Consumer health data privacy policy

Effective Date: February 23, 2025

This Consumer Health Data Privacy Policy ("Health Data Policy") supplements the Diet Direct Privacy Policy (the "General Privacy Policy") and applies solely to residents of states with consumer health data legislation that mandate such a policy. This Health Data Policy describes how Diet Direct Inc. ("Company", "we", or "us") collects, uses, shares, and protects your Consumer Health Data, as defined below. To the extent there are circumstances where some of the personal data collected or processed by Company may be considered "consumer health data" under Washington's My Health My Data Act (MHMDA) and any similar legislation, this Health Data Policy applies. To the extent there are any conflicts between the General Privacy Policy and this Health Data Policy this Health Data Policy will govern.

1. What is Consumer Health Data?

As used herein, "Consumer Health Data" means personal informaton that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. This includes, but is not limited to:

• Health conditions, treatment, diseases, or diagnoses.
• Bodily functions, vital signs, symptoms, or measurements.
• Medications, medical procedures, or tests.
• Information about seeking healthcare services or products.
• Data that identifies as consumer as seeking or receiving heath care services.
• Any inferences derived from the above.

2. Categories of Consumer Health Data We Collect:

Consistent with our General Privacy Policy, we collect the following categories of Consumer Health Data from Washington residents:

• Health Data: As described in the General Privacy Policy, we collect health data when you provide it to us, such as your weight, height, food allergies, whether you are are a candidate for or have had bariatric surgery, and information about whether you are pregnant or nursing.
• Commerical Data: Your purchases of dietary products may reveral information about your health interests and goals.
• Personal Background: Protected class informaton, such as disability (e.g., when you request health accomodations for allergies) may also be considered Consumer Health Data.
• Communications: Information you communicate to customer service agents or via feedback forms relating to your health or dietary needs.
• Inferences: We may draw inferences about your health or dietary preferences based on your purchase history and interactions with our Website.

3. Sources of Consumer Health Data:

We collect Consumer Health Data from the following sources:

• Directly from you: We collect Consumer Health Data from you when you provide information through our Website, customer service interactions, or other communications.
• Automatically: We may collect Consumer Health Data through cookies and other data technologies as described in the General Privacy Policy (to the extent this data is linked or reasonably linkable to a consumer and related to health).
• From Third Parties: We may collect Consumer Health Data from Third Parties, such as from or on behalf of CareValidate Inc. in connection with the Telemedicine Program.

4. Purposes for Collecting and Using Consumer Health Data:

We use your Consumer Health Data for the following purposes, consistent with the General Privacy Policy:

• Providing Products and Services: To fulfill your orders, personalize your experience, and recommend products and services that may be relevant to your health and dietary needs.
• Telemedicine Program: To provide you with access to the Telemedicine Program and related services.
• Customer Support: To respond to your inquiries and provide customer support related to your health and dietary needs.
• Improving Our Products and Services: To analyze trends and improve the effectiveness of our products and services.
• Legal Compliance: To comply with applicable laws and regulations.

5. Sharing of Consumer Health Data:

We may share your Consumer Health Data with the following categories of recipients, consistent with the General Privacy Policy:

• Service Providers: We share information with third-party service providers who assist us in providing our products and services, such as payment processors, shipping providers, and marketing partners.
• CareValidate Inc.: We may share or exchange information with CareValidate Inc. in connection with the Telemedicine Program.
• Legal Authorities: We may disclose Consumer Health Data to legal authorities and other Third Parties if required by law or legal process.
• Business Transfers: In the event of a merger, acquisition, or other business transaction, Consumer Health Data may be transferred to the acquiring entity.

6. Your Rights Regarding Your Consumer Health Data:

You may have the following regarding your Consumer Health Data:

• Right to Confirm or Deny Collection: You have the right to confirm whether we collect, share, or sell your Consumer Health Data.
• Right to Access: You have the right to access a list of all of your Consumer Health Data that we have collected.
• Right to Withdraw Consent: You have the right to withdraw your consent to our collection and sharing of your Consumer Health Data.
• Right to Delete: You have the right to request that we delete your Consumer Health Data.

7. How to Exercise Your Rights:

To exercise your rights, please contact us using the contact information provided in the "WHO WE ARE" section of our General Privacy Policy. We will respond to your request within the timeframes required by law.

8. Data Security:

We implement and maintain reasonable security measures to protect your Consumer Health Data from unauthorized access, use, or disclosure, as described in the General Privacy Policy.

9. Changes to this Health Data Policy:

We may update this Health Data Policy from time to time. We will post any changes on our Website and update the "Effective Date" above.

10. Contact Us:

If you have any questions about this Health Data Policy or our practices regarding Consumer Health Data, please contact us using the information in the "WHO WE ARE" section of the General Privacy Policy.