories of sources from which the Personal Data is collected.
3. The business or commercial purpose for collecting, selling or sharing Personal Data.
4. The categories of third parties with whom we disclose Personal Data.
5. The specific pieces of Personal Data we have collected about you.

You may also request that we disclose to you:

1. The categories of Personal Data that we have sold or shared about you and the categories of third parties to whom the Personal Data was sold or shared, by category or categories of Personal Data for each third party to whom the Personal Data was sold or shared.
2. The categories of Personal Data that we disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose.

Right to Delete
You have the right to request that we delete any Personal Data about you which we have collected from you. If it is necessary for us to maintain your Personal Data for certain purposes, we are not required to comply with your deletion request. If we determine that we will not delete your Personal Data when you request us to do so, we will inform you and tell you why we are not deleting it.

Right to Opt-Out of Sale or Sharing of Personal Data
You have the right to direct a business that sells or shares Personal Data about you to third parties not to sell or share your Personal Data. To opt-out of having your information sold and shared please click “Do Not Sell or Share My Personal Information”.

Right to Correct Inaccurate Personal Data
You have the right to request a business that maintains inaccurate Personal Data about you to correct that inaccurate Personal Data, taking into account the nature of the Personal Data and the purposes of the processing of the Personal Data.

Right to Limit Use and Disclosure of Sensitive Personal Data
You have the right to direct a business that collects sensitive Personal Data about you to limit its use of your sensitive Personal Data (1) to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services; (2) for certain business purposes; and (3) as authorized by the implementing regulations of the CPRA. To limit the use and/or disclosure of your sensitive Personal Data, please click “Limit the Use and/or Disclosure of My Sensitive Personal Information”.

No Discrimination
You have the right not to be discriminated against because you exercised any of your aforementioned rights.

How to Submit a Request

To exercise the rights described above, you must submit a verifiable request to us. You can do so by calling us at 1-888-770-2072 or by visiting https://forian.com/privacy-consumer-requests/.

To submit a verifiable request, you will be asked to provide certain information to help us verify your identity. The information we ask you to provide to initiate a request may differ depending upon the type of request, the type, sensitivity and value of the Personal Data that is the subject of the request and the risk of harm to you that may occur as a result of unauthorized access or deletion, among other factors.

You may designate an authorized agent to make a request on your behalf by providing the agent with signed written permission to do so.

If we cannot verify your identity or authority to make the request, we will not be able to comply with your request. We will inform you if we cannot verify your identity or authority. We will only use Personal Data provided in a verifiable request to verify the requestor’s identity or authority to make the request.

How We Collect, Use, Disclose, Sell and Share Personal Data

Please see I.A. (Personal Data) above for the categories of Personal Data that Forian has collected, used, disclosed, sold or shared in the twelve (12) months prior to the effective date of this Notice.

Each of the above categories are disclosed for a business or commercial purpose as described in Section II (How We Use Personal Data) above to the third parties listed in Section III (Disclosure of Personal Data) above.

The categories of Personal Data that were sold or shared in the twelve (12) months prior to the effective date of this Notice can be separated into two groups: (i) the Personal Data of healthcare providers and (ii) the Personal Data of Site visitors. Please note that we do not sell or share the Personal Data of consumers whose Personal Data we license from third parties.

Certain of Forian’s solutions include limited Personal Data related to professional activities of healthcare providers who reside in California and, as a result, our provision of such solutions to our customers may constitute a “sale” under the CPRA. Such limited Personal Data include:

- Identifiers, such as name, alias, postal address, unique personal identifier, email address or other similar identifiers.
- Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), such as name, address, telephone number, education, employment or employment history.
- Characteristics of protected classifications under California or federal law, such as gender.
- Professional or employment-related information.
- Commercial information, such as records of products and services purchased, obtained or considered or other purchasing or consuming histories or tendencies.
- Inferences drawn from any of the information identified above.

We share or sell such information:

- To provide our products and services to our customers.
- To carry out our obligations arising from any contracts entered into between us and our customers.
- For research and analysis purposes.
- For our business purposes, such as data analysis, audits, developing new features and improving our products and services.
- As we believe to be necessary or appropriate: (a) under applicable law; (b) to comply with legal process; (c) to respond to requests from public and government authorities; (d) to enforce this Notice and our terms and conditions; (e) to protect our operations or those of any of our subsidiaries; (f) to protect our rights, privacy, safety or property and/or that of our subsidiaries, you or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.
- We may use non-personal, non-individual statistics or demographic information in aggregate form without restriction.

For Site visitors, we may sell or share the following categories of Personal Data:

- Identifiers, such as unique personal identifier, online identifier, Internet Protocol address or other similar identifiers.
- Internet or other electronic network activity information, including, but not limited to, browsing history, search history and information regarding a consumer’s interaction with an Internet Web site, application or advertisement.
- Geolocation data.

Such information is sold to our shared with our third-party website analytics and digital advertising service providers.

We share or sell such information:

- To provide the Site.
- To ensure that content from the Site is presented in the most effective manner for you and for your computer.
- To personalize our advertising, marketing communications and to deliver promotions and offers to you that we think may interest you.
- To prevent misuse or improper use of the Site.
- For our business purposes, such as data analysis, audits, developing new features, enhancing our Site, improving our products and services, identifying Site usage trends and determining the effectiveness of our promotional campaigns.
- As we believe to be necessary or appropriate: (a) under applicable law; (b) to comply with legal process; (c) to respond to requests from public and government authorities; (d) to enforce this Notice and our terms and conditions; (e) to protect our operations or those of any of our subsidiaries; (f) to protect our rights, privacy, safety or property and/or that of our subsidiaries, you or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.
- We may use non-personal, non-individual statistics or demographic information in aggregate form without restriction and we may share such information with our marketing partners, advertisers or other third-parties for analytics purposes.

Forian collects the Personal Data described above from or through the following categories of sources:

- You, directly and indirectly, including when you access the Site or when you purchase our products or services, register an account with us, subscribe to our newsletter or otherwise contact us;
- Service providers, including those that provide website analytics services to help us understand the activities taken on the Site;
- Our subsidiaries;
- Third parties from whom we license Personal Data;
- Healthcare organizations, payers, medical claims clearinghouses and software providers;
- Federal and state government organizations; and
- Publicly available information.

Forian will generally retain the Personal Data described above for as long as it may be relevant for the purposes identified in this Notice or at the time the information is collected, unless a longer period of time is required by law.

Personal Data of Minors

Forian does not have actual knowledge that it sells or shares Personal Data about minors under the age of 18.

California Privacy Rights Reporting

The table below reflects all requests received by us from California residents between January 1, 2024 and December 31, 2024:

Request Type	Total Number of Requests Received	Number of Requests Complied with in Whole or In Part*	Number of Requests Denied	Median Number of Days to Complete Requests**	Mean Number of Days to Complete Requests**
*Request to Delete*	—	—	—	—	—
*Request to Correct*	—	—	—	—	—
*Request to Know*	—	—	—	—	—
*Request to Opt Out of Sale/Sharing*	—	—	—	—	—
*Request to Limit*	—	—	—	—	—

* Requests may be unable to be completed due to factors like duplicate requests, the inability to verify the resident’s identity or lack of response.

** Time to complete a request may depend in part on receipt of information from the person making the request, such as information to verify the person’s identity or information about the action requested.

XV. Colorado, Maryland, New Jersey and Virginia

The below applies solely to Colorado, Maryland, New Jersey and Virginia consumers whose Personal Data we license from third parties.

The categories of Personal Data we process about you are set forth in Section I.A. (Personal Data) above. The purposes for processing such Personal Data are described in Section II (How We Use Personal Data) above. We disclose the Personal Data we process about you to the third parties and for the purposes listed in Section III (Disclosure of Personal Data) above.

If you are a resident of Colorado, Maryland, New Jersey and Virginia, you have the rights to:

- Confirm whether or not we are processing your Personal Data and access such Personal Data, including, for Maryland residents, a list of the specific third parties to whom we have disclosed your Personal Data, or if we do not maintain such information in a format specific to you, the third parties to whom we have disclosed Personal Data generally;
- Correct inaccuracies in your Personal Data, taking into account the nature of the Personal Data and the purposes of the processing of your Personal Data;
- Delete Personal Data obtained about you;
- Obtain a copy of your Personal Data we process, in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance, where the processing is carried out by automated means; and
- Opt-out of the processing of Personal Data for purposes of:

You may exercise these rights by calling us at 1-888-770-2072 or by visiting https://forian.com/privacy-consumer-requests/.

Only you may make a verifiable request related to your Personal Data. The verifiable consumer request must:

- Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Data; and
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We reserve the right to verify your identity in connection with any requests regarding Personal Data to help ensure that we provide the information we maintain to the individuals to whom it pertains and allow only those individuals to exercise rights with respect to that information. We cannot respond to your request or provide you with Personal Data if we cannot verify your identity or authority to make the request and confirm the Personal Data relates to you.

In the event we deny your request, you may appeal our denial by contacting us in the same manner by which you submitted your request.

As stated above, we do not process your Personal Data for the purposes of targeted advertising, sale or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

XVI. Contact

pr*****@****an.com
41 University Drive
Suite 400
Newtown, PA 18940
(888) 770-2072

About Forian

Forian provides innovative software solutions, proprietary data, and predictive analytics to optimize the operational, clinical, and financial performance of our healthcare customers.

Navigation

Contact

info@forian.com

41 University Drive
Suite 400
Newtown, PA 18940
(267) 225-6263