Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how ION, operated by KTW Digital Group, LLC ("we," "us," or "our"), collects, uses, shares, and protects consumer health data. It supplements our Privacy Policy. We provide this separate policy to meet the requirements of Washington's My Health My Data Act and similar consumer-health-data laws, including those in Nevada and Connecticut. If anything here conflicts with our general Privacy Policy regarding consumer health data, this policy controls.

"Consumer health data" means personal information that identifies your past, present, or future physical or mental health status. In ION, this can include information you choose to enter in the Body domain and elsewhere, such as:

• Information about your physical health, fitness, sleep, and energy levels
• Information about your mental and emotional wellbeing, mood, and stress
• Mood and energy scores derived from the behavioral data you log
• Any health-related details you choose to write in entries, reflections, journals, or conversations with the AI coaching feature

We collect this data only because you choose to enter it as part of using ION. We do not collect consumer health data from other sources, we do not buy it from data brokers, and we do not derive it from outside your account.

We use consumer health data solely to provide the service you have asked for. That means operating ION, storing your entries, calculating your scores and trends, and generating your personalized insights and coaching responses, at your direction. We do not use consumer health data for advertising, and we do not use it for any purpose unrelated to providing ION to you.

We do not sell your consumer health data. We do not share it for advertising, and we do not share it with data brokers.

We share consumer health data only with the service providers (processors) that operate ION on our behalf, and only as needed to deliver the service to you. These are the same providers listed in the "Third-Party Services" section of our Privacy Policy (for example, our database and hosting providers and our AI provider). Each is bound by a data processing agreement that limits them to processing your data only to provide their service. We do not otherwise share, disclose, or transfer your consumer health data to any third party, and we will not do so without first obtaining your separate consent where the law requires it.

We collect and process your consumer health data based on your consent. You provide that consent in two ways: by affirmatively opting in when you create your account, and by choosing what to enter as you use ION. We do not collect consumer health data beyond what is needed to provide the features you use without first obtaining your separate, opt-in consent.

Because we do not sell consumer health data or share it for purposes beyond providing the service, we do not ask you to consent to any sale or to any sharing that would require separate authorization under the law. If that ever changes, we will obtain your separate, informed consent first.

You can withdraw your consent at any time by deleting the relevant entries, by deleting your account from Settings, or by contacting us at support@ion.coach. Withdrawing consent does not affect processing that already took place, but it stops future processing and, on request, deletes the underlying data.

You have the right to:

• Confirm whether we collect, share, or sell your consumer health data (we collect it, and we do not sell or share it for advertising)
• Access the consumer health data we hold about you
• Withdraw your consent to our collection and use of it
• Have your consumer health data deleted, including by deleting your account

You can exercise the access and deletion rights yourself at any time: download a complete copy of your data, or permanently delete your account and all associated data, from your Settings page. You can also contact us at support@ion.coach. When you delete your data, we delete it from our systems and instruct our service providers to do the same. We will respond to requests within the time your state law requires, and within 45 days at the latest. We will not discriminate against you for exercising any of these rights.

We do not sell consumer health data, and we have no plans to. We would not sell consumer health data without first obtaining your valid authorization as required by law.

Consumer health data is protected by the same safeguards described in our Privacy Policy: encryption in transit and at rest, access controls that isolate your data to your account, rate limiting, input sanitization, and webhook signature verification. No system is perfectly secure, but we take reasonable measures to protect your data and will notify you if we become aware of a breach affecting your personal information.

We may update this policy from time to time. If we make material changes to how we handle consumer health data, we will notify you by email or through a notice within the app before the changes take effect.

For questions or requests regarding consumer health data, contact us at:

Email: support@ion.coach

Washington residents may also contact the Washington State Attorney General regarding the My Health My Data Act.