California Privacy Disclosures

Introduction

These California Privacy Disclosures ("Disclosures") are provided by Eterna IQ LLC ("Eterna IQ," "we," "us," or "our") pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA"), Cal. Civ. Code Sections 1798.100-1798.199.100. These Disclosures apply to California residents ("consumers") and supplement our Privacy Statement and our Consumer Health Data Privacy Policy. Terms used but not defined in these Disclosures have the meanings given to them in our Privacy Statement. If these Disclosures conflict with our Privacy Statement as applied to California residents, these Disclosures control.

Eterna IQ operates our website at www.eternaiq.com and our member portal (together, the "Platform"). The patient portal at https://care.eternaiq.com, where treatment is requested, reviewed, and managed, is operated by CareValidate Incorporated ("CareValidate"), our telehealth platform provider. Through the Platform and CareValidate, we provide administrative coordination services that connect consumers with the independent medical practices affiliated with CareValidate (the "Affiliated Practices"), which are independently owned and operated, for telehealth services. Eterna IQ does not provide medical services, does not employ healthcare providers, and does not participate in clinical decisions. Clinical data collected by CareValidate and the Affiliated Practices during medical treatment is governed by those entities' own privacy notices and, where applicable, by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA").

Contact for privacy inquiries:

• Email: support@eternaiq.com
• Mail: Privacy Officer, Eterna IQ LLC, 30 N Gould St Ste R, Sheridan, WY 82801

1. Personal information collected, sources, and purposes

In the preceding twelve (12) months, we have collected the following categories of personal information from California consumers. We collect personal information directly from consumers, automatically through the Platform, from CareValidate, the Affiliated Practices and our service providers, and from external sources such as marketing, advertising, and social media companies, as described in our Privacy Statement.

• Category A: Identifiers. Name, email address, postal address, telephone number, date of birth, IP address, unique online identifiers, and account name. Collected from: consumers directly through account registration; automatically through the Platform; external sources. Purpose: providing services, account management, identity verification, communications, marketing, and regulatory compliance.
• Category B: Personal Information Under Cal. Civ. Code Section 1798.80(e). Name, address, telephone number, physical characteristics (height, weight), and medical information. Collected from: consumers through registration and medical intake forms; from the Affiliated Practices. Purpose: facilitating healthcare services, treatment coordination, prescription fulfillment, and payment processing.
• Category C: Protected Classification Characteristics. Age, sex, gender, and medical conditions (which may implicate disability status). Collected from: consumers through intake questionnaires. Purpose: healthcare eligibility determination and treatment coordination.
• Category D: Commercial Information. Records of services purchased, subscription status, payment history, and treatment options considered. Collected from: consumers through Platform transactions; from payment processors. Purpose: processing orders, managing subscriptions, customer service, and financial record-keeping.
• Category F: Internet or Other Electronic Network Activity. Browsing history on the Platform, pages viewed, click paths, browser type, operating system, and device information. Collected from: automatically through cookies and similar tracking technologies, as described in the "Cookies and other tracking technologies" section of our Privacy Statement. Purpose: Platform improvement, analytics, security, and marketing and advertising.
• Category G: Geolocation Data. Approximate geolocation derived from IP address and state of residence. Collected from: automatically when consumers access the Platform; from consumers during registration. Purpose: compliance with state telehealth licensing requirements and service eligibility verification.
• Category H: Sensory Data. Recordings of customer service calls, if you call us and the call is recorded where permitted by law. Collected from: consumers, during customer service calls. Purpose: customer service and quality assurance.
• Category K: Inferences. Profiles reflecting health preferences, interests, and treatment adherence patterns generated from information collected above. Purpose: personalizing services, marketing, and improving treatment coordination.

We do not intentionally collect Category E (Biometric Information), Category I (Professional or Employment-Related Information) or Category J (Non-Public Education Information), and we do not collect precise geolocation data such as GPS coordinates. Our intake does not ask for photographs or identification documents. If a treating provider asks for photographs, holds a video visit, or requires identity verification, that information is collected by CareValidate or the Affiliated Practices through the patient portal and is governed by their privacy notices.

2. Disclosure, sale, and sharing of personal information

Disclosure for Business Purposes. In the preceding twelve (12) months, we have disclosed the following categories of personal information to the following categories of third parties for business purposes:

• A (Identifiers): to CareValidate, the Affiliated Practices, pharmacy partners, laboratory partners, payment processors, Platform infrastructure providers, customer support and operations vendors, and marketing and advertising providers, for service delivery, prescription fulfillment, payment processing, customer support, and marketing.
• B (Personal Information): to CareValidate, the Affiliated Practices, pharmacy partners, and laboratory partners, for treatment coordination and prescription fulfillment; and, limited to name, address, and telephone number, to payment processors, for payment processing. Payment processors never receive medical information or physical characteristics.
• C (Protected Classifications): to the Affiliated Practices, for clinical care and eligibility.
• D (Commercial Information): to payment processors and accounting services, for payment processing and financial reporting.
• F (Internet Activity): to analytics providers, Platform infrastructure providers, and marketing and advertising providers, for Platform improvement, analytics, security, and marketing.
• G (Geolocation): to the Affiliated Practices, for telehealth licensing compliance.
• H (Sensory Data): to customer support vendors, for customer service.
• K (Inferences): to the Affiliated Practices, for treatment coordination, and to our customer relationship platform (a service provider), for care communications and, where you have opted in, education and offers. Inferences are never disclosed to advertising or social media platforms.

Sale and Sharing of Personal Information. We do not sell personal information for monetary consideration. However, as described in our Privacy Statement, our transfer of certain personal information to advertising networks, social media networks, and data analytics providers for marketing and advertising purposes may be considered a "sale" or "sharing" of personal information for cross-context behavioral advertising under the CCPA. In the preceding twelve (12) months, we may have sold or shared the following categories of personal information with those categories of third parties: Category A (Identifiers, including persistent identifiers such as device identifiers, IP addresses, and email addresses) and Category F (Internet or Other Electronic Network Activity). You may opt out of the sale or sharing of your personal information as described in Section 4. We do not have actual knowledge that we sell or share the personal information of consumers under sixteen (16) years of age.

The personal information we may sell or share never includes health information: we do not sell Consumer Health Data or share it with advertising or social media platforms, and analytics and advertising tools are disabled on our health assessment, our treatment and intake pages, and our member dashboard.

Our customer relationship platform, which sends our emails and text messages, receives: your name, email address, phone number, date of birth (if you provide it), state, and mailing address (if you add one to your account); the ad or campaign your first visit came from; your consent and notification choices; your assessment score, score band, the names of your strongest and weakest assessment areas, and your focus area; the general treatment category of an intake you start (not the treatment itself); status tags such as intake started or intake submitted; links to your results, order, and shipment tracking pages; and account requests you make, such as closing your account. It never receives your intake answers, lab values, diagnoses, clinical notes, medications, or the name of a treatment.

3. Sensitive personal information

We collect the following categories of sensitive personal information: health information (medical history, conditions, prescriptions, and treatment data, which is also Consumer Health Data under our Consumer Health Data Privacy Policy); and financial account information (credit and debit card numbers, processed by our payment processors and never sent with health information). Government-issued identification used for identity verification is collected by CareValidate, not by us.

We use and disclose sensitive personal information to perform the services you request, ensure Platform security, prevent fraud, comply with legal obligations, and process payments. As described in our Consumer Health Data Privacy Policy, where you have opted in, we may also use Consumer Health Data to send you education and offers relevant to your stated focus area; we do not use it for advertising on third-party platforms. You have the right to limit our use and disclosure of your sensitive personal information to the purposes permitted by the CCPA, as described in Section 4.

4. Your California privacy rights

• Right to Know (Cal. Civ. Code Section 1798.100). You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the third parties to whom we have disclosed it. You may submit this request up to two (2) times in a twelve-month period.
• Right to Delete (Cal. Civ. Code Section 1798.105). You may request that we delete your personal information. We may deny deletion where retention is necessary to complete a transaction, comply with legal obligations (including medical records retention requirements), detect fraud, exercise legal rights, or for other purposes permitted by law.
• Right to Correct (Cal. Civ. Code Section 1798.106). You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing (Cal. Civ. Code Section 1798.120). You have the right to opt out of the sale or sharing of your personal information. To exercise this right, email support@eternaiq.com. We also honor Global Privacy Control ("GPC") signals as valid opt-out requests for the browser or device on which the signal is sent.
• Right to Limit Use of Sensitive Personal Information (Cal. Civ. Code Section 1798.121). You may direct us to limit the use and disclosure of your sensitive personal information to the purposes necessary to perform the services you request and the other purposes permitted by the CCPA. To exercise this right, email support@eternaiq.com.
• Right to Non-Discrimination (Cal. Civ. Code Section 1798.125). We will not discriminate against you for exercising any CCPA right. We will not deny services, charge different prices, or provide a different level of service because you exercised a privacy right.

5. How to exercise your rights

You may submit a request by any of the following methods. By email, include your full name, account email, and the specific right you wish to exercise.

• Email: support@eternaiq.com
• Mail: Privacy Officer, Eterna IQ LLC, 30 N Gould St Ste R, Sheridan, WY 82801

Verification. We will verify your identity before processing a request. For requests to know categories of information, we will match at least two (2) data points you provide against our records. For requests to know specific pieces of information or to delete, we will match at least three (3) data points and may require a signed declaration under penalty of perjury. If we cannot verify your identity, we will notify you and explain what additional information is needed.

Authorized Agents. You may designate an authorized agent to submit a request on your behalf by providing signed written authorization or a valid power of attorney under California Probate Code Sections 4000-4465. We may still require you to verify your identity directly.

Response Timeline. We will acknowledge your request within ten (10) business days and provide a substantive response within forty-five (45) calendar days. If additional time is needed, we will notify you and may extend the response period by an additional forty-five (45) days. Opt-out and limit requests will be processed within fifteen (15) business days.

Appeal. If we deny your request, you may appeal by emailing support@eternaiq.com with the subject line "Data Rights Request Appeal." We will respond within forty-five (45) calendar days. If the appeal is denied, we will provide information on how to contact the California Privacy Protection Agency.

6. Data retention

We retain each category of personal information described in these Disclosures for as long as necessary to fulfill the purposes for which it was collected. We determine retention periods using the criteria described in our Privacy Statement: (1) how long the personal information is needed in connection with the purposes for which we use it; (2) the type of personal information collected; and (3) whether we are subject to a legal, contractual, or similar obligation to retain it, including applicable medical records retention requirements. We may retain information longer when required by law or to exercise or defend legal claims. Our current retention periods for specific records are listed in our Privacy Statement.

7. Minors

The Platform is not directed to individuals under eighteen (18) years of age, and we do not knowingly collect personal information from anyone under eighteen (18). If we learn that we have collected personal information from a minor, we will delete it. We do not have actual knowledge that we sell or share the personal information of consumers under sixteen (16) years of age. If you believe a minor's information has been collected, contact us at support@eternaiq.com.

8. Changes and contact

We may update these Disclosures to reflect changes in our practices or applicable law. When we do, we will post the updated Disclosures with a revised effective date. If the changes materially affect your privacy rights, we will provide additional notice to the email address associated with your account.

Contact:

• Email: support@eternaiq.com
• Mail: Privacy Officer, Eterna IQ LLC, 30 N Gould St Ste R, Sheridan, WY 82801

If you are not satisfied with our response, you may contact the California Privacy Protection Agency at https://cppa.ca.gov or the Office of the Attorney General at https://oag.ca.gov.