Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy ("Health Privacy Policy") supplements our general Privacy Policy and applies specifically to "consumer health data" as defined by the Washington My Health My Data Act (RCW 19.373) and similar state laws. This Policy describes how Take Helm Health, LLC ("TakeHelm," "we," "us," or "our") collects, uses, shares, and protects your consumer health data.

This Policy applies to:

• Washington State residents
• Individuals whose consumer health data is collected in Washington State
• Individuals in other states with similar consumer health data privacy laws

In the event of any conflict between this Health Privacy Policy and our general Privacy Policy, this Health Privacy Policy will control with respect to consumer health data.

How We Obtain Your Consent

Before we collect any consumer health data, we present a dedicated, standalone consent flow that is separate from our Terms of Service and subscription agreement. This consent flow:

• Is presented as a full-screen blocking interaction before any health data is collected
• Requires two separate affirmative actions: one for data collection and one for data sharing with service providers
• Discloses the categories of data collected, purposes of collection, entities data is shared with, and how to withdraw consent
• Uses unchecked checkboxes (no pre-checked boxes or dark patterns)
• Provides a genuine option to decline

You may withdraw this consent at any time through your account settings (Settings > Privacy > Health Data Consent). See Section 8.3 for details on the effects of withdrawal.

When we make material changes to our data collection or sharing practices, we will obtain your affirmative re-consent through a blocking notification before any new practices begin.

1. What Is Consumer Health Data?

Under the Washington My Health My Data Act, "consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. This includes:

• Information about health conditions, status, diseases, or diagnoses
• Social, psychological, behavioral, and medical interventions
• Health-related surgeries or procedures
• Use or purchase of prescribed medication
• Bodily functions, vital signs, and measurements (e.g., heart rate, sleep patterns, activity levels)
• Diagnoses or diagnostic testing, treatment, or medication
• Gender-affirming care information
• Reproductive or sexual health information
• Biometric data (when used to identify health status)
• Genetic data
• Precise location information that could indicate health care service visits
• Data that identifies a consumer seeking health care services
• Any data that is derived from non-health information that relates to health

2. Categories of Consumer Health Data We Collect

TakeHelm collects the following categories of consumer health data:

• Physical Health Status — Lab test results, biomarker values, body composition measurements, vital signs
• Bodily Functions & Vital Signs — Heart rate, HRV, respiratory rate, sleep stages, activity levels, steps, calories burned
• Genetic Data — Genetic testing results from third-party providers (e.g., 23andMe, 3x4 Genetics), genetic variants, pathway analysis
• Mental Health & Wellness — Sleep quality, stress indicators, recovery scores, mood-related inputs
• Medications & Supplements — Current medications, supplements, dosages (user-provided)
• Health Conditions & Diagnoses — Medical conditions, diagnoses, health history (user-provided)
• Nutrition Data — Dietary intake, macronutrients, micronutrients, calorie tracking (from Cronometer or user-provided)
• Health Goals — Fitness goals, longevity goals, health optimization targets
• Derived Health Data — AI-generated health insights, trend analysis, personalized recommendations
• Reproductive/Sexual Health — Only if voluntarily provided by user

We do not collect precise location data or biometric identifiers (fingerprints, facial recognition, etc.).

3. Sources of Consumer Health Data

3.1 Directly From You

Information you enter into our platform (health history, goals, medications, supplements), documents you upload (lab results, genetic reports, medical records), responses to questions and questionnaires, and communications with our team.

3.2 Third-Party Services You Connect

• Wearable devices: Apple Health, Oura Ring, Withings, and other connected devices
• Nutrition tracking: Cronometer (via user-uploaded data exports)
• Laboratory providers: Lab results from services like Function Health, Quest, LabCorp
• Genetic testing services: Reports from 23andMe, 3x4 Genetics, and similar providers

When you connect these services, you authorize us to receive and process the health data they provide.

3.3 Derived Data

We use your data in connection with the Services to generate personalized insights, recommendations, and trend analyses. Our AI systems create derived health information based on patterns in your data.

3.4 Healthcare Providers

If you are enrolled in TakeHelm through a healthcare practice, we may receive consumer health data from your healthcare provider's electronic health record (EHR) system, including:

• Laboratory results and diagnostic test results
• Current supplements and medications
• Vital sign measurements
• Visit summaries and clinical notes
• Demographic information

This data is shared by your healthcare provider pursuant to their privacy policies, your consent, and a Business Associate Agreement between TakeHelm and your healthcare provider. You may request that your healthcare provider stop sharing your data with TakeHelm at any time by contacting your provider directly.

Your consent to TakeHelm's collection of this data is obtained through a dedicated consent flow at enrollment, separate from any agreements between TakeHelm and your healthcare provider.

4. Purposes for Collecting Consumer Health Data

We collect and use your consumer health data for:

• Service Delivery — Personalized health coaching, wellness recommendations, and insights
• Personalization — Tailoring recommendations to your specific health profile, goals, and preferences
• Trend Analysis — Tracking your health metrics over time and identifying patterns
• AI-Powered Insights — Generating personalized recommendations using our AI coaching engine
• Clinical Coordination — To compose and deliver escalation messages to your healthcare provider when clinical attention may be warranted (clinic-enrolled users only)
• Account Management — Managing your subscription and providing customer support
• Service Improvement — Improving our algorithms, features, and user experience using de-identified and aggregated data
• Research — Conducting health and wellness research using de-identified and aggregated data (no individual identification)
• Safety & Security — Detecting and preventing fraud, abuse, and security threats
• Legal Compliance — Complying with applicable laws and responding to legal requests

We do NOT use your consumer health data for: interest-based or targeted advertising, selling to third parties for their marketing purposes, employment decisions, insurance underwriting or coverage decisions, or any purpose not disclosed in this Policy.

5. Categories of Consumer Health Data We Share

We share the following categories of consumer health data with third parties as necessary to provide our Services:

• Physical Health Status (lab results, biomarkers)
• Bodily Functions (HRV, sleep, activity)
• Genetic Data
• Derived Health Data
• De-identified/Aggregated Data (for service improvement and research)

We only share consumer health data as necessary to provide our Services or as required by law. We do not sell your consumer health data.

6. Third Parties and Affiliates We Share Data With

6.1 Service Providers (Processors)

We share consumer health data with the following service providers who process data on our behalf (as of March 4, 2026):

• Supabase, Vercel — Cloud infrastructure (data storage and processing)
• Anthropic — AI/Machine Learning (generating personalized recommendations)

Our payment processor (Stripe) processes subscription payments but does not receive consumer health data. See our general Privacy Policy for details on payment processing.

All service providers are bound by contractual obligations to process data only as instructed by TakeHelm, maintain appropriate security measures, delete data upon our instruction, and not use data for their own purposes.

Contact privacy@takehelm.io for a current list of specific providers.

6.2 Healthcare Providers (Clinic-Enrolled Users Only)

If you are enrolled through a healthcare practice, we share the following with your healthcare provider:

• AI-composed escalation messages when clinical attention may be warranted
• Aggregated engagement information (e.g., whether you responded to coaching check-ins)

This sharing is governed by a Business Associate Agreement and your enrollment consent.

6.3 Affiliates

TakeHelm currently has no affiliates with whom we share consumer health data.

6.4 Other Third Parties

We may share consumer health data with:

• Law Enforcement/Government — When legally required, to comply with subpoenas, court orders, or legal process
• Legal Counsel — When necessary, to establish, exercise, or defend legal claims
• Business Successors — In the event of a merger/acquisition, subject to equivalent privacy protections

6.5 At Your Direction

At your explicit request, we may share your data with third parties you designate, such as family members you authorize or other services you choose to connect. You are responsible for ensuring you have the right to authorize such sharing and for any consequences. TakeHelm is not responsible for how third parties use data once shared at your direction.

Unless you are enrolled through a healthcare practice (see Section 6.2), we do not share data directly with healthcare providers on your behalf. If you wish to share your TakeHelm data with a healthcare provider, you may export your data and share it yourself.

7. We Do Not Sell Your Consumer Health Data

TakeHelm does not sell your consumer health data. We do not exchange consumer health data for monetary or other valuable consideration.

Under the Washington My Health My Data Act, "sale" of consumer health data requires a separate, signed authorization from you. We do not engage in such sales and have no plans to do so.

If this ever changes, we will:

• Update this Policy
• Obtain your separate, signed authorization before any sale
• Provide you with the right to revoke such authorization

8. Your Consumer Health Data Rights

If you are a Washington State resident or your consumer health data was collected in Washington, you have the following rights:

8.1 Right to Confirm and Access

You have the right to confirm whether we are collecting, sharing, or selling consumer health data about you, and to access that data.

8.2 Right to Delete

You have the right to request that we delete your consumer health data, including data derived from your inputs. Upon receiving a valid deletion request, we will delete your consumer health data from our systems, direct our processors to delete your data, and confirm deletion to you.

Exceptions: We may retain data required by law, and de-identified and aggregated data that cannot reasonably be linked to you (see Section 10).

8.3 Right to Withdraw Consent

You have the right to withdraw your consent for the collection and sharing of your consumer health data at any time. Withdrawal of consent will not affect the lawfulness of processing conducted prior to withdrawal.

Important: If you withdraw consent for the collection or processing of your data, we may no longer be able to provide the Services to you. Withdrawal of consent may result in termination of your subscription as described in the Terms of Service. You remain responsible for any fees accrued prior to withdrawal.

8.4 Right to Know Third Parties

You have the right to receive a list of all third parties and affiliates with whom we have shared your consumer health data during the prior 12 months.

8.5 Right to Appeal

If we deny your request to exercise any of these rights, you have the right to appeal our decision. You may also file a complaint with the Washington State Attorney General.

9. How to Exercise Your Rights

9.1 Submitting a Request

You may exercise your rights by contacting us:

Email: privacy@takehelm.io

Mail: Take Helm Health, LLC, Attn: Privacy Rights, 1522 Western Ave STE 24699, Seattle WA 98101

9.2 Verification

To protect your privacy, we will verify your identity before processing your request.

9.3 Response Timeline

We will respond to your request within 45 days of receipt. If we need additional time, we will notify you of the extension (up to an additional 45 days).

9.4 No Fee

We will process your requests at no charge. We may charge a reasonable fee for requests that are manifestly unfounded or excessive, but we will explain why before imposing any fee.

9.5 Authorized Agents

You may designate an authorized agent to submit requests on your behalf. We may require proof of authorization and verify your identity directly.

9.6 Appeals

If we deny your request, you may appeal by emailing privacy@takehelm.io with "Appeal" in the subject line. We will respond to appeals within 45 days. You may also file a complaint with the Washington State Attorney General or call (800) 551-4636.

10. De-Identified Data

TakeHelm may create de-identified and aggregated data from consumer health data for service improvement and research purposes. We commit to:

• Taking reasonable technical measures to prevent re-identification of individuals
• Processing such data only in de-identified form and not attempting to re-identify any individual
• Contractually requiring any recipients of such data to maintain de-identification and not attempt re-identification

De-identified data that meets these standards is not subject to deletion requests under applicable law, as it cannot reasonably be linked to you.

11. Data Security

We implement administrative, technical, and physical safeguards designed to protect your consumer health data, including encryption in transit (TLS) and at rest, role-based access controls, multi-factor authentication, security monitoring and logging, vendor security assessments, and employee training on data protection practices.

While we strive to protect your data, no system is completely secure. We cannot guarantee the absolute security of your consumer health data.

12. Data Retention

We retain your consumer health data for as long as necessary to provide the Services, maintain your account, comply with legal obligations, resolve disputes, and enforce our agreements.

When you delete your account or request deletion of your data, we will delete or de-identify your identifiable consumer health data, including data derived from your inputs, within 45 days, except where retention is required by law, for de-identified and aggregated data (see Section 10), or data in encrypted backups (purged within an additional 90 days).

13. Changes to This Policy

We may update this Health Privacy Policy from time to time. If we make material changes, we will post the updated Policy on our website, update the "Last Updated" date, and notify you by email.

For material changes to data collection or sharing practices: We will obtain your affirmative re-consent through a dedicated in-app notification before any new practices begin. We will not rely on continued use as acceptance for changes that expand how we collect, use, or share your consumer health data.

For non-material changes (clarifications, corrections, security improvements), your continued use of the Services after notice constitutes acceptance of the updated Policy.

14. Contact Us

If you have questions about this Consumer Health Data Privacy Policy or our privacy practices, please contact us:

Take Helm Health, LLC

Email: privacy@takehelm.io

Mail:
Take Helm Health, LLC
Attn: Privacy
1522 Western Ave STE 24699
Seattle WA 98101
United States