Consumer Health Data Privacy Policy

Table of Contents

Introduction

VitalHaus LLC (“VitalHaus,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your consumer health data. This Consumer Health Data Privacy Policy (“Policy”) describes how we collect, use, disclose, and retain “consumer health data,” as that term is defined under applicable state laws, including but not limited to the Washington My Health My Data Act, the Nevada Senate Bill 370, the Connecticut Data Privacy Act, and similar laws (collectively, “Health Privacy Laws”).

This Policy is in addition to, and does not replace, the VitalHaus Privacy Policy, which describes our general practices regarding personal information. In the event of a conflict between this Policy and the VitalHaus Privacy Policy with respect to consumer health data, this Policy controls. Capitalized terms used but not defined in this Policy have the meanings given to them in the VitalHaus Terms and Conditions or the VitalHaus Privacy Policy.

This Policy applies to consumer health data that we collect from or about you in your capacity as a consumer or prospective consumer of VitalHaus's products or services through the VitalHaus website located at www.vitalhaus.com and any VitalHaus mobile application (collectively, the “Platform”). It does not apply to consumer health data that is protected by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, “HIPAA”) when such data is collected, used, or disclosed by VitalHaus in its capacity as a “business associate” or “covered entity” under HIPAA, or by the Medical Groups, Providers, Labs, or Pharmacies as defined in the VitalHaus Terms and Conditions.

What Is Consumer Health Data

“Consumer health data” means personal information that identifies a consumer and that relates to the consumer's health. Depending on the applicable Health Privacy Law, this may include, without limitation: information that identifies an individual who is seeking, receiving, or has received health care services; information relating to the individual's physical or mental health status; information relating to the provision of health care to the individual; information relating to the individual's health care payment or cost; prescription information; information regarding the individual's bodily symptoms, measurements, or vital signs; information regarding reproductive or sexual health; information regarding an individual's use of, or purchase of, medication or medical devices; information regarding an individual's exercise, sleep, or diet; information regarding an individual's use of a wellness product or service; and inferences derived from any of the above.

Not all information we collect constitutes consumer health data under every applicable Health Privacy Law. Where a particular category of information is not consumer health data under applicable law, it is governed by our Privacy Policy.

Categories of Consumer Health Data We Collect

Depending on how you interact with us, the services you use, and the choices you make, we may collect the following categories of consumer health data:

• Health conditions and status. Information about your physical or mental health, diagnoses, symptoms, and treatment goals that you provide through health assessments, intake forms, or communications with us.
• Medication and treatment information. Information about your prescriptions, medications, supplements, and treatments, including your interest in or use of GLP-1 weight care and related treatments.
• Body measurements and vital signs. Self-reported information regarding your weight, body mass index, blood pressure, or other measurements you provide.
• Exercise, sleep, diet, and wellness. Information you provide regarding your lifestyle, activity, sleep, or nutrition in connection with your use of the Service.
• Identifiers and contact information. Your name, email address, shipping address, phone number, and similar identifiers we associate with your health information.
• Inferences. Inferences we derive from the above information that relate to your health or potential health needs.

We collect consumer health data from the following sources: (a) directly from you when you complete assessments, forms, or other interactions through the Service; (b) automatically when you use the Platform, including usage and device information associated with your account; and (c) from our affiliated Medical Groups, Providers, Labs, and Pharmacies where permitted by applicable law.

Purposes of Use

We collect, use, and disclose consumer health data for the following business or commercial purposes:

• To provide, operate, and maintain the Service, including processing your requests, facilitating care through our affiliated Medical Groups and Providers, and coordinating with Labs and Pharmacies.
• To respond to your inquiries, provide customer support, and communicate with you about your account and the Service.
• To personalize your experience and provide recommendations related to your use of the Service.
• To improve, test, and enhance the Service and develop new features, products, and services.
• To process transactions, administer accounts, and perform billing and payment functions.
• To detect, prevent, and address fraud, security issues, and technical or functionality problems.
• To comply with our legal obligations, protect our rights and the rights of others, and enforce our agreements.

We will not collect, use, or share consumer health data for purposes other than those disclosed in this Policy without first providing you with notice and, where required by applicable law, obtaining your consent.

Disclosure of Consumer Health Data

We may disclose consumer health data to the following categories of third parties for the purposes described in this Policy:

• Service providers and vendors. Third parties that perform services on our behalf, such as hosting, analytics, customer support, and payment processing, subject to contractual obligations of confidentiality.
• Medical Groups, Providers, Labs, and Pharmacies. Our affiliated Medical Groups and their Providers, as well as contracted Labs and Pharmacies, for the purpose of providing care, laboratory services, and prescription fulfillment.
• Affiliates and corporate transactions. Our subsidiaries and affiliates, and in connection with a merger, acquisition, sale of assets, or other corporate transaction.
• Legal and law enforcement. When we believe disclosure is necessary to comply with applicable law, respond to valid legal process, or protect the rights, property, or safety of VitalHaus, our users, or others.
• With your consent or at your direction, as required or permitted by applicable law.

We do not “sell” or “share” consumer health data as those terms are defined under applicable Health Privacy Laws. We do not process consumer health data for the purpose of cross-context behavioral advertising.

Your Rights and Choices

Subject to applicable law, you have the following rights with respect to your consumer health data:

• Right to know. You may request a list of the categories of consumer health data we have collected about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties to which we have disclosed consumer health data.
• Right to access. You may request a copy of the specific consumer health data we have collected about you.
• Right to delete. You may request that we delete consumer health data we have collected from or about you, subject to certain exceptions permitted by applicable law.
• Right to withdraw consent. Where we process consumer health data based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.
• Right to limit use and disclosure of sensitive data. You may limit the use and disclosure of sensitive consumer health data to purposes other than providing or maintaining the Service you requested.
• Right to authorize. Where applicable Health Privacy Law requires affirmative authorization for the collection, use, or disclosure of consumer health data, you have the right to authorize or decline to authorize such processing.

To exercise any of these rights, please contact us using the information provided in the “Contacting Us” section below. We will verify your identity before responding to your request and will respond within the timeframes required by applicable law. You may designate an authorized agent to make a request on your behalf by providing us with written authorization to do so.

We will not discriminate against you for exercising any of the rights described in this Policy.

Data Retention

We retain consumer health data for only as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements, and to establish, exercise, or defend legal claims. After the applicable retention period, we will delete or de-identify the consumer health data, unless applicable law requires otherwise.

Data Security

We use reasonable physical, technical, and administrative safeguards designed to protect consumer health data from unauthorized access, use, alteration, or disclosure. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

Sensitive Data and Data Minimization

We seek to limit the collection of consumer health data to what is reasonably necessary to provide and maintain the Service, to comply with legal obligations, and to fulfill the purposes described in this Policy. Where you provide sensitive consumer health data, we limit its use and disclosure to the purposes for which it was provided or as otherwise permitted by applicable law.

Children's Data

The Service is not directed to children under the age of eighteen (18), and we do not knowingly collect consumer health data from children under the age of eighteen (18) without the consent of a parent or legal guardian where required by applicable law. If we learn that we have collected consumer health data from a child under the applicable age without the required consent, we will take reasonable steps to delete such data. If you believe we have collected such data, please contact us using the information provided below.

Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date at the top of this Policy. If we make material changes to our practices with respect to consumer health data, we will provide notice as required by applicable law and, where required, obtain your consent. We encourage you to review this Policy periodically.

Contacting Us

If you have any questions about this Consumer Health Data Privacy Policy or wish to exercise any of your rights, please contact us by email at privacy@vitalhaus.com, or by regular mail at: