Consumer Health Data Privacy Policy

1. About This Policy

This Consumer Health Data Privacy Policy explains how Affinity Direct, a division of Affinity Whole Health LLC ("Affinity Direct," "we," "us," or "our"), collects, uses, and shares "consumer health data" as that term is defined in Washington's My Health My Data Act, Nevada's consumer health data law (SB 370), Connecticut's consumer health data provisions, and similar laws in other states. Consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status.

This policy supplements our Privacy Policy. It does not apply to protected health information governed by HIPAA, which is described in our HIPAA Notice of Privacy Practices, or to other information exempt under these laws. If you have questions about which applies to you, contact us using the details below.

2. Consumer Health Data We Collect and Why

Depending on the products and services you use, we may collect the following categories of consumer health data:

• Health assessment and intake answers — answers to our online questionnaires and screenings (for example, about sexual health, weight, height and body mass index, medical conditions, current medications, allergies, pregnancy or breastfeeding, prior treatment, and treatment goals), and the results of those assessments, such as a score, a suggested treatment option, or whether you appear eligible.
• Treatment and order information — the health products and treatments you view, request, purchase, or subscribe to (including prescription medications and supplements), prescriptions and provider decisions, refill and renewal check-in answers, video-visit scheduling and attendance, and shipping and delivery status.
• Identity verification photos — photos of your government-issued ID and, for some treatments, of your face, which providers and staff review to verify your identity. We do not create a face template or other biometric identifier from these photos, though a photo of your face may be considered biometric data under some state laws.
• Communications — messages, photos, and questions you send to our care team or providers, specialist call requests, and reasons you give when you pause or cancel a subscription.
• AI Wellness Advisor questions — questions you type into our AI Wellness Advisor, which are used to generate a reply and are not stored as transcripts, and any question you choose to send to our care team. A question typed into the box on our home page also becomes part of a web address (see our Privacy Policy).
• Online activity that relates to health — the health-related pages you visit on our site, the steps you complete in our online assessments, and related device, browser, IP-address, cookie, and advertising identifiers.
• Inferences — conclusions we or our providers draw from the information above, such as eligibility for a treatment or the product most likely to fit your goals.

We use consumer health data to: provide the products and services you request, including provider review, prescribing, pharmacy fulfillment, and shipping; verify your identity and prevent fraud; process payments, refills, and subscriptions; communicate with you about your orders and care; send you reminders about assessments or orders you started, and offers and other marketing messages about our products, which we may choose based on the products you have viewed, requested, or purchased, how far you got in an assessment and its result, and information in your profile such as your sex (you can opt out of marketing messages at any time); credit affiliates, referral partners, and referring patients for orders and calculate their commissions and rewards; prepare internal notes and summaries for our staff, including with the help of AI tools, so our care team can assist you; respond to your questions and requests; operate, secure, and improve our website and services; measure and improve our marketing and advertising; and comply with legal and professional obligations.

3. Where We Get Consumer Health Data

• You, when you use our website, complete an assessment, place an order, message us, or call us.
• Healthcare providers, including our own clinicians and the independent medical group in our partner provider network, about provider decisions, prescriptions, visits, and messages.
• Pharmacies and shipping carriers, about fulfillment, shipping, and delivery.
• Our payment processor, about the status of your payments.
• Affiliates and referral partners, who may give us your name, contact information, and the product they are recommending when they send you a link.
• Our staff, who record notes and information you give them by phone or message.
• Technology and advertising services, such as approximate location derived from your IP address and advertising click identifiers.
• Inferences we draw from the information above.

4. Consumer Health Data We Share and With Whom

We may share the consumer health data described in Section 2 with the following categories of third parties, as described below and to the extent needed for the purposes described in this policy:

• Healthcare providers — our own licensed clinicians and the independent medical group in our partner provider network, and the care platform it uses, which review your requests and treat you.
• Pharmacies, including compounding pharmacies, that prepare, dispense, and ship your treatment.
• Service providers and processors that act on our behalf, including electronic health record, cloud hosting and database, email, text-message and communications, payment processing, network, and shipping providers.
• Analytics and advertising partners, including social media and search platforms, which may receive the online activity described in Section 2 and hashed (cryptographically obscured) identifiers to help us measure our advertising. They do not receive your identity-verification photos, your complete questionnaire responses, your medical or prescription records, or your messages with our care team.
• Affiliate marketers and referral partners who sent you a link, who may see that you received or opened it, whether an order was placed through their referral, and limited order information used to calculate their commission. They do not see your questionnaire answers or payment card information.
• Professional advisors, government authorities, and others where required by law, to protect the rights and safety of our patients or the public, to establish or defend legal claims, or in connection with a merger, acquisition, financing, or sale of assets.

Companies under common ownership (affiliates). Affinity Direct is a division of Affinity Whole Health LLC. We share consumer health data with these affiliates: (1) Affinity Whole Health's in-person clinics, which are operated by Affinity Whole Health LLC or by companies under common ownership or control with it, and which may access consumer health data about patients they treat or support; and (2) Core Pharmacy (Core Compounding), a pharmacy under common ownership with Affinity Whole Health, which receives order and patient information (such as your name, date of birth, contact details, shipping address, the product or medication ordered, quantity, prescription details, and order and payment status) to fill, ship, and support orders and to help us run our pharmacy operations. We do not share consumer health data with any other company under common ownership or control with us.

5. Third-Party Collection Across Websites

The analytics and advertising partners described above may collect information about your online activities over time and across different websites and online services, including when you use our website.

6. Sale of Data and Geofencing

We do not sell consumer health data for money, and we do not provide it to data brokers. We do not use geofencing to collect consumer health data or to send messages around healthcare facilities, and we do not collect precise geolocation from your device; we and our service providers may infer your approximate location (such as country, state, or city) from your IP address.

7. Your Rights

Depending on where you live, you may have the right to:

• Confirm and access — confirm whether we collect, share, or sell your consumer health data, access that data, and receive a list of the third parties and affiliates with whom we have shared or sold it, with a way to contact them;
• Withdraw consent you have given to our collection or sharing of your consumer health data, or ask us to stop collecting, sharing, or selling it, where your state provides that right. When you make this request, we will tell you which collection and sharing will stop, which will continue, and why;
• Delete your consumer health data, including, where the law requires, copies held by our processors and third parties;
• Correct inaccurate information, and opt out of the use of your data for targeted advertising, where your state provides those rights; and
• Appeal our decision on your request.

How to make a request. Email virtual@affinitywholehealth.com with the subject "Consumer Health Data Request," call (330) 647-5849, or write to us at the address below. Tell us your state of residence, the right you want to exercise, and the email address or phone number you use with us. We may need to verify your identity before acting on a request, and an authorized agent may make a request for you where the law allows.

Timing and cost. If you live in a state that gives you these rights, we will respond within 45 days after we receive your request (Nevada residents: within 45 days after we verify it). If it is reasonably necessary, given the complexity and number of your requests, we may extend that period once by up to 45 additional days; if we do, we will tell you, with our reasons, within the first 45 days. Nevada residents: we will complete a verified deletion request within 30 days after we verify it. Data stored on archived or backup systems may be deleted later, within the period the law allows. If we cannot verify your identity using commercially reasonable efforts, we are not required to act on the request and may ask you for more information. Requests are free of charge up to twice in a 12-month period; we may decline or charge a reasonable fee for requests that are manifestly unfounded, excessive, or repetitive, where the law allows.

Limits. We may decline or limit a request where an exemption applies — for example, where the data is protected health information or part of a medical record we are required by law to keep, where we need it to complete a transaction you requested, to detect or prevent fraud or security incidents, to comply with a legal obligation, or to establish or defend legal claims. If we decline, we will tell you why.

Appeals. If we decline your request, you may appeal by replying to our decision, emailing virtual@affinitywholehealth.com with the subject "Consumer Health Data Appeal," or using any of the other methods above, within 60 days. We will respond in writing within 45 days of receiving your appeal, explaining what we decided and why. If your appeal is denied, you may contact your state Attorney General: Washington, Nevada, or Connecticut.

We will not discriminate against you for exercising these rights.

8. How We Protect Consumer Health Data

We use reasonable administrative, technical, and physical safeguards designed to protect consumer health data, and we limit access to it to authorized workforce members, service providers, and contractors for the purposes described in this policy. No method of storage or transmission is completely secure.

9. Changes to This Policy

We may update this policy from time to time. We will post the updated policy on this page with a new "last updated" date. For a material change, we will also post a notice on our website, and where the law requires, email you or ask for your consent, before the change takes effect.

10. Contact Us

Affinity Direct — Privacy Officer
Email: virtual@affinitywholehealth.com
Phone: (330) 647-5849 (privacy questions only)
Affinity Whole Health LLC
3401 Richmond Road, Suite 101
Beachwood, OH 44122