Consumer Health Data Privacy Policy

About This Policy

This Consumer Health Data Privacy Policy explains how Ucardia, Inc. ("Ucardia," "we," "us," or "our") collects, uses, shares, and protects "consumer health data" as defined by the Washington My Health My Data Act, Nevada's consumer health data law (SB 370), Connecticut's consumer health data provisions, and similar state laws. It supplements our Privacy Policy, which covers all of our privacy practices, and our Notice of Privacy Practices.

Consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. This Policy does not apply to protected health information governed by HIPAA, to information covered by other health privacy laws that these state laws exempt, or to de-identified data.

Consumer Health Data We Collect

Depending on how you use the Services, we may collect:

• Health goals, conditions, symptoms, medications, and health history you choose to share.
• Measurements and biometric readings from you or your connected devices and apps, such as heart rate, blood pressure, weight, body composition, glucose, sleep, steps, and workouts.
• Nutrition, exercise, and habit logs, questionnaire answers, and assessment results.
• Lab results and other files you upload.
• Messages, session recordings, transcripts, and notes from your interactions with our Care Team, your Sponsor's staff, and Arny, our AI coach.
• Information about your use of health-related services, such as program enrollment, session attendance, and purchases of health products or devices.
• Inferences about your health status that we or our AI features derive from the information above.

We do not use geofencing around health care facilities, and we do not collect precise location to infer that you are seeking health care.

Why We Collect and Use It

We collect and use consumer health data to:

• Provide the Services you request, including your app, coaching, nutrition support, care plans, insights, Arny, and sessions.
• Support the program you joined through your Sponsor, such as your gym, employer, practice, or research study.
• Communicate with you about your account, sessions, and care.
• Keep the Services safe and secure, review quality, and train and supervise our care team.
• Create de-identified and aggregated data, as permitted by applicable law, to improve our Services and AI, support research, and protect our legal rights.
• Comply with law and respond to legal process.

We collect and use consumer health data only as necessary to provide the products and services you request, or with your consent. Where we need your consent, we ask for it clearly and separately.

Where It Comes From

• You, when you create an account, enter information, upload files, or communicate with us.
• Devices and apps you choose to connect, such as Apple Health, Android Health Connect, and wearable and device partners.
• Your Sponsor, to confirm eligibility and support your program.
• Our Care Team and AI features, which create notes, summaries, and insights.

Who We Share It With

We share consumer health data only as necessary to provide the Services you request, or with your consent. We share it with these categories of third parties:

• Your Sponsor and its authorized staff, as described in our Privacy Policy and when you enroll.
• Health coaches, registered dietitians, and healthcare providers who support you.
• Service providers that act on our behalf (processors), such as cloud hosting, data storage, video sessions, text messaging, device integrations, e-prescribing, payment processing, customer support, and security providers.
• Research institutions, if you join a study and consent to sharing.
• Third parties you direct us to share with, such as apps you connect.
• Government authorities or others when required by law.

Ucardia does not currently have affiliates with which it shares consumer health data. We do not sell consumer health data.

Your Rights

Depending on where you live, you have the right to:

• Confirm whether we collect, share, or sell your consumer health data, and access that data.
• Get a list of all third parties and affiliates with which we have shared your consumer health data, and an active email address or other online way to contact them.
• Withdraw your consent to our collection and sharing of your consumer health data.
• Have your consumer health data deleted. When you ask, we will delete it from our records, including backups within six months, and tell our processors and the third parties we shared it with to delete it too.
• Appeal our decision if we deny your request.

We will not discriminate against you for using these rights.

How to Use Your Rights

Email privacy@ucardia.com or call 833-617-1926 (toll free). We will verify your identity before responding and will respond within 45 days, which we may extend once by another 45 days when reasonably necessary; we will tell you if we do. If we deny your request, you may appeal by emailing privacy@ucardia.com with "Appeal" in the subject line. We will respond to your appeal within 45 days and explain our decision. If your appeal is denied, you may contact the attorney general of your state; Washington residents can file a complaint at www.atg.wa.gov/file-complaint.

If you joined Ucardia through a healthcare organization, information we hold on its behalf may be governed by HIPAA instead. We will let you know and help direct your request.

How We Protect It

We limit access to consumer health data to the employees, contractors, and service providers who need it, and we protect it with administrative, technical, and physical safeguards described in our Privacy Policy.

Changes and Contact

We may update this Policy from time to time and will post changes here with a new "Last Updated" date. Questions? Contact privacy@ucardia.com or Ucardia, Inc., Attn: Privacy, 1910 Pacific Ave, Suite 2000-1741, Dallas, TX 75201.