Health Data Privacy Policy

Effective Date: [8/27/2026]

1. SCOPE AND APPLICABILITY

This Consumer Health Data Privacy Policy ("Policy") supplements the Privacy Policy of Control Health LLC (“Company”) and applies solely to the extent required by applicable Consumer Health Privacy Laws. Except as expressly provided in this Policy, the Privacy Policy governs Company's collection, use, disclosure, retention, and other processing of Personal Information. This Policy describes Company's collection, use, disclosure, and other processing of Consumer Health Data and the rights that may be available to certain individuals under applicable law. Capitalized terms not otherwise defined in this Policy have the meanings assigned to them in our Terms of Service (“Terms of Service”) and Privacy Policy (“Privacy Policy”).

This Policy applies only to Consumer Health Data collected through or in connection with your access to or use of the Platform. It does not apply to information collected by independent healthcare providers, laboratories, Laboratory Platform Providers, pharmacies, electronic health record systems, health information exchanges, wearable device providers, or other Third-Party Services, each of which maintains its own privacy practices and privacy notices.

Company collects, uses, discloses, and otherwise processes Consumer Health Data only for the purposes described in this Policy, to the extent reasonably necessary to provide the Platform and requested services, fulfill the purposes for which the Consumer Health Data was collected, comply with applicable law, or as otherwise permitted or required by applicable Consumer Health Privacy Laws. Company will obtain any consent or authorization required by applicable Consumer Health Privacy Laws before collecting, using, or disclosing Consumer Health Data where such consent or authorization is required.

Except as expressly provided in this Policy, the Company's Privacy Policy continues to govern Company's collection, use, disclosure, retention, and other processing of Personal Information.

To the extent any provision of this Policy conflicts with applicable Consumer Health Privacy Laws, the applicable law will govern solely to the extent of the conflict.

2. DEFINITIONS

For purposes of this Policy:

"Consumer Health Data" has the meaning assigned under applicable Consumer Health Privacy Laws and generally means Personal Information that is linked or reasonably linkable to an individual and identifies or can reasonably be used to identify the individual's past, present, or future physical or mental health status.

"Consumer Health Privacy Laws" means applicable federal, state, or local laws regulating the collection, use, disclosure, sale, sharing, or other processing of Consumer Health Data, including laws that provide specific rights regarding Consumer Health Data.

3. CONSUMER HEALTH DATA WE COLLECT

Depending on your use of the Platform and the features you choose to use, Company may collect the following categories of Consumer Health Data:

Health Information. Health history, medical conditions, diagnoses, symptoms, treatments, procedures, medications, allergies, immunizations, laboratory orders, laboratory results, vital signs, medical records, health-related questionnaires, assessments, wellness information, and other health-related information that you provide or authorize Company to access.
Healthcare Services Information. Information relating to healthcare providers, laboratories, Laboratory Platform Providers, pharmacies, specimen collection sites, appointments, laboratory requests, laboratory status updates, laboratory reports, and other healthcare services or providers with whom you choose to interact through the Platform.
AI Interactions. Health-related prompts, questions, instructions, uploaded documents, conversations, searches, requests, summaries, AI-generated outputs, and other information processed through your use of AI Features.
Connected Health Device Information. Health-related information received from wearable devices, health applications, fitness devices, or other connected devices or services that you choose to connect to the Platform, including biometric information, activity information, sleep information, heart rate information, and similar health-related measurements.
Precise Geolocation Information. Precise geolocation information, where you authorize its collection through your device or browser and where such information constitutes Consumer Health Data under applicable Consumer Health Privacy Laws.
Health-Related Inferences. Inferences, insights, and other information reasonably derived from the Consumer Health Data described above to provide, personalize, secure, maintain, improve, or support the Platform and requested services, consistent with applicable law.

Company does not knowingly collect Consumer Health Data directly from individuals under eighteen (18) years of age.

4. SOURCES OF HEALTH DATA

Company may collect Consumer Health Data from one or more of the following sources, depending on how you use the Platform:

Directly from you, including when you create an account, complete your profile, upload records or documents, submit information through the Platform, communicate with Company, use AI Features, request Laboratory Services, complete questionnaires or surveys, or otherwise interact with the Platform.
From healthcare providers and other Third-Party Services that you authorize, including laboratories, Laboratory Platform Providers, electronic health record systems, health information exchanges, pharmacies, wearable device providers, health applications, and other third parties that you choose to connect to the Platform or authorize to provide information to Company.
Automatically through your use of the Platform, including Consumer Health Data generated through your interactions with AI Features, your use of Platform functionality, authorized device permissions, connected wearable devices, or other features that you choose to enable.
From service providers acting on Company's behalf, where necessary to provide, operate, maintain, support, secure, or improve the Platform or to provide services that you request.

Company may combine Consumer Health Data received from multiple sources as reasonably necessary to provide the Platform and requested services, subject to applicable Consumer Health Privacy Laws.

5. HOW WE USE CONSUMER HEALTH DATA

Company may collect, use, disclose, and otherwise process Consumer Health Data for the following purposes, as permitted or required by applicable Consumer Health Privacy Laws:

To create, administer, and maintain your Platform account.
To retrieve, organize, display, maintain, and otherwise provide access to Health Information and other information that you authorize Company to access through the Platform.
To provide AI Features, including retrieving, accessing, and processing Consumer Health Data reasonably necessary to generate AI-powered summaries, explanations, search results, educational content, organizational tools, and other AI-generated Outputs that you request.
To facilitate Laboratory Services requested or authorized by you, including coordinating requests with independent Laboratory Platform Providers, transmitting information necessary to process laboratory requests, receiving laboratory results through authorized electronic connections, and displaying laboratory information within the Platform.
To provide customer support, respond to inquiries, troubleshoot technical issues, communicate regarding your account, and respond to your requests.
To operate, maintain, secure, monitor, troubleshoot, test, evaluate, improve, and enhance the Platform, AI Features, retrieval systems, search functionality, and related technologies.
To detect, investigate, prevent, and respond to fraud, abuse, unauthorized access, security incidents, malicious activity, and violations of Company's agreements.
To comply with applicable law, legal process, governmental requests, contractual obligations, and professional or regulatory requirements, and to establish, exercise, or defend legal claims.
To create, use, and disclose Aggregated Data, De-identified Data, Usage Data, Platform Data, and other information that does not reasonably identify you for research, analytics, benchmarking, product development, quality improvement, software testing, artificial intelligence evaluation, and other lawful business purposes consistent with applicable law. Consumer Health Data that has been Aggregated or De-identified in accordance with applicable law is no longer treated as Consumer Health Data for purposes of this Policy.

Consumer Health Data may be disclosed to different categories of recipients depending on the services you request and the permissions or authorizations you provide through the Platform.

In providing the Platform and requested services, Company may organize, summarize, index, search, analyze, derive, or otherwise process Consumer Health Data that you provide or authorize Company to access through AI Features and other Platform functionality. Such processing is performed solely to provide, operate, maintain, secure, support, and improve the Platform and requested services, or as otherwise permitted by applicable Consumer Health Privacy Laws.

Company does not use identifiable Consumer Health Data for interest-based advertising or cross-context behavioral advertising.

6. HOW WE SHARE CONSUMER HEALTH DATA

Company may disclose Consumer Health Data with your consent or authorization where required by applicable law, at your direction, as reasonably necessary to provide the Platform and requested services, as otherwise described in this Policy, or as otherwise permitted or required by applicable Consumer Health Privacy Laws.

Depending on your use of the Platform, Company may disclose Consumer Health Data to the following categories of recipients:

Service Providers. Vendors and service providers that provide cloud hosting, data storage, cybersecurity, payment processing, communications, customer support, software development, artificial intelligence processing, analytics, infrastructure, monitoring, auditing, and other business operations on Company's behalf.
Healthcare Providers and Laboratory Service Providers. Healthcare providers, laboratories, Laboratory Platform Providers, specimen collection sites, pharmacies, and other healthcare organizations that you authorize to interact with the Platform or that are reasonably necessary to provide requested Laboratory Services or other requested Platform functionality.
Third-Party Services Authorized by You. Electronic health record systems, health information exchanges, wearable device providers, consumer health applications, payment processors, and other Third-Party Services that you choose to connect to the Platform or authorize Company to exchange information with.
Professional Advisors. Attorneys, accountants, auditors, insurers, consultants, financing sources, and other professional advisors providing services to Company.
Corporate Transactions. Actual or prospective purchasers, investors, lenders, financing sources, merger partners, successors, or other participants in connection with an actual or proposed merger, acquisition, financing, investment, asset sale, reorganization, bankruptcy, or other corporate transaction, subject to appropriate confidentiality obligations and applicable law.
Government Authorities and Legal Process. Courts, regulators, law enforcement agencies, governmental authorities, or other third parties where disclosure is required or permitted by applicable law or legal process.

Company does not sell Consumer Health Data.

Company does not disclose identifiable Consumer Health Data to third parties for interest-based advertising or cross-context behavioral advertising.

7. AI FEATURES

The Platform includes AI Features designed to help you organize, search, summarize, understand, and interact with your Health Information.

When you choose to use AI Features, Company processes only the Consumer Health Data reasonably necessary to provide the requested AI functionality. Depending on the AI Feature you use, this may include processing prompts, questions, uploaded documents, Health Information available within your Platform account, laboratory results, medical records, prior AI interactions within your account, and other information reasonably necessary to respond to your request.

Company may use third-party artificial intelligence service providers to process Consumer Health Data on Company's behalf in order to provide AI Features. Company does not authorize third-party artificial intelligence providers to use your identifiable Consumer Health Data or identifiable AI conversations to train or improve publicly available foundation artificial intelligence models, except with your consent or as otherwise required or expressly permitted by applicable law.

Additional information regarding the operation of AI Features is provided in our Privacy Policy and Terms of Service.

8. YOUR CONSUMER HEALTH PRIVACY RIGHTS

Subject to applicable Consumer Health Privacy Laws, you may have certain rights regarding your Consumer Health Data, including the right to:

Confirm whether Company is collecting, using, or disclosing your Consumer Health Data.
Access Consumer Health Data collected about you.
Delete Consumer Health Data maintained by Company, subject to applicable legal exceptions.
Withdraw consent or authorization for Company's collection, use, or disclosure of Consumer Health Data where processing is based upon your consent or authorization.
Obtain a list of categories of third parties and specific third parties with whom Company has shared your Consumer Health Data, where required by applicable law.
Appeal Company's denial of a privacy request, where required by applicable law.

These rights are not absolute and may be limited or subject to exceptions under applicable Consumer Health Privacy Laws.

9. EXERCISING YOUR PRIVACY RIGHTS

You or your authorized representative, where permitted by applicable law, may submit a request to exercise your rights by contacting Company using the contact information provided below.

Company may take reasonable steps to verify your identity and authority before responding to your request. If Company is unable to verify your identity or authority, Company may request additional information before processing your request or may deny the request as permitted by applicable law.

If Company denies your request and applicable Consumer Health Privacy Laws provide a right to appeal, Company will provide information regarding how to submit an appeal and the applicable appeal process. If your appeal is denied, Company will inform you of any additional rights or remedies available under applicable Consumer Health Privacy Laws, if any.

Company will respond to verified requests within the time periods required by applicable Consumer Health Privacy Laws.

10. SALE OF CONSUMER HEALTH DATA

Company does not sell your Consumer Health Data.

Company does not use or disclose identifiable Consumer Health Data for interest-based advertising or cross-context behavioral advertising.

If Company's practices regarding the sale or disclosure of Consumer Health Data materially change in the future, Company will update this Policy and, where required by applicable Consumer Health Privacy Laws, obtain any required consent before engaging in such activities.

11. CHANGES TO THIS POLICY

Company may revise this Policy from time to time to reflect changes in the Platform, applicable law, our information practices, or other operational, legal, or regulatory requirements. When we make material changes, we will update the "Effective Date" above and provide any additional notice required by applicable law.

Your continued access to or use of the Platform following the effective date of an updated Policy constitutes your acknowledgment of the revised Policy, except to the extent additional consent is required by applicable law.

12. CONTACT US

If you have any questions regarding this Policy or wish to exercise your rights under applicable Consumer Health Privacy Laws, please contact Company at:

Control Health LLC
Attn: Privacy
421 Penman St., Suite 310
Charlotte, NC 28203

Email: privacy@controlhealth.ai