CONNEQT Consumer Health Data Privacy Policy

Effective date: August 15, 2026
Last updated: August 15, 2026
Version: 1.0.1

This Consumer Health Data Privacy Policy supplements the CONNEQT Privacy Notice and provides disclosures under Nevada and other applicable U.S. consumer-health privacy laws. The separate Washington Consumer Health Data Privacy Policy applies to consumer health data covered by Washington's My Health My Data Act. This Policy applies when and to the extent another applicable consumer-health law covers consumer health data controlled by CONNEQT, Inc. ("CONNEQT," "we," "us," or "our").

"Consumer health data" means personal information that identifies or is reasonably capable of being linked to a consumer and that identifies the consumer's past, present, or future physical or mental health status, as defined by applicable consumer-health privacy law. This can include information that is inferred from other information.

This Policy is not a HIPAA Notice of Privacy Practices. When a licensed healthcare provider receives information for its own healthcare operations, the provider's notice and applicable healthcare law govern the provider's records. This Policy continues to govern CONNEQT's handling of consumer health data within CONNEQT's control.

1. Consumer health data we collect

Depending on the products and features you use, we may collect:

• Measurements and device data: blood pressure, heart rate, pulse and waveform information, central arterial measurements or indices, timestamps, product identifiers, and related measurement-quality information.
• Health profile information: age or date of birth, sex assigned at birth, height, weight, and other profile information you provide for a requested health feature.
• App health content: readings, trends, notes, selected goals or program responses, reports, assessments, and files or information you choose to add or share.
• Derived or inferred information: summaries, trends, scores, reports, assessments, or other outputs generated to provide a requested CONNEQT feature.
• Prescription and eligibility information: required eligibility confirmations and the health, demographic, contact, and location information submitted for prescription review.
• Health-related support information: health or product-use information you choose to provide when requesting support.
• Health-feature activity: limited records showing that a health feature, report, assessment, export, sharing function, or permission was used.
• Website health-interest data: pseudonymous identifiers, campaign or referral information, visits to health-related content, product and cart activity, limited purchase events, and inferences those events may support about a person's health interests.

2. Sources of consumer health data

We collect consumer health data from:

• you, including information entered in the app, an intake, a note, a questionnaire, or a support request;
• your CONNEQT PULSE or another compatible CONNEQT feature you choose to use;
• the CONNEQT Health app when it organizes measurements or generates a requested output;
• a connected health service that you expressly authorize;
• a healthcare professional or another person only when you direct the transfer or that person is legally authorized to act for you; and
• your browser or device when you interact with covered CONNEQT website pages, products, cart functions, or purchase-confirmation pages after the required privacy choice.

3. Why and how we process consumer health data

We collect and process consumer health data for the purposes described below, subject to any choice, consent, or authorization required by law:

• connect a compatible product and display, organize, trend, store, or export readings;
• provide the app, Care+, reports, assessments, and other health features you request;
• maintain the accuracy, integrity, security, and reliability of those features;
• administer eligibility and route prescription intake for the provider review you request;
• respond to health-related product or technical support requests;
• measure and understand website use, campaigns, referrals, and purchases using first-party analytics and attribution;
• measure or optimize eligible advertising, affiliate, or other external campaigns, and conduct targeted advertising where permitted, using website health-interest data after the required privacy choices;
• honor your choices, consents, sharing directions, and privacy requests;
• investigate security, fraud, misuse, product-safety, or legal-compliance matters; and
• comply with law and establish, exercise, or defend legal claims.

Processing may include collecting information from you or a connected product, transmitting it to systems that support the requested feature, organizing or analyzing it to produce the requested display or report, storing it for continued access, and deleting or de-identifying it when appropriate.

We do not use or disclose device readings, app health records, reports, assessments, prescription or eligibility information, contact information, account or profile content, or support content for advertising, affiliate marketing, campaign optimization, or targeted advertising.

After the required privacy choices, website visits to health-related content and related product, cart, and limited purchase events may be used or disclosed for analytics, attribution, advertising or affiliate measurement, campaign optimization, and targeted advertising where permitted. Those events may indicate a health interest and may qualify as consumer health data under applicable law even when CONNEQT does not create a separate persistent user-level health profile.

CONNEQT does not conduct a transaction treated as a sale of consumer health data where applicable law requires a signed authorization for that sale unless it first obtains the required authorization.

4. Consumer health data we share and recipient categories

We share consumer health data for the purposes shown below when necessary to provide a product or service you request, with your separate consent when required, at your direction, or as otherwise permitted by law.

Categories of third parties: cloud and technical service providers; customer-support providers; healthcare providers and their supporting processors; website analytics, advertising, affiliate, and campaign-measurement providers; user-directed recipients; professional advisers; government or legal recipients; and a qualifying corporate successor.

Categories of affiliates: our corporate parent and affiliated operating companies that supply contracted personnel or shared services, limited to authorized, role-based need-to-know access.

CONNEQT does not authorize advertising or affiliate-marketing providers to receive device readings, app health records, reports, assessments, prescription or eligibility information, contact information, account or profile content, or support content for advertising, affiliate marketing, campaign optimization, or targeted advertising.

5. Website tracking and health-related browsing

Visits to health-related pages and related product, cart, and purchase activity can reveal or support an inference about a visitor's health interests. Depending on the visitor and applicable law, these signals and inferences may be consumer health data even when they use a pseudonymous identifier.

Where the described controls are deployed, the Analytics choice permits detailed first-party collection and approved minimized service-provider collection for website analytics and attribution. The Marketing choice permits eligible minimized disclosures to external advertising, affiliate, and campaign-measurement providers for measurement, optimization, or targeted advertising. When applicable consumer-health law requires separate consent for collection and for external sharing, CONNEQT will request those choices separately.

After the required choices, an external advertising or campaign-measurement provider may collect or receive eligible website health-interest data over time and across different websites or online services. Provider identity, purpose, and available retention information must appear in the live cookie and service inventory.

On website surfaces covered by the Cookie and Tracking Notice, optional external advertising, affiliate, and campaign-measurement tracking is restricted within prescription, account, checkout, return, warranty, privacy-request, account-deletion, contact, help, and support workflows. A confirmed purchase page may report a limited conversion after the required choice. The external event is limited to approved fields such as a generic event name, pseudonymous event, cookie, browser, or device identifier, campaign or advertising click identifier, value, currency, quantity, time, and technical network information automatically associated with the request, and may itself reveal a health-related purchase. Detailed product identities and raw order identifiers remain in CONNEQT's first-party measurement systems. The external event does not include names, contact details, street addresses, device readings, app health records, reports, assessments, prescription or eligibility information, account or profile content, or support content.

You can reject or withdraw optional website tracking in the Privacy choices section of our Cookie and Tracking Notice.

6. Collection and sharing consent

Where applicable law requires consent, we will request it before collecting or sharing the consumer health data covered by that request. The request will identify the relevant categories, purposes, recipient categories, and withdrawal method.

Consent to collect and consent to disclose consumer health data externally for advertising, affiliate measurement, campaign optimization, or targeted advertising will be separate when required. Rejecting or withdrawing the Marketing choice does not necessarily disable optional first-party analytics authorized by a separate Analytics choice. A privacy notice, acceptance of Terms, silence, or continued use is not treated as health-data consent where affirmative consent is required.

You may withdraw a website analytics or marketing choice in the Privacy choices section of our Cookie and Tracking Notice. For another consumer-health consent or a rights request, use our Privacy Request page or email hello@conneqthealth.com with the subject Consumer Health Data Request. Withdrawal applies prospectively, does not affect processing that occurred before withdrawal, and may prevent us from continuing a feature that requires the information.

CONNEQT processes recognized browser-based opt-out signals, including Global Privacy Control, as required by applicable law. A signal does not opt a visitor into optional collection or external sharing and does not replace an affirmative consumer-health consent where one is required.

7. Consumer health data rights

Subject to applicable law, you may request to:

• confirm whether we collect, share, or sell consumer health data concerning you;
• access consumer health data concerning you;
• receive a list of third parties and affiliates with which we shared or sold your consumer health data, including available contact information when required;
• correct consumer health data where applicable;
• withdraw consent and stop future collection or sharing subject to legal exceptions; and
• delete consumer health data concerning you.

Submit a request through our Privacy Request page or by emailing hello@conneqthealth.com with the subject Consumer Health Data Request. You do not need to create a new account to make a request, although we may ask you to use an existing account or provide information reasonably necessary to authenticate the request.

We respond without undue delay and within the period required by applicable law, generally within 45 days. A permitted extension may apply to some requests. We ordinarily provide the response without charge, but applicable law may allow a reasonable fee or refusal for manifestly unfounded, excessive, or repetitive requests.

If we deny a request, you may appeal through the same request method using the subject Consumer Health Data Appeal. We will provide the result and any legally required method for contacting the appropriate regulator.

8. Deletion

When a verified deletion request applies, we delete the covered consumer health data from our active records and notify the affiliates, processors, contractors, or other third parties required to honor the request. Deletion from archived or backup systems may occur later where applicable law permits a limited delay, provided the information remains protected and is not used for another purpose.

Some information may be exempt from deletion or retained where applicable law permits, including for security, fraud prevention, product safety, a transaction requested by you, legal compliance, or establishing, exercising, or defending legal claims. A healthcare provider may have independent legal duties to retain its medical records.

Deleting a CONNEQT account does not automatically cancel an Apple App Store or Google Play subscription. Manage an active store subscription directly through the applicable store.

9. Retention

We retain consumer health data only as long as reasonably necessary to provide the requested product or feature and for legitimate security, safety, legal, regulatory, and dispute purposes. The period depends on the type of information and context:

• readings, reports, assessments, and profile information may be retained while the account is active so they remain available to the user;
• prescription-intake and transaction-related records may be retained as necessary to administer the requested workflow and meet legal or dispute obligations;
• support information is retained according to the nature of the request; and
• a provider retains provider-controlled records under its own notice and legal obligations.

At the end of the applicable period, we delete, de-identify, or securely dispose of the information, subject to permitted backup and legal-hold practices.

10. Security

We restrict access to consumer health data to personnel, service providers, and contractors that need it for an authorized purpose. We maintain administrative, technical, and physical safeguards appropriate to the nature of the information and our operations. No system can be guaranteed completely secure.

11. Changes to this Policy

We will post material changes with a new effective date and provide additional notice as required by law. We will not collect, use, or share a new category of consumer health data, add a materially different purpose, or add a recipient in a manner requiring consent without first providing the required disclosure and obtaining that consent.

12. Contact

CONNEQT, Inc.
184 Shuman Blvd, Suite 515
Naperville, IL 60563
Email: hello@conneqthealth.com
Support: https://conneqthealth.com/support/