Consumer Health Data Privacy Notice

Effective Date: November 8, 2025

This Consumer Health Data Privacy Notice (“Notice”) provides information regarding the consumer health data (defined below) that Vida Health, Inc. (“Vida”, “we”, “us”, or “our”), in conjunction with Vida Medical, PC, a California professional corporation, Vida Medical, P.A., a Kansas professional association, Vida Medical, New Jersey, P.C., a New Jersey professional corporation, and Vida Medical P.A., a Delaware professional corporation (collectively, the “Affiliated Practices”, “Affiliates”, or “Vida Medical”) collects, how we collect and use that information, and to whom we disclose it. This Notice applies to Connecticut, Nevada, and Washington residents about whom we collect consumer health data, and is intended to provide notices in compliance with the Connecticut Data Privacy Act (“CTDPA”), Nevada SB 370, and Washington’s My Health, My Data Act (“MHMD”). This Notice incorporates our Terms of Use and Privacy Policy. Any capitalized terms not otherwise defined in this Notice have the meaning given to them in our Terms of Use.

This Notice applies to information we collect from users of our Services. This Notice does not apply to information we collect from individuals in a business-to-business or employment context. This Notice also does not apply to third-party websites, applications, products, services, or other properties, even if they may link to our Services or our Services link to them. We recommend you review the privacy practices of those third parties.

Please note that we are providing these disclosures in the interest of transparency. Such disclosures are not intended to waive any exemptions under applicable law.

1. Collection of Consumer Health Data

For purposes of this Notice, “personal information” means information that identifies or is reasonably capable of being associated or linked, directly or indirectly, with an individual in Connecticut, Nevada, and/or Washington. Personal information does not include de-identified data or publicly available information. “Consumer health data” means personal information that is linked or reasonably linkable to an individual and that identifies the individual’s past, present, or future health status or mental health status, as may be applicable.

We may collect the following categories of consumer health data:

  • Individual health condition, treatment, disease, or diagnosis information.
  • Social, psychological, behavioral, and medical intervention information.
  • Health-related surgery or procedure information.
  • Use or purchase of prescribed medication information.
  • Reproductive or sexual health information.
  • Gender affirming care information.
  • Data that identifies you seeking health services.
  • Vital signs, symptoms, or measurement of health information.
  • Diagnosis or diagnostic testing, treatment, or medication information.
  • Information about your access to healthcare, including precise location information that could reasonably indicate an attempt to acquire or receive health services or supplies.
  • Information that we or our service providers process to associate or identify you with above information or any other information relating to physical or mental health treatments, conditions, or status that may be derived from non-health information (such as inferred data).

2. Sources of Consumer Health Data

We collect consumer health data from the following sources:

  • Directly from you through your interactions with us, such as when you register for or use our Services, complete electronic forms, or otherwise communicate with us.
  • Our service providers and business partners, in accordance with applicable law and the context in which you provided the data.
  • Healthcare providers, health plans, pharmacy benefits manager, employer group plan, or other payors, when information is necessary to provide our Services, determine program eligibility, or to comply with legal and regulatory obligations.
  • Affiliates and subsidiaries, including parent entities, corporate affiliates, subsidiaries, business units, and other companies that share common ownership.

Consistent with users’ expressed preferences, we may use third-party cookies, pixels, and similar trackers that collect data to enhance experience on our Services, analyze usage on our Services, and assist in our marketing efforts. To the extent that we use these trackers in a manner that may constitute “selling” or “sharing” consumer health data collected through these technologies with third parties for advertising purposes, we implement measures to help ensure that we do not use third-party cookies for individuals accessing our services from Nevada or Washington.

3. Use of Consumer Health Data

We use the consumer health data we collect for the following purposes:

  • To provide and manage the Services, including creating your account, identifying representatives and providers in your area facilitating the delivery of our Services, and addressing any support needs.
  • To respond to your inquiries, requests, and feedback, such as answering questions, providing information on programs and services, or connecting you with a representative.
  • To analyze how our Services are used and improve their performance.
  • To provide you with information about our Services, including, but not limited to, contacting you about new product lines, product updates, details of current and future projects, quality and technical issues, and to invite you to participate in surveys, promotions, or other marketing activities.
  • In accordance with applicable legal requirements, to allow us and our advertising partners to personalize your experience when using the Services and on third-party platforms, including through advertising on our websites, third-party sites, and via email or text message.
  • To support internal operations such as research, reporting, and data analytics.
  • To enable third parties or agents to help Vida maintain the Services, analyze how users use the Services, or provide other administrative services to Vida.
  • To comply with applicable laws and regulations.
  • To protect or defend Vida’s legal rights or property.
  • To enforce the legal or contractual terms that govern our Services.
  • For any other disclosed purposes to which you consent.
  • As otherwise required or permitted by law.

4. Disclosure of Consumer Health Data

We only disclose consumer health data in accordance with applicable law, including as needed to provide you with the products or Services that you request, as required by law, or with your consent. Accordingly, we may disclose any or all the above categories of consumer health data to the following parties:

  • Service Providers (including those hosting or analyzing data on our behalf).
  • Authorized/legal representatives.
  • Family, friends, or third parties invited to be part of your team or participate in chat sessions with your health coach or others.
  • Healthcare providers, health plans, pharmacy benefits manager, employer group plan, or other payors.
  • Medical professionals that provide services to you via our Services.
  • Affiliates and subsidiaries, including parent entities, corporate affiliates, subsidiaries, business units, and other companies that share common ownership.
  • Business transferees, if we are involved in a merger, acquisition, asset sale, or other corporate combination.
  • Other third parties with your consent.

Additionally, under certain circumstances, we may be required to disclose your consumer health data if required to do so by law, in response to valid requests by public authorities, or in response to a threat of harm involving an individual’s health or safety.

As noted above, we implement measures to help ensure that we do not share the consumer health data relating to individuals accessing our Services from Nevada or Washington with third-party platform providers who assist us in serving advertising.

5. Consumer Health Data Privacy Rights

Connecticut residents have the following rights in relation to your consumer health data, subject to certain exceptions:

  • Right to know and access. You have the right to know what consumer health data we process, as the term is defined under the CTDPA. You may ask us to provide you with a portable copy of this information up to two times in a rolling twelve-month period.
  • Right to delete. You have the right to request under certain circumstances that we, as well as our service providers and contractors, delete the consumer health data that we collect about you.
  • Right to correct inaccurate consumer health data. You have the right to request the correction of inaccurate consumer health data.
  • Right to opt out. You have the right to opt out of targeted advertising, our sale of your personal information, and profiling decisions that could produce legal or similarly significant effects.
  • Rights concerning sensitive personal information. We cannot process your consumer health data, or use your consumer health data for certain purposes without your affirmative consent.
  • Right to non-discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described above.

Nevada and Washington residents may have the following rights in relation to your consumer health data, subject to certain exceptions:

  • Right to know. You have the right to know what consumer health data we collect, share, or sell, as those terms are defined under applicable law. You also have the right to obtain a list of all third parties and affiliates with whom we have shared or sold your consumer health data, and an active email address or other mechanism that you may use to contact these third parties. If you are a Washington resident or otherwise protected by Washington law, you also have the right to access your consumer health data that we collect, share, or sell.
  • Right to withdraw consent. You have the right to withdraw consent from the collection and sharing of your consumer health data.
  • Right to delete. You have the right to request that we, as well as our service providers and contractors, delete the consumer health data that we collect about you.
  • Right to non-discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described above.

a. How to exercise your right

You may submit a request pursuant to any of these rights by contacting us at compliance@vida.com.

We do not charge a fee to process or respond to your request unless it is excessive, repetitive, manifestly unfounded, or in accordance with applicable law. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. We will respond to your request within forty-five (45) days after receipt and we reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days.

We cannot respond to your request or provide you with consumer health data if we cannot verify or authenticate your identity or authority to make the request and confirm that the consumer health data relates to you. We will only use consumer health data provided in a verifiable or authenticated consumer request to verify your (or your authorized agent’s as applicable) identity or authority to make the request. Connecticut residents may designate an authorized agent to submit a request on your behalf, and if so, we may require proof of the agent’s authorization by you and/or verification of the agent’s own identity.

If you are a visually impaired customer, a customer who has another disability or a customer who seeks support in another language, you may access your privacy rights by emailing us at compliance@vida.com.

b. How to appeal decisions about your rights

Residents of Connecticut, Nevada, and Washington can appeal decisions about privacy rights in the following ways:

  • Connecticut. If you are a Connecticut resident and want to appeal our decision regarding a request that you have made, please Contact Us. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact Connecticut’s Office of the Attorney General by phone at (860) 808-5420 or by submitting a form here.
  • Nevada. If you are a Nevada resident and want to appeal our decision regarding a request that you have made, please Contact Us. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If your appeal is not successful, you may submit a complaint with the Nevada Attorney General here.
  • Washington. If you are a Washington resident or located in Washington and want to appeal our decision regarding a request that you have made, please Contact Us. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact Washington’s Office of the Attorney General by phone at (800) 551-4636 or by submitting a complaint here.

6. Changes to This Notice

We may update this Notice from time to time. We will notify you of any changes by posting the new Notice on this page. If we make material changes to this Notice, we will also let you know via email and/or a prominent notice on our Services, prior to the change becoming effective and update “effective date” at the top of this Notice. We recommend reviewing this Notice periodically for any changes. Changes to this Notice are effective when they are posted on this page.

7. Contact Us

If you have any questions or concerns about this Notice or our privacy practices, please contact us at compliance@vida.com.