Consumer Health Data Privacy Policy

1. Introduction and Scope

This Consumer Health Data Privacy Policy (this “CHD Policy”) describes how Oriah Wellness LLC (“Oriah,” “we,” “us,” or “our”) collects, uses, shares, and protects “consumer health data” (“CHD”), and the rights you have with respect to that data. It is a supplement to our Privacy Policy, and any term not defined here has the meaning given to it in the Privacy Policy.

We provide this CHD Policy to address consumer health data as that term is defined under state laws including the Washington My Health My Data Act (“MHMDA”), Nevada Senate Bill 370, and the Connecticut Data Privacy Act (“CTDPA”). In general, “consumer health data” means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. To the extent your health information is governed by the Health Insurance Portability and Accountability Act (“HIPAA”) in connection with care provided by our independent, licensed providers, it is handled under those providers’ HIPAA Notice of Privacy Practices rather than this CHD Policy.

2. Categories of Consumer Health Data We Collect

Depending on how you interact with our Services, we may collect the following categories of consumer health data:

• Health conditions, symptoms, and status — health conditions, symptoms, diagnoses, and other indicators of your physical or mental health that you report or that are derived during your care.
• Treatments and interventions — information about treatments, protocols, and medications, including weight-management (GLP-1) therapy, longevity and peptide protocols, hormone therapy, and sexual-health treatment.
• Medications — prescription and medication use, dosages, refills, and related instructions.
• Measurements and vitals — bodily measurements such as height, weight, body-mass index, blood pressure, and other vital signs.
• Diagnostic and laboratory data — bloodwork, lab results, and other diagnostic testing information.
• Reproductive and sexual-health data — information relating to sexual or reproductive health where relevant to the care you seek.
• Gender-affirming care data — information relating to gender-affirming care, where applicable.
• Identifying and contact data — information that identifies you in connection with health data, such as name, date of birth, contact details, and account identifiers.
• Usage and technical data — information about your interactions with our website and apps that can indicate your attempt to acquire or receive health services, including precise or approximate location data where collected.
• Inferences — inferences or extrapolations we or our service providers derive from any of the above.

3. Sources of Consumer Health Data

We collect consumer health data from the following sources:

• Directly from you — through intake questionnaires, account registration, messages, and other information you submit.
• Automatically — through your use of our website, apps, and communications, including cookies and similar technologies described in our Privacy Policy.
• From your care team — from the independent, licensed providers and pharmacies that deliver care and dispense medications, consistent with applicable law.
• From third parties — such as service providers, laboratories, analytics and advertising partners, and other sources described in our Privacy Policy.

4. How and Why We Use Consumer Health Data

We use consumer health data to:

• Provide, facilitate, and coordinate the Services you request, including connecting you with independent, licensed providers and pharmacies;
• Operate, maintain, secure, and improve our Services;
• Communicate with you about your account, orders, subscriptions, and care, and respond to your inquiries;
• Conduct marketing and advertising for our own Services, where permitted and, where required, with your consent;
• Detect, prevent, and address fraud, abuse, and security issues;
• Comply with legal obligations and protect our rights and the rights, safety, and property of others.

We use consumer health data for these purposes only as directed by you, with your consent, or as otherwise permitted by applicable law.

5. How and With Whom We Share Consumer Health Data

We may share consumer health data with the following categories of recipients, in each case consistent with applicable law and, where required, with your consent:

• Healthcare providers and pharmacies — the independent, licensed providers and affiliated professional medical groups responsible for your care, and the licensed pharmacies that dispense your medications.
• Service providers (processors) — vendors that perform services on our behalf, such as cloud hosting, payment processing, analytics, customer support, and communications, under contracts that limit their use of the data.
• Affiliates — our corporate affiliates, for the purposes described in this CHD Policy and our Privacy Policy.
• Advertising and marketing partners — only with your consent where required by law; see Section 6 below.
• Legal and safety — government authorities or other parties when necessary to comply with law, respond to lawful requests, or protect rights, safety, and property.
• Business transfers — a successor or acquirer in connection with a merger, financing, acquisition, or sale of assets, subject to appropriate confidentiality protections.

We may also create and share aggregated or de-identified information that is not reasonably linkable to you and does not constitute consumer health data.

6. Sale of Consumer Health Data and Targeted Advertising

We do not sell your consumer health data, and we do not share consumer health data with third parties for their own targeted advertising, without obtaining valid authorization or consent where required by law. We will not collect, use, or share consumer health data for any purpose that requires your consent under the MHMDA, Nevada law, or the CTDPA without first obtaining that consent, and you may withdraw your consent at any time as described in Section 8.

7. Your Consumer Health Data Rights

Subject to the requirements and exceptions of applicable law, you may have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data;
• Access a list of the third parties and affiliates with whom we have shared your consumer health data;
• Delete your consumer health data, subject to legal exceptions;
• Correct inaccurate consumer health data (where provided by applicable law); and
• Withdraw consent to the collection and sharing of your consumer health data.

We will not discriminate against you for exercising any of these rights.

8. How to Exercise Your Rights

To submit a request, email us at privacy@oriahwellness.com or write to us at the address in Section 11. You may also use an authorized agent to submit a request on your behalf, in which case we may require proof of the agent’s authorization and may verify your identity directly.

Verification

To protect your privacy and security, we will take reasonable steps to verify your identity before fulfilling a request, generally by matching information you provide against information in our records. We will never ask you for sensitive financial information to verify a consumer-health-data request.

Appeals

If we decline to take action on your request, you may appeal our decision by replying to our response or contacting us at privacy@oriahwellness.com. If your appeal is denied, you may contact the attorney general in your state:

• Washington — Office of the Washington State Attorney General, atg.wa.gov/file-complaint.
• Nevada — Office of the Nevada Attorney General, ag.nv.gov.
• Connecticut — Office of the Connecticut Attorney General, portal.ct.gov/ag.

9. Data Retention and Security

We retain consumer health data only for as long as necessary to provide the Services, for the purposes described in this CHD Policy and our Privacy Policy, and as required to meet our legal, accounting, and regulatory obligations. We maintain administrative, technical, and physical safeguards designed to protect consumer health data against unauthorized access, use, or disclosure, including encryption in transit and at rest, access controls, and restricting internal access to personnel who need it to perform their roles.

10. Updates to This Policy

We may update this CHD Policy from time to time to reflect changes in our practices, our Services, or applicable law. When we make material changes, we will revise the “Last updated” date above and provide any additional notice required by law. Your continued use of the Services after an update takes effect constitutes acknowledgment of the revised CHD Policy.

11. Contact Us

If you have questions about this CHD Policy or wish to exercise your rights, please contact us: