Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy supplements the zLifespan Privacy Policy. We at zLifespan, Inc. (“we”, “us”, “the Company”, or “zLifespan”) value your privacy and are committed to keeping your data confidential. This Consumer Health Data Privacy Policy applies to personal health information defined as “Consumer Health Data” under applicable state health privacy law, including, but not limited to, Washington’s My Health My Data Act (“MHMDA”), Nevada’s Consumer Health Data Privacy Law (SB 370), and health-data provisions under the Connecticut Data Privacy Act (“CTDPA”). Capitalized terms not defined in this policy have the meanings set forth in the zLifespan Privacy Policy. This Consumer Health Data Privacy Policy does not apply to any data considered Protected Health Information (“PHI”) as defined by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

Categories of Consumer Health Data We Collect

To provide the zLifespan mobile application (the “Platform”) to allow you to aggregate and manage your personal health information in one place, we collect the following categories of information that may be considered Consumer Health Data under applicable law:

• Demographic Data: We collect demographic data from Users, which may include, but not be limited to, your name, date of birth, sex at birth, gender identity, city and state, email address, phone number, and, if you choose to provide one, an emergency contact’s name, relationship, and phone number. The collection of this demographic data is primarily used to create your User Account, which you can use to securely utilize the Platform.
• User-Provided Health Data: In addition to demographic information, we may collect information regarding your health status; health conditions, which may include mental health conditions; allergies; medications; and lifestyle information, such as exercise, sleep, stress level, vaccination status, and tobacco and alcohol use. We collect this information to provide you with the Platform.
• Uploaded Documents: If you choose, we collect files you upload, which may include, but not be limited to, lab reports, prescriptions, images, and insurance cards. We collect this information to provide you with the Platform.
• Connected Source Data: We may collect information imported from external sources you explicitly authorize and connect to the Platform, including electronic health record (“EHR”) systems, retail pharmacies, health insurers, and personal wearable devices.
• Derived and Inferred Health Data: We collect informational summaries computed by the Platform based on your other Personal Data, such as health trend indicators and plain-language record summaries.
• AI Assistant Interactions: We collect text queries and prompts you enter when using the Platform’s AI assistant feature.
• Support Data: If you contact us for support or to lodge a complaint, we may collect technical or other information from you through log files and other technologies, such as your app version, operating system, and device model, some of which may qualify as Consumer Health Data. Such information will be used for troubleshooting, customer support, software updates, and improvement of the Platform.
• Technology Data: Our servers automatically record technical information when you use the Platform, including your IP address, the date and time of each request, and the address of the request, and the user agent your device reports when you sign up, sign in, or sign out. The app sends your device’s time zone. If you choose to search for nearby clinics, we collect your device’s location at that time and use it only for that search; because it may indicate that you are seeking health services, we treat it as Consumer Health Data. If you turn on notifications, we collect a push notification token from Apple or Google. We do not collect advertising identifiers, and the app does not use cookies or third-party analytics or crash-reporting tools.

Sources of Consumer Health Data

We collect Consumer Health Data from the following categories of sources:

• Directly from you: When you register your User Account, complete intake profiles, upload documents, communicate with our AI assistant feature, or input information to utilize our Platform.
• Connected External Sources and Integrated Platforms: From external platforms and health systems that you explicitly authorize and connect to the Platform, including electronic health record (“EHR”) systems, retail pharmacies, health insurance plans, and personal wearable devices or health apps.
• Automatically from your Device: The technical information described above, including your location if you choose to search for nearby clinics.
• Third-Party Authentication Partners: From third-party authentication services, such as Google, if you choose to log into your User Account using your Google credentials.

Why We Collect and Use Consumer Health Data

We process your data based on legitimate business interests, the fulfillment of our Services, or your consent, specifically for the following purposes:

• To provide the Platform;
• To fulfill our contractual obligations to you;
• To communicate with you about and manage your User Account;
• To properly store and track your data within our system;
• To respond to lawful requests from public and government authorities, and to comply with applicable state/federal law, including cooperation with judicial proceedings and court orders;
• To protect our rights, privacy, safety, or property, and/or that of you or others by providing proper notices, pursuing available legal remedies, and acting to limit our damages;
• To handle technical support and other requests from you;
• To enforce and ensure your compliance with our zLifespan Terms of Use or the terms of any other applicable services agreement we have with you;
• To manage and improve our operations and the Platform, including the development of additional functionality;
• To manage payment processing;
• To evaluate the quality of service you receive, identify usage trends, and improve your user experience;
• To keep our Platform safe and secure;
• To send you information about changes to our terms, conditions, and policies; and
• To allow us to pursue available remedies or limit the damages that we may sustain.

Categories of Consumer Health Data We Share

We do not sell your Consumer Health Data. We do not share or disclose your Consumer Health Data to third-party advertising networks, data brokers, or retargeting marketing services. We may share any of the categories of Consumer Health Data collected when necessary to provide our Platform or to satisfy legal mandates.

Third Parties and Affiliates with Whom We Share Consumer Health Data

We share Consumer Health Data with the following categories of third parties and affiliates:

• Business Partners and Vendors: We share Consumer Health Data with a limited number of partners, service providers, and other persons/entities who help run our business (“Business Partners”). Specifically, we may employ third-party companies and individuals to facilitate our Platform, provide components of the Platform on our behalf, perform Platform-related functions, or assist us in analyzing how our Platform is used. Our Business Partners are contractually bound to protect your Consumer Health Data and to use it only for the limited purpose(s) for which it is shared. Business Partners’ use of Consumer Health Data may include, but is not limited to, the provision of services such as data hosting, IT services, customer services, and payment processing.
• Our Advisors: We may share your Consumer Health Data with third parties that provide advisory services to zLifespan, including, but not limited to, our lawyers, auditors, accountants, and banks (collectively, “Advisors”). Consumer Health Data will only be shared with Advisors if zLifespan has a legitimate business interest in the sharing of such data.
• Third Parties Upon Your Direction or Consent (Including Healthcare Providers): You may direct zLifespan to share your Consumer Health Data with third parties, such as your designated healthcare providers or care team members. Upon your request and consent, we share your data with those third parties that you identify. Note regarding provider messaging: While Consumer Health Data you input and manage directly in the Platform is governed by state consumer health privacy laws, messages and clinical records transmitted directly to or from your healthcare provider or care team through a provider-messaging workflow are handled by zLifespan as a “Business Associate” under HIPAA and governed by a Business Associate Agreement (“BAA”) between zLifespan and your healthcare provider or care team.
• Corporate Affiliates: We may share Consumer Health Data with our corporate affiliates, parent companies, or subsidiaries under common ownership and control, provided that such entities are bound to protect your Consumer Health Data in a manner consistent with this policy.
• Third Parties Pursuant to Business Transfers: In the event of a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of zLifespan’s corporate entity, assets, or stock (including in connection with any bankruptcy or similar proceedings), we may share your Consumer Health Data with a third party.
• Government and Law Enforcement Authorities: If reasonable and necessary, to comply with legal processes, judicial orders, or enforceable government requests, or to investigate violations of the zLifespan Terms of Use, we may share your Consumer Health Data with Government and Law Enforcement Authorities.

Data Retention

zLifespan retains your Consumer Health Data only as long as necessary for our business operations, the provision of the Platform, archival purposes, and/or to satisfy legal requirements. In general, zLifespan deletes your Consumer Health Data within thirty (30) days after your User Account is closed, unless applicable law requires us to keep it longer or it is needed for a pending dispute. Copies held in backups are deleted when those backups expire on their normal schedule. Consumer Health Data you chose to share with your healthcare provider becomes part of that provider’s records and is retained under the provider’s own policies. At the conclusion of the retention period, we will securely remove your Consumer Health Data from our active databases and require our Business Partners to do the same.

Your State Consumer Health Data Rights

Under Washington, Nevada, Connecticut, and additional applicable state health privacy laws, residents utilizing our Platform have specific legal rights regarding their Consumer Health Data:

• Right to Confirm and Access: You have the right to confirm whether we are collecting or sharing your Consumer Health Data and to obtain a copy of your data in a readily usable format.
• Right to a List of Recipients: You have the right to request a list of all third parties and specific affiliates with whom your Consumer Health Data has been shared, disclosed, or sold.
• Right to Delete: You have the right to request the complete deletion of your Consumer Health Data from our databases and to have our business partners do the same.
• Right to Withdraw Consent: You have the right to withdraw your consent for the ongoing collection or sharing of your Consumer Health Data at any time. Revoking consent will not affect the lawfulness of processing conducted prior to your withdrawal.
• Right to Appeal: If we decline to act on any of your data rights requests, you have the right to appeal our decision.

In compliance with Washington, Nevada, Connecticut, and additional applicable state health privacy laws, zLifespan does not implement geofences around healthcare facilities, hospitals, mental health centers, clinics, or medical offices to identify consumers, track movements, collect health data, or deliver targeted health notifications.

Security and Breach Notification

zLifespan implements reasonable physical, technical, and administrative safeguards to protect Consumer Health Data. In the event of a data or security breach involving unsecured identifiable Consumer Health Data, zLifespan will investigate promptly and notify affected individuals and the Federal Trade Commission (“FTC”) without unreasonable delay, and in no case later than sixty (60) calendar days following discovery, in compliance with the FTC Health Breach Notification Rule (16 C.F.R. Part 318) and applicable state health data breach notification laws.

How to Exercise Your Rights

To exercise your right to access, delete, request recipient lists, withdraw consent, or appeal a decision, please contact our Privacy Officer at privacy@zlifespan.com, submit a request at https://privacy.zlifespan.com, or call +1 201-614-5203.

Appeals: If your request is denied, you may submit a formal appeal within forty-five (45) days by replying directly to the denial notification. If your appeal is denied, we will provide you with a direct link to submit a complaint to your state Attorney General.

To request the complete deletion of your data and User Account, you may adjust your account settings within the Platform, submit a request at https://privacy.zlifespan.com, or email privacy@zlifespan.com with your login email address and a formal statement requesting account deletion.

Written correspondence may be mailed to:

zLifespan, Inc.

Attn: Privacy Officer

8 Providence Street

New Providence, NJ 07974