Consumer Health Data Privacy Policy

Scope of this policy

"Consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. Because our programs address health-related behaviors, certain information we handle qualifies as consumer health data under U.S. state laws such as the Washington My Health My Data Act, the Nevada consumer health data law, and the Connecticut Data Privacy Act.

This policy explains how we handle that data. The entity responsible is Simone Astarita, contactable at hello@headscovery.com.

Consumer health data we collect

We collect very little, and only what we need to provide a program you choose to buy:

• The fact that you purchased a specific program that addresses a health-related behavior, which may indicate an interest in or a condition relating to that behavior.
• The email address and order information associated with that purchase, which is linked to the program you bought.

We do not collect biometric data, precise location data, information from health devices, or any health information you might write down while doing the program exercises. Exercises are done on your own notebook or document and are never submitted to us.

Sources of the data

We collect this data directly from you when you purchase a program, including through our payment provider at checkout. We do not buy consumer health data from data brokers or obtain it from other third-party sources.

How we use it

• To give you access to the program you purchased.
• To provide customer support and respond to your requests.
• To process your payment and meet our legal, tax, and accounting obligations.

We do not use consumer health data for advertising, and we do not use it to build profiles about you.

How we share it and with whom

We share consumer health data only with service providers (processors) that help us deliver the service and act on our instructions:

• Stripe (payment processing) — categories shared: email, order, and payment information.
• Netlify (website hosting and delivery) — categories shared: technical information needed to deliver the website.

We do not share consumer health data with advertisers, data brokers, or any third party for their own purposes. We may disclose it if required by law or to protect our rights or someone's safety.

We do not sell your data

We do not sell consumer health data, and we do not offer it for sale. We will not do so without first obtaining your separate, valid authorization, which the law requires for any such sale.

Consent

We collect and use consumer health data only with your consent, which you provide at checkout before completing your purchase, or as otherwise permitted by law to provide the service you requested. You can withdraw your consent at any time, as described below.

Your rights and how to exercise them

Depending on your state of residence, you have the right to:

• Know and access the consumer health data we have collected, used, or shared, and the third parties with whom we have shared it.
• Withdraw consent to our collection and sharing of your consumer health data.
• Request deletion of your consumer health data from our records, including from backups, subject to limited legal exceptions.

To exercise any of these rights, email hello@headscovery.com with the request and the email address used for your purchase, so we can locate your data. We will respond within the time limits set by applicable law and will not discriminate against you for exercising your rights. If we deny a request, you may appeal by replying to our response; we will inform you of the outcome of the appeal.

Washington residents may also contact the Washington State Office of the Attorney General, and Connecticut residents the Connecticut Attorney General, regarding the handling of their consumer health data.

No geofencing

We do not use geofencing around any location, including health care facilities, to identify or track consumers, to collect consumer health data, or to send related messages or advertising.

Changes to this policy

If we change how we collect, use, or share consumer health data, we will update this policy and obtain your consent where the law requires it before the new practice takes effect. We will change the date at the top when we make changes.

How to contact us

For any question about this policy or your consumer health data, email hello@headscovery.com.