Effective as of March 20, 2026

This policy supplements and forms part of our Privacy Policy and applies only to personal information covered by our Privacy Policy that constitutes “consumer health data” subject to the Washington State My Health My Data Act (“MHMDA”) or Nevada’s Consumer Health Data Privacy Law. Capitalized terms not defined in this Consumer Health Data Privacy Policy are defined in our Privacy Policy.

If you have questions about this policy, contact us at support@cocohealth.com.

Consumer Health Data We Collect

Please refer to the Personal Information We Collect section of our Privacy Policy for a complete description of the personal information (including consumer health data) we may collect. For example, you may give us access to your medical or health data that is stored on your device, such as health data stored in Apple HealthKit. You may also give us access to your health data stored on third-party apps or to your medical records. You may also provide certain medical, health or fitness information to us when you complete our quiz about your health goals. Information from your chats and conversations with our chatbot, Coco, and any photos or files that you upload to the Service may contain consumer health data.

Consumer health data we collect may include information about your (i) individual health conditions, status, treatment, diseases, or diagnosis; (ii) social, psychological, behavioral, and medical interventions; (iii) health-related surgeries or procedures; (iv) use, acquisition or purchase of prescribed medication; (v) bodily functions, vital signs, symptoms, or measurements of the information described in this policy; (vi) diagnoses or diagnostic testing, treatment, or medication; (vii) gender-affirming care; (viii) reproductive or sexual health information; (ix) genetic data; (x) data that identifies you seeking health care services, or (xi) any information that we or our service providers/processors process to associate or identify you with the data described in this policy that is derived or extrapolated from nonhealth information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning).

Sources of Consumer Health Data

As described further in our Privacy Policy, we may collect consumer health data directly from you (such as when you register for an account with the Service) and from your interactions with us and the Service, including with our chatbot, Coco. We use third-party partners, such as Junction and Fasten Health, to help you give us access to certain of your consumer health data where you choose to give us such access.

How We Use Consumer Health Data

Please refer to the How we use your personal information section of our Privacy Policy for a complete description of how we use personal information, including consumer health data. Primarily, we collect and use consumer health data to provide the Service, operate our business, and communicate with you about the Service, as well as for research and development and the compliance and protection purposes described in our Privacy Policy. We may also use your consumer health data for other purposes with your consent or at your direction.

How We Disclose Consumer Health Data

Please refer to the How we share your personal information section of our Privacy Policy for a complete description of how we share personal information, including consumer health data. Primarily, we may disclose all categories of consumer health data that we collect to our service providers who need it to perform services for us, and to other parties with your consent or at your direction. While not a regular occurrence, we may also need to disclose consumer health data to our professional advisors; to law enforcement, government authorities and other parties to legal proceedings; and in connection with a merger or acquisition of our business or assets.

Your Rights

The MHMDA and Nevada’s Consumer Health Data Privacy Law provide certain rights with respect to consumer health data, such as the right to access, delete, or withdraw consent relating to consumer health data, subject to certain exceptions. For more details, you can read about the rights granted by the MHMDA at https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.040, and you can read about the rights granted to Nevada residents at https://www.leg.state.nv.us/NRS/NRS-603A.html#NRS603ASec505.

You may send requests to us to exercise these rights to support@cocohealth.com.

Appeals

If your request to exercise a right under the MHMDA or Nevada’s Consumer Health Data Privacy Law is denied, you may appeal that decision by contacting us at support@cocohealth.com. You must submit your appeal within 45 days of the denial of our request or within any longer timeframe provided by applicable law. When sending your appeal, please include your name, contact information, details of the original request, the date of our response, and any reason you believe the denial should be reconsidered. We will review your appeal and respond in writing within the timeframe required by law. If we deny your appeal, we will explain why. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at https://www.atg.wa.gov/file-complaint or the Nevada State Attorney General at https://ag.nv.gov/Contact/.

Changes to this Policy

We reserve the right to modify this policy at any time. If we make material changes to this policy we will notify you in the same manner that we give notice of material changes to our Privacy Policy as described in the Changes to this Privacy Policy section.