Consumer Health Data Privacy Policy

Scope of this policy

Eterna IQ LLC (collectively, "Eterna IQ," "our," "we," or "us") values and respects the privacy of its customers and visitors. While operating our business and interacting with you, we may collect, use, and share "Consumer Health Data" as defined by U.S. state consumer health data privacy laws, such as the Washington My Health, My Data Act and Nevada SB370 (collectively, "Consumer Health Data Privacy Laws"). Consumer Health Data Privacy Laws apply to consumers residing in certain states whose consumer health data is collected by Eterna IQ ("Consumers", "you", or "your") and provide Consumers with specific rights regarding their Consumer Health Data. This Consumer Health Data Privacy Policy supplements our Privacy Statement and applies solely to such Consumers. Where the two differ with respect to Consumer Health Data, this policy controls.

This Consumer Health Data Privacy Policy provides you with detailed information about how we and our subsidiaries, divisions, affiliates, brands and other companies that link to this Consumer Health Data Privacy Policy collect, use, and share your Consumer Health Data, and describes your choices and rights. We encourage you to read this Consumer Health Data Privacy Policy carefully and if you have any questions to contact us using the methods listed below.

Eterna IQ LLC is a health technology company, not a healthcare provider. Clinical services are delivered by independent licensed clinicians and partners who maintain their own records and privacy practices.

We reserve the right to make changes to this Consumer Health Data Privacy Policy at any time and for any reason. Any changes will be reflected in a revised Consumer Health Data Privacy Policy posted on our website (the "Website") and we will alert you that there has been a change by updating the "Last updated" date displayed on the Consumer Health Data Privacy Policy. If we determine that such changes materially affect your privacy rights, we will provide additional notice to you at the email address specified in your account. You are responsible for ensuring we have an up-to-date, active, and deliverable email address for you, and for periodically visiting our Website and this Consumer Health Data Privacy Policy to check for any changes.

Definitions

"Consumer Health Data" is defined for purposes of this Consumer Health Data Privacy Policy and the Consumer Health Data Privacy Laws as personal information that is linked or reasonably linkable to a Consumer and that identifies the Consumer's past, present, or future physical or mental health status.

Consumer Health Data does not include: (a) publicly available information, such as information from government records, information we reasonably believe you made available to the general public, or unrestricted information you have disclosed or made available; (b) deidentified or aggregated consumer information we maintain in deidentified form and do not attempt to re-identify except as required or permitted by law; (c) health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"); and (d) personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act ("FCRA") and the Gramm-Leach-Bliley Act ("GLBA").

Categories of consumer health data collected, and purposes for collection, use, and sharing

Categories of Consumer Health Data we may collect, use, disclose, and share include data regarding: (a) health conditions, treatments, symptoms, diseases, diagnosis, medical conditions, medical recommendations, mental health conditions, and mental health information; (b) health history information; (c) use or purchase of prescribed medication; (d) data that identifies a consumer seeking health care services or referrals; (e) gender, reproductive, or sexual health information; (f) consultations and information relating to consulting with a physician; (g) height and weight information; (h) records of your communications and requests with us or one of our partner companies; and (i) any other health or medical information.

We collect, use, and disclose the above-described Consumer Health Data to offer our products and services to you, as directed by you. Where you have opted in, we also use it to send you education and offers relevant to your stated focus area; we do not use it for advertising on third-party platforms (see below). In practice, we collect the following, and only in connection with a service you asked for:

• Health assessment responses: goals, symptoms you choose to report, sleep, energy, recovery, and lifestyle answers.
• Assessment outputs: your score, score band, primary focus area, and the segment we use to tailor what we send you.
• Demographics relevant to eligibility and care: date of birth and state of residence.
• Clinical intake responses you submit when requesting treatment, including medical history, current medications, and shipping address.
• Treatment and order status: whether a request is under review, approved, being prepared, shipped, or declined.
• Appointment and care information displayed to you in your member dashboard, including lab results and care plans.
• Account identifiers that connect you across our partners: your email address and the record identifiers each partner assigns you.

Where it comes from

We may collect your Consumer Health Data in a variety of ways, including when you provide information directly to us through our agents or our Website, and through or from your doctor or other medical professional, as well as from our service providers and business partners. We do not buy consumer health data, and we do not infer health status from your browsing behavior or from data brokers.

• Directly from you, when you complete an assessment, intake, profile, or booking.
• From your clinical partners, when results, care plans, appointments, or order status are returned to us for display.
• From service providers and business partners that help us deliver the services you request.

Why we collect it, and how it is used

We do not use consumer health data to build advertising audiences, to target advertising to you, or to measure advertising performance. See the section below.

• To produce and show you your assessment results.
• To determine whether a treatment you requested is appropriate to send to a licensed provider for review.
• To pass your intake to the prescribing partner who reviews it.
• To display your own clinical record back to you in your member dashboard.
• To send you communications about your care and, where you have opted in, education and offers relevant to your stated focus area.
• To operate, secure, and debug the platform, and to meet legal obligations.

What we store, and what we only display

Much of your health information is held by our clinical partners rather than by us. Our platform is generally designed to display it rather than to keep its own copy.

Your clinical intake responses are passed through to the prescribing partner rather than written to our database. Your lab results, care plan, documents, and order status are requested from our clinical partners when you open the relevant page and shown to you, rather than stored by us.

What we do store is your assessment responses and results, together with the contact, eligibility, and account identifier details described above.

Who we share it with

We share consumer health data only with the categories of recipients listed here, and only as needed to deliver what you asked for:

• Clinical record platform: maintains your chart, care plan, lab results, documents, and appointments.
• Prescribing and pharmacy partner: reviews your intake, makes the prescribing decision, and dispenses and ships your medication.
• Diagnostics partner: performs lab testing and returns results to your clinical record.
• Our customer relationship platform, which sends our emails and text messages, receives: your name, email address, phone number, date of birth (if you provide it), state, and mailing address (if you add one to your account); the ad or campaign your first visit came from; your consent and notification choices; your assessment score, score band, the names of your strongest and weakest assessment areas, and your focus area; the general treatment category of an intake you start (not the treatment itself); status tags such as intake started or intake submitted; links to your results, order, and shipment tracking pages; and account requests you make, such as closing your account. It never receives your intake answers, lab values, diagnoses, clinical notes, medications, or the name of a treatment.
• Infrastructure providers that host our application and database, under contractual confidentiality and security obligations.
• Payment processors, which receive billing information but no health data.
• Professional advisors under confidentiality duties, and authorities where required by law.

We do not share consumer health data with advertising platforms

We do not sell consumer health data. We do not share it with advertising or social media platforms, and we do not use it for cross-context behavioral advertising.

Analytics, session recording, and advertising tools are disabled on our health assessment, our treatment and intake pages, our member dashboard, and our member portal domain.

On our general marketing pages, which do not collect or display health information, we use ordinary advertising measurement to understand which campaigns work. Those events carry contact and purchase information, not health data.

How long we keep it

We retain consumer health data for no longer than needed for the purposes described above, and for these periods:

• Assessment responses, results, and the contact details captured with them: up to 24 months from your last activity.
• Account identifier records linking you to our partners: for the life of your account (whether a membership, a treatment history, or both), and afterwards for as long as needed to respond to questions about access to your information.
• Records of access to health information: up to six years.
• Payment records: up to seven years, for tax and accounting purposes. These contain no health data.
• Clinical records held by our partners: governed by their retention policies and by medical record retention law, which we do not control.

Your rights

Subject to certain legal limitations and exceptions, Consumer Health Data Privacy Laws provide you with certain rights you may exercise. If you are a Washington or Nevada resident, these include:

• The Right to Confirm. You may request that we confirm whether we collect, share, or sell your Consumer Health Data.
• The Right to Access and Request Copies. You may request to access or request a copy of your Consumer Health Data, including a list of all third parties and affiliates with whom we shared or sold the Consumer Health Data, along with contact information for each.
• The Right to Correct. You may request that we correct your Consumer Health Data.
• The Right to Withdraw Consent. You may request to withdraw your consent from our collection and sharing of your Consumer Health Data.
• The Right to Delete. You may request that we delete your Consumer Health Data. Where we have shared it, we will notify the recipients of your request.

Exercising your rights under this Consumer Health Data Privacy Policy will not result in any discrimination by us. We will treat you the same as any other user.

How to exercise these rights

In order to exercise any of the rights detailed in this Consumer Health Data Privacy Policy, please contact us at support@eternaiq.com with the request you are making.

We may require additional information from you to help us verify your identity and state or country of residence, and to process your request. The verification steps may vary depending on the sensitivity of the information and whether you have an account with us. If we are unable to verify your identity, we may deny your requests. You can designate an authorized agent to submit requests on your behalf. However, we will require written proof of the agent's permission to do so and verify your identity directly.

We will respond within the period the applicable law allows, currently 45 days, and where the law permits an extension we will tell you before taking it and explain why.

Clinical records held by your treating partners generally cannot be deleted on request, because medical record retention is required by law. A deletion request will cover the consumer health data we hold and will be forwarded to the partners we have shared it with, but their own legal retention obligations govern what they do with it. We would rather say that here than imply a deletion we are not able to deliver.

If you make a request to exercise any of the applicable rights and we are unable to comply with your request, or if you disagree with or dispute our decision, you may request to appeal our decision. To appeal any data rights decision, please contact us by email at support@eternaiq.com with the subject line "Data Rights Request Appeal." If we deny your appeal, we will tell you why. If you are still not satisfied with our response after you complete the appeal process with us, you may file a complaint with the Washington state Attorney General through their complaint filing system, available at https://www.atg.wa.gov/file-complaint, or with the Attorney General of your state.

Geofencing

We do not operate geofences around healthcare facilities, and we do not use location data to identify people near them, to advertise to them, or to collect health data from them. This practice is prohibited by law and we have no exception to it.

How it is protected

We use administrative, technical, and organizational safeguards designed to protect consumer health data. These include encryption in transit, limiting access to the people and systems that need it to run the service, and logging access to health information through our platform.

No system is perfectly secure, and we will not claim otherwise. If consumer health data is disclosed without authorization, we will notify affected people as required by applicable law.

Contact us

If you have questions or comments about this Consumer Health Data Privacy Policy, please contact us at:

• Address: Eterna IQ LLC, 30 N Gould St Ste R, Sheridan, WY 82801
• Email: support@eternaiq.com