California Privacy Disclosures

Adapt Your Life Inc.

Introduction

These California Privacy Disclosures (“Disclosures”) are provided by Adapt Your Life Inc. (“Adapt Your Life Inc.,” “we,” “us,” or “our”) pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”), Cal. Civ. Code Sections 1798.100-1798.199.100. These Disclosures apply to California residents (“consumers”) and supplement our Privacy Statement and our Consumer Health Data Privacy Policy. Terms used but not defined in these Disclosures have the meanings given to them in our Privacy Statement. If these Disclosures conflict with our Privacy Statement as applied to California residents, these Disclosures control.

Adapt Your Life Inc. operates a technology platform, including the websites, applications, and patient portal that link to these Disclosures (collectively, the “Platform”), and provides administrative coordination services that connect consumers with independently owned and operated professional medical practices, including Usable Health, PC and its affiliated professional corporations (the “Affiliated Practices”), for telehealth weight management services. Adapt Your Life Inc. does not provide medical services, does not employ healthcare providers, and does not participate in clinical decisions. Clinical data collected by the Affiliated Practices during medical treatment is governed by those entities’ own privacy notices and, where applicable, by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

Section 1: Personal Information Collected, Sources, and Purposes

In the preceding twelve (12) months, we have collected the following categories of personal information from California consumers. We collect personal information directly from consumers, automatically through the Platform, from the Affiliated Practices and our service providers, and from external sources such as marketing, advertising, and social media companies, as described in our Privacy Statement.

Category A: Identifiers. Name, email address, postal address, telephone number, date of birth, IP address, unique online identifiers, and account name. Collected from: consumers directly through account registration; automatically through the Platform; external sources. Purpose: providing services, account management, identity verification, communications, marketing, and regulatory compliance.

Category B: Personal Information Under Cal. Civ. Code Section 1798.80(e). Name, address, telephone number, physical characteristics (height, weight), and medical information. Collected from: consumers through registration and medical intake forms; from the Affiliated Practices. Purpose: facilitating healthcare services, treatment coordination, prescription fulfillment, and payment processing.

Category C: Protected Classification Characteristics. Age, sex, gender, and medical conditions (which may implicate disability status). Collected from: consumers through intake questionnaires. Purpose: healthcare eligibility determination and treatment coordination.

Category D: Commercial Information. Records of services purchased, subscription status, payment history, and treatment options considered. Collected from: consumers through Platform transactions; from payment processors. Purpose: processing orders, managing subscriptions, customer service, and financial record-keeping.

Category E: Biometric Information. Body photographs and measurements submitted for clinical assessment. Collected from: consumers through the intake process. Purpose: clinical evaluation by the Affiliated Practices.

Category F: Internet or Other Electronic Network Activity. Browsing history on the Platform, pages viewed, click paths, browser type, operating system, and device information. Collected from: automatically through cookies and similar tracking technologies, as described in the “Cookies and Other Tracking Technologies” section of our Privacy Statement. Purpose: Platform improvement, analytics, security, and marketing and advertising.

Category G: Geolocation Data. Approximate geolocation derived from IP address and state of residence. Collected from: automatically when consumers access the Platform; from consumers during registration. Purpose: compliance with state telehealth licensing requirements and service eligibility verification.

Category H: Sensory Data. Body photographs and any audio or video from telehealth consultations, and recordings of customer service calls where permitted by law. Collected from: consumers through the intake process, consultations, and customer service interactions. Purpose: clinical evaluation by the Affiliated Practices; customer service and quality assurance.

Category K: Inferences. Profiles reflecting health preferences, interests, and treatment adherence patterns generated from information collected above. Purpose: personalizing services, marketing, and improving treatment coordination.

We do not intentionally collect Category I (Professional or Employment-Related Information) or Category J (Non-Public Education Information), and we do not collect precise geolocation data such as GPS coordinates.

Section 2: Disclosure, Sale, and Sharing of Personal Information

Disclosure for Business Purposes. In the preceding twelve (12) months, we have disclosed the following categories of personal information to the following categories of third parties for business purposes:

Sale and Sharing of Personal Information. We do not sell personal information for monetary consideration. However, as described in our Privacy Statement, our transfer of certain personal information to advertising networks, social media networks, and data analytics providers for marketing and advertising purposes may be considered a “sale” or “sharing” of personal information for cross-context behavioral advertising under the CCPA. In the preceding twelve (12) months, we may have sold or shared the following categories of personal information with those categories of third parties: Category A (Identifiers, including persistent identifiers such as device identifiers, IP addresses, and email addresses) and Category F (Internet or Other Electronic Network Activity). You may opt out of the sale or sharing of your personal information as described in Section 4. We do not have actual knowledge that we sell or share the personal information of consumers under sixteen (16) years of age.

Section 3: Sensitive Personal Information

We collect the following categories of sensitive personal information: health information (medical history, conditions, prescriptions, and treatment data, which is also Consumer Health Data under our Consumer Health Data Privacy Policy); biometric information (body photographs and measurements for clinical assessment); government identifiers (driver’s license or other government-issued identification collected for identity verification); and financial account information (credit and debit card numbers processed by our payment processors).

We use and disclose sensitive personal information to perform the services you request, ensure Platform security, prevent fraud, comply with legal obligations, and process payments. As described in our Consumer Health Data Privacy Policy, we may also use or disclose Consumer Health Data to market and advertise our services to you. You have the right to limit our use and disclosure of your sensitive personal information to the purposes permitted by the CCPA, as described in Section 4.

Section 4: Your California Privacy Rights

Right to Know (Cal. Civ. Code Section 1798.100). You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the third parties to whom we have disclosed it. You may submit this request up to two (2) times in a twelve-month period.

Right to Delete (Cal. Civ. Code Section 1798.105). You may request that we delete your personal information. We may deny deletion where retention is necessary to complete a transaction, comply with legal obligations (including medical records retention requirements), detect fraud, exercise legal rights, or for other purposes permitted by law.

Right to Correct (Cal. Civ. Code Section 1798.106). You may request that we correct inaccurate personal information we maintain about you.

Right to Opt-Out of Sale or Sharing (Cal. Civ. Code Section 1798.120). You have the right to opt out of the sale or sharing of your personal information. To exercise this right, email support@care.adaptyourlife.com or visit [Do Not Sell or Share Link]. We also honor Global Privacy Control (“GPC”) signals as valid opt-out requests for the browser or device on which the signal is sent.

Right to Limit Use of Sensitive Personal Information (Cal. Civ. Code Section 1798.121). You may direct us to limit the use and disclosure of your sensitive personal information to the purposes necessary to perform the services you request and the other purposes permitted by the CCPA. To exercise this right, email support@care.adaptyourlife.com or visit [Limit Sensitive Personal Information Link].

Right to Non-Discrimination (Cal. Civ. Code Section 1798.125). We will not discriminate against you for exercising any CCPA right. We will not deny services, charge different prices, or provide a different level of service because you exercised a privacy right.

Section 5: How to Exercise Your Rights

Verification. We will verify your identity before processing a request. For requests to know categories of information, we will match at least two (2) data points you provide against our records. For requests to know specific pieces of information or to delete, we will match at least three (3) data points and may require a signed declaration under penalty of perjury. If we cannot verify your identity, we will notify you and explain what additional information is needed.

Authorized Agents. You may designate an authorized agent to submit a request on your behalf by providing signed written authorization or a valid power of attorney under California Probate Code Sections 4000-4465. We may still require you to verify your identity directly.

Response Timeline. We will acknowledge your request within ten (10) business days and provide a substantive response within forty-five (45) calendar days. If additional time is needed, we will notify you and may extend the response period by an additional forty-five (45) days. Opt-out and limit requests will be processed within fifteen (15) business days.

Appeal. If we deny your request, you may appeal by emailing support@care.adaptyourlife.com with the subject line “Data Rights Request Appeal.” We will respond within forty-five (45) calendar days. If the appeal is denied, we will provide information on how to contact the California Privacy Protection Agency.

Section 6: Data Retention

We retain each category of personal information described in these Disclosures for as long as necessary to fulfill the purposes for which it was collected. We determine retention periods using the criteria described in our Privacy Statement: (1) how long the personal information is needed in connection with the purposes for which we use it; (2) the type of personal information collected; and (3) whether we are subject to a legal, contractual, or similar obligation to retain it, including applicable medical records retention requirements. We may retain information longer when required by law or to exercise or defend legal claims.

Section 7: Minors

The Platform is not directed to individuals under eighteen (18) years of age, and we do not knowingly collect personal information from anyone under eighteen (18). If we learn that we have collected personal information from a minor, we will delete it. We do not have actual knowledge that we sell or share the personal information of consumers under sixteen (16) years of age. If you believe a minor’s information has been collected, contact us at support@care.adaptyourlife.com.

Section 8: Changes and Contact

We may update these Disclosures to reflect changes in our practices or applicable law. When we do, we will post the updated Disclosures with a revised effective date. If the changes materially affect your privacy rights, we will provide additional notice to the email address associated with your account.

If you are not satisfied with our response, you may contact the California Privacy Protection Agency at cppa.ca.gov or the Office of the Attorney General at oag.ca.gov.

Adapt Your Life Inc., [Mailing Address]