CONSUMER HEALTH DATA PRIVACY POLICY

Provider: Turritopsis Inc., a Nevada corporation ("Company", "we", "us", or "our") Application / Service: Coach (iOS application and related backend voice/data services, available exclusively to users located in the United States) (the "Service" or "Early Access Service") 1. Scope and Overview This standalone Consumer Health Data Privacy Policy describes how Turritopsis Inc. collects, uses, stores, discloses, and protects Consumer Health Data in connection with the Coach mobile application and related voice and wellness coaching platforms. This policy is published pursuant to applicable consumer health data privacy laws, including Washington’s My Health My Data Act (MHMDA, RCW 19.373) and Nevada’s Consumer Health Data Law (NRS 603A). Under these statutes, "Consumer Health Data" is defined broadly as personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. 2. Categories of Consumer Health Data Collected To deliver voice-first wellness coaching and personalized program adjustments, we collect the following categories of Consumer Health Data directly from you or through connected device integrations: User-Reported Symptoms & Check-Ins: Information you share during daily voice or text check-ins (Morning Readiness and Evening Reflection), including daily pain ratings, soreness, fatigue, stress levels, energy ratings, and notes on how you feel physically. Health Conditions, Medications, and Intake Data: Information provided during your initial intake interview or profile updates, such as health conditions, past or current physical injuries, physical impairments, medications, and dietary supplements. Biometric & Physical Metrics: Body measurements, weight logs, workouts, exercise sets/reps, caloric and macronutrient targets, meals, and meal photographs. Conversational Audio & Transcripts: Spoken voice inputs, audio recordings, and machine-generated transcripts of your dialogues with Coach regarding your health, physical progress, and wellness goals. Connected Health & Sensor Telemetry: Biometric telemetry synced via Apple Health (which may include data from your watch, ring, or scale), the Apple Watch app, or a Bluetooth scale you connect, including sleep stages, resting heart rate, heart rate variability (HRV), step counts, and physical exertion metrics. Laboratory Results & Biomarkers: Confirmed lab test values (e.g., ApoB, HbA1c, ferritin, vitamin D), reference ranges, laboratory flags, test draw dates, and laboratory names. Note on On-Device De-identification: Lab reports uploaded to the app are processed on your iPhone locally. Personal identifiers (name, date of birth, address, accession numbers) and unsupported test lines are automatically removed on your device before any data leaves your phone. 3. Sources of Consumer Health Data We collect Consumer Health Data from the following sources: Direct Consumer Inputs: Voice recordings, text entries, and photo uploads you submit directly to the Coach app. Connected Devices & Applications: Biometric data streams synced with your explicit permission from Apple Health, the Apple Watch app, or a Bluetooth scale you connect. Laboratory Test Documents: Lab biomarker panels confirmed by you through the Blood work section. 4. How We Use Consumer Health Data (Purposes of Processing) We collect and process Consumer Health Data strictly to operate and deliver the Coach wellness service, specifically for: Personalized Wellness Coaching: Formulating and adjusting your fitness, workout, and nutritional programs, generating daily check-in recommendations, and projecting wellness trends. Safety & Risk Mitigation: Enforcing deterministic safety rules, such as pausing workout intensity and advising you to consult a licensed physician when reported symptoms indicate potential health risks. Service Quality Improvement: Our team reviews health and performance records, including records that identify you when a problem requires it, to fix problems and improve coaching and system performance. Laboratory Data Utilization: Using confirmed biomarker values to highlight areas of health focus, adjust nutritional targets, and discuss research-backed ranges with you. STRICT ZERO-SALE AND NO-ADVERTISING GUARANTEE: We never sell, rent, broker, or trade Consumer Health Data. We never use Consumer Health Data for third-party advertising, marketing, or profiling. We never use lab result data for model training, analytics, or research. 5. Sharing and Disclosure of Consumer Health Data Under Washington MHMDA and Nevada NRS 603A, "sharing" includes disclosing or transferring data to third parties or service providers. We disclose Consumer Health Data strictly to contracted service providers (data processors) who assist us in operating the Service. Categories of Third-Party Processors & Recipients: Generative Language Model Provider (Anthropic): Purpose: Processing conversation transcripts, health check-ins, and confirmed lab values to generate coaching responses. Protections: Contractually prohibited from using Consumer Health Data to train foundational AI models, selling data, or retaining data beyond necessary operational/compliance periods. Voice Synthesis & Transcription Providers (ElevenLabs): Purpose: Transcribing spoken voice audio and generating synthetic voice coaching audio. Protections: Audio recordings and transcripts are retained for no more than 30 days (or until account deletion) and opt-out controls prevent model training. Cloud Infrastructure & Hosting Providers (Amazon Web Services - AWS): Purpose: Encrypted server hosting, database storage, and system backups. Protections: Enterprise security controls and encryption at rest and in transit. Push Notifications (Apple): Purpose: Delivering reminders and coaching notifications, which may include your first name and a short line from your coach. Protections: Apple's push service terms. Bug Tracking & Issue Management (GitHub): Purpose: GitHub processes bug reports, engineering telemetry, and user feedback that may contain health data. Protections: Subject to strict data processing agreements and enterprise privacy terms. Each processor is bound by a strict Data Processing Agreement requiring them to process Consumer Health Data solely on our behalf and subject to non-disclosure obligations. 6. Dual-Consent Framework & Withdrawal Procedures In compliance with MHMDA and Nevada law, we maintain a separate, distinct opt-in consent structure: Collection Consent: Separate opt-in consent to collect your health and wellness data. Sharing Consent: Separate opt-in consent to transmit your data to our named technology processors (Anthropic, ElevenLabs, AWS). Laboratory Consents: Dedicated separate consents for collecting and sharing blood work / laboratory results prior to your first upload. How to Withdraw Your Consents: Account Consents: You can withdraw your collection or sharing consent at any time in Settings > Privacy. Effect: Withdrawing consent pauses coaching functionality immediately (since Coach cannot operate without these consents). While coaching is paused, the Service stops accepting new health data from any of your devices. Your historical data is retained securely in a paused state until you re-consent or choose to delete your account. Laboratory Consents: You can withdraw your blood work consents in Settings > Biomarkers > Blood work. Effect: Withdrawing lab consents immediately deletes all confirmed lab panels and results, the lab answers from your intake interview, and recommendations based on your results, such as walks after meals. What you said about your results in conversation stays in your conversation history until you delete your account. 7. Consumer Privacy Rights Subject to statutory verification and exceptions under Washington MHMDA and Nevada NRS 603A, you hold the following rights regarding your Consumer Health Data: Right to Confirm Processing & Access: You have the right to confirm whether we are collecting, sharing, or processing your Consumer Health Data, and to request access to such data, including a list of all third parties and affiliates with whom data has been shared. Right to Withdraw Consent: You have the right to withdraw your consent for the collection or sharing of your Consumer Health Data at any time. Right to Delete: You have the right to request the permanent deletion of your Consumer Health Data. Self-Service Deletion: You may permanently delete your account, conversation history, and biometric data directly within the app by selecting Settings > Delete account. Right to Non-Discrimination: We will not discriminate against you, deny you services, or charge different prices for exercising any of your consumer privacy rights. How to Exercise Your Rights or Submit an Appeal: To exercise your access or deletion rights, or if you wish to appeal a decision regarding a privacy request: Email: ops@turritopsis.ai (Subject: Consumer Health Data Privacy Request) App Settings: Use the Delete account or consent withdrawal features directly in the app. We will acknowledge and process your request within forty-five (45) calendar days as required by law. If an appeal is denied, we will provide instructions on how to submit a complaint to the relevant State Attorney General (Washington AG or Nevada AG). 8. Security and Data Retention We employ administrative, physical, and technical security safeguards—including Transport Layer Security (TLS/HTTPS) encryption in transit and AES-256 database encryption at rest—to protect Consumer Health Data against unauthorized access or disclosure. Retention Period: Consumer Health Data is retained for as long as your account remains active to provide coaching continuity. Deletion Lifecycle: When you initiate account deletion in Settings, your profile, transcripts, and biometric records are permanently purged from active servers, and deletion requests are issued to our voice processor and retried until it confirms them. We keep a record that the deletion happened, which contains no health data. System backup copies are overwritten within 30 days. 9. Changes to This Policy We reserve the right to update this Consumer Health Data Privacy Policy to reflect changes in legal requirements or system features. Material updates will be highlighted by updating the "Last Updated" date at the top of this policy and providing in-app notifications. 10. Contact Us If you have any questions, concerns, or requests regarding this policy or our health data practices, please contact: Turritopsis Inc. Attention: Privacy Officer Email: ops@turritopsis.ai