Pyx Health Washington Consumer Health Data Public Platform Privacy Policy Addendum

WHAT IS CONSUMER HEALTH DATA

The WMHMDA broadly defines Consumer Health Data as personal information that is linked or reasonably linkable to a Washington Consumer and that identifies the Washington Consumer’s past, present, or future physical or mental health status (collectively “Consumer Health Data”). Consumer Health Data does not include information that is de-identified or publicly available.

CONSUMER HEALTH DATA WE MAY COLLECT

As described in the Personal Information We May Collect About You section of our Public Platform Privacy Policy, the Consumer Health Data we collect about you depends on the purpose and nature of your interactions with us on our Public Platform and on what Services and features you use on our Public Platform. It will also depend on the choices you make (including your privacy settings), your location, and Appliable Law. The personal information we collect may include Consumer Health Data within the meaning of the WMHMDA, including:

• Information about your physical or mental health status including, (i) information about individual health conditions, treatment, diseases, or diagnosis; (ii) social, psychological, behavioral, and medical interventions; (iii) health-related surgeries or procedures; and (iv) reproductive or sexual health information.
• Biometric data
• Precise location information that could reasonably indicate an individual attempt to acquire or receive health services or supplies
• Data that identifies a consumer seeking health care services

• Other information used to associate or identify an individual with any category of health data that is derived or extrapolated from non-health information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning)

  We may collect and store Consumer Health Data you share with us on the Public Platform including as you navigate our Public Platform through the use of Automated Technologies as set forth in the Automated Technologies section of our Public Platform Privacy Policy.

HOW WE MAY USE THE CONSUMER HEALTH DATA WE COLLECT FROM YOU

We collect and use Consumer Health Data for the purposes described in the How We May Use Your Consumer Health Data section of our Public Platform Privacy Policy. Primarily, we collect and use Consumer Health Data as reasonably necessary to provide you access to the Services you have requested through our Public Platform This may include :

• A purpose you direct. You direct us to collect, use, and/or disclose your Consumer Health Data.
• Marketing to you. For example, this may include determining what products and Services you may be interested in; marketing products and Services to you.
• Notice of Changes to Our Public Platform Privacy Policies and Public Platform Terms of Use. For example, notifying you about changes to our Public Platform, our Public Platform Terms of Use, and our Public Platform Privacy Policy.
• Enhancing your experience with us on our Public Platform. For example, this may include recommending products and Services based on preferences; delivering jurisdiction-specific Platform content; tailoring your experience on our Public Platform; and drawing inferences from your Consumer Health Data to tailor your experience on our Public Platform and identify the products you might be interested in.
• Legal and regulatory compliance. For example, this may include complying with applicable laws, regulations, and oversight obligations; for quality assurance; for internal and external audits and investigations; engaging with law enforcement and other governmental bodies; for litigation; for compliance with mutual policies and procedures, contracts, and oversight obligations; and enforcing contractual obligations and exercising contractual rights.
• Our internal purposes. For example, this may include conducting, managing, maintaining, and improving our products and Services; business operations and processes; security and privacy practices, which may include, but not be limited to detecting, investigating, and resolving potential vulnerabilities, data security, or privacy incidents; quality assurance; business continuity; systems, networks, applications, and databases, which may include, but not be limited to preventing, finding, and resolving software, hardware, or application bugs and issues.

HOW WE MAY DISCLOSE YOUR CONSUMER HEALTH DATA

We may disclose any of the Consumer Health Data categories listed above to processors, service providers, and subcontractors that help us provide products and services to you and to our affiliates.

We instruct these affiliates processors, service providers, and subcontractors to only use Consumer Health Data as permitted by our contracts with them and consistent with applicable law.

Please note that we do not sell your Consumer Health Data.

We may also disclose Consumer Health Data as permitted by applicable law, including:

• With your consent.
• To prevent, detect, protect from, or respond to security incidents, identity theft, fraud, harassment, or malicious or deceptive activities.
• To a third party acquiring our assets if Pyx Health sells its business or otherwise is part of a merger, acquisition, bankruptcy, or other transaction involving a third party taking control of our assets or business.
• To investigate, report, or take legal action to protect our rights, property, and safety and the rights, property, and safety of others.
• To protect your or others’ vital interests, including health and safety.

Third Parties With Which We May Share Consumer Health Data. As necessary for the purposes described above, we share Consumer Health Data with the following categories of third parties:

• Service providers. Vendors or agents working on our behalf may access Consumer Health Data for the purposes described above. For example, companies we’ve hired to assist in protecting and securing our systems and Services may need access to data to provide those functions.
• Business partners. We may share Consumer Health Data with other companies, for example, where you use a service that is cobranded and jointly operated with another company, or where you use our Services to interact with another company.
• Government agencies. To respond to law enforcement requests, subpoenas, or other legal processes, or as otherwise required by law, by court order, or to respond to a governmental/regulatory request;
• Other third parties. In certain circumstances, it may be necessary to provide data to other third parties, for example, to comply with the law or to protect our rights or those of our customers.

YOUR RIGHTS AND CHOICES

You may have certain rights with respect to your Consumer Health Data under WMHMDA, including rights to access, delete, or withdraw consent from future collection or sharing, subject to certain exceptions. See the section on Rights and Choices You May Have About Your Consumer Health Data in our Public Platform Privacy Policy for more details on the rights and choices you may have regarding your Consumer Health Data.

Your Right Not to Receive Discriminating Treatment. We will not discriminate against you for exercising any of your rights under this Washington Addendum. You have a right not to receive discriminatory treatment by us for exercising your privacy rights.

The Right to Know/Access the Consumer Health Data We Collected And How We Shared Your Information. You have the right to request a copy of, or access to, the Consumer Health Data that we have collected and maintain about you.

Right to Withdraw Your Consent. You have the right to withdraw consent for the collection and sharing of your Consumer Health Data. If we seek your consent, we will provide you with a process for withdrawing it.

Right to Request Deletion of Consumer Health Data. You have the right to request that we delete any Consumer Health Data we have collected from you. Subject to certain exceptions set out below, we will, on receipt of a verifiable request, delete your Consumer Health Data from our records and direct any service providers to do the same. We will also notify all third parties with whom we have shared your Consumer Health Data of your request to delete.

We may deny your deletion request if retaining the Consumer Health Data is reasonably necessary for us (or our affiliates, processors, contractor(s), or third parties) to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any activity that is illegal under Washington state law or federal law; preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action that is illegal under Washington state law or federal law.

Please also note that any request to delete collected Consumer Health Data may impact your ability to interact with us or to use our Public Platform for its intended purposes.

EXERCISING YOUR RIGHTS AND CHOICES.

You can exercise the rights set out in this section above by emailing us at [email protected]. We will not require you to create a new account to submit a request, though we may require authentication using an existing account. We may ask you to provide additional Personal Data, such as name and date of birth so that we can properly identify you in our data systems. We will only use Personal Data provided in a request to review to comply with your request. If you choose not to provide this information, we may only be able to process your request to the extent we are able to identify you in our data systems. In certain circumstances, we may decline a request to exercise the rights described above.

Appealing Our Decision About Your Rights. If we have denied your request to exercise your rights under the WMHMDA, you may appeal our denial. Please submit your appeal request by contacting us [email protected]. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

CHANGES TO THIS WASHINGTON ADDENDUM

We reserve the right, at any time, to add to, change, update, or modify this Washington Addendum. We reserve the right to provide data and privacy transparency as required by law. If we decide to change this Washington Addendum, we will notify you by posting a new policy through our Public Platform and change the “Last Updated” at the top of this Washington Addendum. Any change, update, or modification will be effective immediately upon posting to our Public Platform and will apply to any Consumer Health Data provided to us on and after that date. If we make material changes to the type of Consumer Health Data collected, or how we share, use or sell Consumer Health Data, we will provide you with notice to the e-mail address you provided, if you provided one. It is important that you monitor this Washington Addendum and your e-mail for changes to this Washington Addendum. We may also request that you confirm you have read this Washington Addendum and any revised version before we provide you access to our Public Platform. We will accept your continued use of our Public Platform after we make changes to constitute acceptance of those changes.

Changes to the Washington Addendum will not affect our use of previously provided Consumer Health Data.

CONTACT US

If you have any questions about this Washington Addendum, the ways in which we may collect and use your Consumer Health Data described in this Washington Addendum, or your choices and rights regarding such use, please feel free to contact us at

Mailing Address: Pyx Health, Inc.

Attn: Privacy Officer

4625 E. Fort Lowell Road

Tucson, AZ 85712

Phone Number: 520‑263‑0701

Email Address: [email protected]