Consumer Health Data Privacy Notice

This Consumer Health Data Privacy Policy (the "CHD Privacy Notice") supplements the information contained in SPHERE HEALTH of Florida LLC's ("SPHERE HEALTH," "we," "us," or "our") Privacy Notice, and describes the consumer health data (as defined below) we collect, how we use it, to whom we disclose it and why, and the choices and rights you may have regarding your consumer health data.

This CHD Privacy Notice applies only to (i) individual consumers who are residents of the State of Washington or Nevada, and (ii) individuals whose consumer health data is collected in Washington or Nevada. Accordingly, this CHD Privacy Notice is provided in accordance with the Washington My Health My Data Act ("MHMDA") and the Nevada Consumer Health Data Privacy Law ("NV CHDP") (collectively, the "Applicable CHD Laws"). In the event of a conflict between any other policy, statement, or notice provided by SPHERE HEALTH and this CHD Privacy Notice, this CHD Privacy Notice will control with respect to consumer health data collected under the Applicable CHD Laws.

SPHERE HEALTH is not a medical group or a health care provider and does not provide medical advice, diagnosis, or treatment. Telehealth consultations and clinical care are provided by independent medical practitioners and pharmacists, including M&D Integrations, Inc. d/b/a MD Integrations and its affiliated covered entities (collectively, "Medical Group"), which maintains a network of United States-based health care providers (each, a "Provider").

Consumer Health Data

The term "consumer health data" has the following meaning with respect to residents of Washington and Nevada:

• For Washington residents, "consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.
• For Nevada residents, "consumer health data" means personally identifiable information that is linked or reasonably capable of being linked to a consumer and that is used to identify the past, present, or future health status of the consumer.

However, the following categories of information are not consumer health data and are not covered by this CHD Privacy Notice to the extent applicable under the Applicable CHD Laws:

• For Washington residents, Protected Health Information ("PHI"), as defined by the Health Insurance Portability and Accountability Act ("HIPAA");
• For Washington residents, health care information collected, used, or disclosed in accordance with Washington Revised Code § 70.02 ("Medical Records – Health Care Information Access and Disclosure");
• Publicly available information;
• De-identified data;
• For Nevada residents, information of individuals acting in an employment context, such as job applicants, employees, or contractors;
• For Nevada residents, information used to identify an individual's shopping habits or interests that is not used to identify the individual's past, present, or future health status;
• For Nevada residents, information of individuals acting as an agent of a governmental entity;
• For Nevada residents, the collection or sharing of consumer health data expressly authorized by federal or state law; or
• Information otherwise excluded from the scope of the Applicable CHD Laws.

Please note that data practices concerning Protected Health Information collected by Medical Group and its affiliated Providers are described in Medical Group's Notice of Privacy Practices, not in this CHD Privacy Notice.

To view our Privacy Notice describing how we treat other personal data, please visit Privacy Notice.

As described in our Privacy Notice, the data we collect depends on the context of your interactions with SPHERE HEALTH, the choices you make, the products and features you use, and applicable law. Because consumer health data is defined broadly, many of the categories of data we collect could also be considered consumer health data. We may collect the following categories of consumer health data with your consent or to the extent necessary to provide a product or Service that you have requested. We only collect the categories of consumer health data described in this CHD Privacy Notice:

• Individual health conditions, treatment, diseases, or diagnoses, including conditions relating to our clinical segments (fertility/preconception, PCOS, weight/metabolic health, endometriosis, and perimenopause/HRT);
• Social, psychological, behavioral, and medical interventions;
• Health-related surgeries or procedures;
• Use or purchase of prescribed medication, including branded GLP-1 and other prescribed medications routed for fulfillment to our partner pharmacies;
• Bodily functions, vital signs, symptoms, or measurements of other health data, including lab biomarker results;
• Diagnoses or diagnostic testing, treatment, or medication, including lab-based screening fulfilled through our laboratory network;
• Reproductive or sexual health information, including reproductive history, fertility status, pregnancy planning, and menstrual or cycle-related information;
• Data that identifies a consumer seeking health care services; and
• Any other information used to associate or identify an individual with any category of health data that is derived or extrapolated from nonhealth information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning).

Examples of consumer health data may include:

• Health information you choose to provide via our Contact Us form.
• Other information that may be used to infer or derive data related to the above or other health information.

As described further in our Privacy Notice, we collect personal data (which may include consumer health data) from the following sources:

• Directly from you, including from the intake forms, questionnaires, and other information you provide when you register for, purchase, or use our Services or communicate with us;
• Automatically as you access, navigate through, or otherwise use our Platform, including through cookies and similar technologies;
• From our business partners and service providers, including Medical Group (clinical encounter data), our laboratory partner (lab results), our payment processor (payment confirmation metadata), and our partner pharmacies (fulfillment confirmations); and
• From inferences we derive from your activity using our Services and from publicly available sources.

We only collect and use consumer health data for the purposes described in this CHD Privacy Notice. Primarily, we collect and use consumer health data as reasonably necessary to communicate with you and to provide you with the products and Services you have requested or authorized. We may also collect and use consumer health data for the following purposes:

• Provide Services. To provide, support, and administer our Services, including facilitating telehealth consultations with Medical Group, submitting laboratory orders to our laboratory partner, transmitting prescription information to partner pharmacies, and administering your membership.
• Personalization. To support clinical segment routing, personalized educational content, membership tier recommendations, and (where offered) clinician-approved supplement recommendations.
• Payment. To process your requests, purchases, transactions, and payments, and to prevent transactional fraud.
• Customer Service. To provide you with support and respond to your inquiries, including to investigate and address concerns and to monitor and improve our responses.
• Communications.To send you notices about your account (including notices about subscriptions, expiration, and renewals) and, where permitted, to provide you with information about our own or our affiliates' products and Services that may be of interest to you. You can opt out of receiving marketing communications at any time.
• Security and Fraud Prevention. To authenticate users, detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and otherwise maintain the safety, security, and integrity of our Platform and the safety of others.
• Research and Product Improvement. To de-identify and/or aggregate information for analytics, reporting, research, quality improvement, and product development, including the development and improvement of our Platform (which may include training or retraining of artificial intelligence applications), consistent with applicable law.
• Legal and Business Operations. To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection; to respond to law enforcement requests, court orders, and subpoenas; and to comply with our legal, regulatory, and contractual obligations.
• With Your Consent. We may use your consumer health data for any other purpose with your affirmative, voluntary consent.

We will not process consumer health data for purposes that are neither reasonably necessary for, nor compatible with, the purposes for which the consumer health data is processed as described in this CHD Privacy Notice and our Privacy Notice without your consent.

We may share consumer health data with your consent or as reasonably necessary to provide a product or Service that you have requested or authorized. "Share" under the Applicable CHD Laws means to release, disclose, disseminate, divulge, make available, provide access to, license, or otherwise communicate consumer health data. However, "share" does not include (i) disclosure of consumer health data to provide goods or services in a manner consistent with the purpose for which we collected the consumer health data; (ii) disclosure to a third party with whom you have a direct relationship for the purpose of providing a product or service you requested, if we maintain control and ownership of the data and the third party uses the data only at our direction, consistent with your consent, and for the purpose for which it was collected; or (iii) disclosure or transfer of consumer health data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in compliance with the Applicable CHD Laws.

The term "third party," as used in this CHD Privacy Notice, means a person who is not a consumer, an entity regulated under the Applicable CHD Laws, a processor, or an affiliate of an entity regulated under the Applicable CHD Laws.

As necessary for the purposes described above, we may share consumer health data with the following categories of third parties and specific affiliates:

• Business partners and service providers that support our business or assist us in providing our Services, such as our clinical services partners, and providers of laboratory orchestration, payment processing, cloud hosting and infrastructure, and analytics;
• Affiliates, parents, and subsidiary organizations of SPHERE HEALTH;
• Parties to a corporate transaction or proceeding, such as a potential or actual buyer or other successor-in-interest in connection with a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets; and
• Law enforcement or other government agencies where we believe doing so is necessary to comply with applicable law or respond to valid legal process, or as otherwise required or permitted by applicable law.

We do not share consumer health data with advertising networks or for cross-context targeted advertising without your consent.

We do not "sell" consumer health data. Under the Applicable CHD Laws, a "sale" means the exchange of consumer health data for monetary or other valuable consideration, excluding (i) the exchange to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of our assets in compliance with the Applicable CHD Laws; (ii) the exchange by us to a processor when such exchange is consistent with the purpose for which the consumer health data was collected and disclosed to the consumer; or (iii) as directed by you, or if you intentionally use us to interact with and disclose consumer health data to a third party. To the extent we ever sell consumer health data as defined above, we will only do so after obtaining valid authorization from the consumer whose consumer health data is involved in the sale, and you may revoke any such authorization at any time by contacting us at privacy@spherehealth.com.

If you are covered by the MHMDA or the NV CHDP, you may have certain rights with respect to consumer health data under the law that applies to you (subject to certain limitations), including:

• The right to confirm whether we are collecting, sharing, or selling your consumer health data;
• The right to access your consumer health data that we have collected or control, including a list of all third parties and affiliates with whom we have shared or to whom we have sold your consumer health data, and an email address or other online mechanism to contact those third parties and affiliates;
• The right to delete your consumer health data, subject to certain exceptions, including where we are required to retain medical or other records under applicable law;
• The right to withdraw consent for the collection or sharing of your consumer health data (if you provided such consent), subject to certain exceptions (e.g., where our collection and/or sharing is necessary to provide a product or Service you have requested or authorized);
• The right, if you are a Nevada resident, to opt out of the collection, sale, or sharing of your consumer health data; and
• The right to appeal our decision on a request to exercise any of these rights.

We will not discriminate against you for exercising any of your rights under the Applicable CHD Laws.

You can request to exercise such rights by contacting us at privacy@spherehealth.com (with the subject line "Health Privacy Rights Request"). You may submit a rights request, free of charge, up to two times per year. We will respond to your rights request within 45 days, though in certain cases we may inform you that we need up to another 45 days to act on your request.

To protect your privacy and security, we take steps to verify your identity before fulfilling your request. For account holders, we verify your identity through your existing account login. For other requests, we match the identifiers you provide against the records we maintain. We will not require sensitive identifiers (such as a Social Security number or government identification number) to verify standard rights requests.

If your request to exercise a right is denied, you may appeal that decision by contacting us at privacy@spherehealth.com. If your appeal is unsuccessful and you are a Washington or Nevada resident, you can raise a concern or lodge a complaint with the Washington State Attorney General at https://www.atg.wa.gov/file-complaint or the Nevada Attorney General at https://ag.nv.gov/contact.

We reserve the right to amend this CHD Privacy Notice at our discretion and at any time. When we make material changes to this CHD Privacy Notice, we will post the updated version on our Website and update the "Last Updated" date above. We will not collect, use, or share additional categories of consumer health data, or collect, use, or share consumer health data for additional purposes, without first providing notice and, where required, obtaining your consent.

If you have any questions, concerns, complaints, or suggestions regarding this CHD Privacy Notice or our Privacy Notice, the ways in which SPHERE HEALTH collects and uses your consumer health data, or your choices and rights, please contact us at: