Consumer Health Data Privacy Policy.

1.Consumer Health Data We Collect

As described in the Personal Data We Collect About You section of the Privacy Policy, the data we collect depends on the context of your interactions with us and the choices you make (including your privacy settings), the Services you use, your location, and applicable law. Because consumer health data is defined very broadly, many of the categories of data we collect could also be considered consumer health data.

Examples of consumer health data may include:

• Information about your health-related conditions, symptoms, status, diagnoses, testing, or treatments (including surgeries, procedures, medications, or other interventions). For example, we may collect such information through surveys or other communication with you for research studies and improving product accessibility.
• Measurements of bodily functions, vital signs, or characteristics, including photographs, which may also be considered biometric information under the MHMDA, the NHDPA, or other applicable state consumer health privacy law.
• Precise location information that could reasonably indicate your attempt to acquire or receive health services or supplies.
• Information that could identify your attempt to seek health care services or information, including services that allow you to assess, measure, improve, or learn about your or another person’s health.
• Other information that may be used to infer or derive data related to the above or other health information.
• If you use our AI-powered features, including our AI assistant ERO (“AI Technology”), the text and other content you submit (“Input”) and the content the AI Technology generates in response (“Output”) may contain consumer health data. For example, if you describe symptoms, ask about medications, or discuss health conditions with ERO, that information is consumer health data. We collect and retain records of these interactions as described below and in our Privacy Policy.

2.Sources of Consumer Health Data

As described further in the How We Collect Your Personal Data section of the Privacy Policy, we collect personal data (which may include consumer health data) directly from you, from your interactions with our Services, from third parties, and from publicly available sources. We also collect consumer health data through your interactions with our AI Technology. When you submit Input to the AI Technology, including health-related questions, descriptions of symptoms, or other health information, we collect that Input and the resulting Output.

3.Why We Collect and Use Consumer Health Data

We collect and use consumer health data for the purposes described in the How We Collect Your Personal Data and Personal Data Collected Through and Use of Automatic Data Collection Technologies and Cookies sections of the Privacy Policy. Primarily, we collect and use consumer health data as reasonably necessary to provide you with the Services you have requested or authorized. This may include delivering and operating the Services and their features, including processing your Input through the AI Technology to generate Output; personalization of certain Service features, ensuring the secure and reliable operation of the Services and the systems that support them, troubleshooting and improving the Services, and other essential business operations that support the provision of the Services (such as analyzing our performance, meeting our legal obligations, developing our workforce, and conducting research and development).

We may use consumer health data for other purposes for which we give you choices and/or obtain your consent as required by law — for example, for advertising or marketing purposes. See the Choices About How We Use and Disclose Your Personal Data section of the Privacy Policy and the How to Exercise Your Rights section below for more details on the controls and choices you may have.

With your consent, we may also use consumer health data for purposes beyond what is necessary to provide the Services you requested, including:

• Evaluating and improving the AI Technology, including auditing Output for accuracy and bias, using de-identified or aggregated data in accordance with 45 CFR 164.514.
• Developing, training, and improving our AI models and features, using de-identified or aggregated data only.
• Conducting research and development to improve the Services.

You may withdraw your consent for these additional purposes at any time as described in the How to Exercise Your Rights section below. Withdrawing consent for these purposes will not affect your ability to use the Services.

4.Our Sharing of Consumer Health Data

We may share each of the categories of consumer health data described above for the purposes described in the How We Use or Disclose Your Personal Data section of the Privacy Policy. In particular, we may share personal data, including consumer health data, with your consent or as reasonably necessary to complete any transaction or provide any Service you have requested or authorized, as described above.

For example, we share your content with third parties when you tell us to do so. And we may disclose data when we believe that doing so is necessary to comply with applicable law or respond to valid legal process.

When you use our AI Technology, your Input may be transmitted to third-party AI and machine learning model providers for processing. This sharing is necessary to provide the AI Technology features you have requested. These providers process your data on our behalf and under contractual restrictions that prohibit them from using your consumer health data for their own purposes. For a list of the categories of third parties that receive consumer health data, see the section below.

5.Third Parties With Which We Share Consumer Health Data

As necessary for the purposes described above, we share consumer health data with the following categories of third parties:

• Service providers. Vendors or agents (“processors”) working on our behalf may access consumer health data for the purposes described above. For example, companies we’ve hired to provide customer service support or assist in protecting and securing our systems and Services may need access to data to provide those functions. These service providers, including our AI model providers, are contractually prohibited from using your consumer health data for any purpose other than providing services on our behalf.
• Business partners. We may share consumer health data with other companies, for example, where you use a Service that is cobranded and jointly operated with another company, or where you use our Services to interact with another company.
• Financial institutions & payment processors. When you make a purchase or enter into a financial transaction, we will disclose payment and transactional data to banks and other entities as necessary for payment processing, fraud prevention, credit risk reduction, analytics, or other related financial services.
• Parties to a corporate transaction. We may disclose consumer health data as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets.
• Affiliates. We enable access to data across our subsidiaries, affiliates, and related companies, for example, where we share common data systems or where access helps us to provide our Services and operate our business.
• Government agencies. As described in our Privacy Policy, we disclose data to law enforcement or other government agencies when we believe doing so is necessary to comply with applicable law or respond to valid legal process.
• Other third parties. In certain circumstances, it may be necessary to provide data to other third parties, for example, to comply with the law or to protect our rights or those of our customers.
• Other users and individuals. If you use our Services to interact with other Users of the Service or other recipients of communications, we will share data, including consumer health data, as directed by you and your interactions.
• The public. You may select options available through our Services to publicly display and disclose certain information, such as your profile, demographic data, content and files, or geolocation data, which may include consumer health data.

6.How to Exercise Your Rights

If you are covered by the MHMDA, the NHDPA, or other applicable consumer health privacy law then you may have certain rights with respect to consumer health data, including rights to access, delete, or withdraw consent relating to such data, subject to certain exceptions. You may request deletion of your AI Technology interaction history (Input and Output) by contacting us at the address below. Upon receiving a verified request, we will delete or de-identify your AI interaction data within 45 days, except to the extent retention is required by applicable law. Deletion does not apply to de-identified or aggregated data that can no longer be linked to you. If you previously consented to our use of your consumer health data for purposes beyond providing the Services (such as AI model improvement or research and development), you may withdraw that consent at any time by contacting us at the address below. Withdrawal of consent will not affect the lawfulness of processing conducted before the withdrawal or our ability to provide the Services to you.

You can request to exercise such rights using the various tools and mechanisms described in the Choices About How We Use and Disclose Your Personal Data section of the Privacy Policy. For example, depending on the Service you use, you can access and make choices about your data through product controls. You can also access and clear some of your data through your web browser. And if you want to access or control consumer health data processed by us that is not available via those tools or directly through the Service you use, you can always contact us at support@sumerohealth.com.

If your request to exercise a right is denied, you may appeal that decision by contacting our support team at support@sumerohealth.com. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint, the Nevada State Attorney General at ag.nv.gov/complaints/file_complaint, or other regulatory authority as applicable.