Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how Wellthrive Inc. ("Wellthrive," "we," "us," or "our") handles consumer health data. It is general information about our privacy practices and is not legal advice. It supplements, and should be read together with, our Privacy Policy. Wellthrive is a wellness and nutrition education service and does not provide medical diagnosis, treatment, clinical decision support, lab interpretation, or medication or supplement action. If we make material changes to this Policy, we will update the date shown above and, where required by law, give you additional notice before the change takes effect.

1. What We Treat as Consumer Health Data

Some information you provide or authorize may be "consumer health data" under Washington, Nevada, Connecticut, or other state laws. On a conservative (high-watermark) basis, we treat the following as consumer health data where it is linkable to you:

• Meals and nutrition entries you choose to log.
• Supplement logs you choose to record.
• Values, units, dates, and source reference ranges from any health or lab report you choose to upload, shown back to you on a pass-through basis.
• Optional health connections you authorize from supported third-party health data sources.
• Skin wellness inputs you choose to provide where you enable skin features: your skin goals and notes, irritation notes, sensitivity and ingredient-avoidance inputs, routine preferences, and how you use the skin features.
• Health goals, health conditions, allergies, medication classes, and body and lifestyle information you choose to provide. Additional categories such as reproductive-health information, blood-glucose data or genetic information are treated as consumer health data only if you choose to activate the relevant feature.
• Your messages to the Plus AI Coach and the Coach's replies, including scheduled check-in messages if you turn them on.
• Any health-context fields generated to organize your wellness information.

Technical and account data, such as device and session metadata, are not consumer health data by themselves unless we use them to infer your health status.

General contact, waitlist, and account-deletion request forms are not intended to collect consumer health data. Please do not include medical, lab, supplement, skin, genetic, or other health details in those forms. If you need to exercise privacy rights over consumer health data, use the consumer-health-data rights mechanism described in this Policy.

2. How We Collect and Use Consumer Health Data

Except as described in the next paragraph, we collect and use consumer health data only to provide the personalized Wellthrive wellness service you request, including tailored general wellness guidance, analysis of meal and supplement entries, and possible food or supplement cautions based on the health conditions, allergies, and medication classes you provide, with consent where required by law, or to the extent necessary to provide a product or service you requested. If you choose to use the Plus AI Coach, we also use the information and results you have entered or enabled to generate personalized wellness explanations and, if you turn on Coach check-ins, to prepare the scheduled check-in you asked for, sending only the information needed for your question or check-in to an AI service provider acting on our behalf (see Section 6). These features are informational only and do not diagnose, treat, prescribe, or tell you to start, stop or change a medication or supplement. We do not create diagnoses, disease-risk scores, deficiency conclusions, treatment plans, or individualized clinical recommendations from this data.

With your separate consent, we also use the corrections you make to AI food capture results for one additional purpose: to create de-identified statistics that help us improve the accuracy of food capture. We handle de-identified information as described in Section 10 of our Privacy Policy. You can withdraw this consent at any time in the app's privacy settings or by contacting us at the address in Section 9, and we will then stop collecting your corrections for this purpose.

3. No Sale and No Advertising Use

We do not sell consumer health data. We do not use consumer health data for advertising, sponsored-campaign measurement, affiliate matching, or partner analytics. Raw health values and notes are not provided to advertising networks, sponsored-campaign measurement tools, affiliate partners, or partner analytics. We do not use consumer health data to decide who receives wellness tips, app news, or Wellthrive Plus information by email; those emails are sent based on your account information only, as described in Section 3 of our Privacy Policy.

4. No Geofencing

We do not use geofencing around healthcare facilities to identify, track, collect data from, or send health-related messages to consumers.

5. Your Consumer Health Data Rights

Subject to applicable law, you may:

• Confirm whether we are processing your consumer health data and access that data, including a list of third parties and affiliates with whom it has been shared.
• Request deletion of your consumer health data. Where required, we will notify affiliates, processors, contractors, and third parties to whom the data was disclosed to delete it, subject to lawful retention and backup-restoration limits.
• Withdraw consent for any optional health-source connection or upload, or for our use of your AI food capture corrections to create de-identified statistics.
• Appeal a decision we make about a request.

If you delete your consumer health data or withdraw consent for skin features, we also remove your skin profile, notes, derived personalization caches, and related event references.

For requests based on applicable Québec law, we respond in writing with diligence and no later than 30 days after receiving the request. For requests under certain U.S. consumer health data laws, we aim to respond to verified requests within 45 days, with one extension where permitted by law. To make a request, contact us at the address below.

6. Service Providers and Processors

Service providers and processors process consumer health data only under written instructions and confidentiality, security, deletion, and assistance obligations. The processors that may receive consumer health data are listed in Section 7 of our Privacy Policy. AI service providers act as processors for the Coach and process what you send to the Coach and the limited health context Wellthrive provides for that conversation or scheduled check-in only under Wellthrive’s instructions to provide the Coach service, and not for advertising or model training, subject to applicable security and legal requirements. Our AI service provider may retain inputs and outputs for up to 30 days for abuse monitoring, or longer where required by law or for safety reasons, and does not use them to train its models.

7. Cross-Border Transfers

Wellthrive Inc. is organized in the Republic of Korea. Depending on the feature and provider used, personal information may be accessed from Korea and processed in the United States or other regions by service providers such as Supabase and Vercel. We maintain a transfer and processor record, use contractual safeguards, restrict access to personnel and processors with a need to know, and apply technical and organizational safeguards appropriate to the sensitivity of the data. See the Cross-Border section of our Privacy Policy for more detail.

8. Genetic and Neurotechnology Data

Genetic, DNA, and neurotechnology features are disabled. We do not collect, analyze, transfer, or store genetic or neurotechnology data. If such a feature is activated in the future, we will present separate consent, transfer, retention, processor, and deletion terms before any collection or transfer, and we will not use such data for advertising, lookalike or affiliate matching, or product ranking.

9. Contact and Complaints

Questions or requests about consumer health data can be sent to privacy@wellthrive-inc.com. Where provided by law, you may also contact the relevant regulator in your state, or file a complaint or submit a dispute to the competent authority, including the Commission d'accès à l'information du Québec.