Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how Wellthrive Inc. ("Wellthrive," "we," "us," or "our") handles consumer health data. It is general information about our privacy practices and is not legal advice. It supplements, and should be read together with, our Privacy Policy. Wellthrive is a wellness and nutrition education service and does not provide medical diagnosis, treatment, clinical decision support, lab interpretation, or medication or supplement action.

1. What We Treat as Consumer Health Data

Some information you provide or authorize may be "consumer health data" under Washington, Nevada, Connecticut, or other state laws. On a conservative (high-watermark) basis, we treat the following as consumer health data where it is linkable to you:

• Meals and nutrition entries you choose to log.
• Supplement logs you choose to record.
• Values, units, dates, and source reference ranges from any health or lab report you choose to upload, shown back to you on a pass-through basis.
• Optional health connections you authorize from supported third-party health data sources.
• Skin wellness inputs you choose to provide where you enable skin features, including the skin goals you select, free-text skin-concern descriptions, irritation notes, and ingredient-sensitivity preferences.
• Wellness profile information you provide.
• Any health-context fields generated to organize your wellness information.

Technical and account data, such as device and session metadata, are not consumer health data by themselves unless we use them to infer your health status.

General contact, waitlist, and account-deletion request forms are not intended to collect consumer health data. Please do not include medical, lab, supplement, skin, genetic, or other health details in those forms. If you need to exercise privacy rights over consumer health data, use the consumer-health-data rights mechanism described in this Policy.

2. How We Collect and Use Consumer Health Data

We collect and use consumer health data only to provide the wellness and education features you request, with consent where required by law, or to the extent necessary to provide a product or service you requested. We do not create diagnoses, disease-risk scores, deficiency conclusions, treatment plans, or individualized clinical recommendations from this data.

3. No Sale and No Advertising Use

We do not sell consumer health data. We do not use consumer health data for advertising, sponsored-campaign measurement, affiliate matching, or partner analytics. Raw health values and notes are not provided to advertising networks, sponsored-campaign measurement tools, affiliate partners, or partner analytics.

4. No Geofencing

We do not use geofencing around healthcare facilities to identify, track, collect data from, or send health-related messages to consumers.

5. Your Consumer Health Data Rights

Subject to applicable law, you may:

• Confirm whether we are processing your consumer health data and access that data, including a list of third parties and affiliates with whom it has been shared.
• Request deletion of your consumer health data. Where required, we will notify affiliates, processors, contractors, and third parties to whom the data was disclosed to delete it, subject to lawful retention and backup-restoration limits.
• Withdraw consent for any optional health-source connection or upload.
• Appeal a decision we make about a request.

If you delete your consumer health data or withdraw consent for skin features, we also remove your skin profile, notes, derived personalization caches, and related event references.

For requests based on applicable Québec law, we respond in writing with diligence and no later than 30 days after receiving the request. For requests under certain U.S. consumer health data laws, we aim to respond to verified requests within 45 days, with one extension where permitted by law. To make a request, contact us at the address below.

6. Service Providers and Processors

Service providers and processors process consumer health data only under written instructions and confidentiality, security, deletion, and assistance obligations.

7. Cross-Border Transfers

Wellthrive Inc. is organized in the Republic of Korea. Depending on the feature and provider used, personal information may be accessed from Korea and processed in the United States or other regions by service providers such as Supabase and Vercel. We maintain a transfer and processor record, use contractual safeguards, restrict access to personnel and processors with a need to know, and apply technical and organizational safeguards appropriate to the sensitivity of the data. See the Cross-Border section of our Privacy Policy for more detail.

8. Genetic and Neurotechnology Data

Genetic, DNA, and neurotechnology features are disabled. We do not collect, analyze, transfer, or store genetic or neurotechnology data. If such a feature is activated in the future, we will present separate consent, transfer, retention, processor, and deletion terms before any collection or transfer, and we will not use such data for advertising, lookalike or affiliate matching, or product ranking.

9. Contact and Complaints

Questions or requests about consumer health data can be sent to privacy@wellthrive-inc.com. Where provided by law, you may also contact the relevant regulator in your state, or file a complaint or submit a dispute to the competent authority, including the Commission d'accès à l'information du Québec.