PRIVACY STATEMENT & DATA GOVERNANCE POLICY

Provider: Turritopsis Inc., a Nevada corporation (“Company”, “we”, “us”, or “our”) This Privacy Statement describes how Turritopsis Inc. collects, processes, and protects your personal data when you use the Coach application. This document is directly integrated with and governed by our Early Access Agreement & Terms of Service and our Medical, Health, and Safety Disclaimer. For detailed information regarding our handling of sensitive health and biometric data under state consumer health privacy laws, please refer to our standalone Consumer Health Data Privacy Policy. By accessing or using the Coach app, you confirm that you have read, understood, and agreed to the data practices described herein. Privacy Principles We take your privacy seriously and are committed to ensuring you clearly understand how we collect, use, share, and protect your personal data. We have invested heavily, and will continue to invest, in robust product features, infrastructure, and administrative safeguards to protect the confidentiality, integrity, and security of your personal data. Applicable Service: The Coach mobile application and associated backend voice/cloud systems (the “Service”) 1. Our Core Data Principles: Zero Sale, Service-Only Use No Selling or Renting of Data: We do not sell, rent, monetize, broker, or trade your personal information, voice recordings, or fitness data to data brokers, advertising networks, or third parties for marketing purposes. Service-Only Purpose: We collect and process your information solely to provide, operate, debug, and improve the Coach experience for you. No Marketing Profiling: Your interactions and health-related metrics are never used to serve targeted third-party advertising. Government & Legal Requests: We will only disclose your personal information or data to government agencies or law enforcement authorities if compelled to do so by a valid legal process, such as a legally binding subpoena, warrant, or court order. 2. Information We Collect To deliver an adaptive, voice-first coaching service, the Coach app collects the following categories of information: Account & Profile Information: Name, email address, age, gender, and basic profile attributes collected during your intake interview. Conversational Audio & Transcripts: Spoken inputs captured when using voice features (including wake-phrase interactions, responses to check-in queries, and audio prompts), together with the resulting machine-generated text transcripts. This includes what you say right after your coach asks you a question, and rep counts you say during a set, which are sent without the wake phrase. Health, Fitness & Biometric Inputs: Daily weigh-ins, body metrics, target goals, workout logs, nutritional/meal logs, energy ratings, and habit completion records. Apple Health and Connected Devices: With your permission, sleep, heart rate variability, resting heart rate, steps, weight, height, VO2 max, workouts recorded by other apps (with heart rate, energy, and distance), and food, water, and caffeine logged in other apps; heart rate during each set from the Apple Watch; and readings from a Bluetooth scale you connect. Check-In and Intake Answers: Mood, sleep quality, snoring, and daily stress from check-ins; and family medical history, pregnancy, blood pressure readings, food allergies and diet, and whether you have had genetic testing, from the intake interview. Feedback Reports: What you write or dictate in a report, an optional screenshot, the last 30 minutes of the app's log, and device details. Account and Device Identifiers: Your Apple or Google account identifier, push notification tokens, and time zone. Lab Results: Laboratory test results (biomarkers) you upload, tell your coach, or type in, with the laboratory's reference ranges and flags and the date and laboratory of the test. Coach has no way to upload genetic or DNA data at this time; we will update this policy before it does. The intake interview may ask whether you have had genetic testing, and anything you tell your Coach in conversation is kept with your conversation history. Technical & Diagnostic Telemetry: Device identifiers, iOS version, system crash logs, latency benchmarks, session durations, and interaction timestamps necessary to debug the software. Lab Report Uploads: When you upload a lab report, the Coach app reads it on your iPhone. Before anything leaves your phone, the app automatically removes the identifying details it recognizes, such as your name, date of birth, address, and patient and accession numbers, and keeps only the results on Coach's list of supported markers. Other results, such as infectious disease and drug screening tests, stay on your phone. We never upload or store the report itself. The remaining result lines are sent to our servers and to our language model provider to be read into values. Values you have not yet confirmed are held as a draft for up to seven days and then discarded; only values you confirm are saved to your record. 3. How We Use Your Information We use the data collected strictly for the following operational purposes: Real-Time Coaching Generation: Processing your spoken queries and daily check-ins to generate personalized workout programming, dietary guidelines, and progress predictions via our deterministic rule engine and AI model pipelines. Session Continuity: Maintaining conversation state across morning and evening check-ins so your coach remembers recent logs, adjustments, and preferences. Operating and Improving the Service: Our team reviews interaction logs, system errors, and account records, including records that identify you when a problem requires it, to operate the Service, fix problems, and improve Coach responses, voice transcription, and prompts. We do not conduct or publish research using your data. Consumer Health Data: We treat your health and fitness information as sensitive consumer health data. For comprehensive disclosures on health-specific data collection, dual-consent frameworks, and state health privacy rights, please refer to our standalone Consumer Health Data Privacy Policy. General state privacy rights (such as CCPA/CPRA) and overall data governance principles remain governed by this Privacy Statement & Data Governance Policy for the Coach app. Lab Results: We use the lab results you confirm to rank areas of your health for attention under our wellness framework, adjust your nutrition targets and training, show projected ranges from published research, and let your coach discuss your results with you. We do not use lab results for research, analytics, or improving our models. Safety Verification: Ensuring that generated recommendations comply with the internal safety protocols and deterministic guardrails established by our programming guidelines. 4. Third-Party Infrastructure & Technical Processors To deliver voice and generative AI features, we send the data each request needs to the service providers below. Each processes it on our behalf under its commercial terms and data processing agreement with us. Cloud Hosting: Amazon Web Services hosts our servers and encrypted databases. Language Model: Anthropic (the “LLM Provider”) processes your conversations, check-ins, lab results, and related health and fitness data to generate coaching responses. LLM Provider’s terms prohibit it from training its models on this data. LLM Provider may keep it for a limited time to detect misuse and meet legal obligations. Voice: ElevenLabs runs voice conversations and synthesizes spoken coaching audio, so it receives your voice audio and conversation transcripts. We have opted out of ElevenLabs using our data to train its models. ElevenLabs keeps each conversation's audio and transcript for no more than 30 days, and we have them deleted sooner when you delete your account. ElevenLabs may also use this data as its terms permit, such as for security, abuse prevention, and service analytics. When your Coach speaks about your lab results, ElevenLabs receives those values to produce the speech. Sign-In and Notifications: Apple and Google confirm your identity when you sign in with them. Apple delivers push notifications, which may include your first name and a short line from your Coach. Bug Tracking & Feedback: GitHub processes bug reports, engineering telemetry, and user feedback that may contain health data under strict data processing and privacy terms. We do not allow these providers to sell your data or use it for advertising. You can read their own policies at anthropic.com/legal/privacy, elevenlabs.io/privacy-policy, and docs.github.com/en/site-policy/privacy-policies/github-privacy-statement. Future Technology & Infrastructure Updates As artificial intelligence, language model architectures, and voice technologies evolve, we reserve the right to integrate additional or alternative technology providers and models to power the Service. Any future third-party processors will be bound by strict data processing agreements that prohibit the sale of your data, bar the use of your health or conversational data for model training, and enforce security standards equal to or exceeding those outlined in this policy. Material updates regarding the addition of new core infrastructure partners will be communicated by updating Section 4 directly and updating the Privacy Policy Last Updated date. 5. On-Demand Data Deletion via App Settings You retain full ownership and control over your personal data. Self-Service Data Deletion at Any Time: You may permanently delete your data, including conversational history, voice recordings, and health logs at any point directly within the application: Open the Coach app. Navigate to App Settings. Select "Delete account" and confirm. Effect of Deletion: Once initiated, your personal identifiers, profile data, conversation transcripts, and biometric logs are permanently purged from our active databases. We also have your voice conversations deleted from our voice provider's systems. We keep a record that your account was deleted (a random account number and the date), and usage and cost records with your identity removed. Server logs that include your account number are kept for up to 90 days. Backups: Residual copies in secure, encrypted system backups will be permanently overwritten in accordance with standard backup rotation cycles (typically within 30 days). Lab Results: Delete a lab panel in the Biomarkers section (Settings > Biomarkers) to delete its results, or withdraw your lab results consent to delete all of them. Results you do not confirm are discarded within seven days. Results you said to your Coach remain in your conversation history until you delete your account. 6. California Privacy Rights (CCPA / CPRA) This section applies solely to residents of California under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”). A. Statutory Consumer Rights Right to Know / Access: You have the right to request access to the specific pieces and categories of personal information we have collected about you, the sources of collection, the business or commercial purpose, and the third parties with whom we share it. Right to Delete: You have the right to request the deletion of personal information collected from you, subject to certain exceptions provided by law. Right to Correct: You have the right to request correction of inaccurate personal information maintained about you. Right to Limit Use of Sensitive Personal Information: You have the right to limit our use and disclosure of sensitive personal information (such as health data, biometric information, or precise location) to only those uses necessary to perform the Service. Right to Opt-Out of Sale / Sharing: We do not sell or share your personal information for cross-context behavioral advertising. Should this practice change, you will be provided a direct opt-out mechanism. Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. B. Categories of Information Collected Identifiers & Contact Info: Name, email address, age, and profile attributes. Sensitive Personal Information: Health and fitness logs, biomarker lab results, and audio recordings/transcripts of voice communications. Internet / Technical Activity: Device identifiers, operating system version, and system diagnostic logs. C. Submitting & Verifying Consumer Requests To exercise your California privacy rights, you may submit a request by emailing ops@turritopsis.ai with the subject line “CCPA Request” or by using the self-service deletion feature in App Settings. To protect your privacy and security, we verify your identity by matching the email address provided in your request against the registered account details in our systems before processing your request. 7. Data Security Measures We implement administrative, technical, and physical safeguards engineered to protect your personal and biometric data against unauthorized access, loss, or alteration. All data in transit between the iOS application, our backend servers, and inference APIs is protected using Transport Layer Security (TLS/HTTPS) encryption, and sensitive database volumes are encrypted at rest. Because Coach is experimental software, we encourage you to maintain independent records of any critical personal fitness logs. 8. Relationship to Medical Disclaimers Turritopsis Inc. is not a healthcare provider, health plan, or business associate under the Health Insurance Portability and Accountability Act (HIPAA), so the information you give Coach, including lab results, is not protected health information under HIPAA. We protect it as described in this policy, and we use it to provide wellness guidance rather than medical care. 9. Changes to This Policy We may update this Privacy Statement periodically to reflect functional updates to the Coach app or evolving legal requirements. Any material changes will be communicated by updating Section 4 directly where applicable and updating the Privacy Policy Last Updated date. 10. Privacy Contact If you have questions regarding this Privacy Statement or our data handling practices, please contact: Turritopsis Inc. Attention: Privacy Officer Email: ops@turritopsis.ai