CONSUMER HEALTH DATA PRIVACY POLICY

This Consumer Health Data Privacy Policy supplements the RestartRX Privacy Policy and applies specifically to personal information that constitutes "consumer health data" ("CHD") as defined under the Washington My Health My Data Act ("MHMDA"), Nevada's Consumer Health Data Privacy Law ("Nevada CHD Law"), and Connecticut's Data Privacy Act ("CTDPA"). If you are a resident of Washington, Nevada, or Connecticut, this policy describes your specific rights and our obligations under those laws. For additional information on how we process personal data generally, please review our Privacy Policy.

RestartRX Management LLC ("RestartRX," "we," "us," or "our") is a technology platform that connects individuals with independently licensed healthcare providers. RestartRX does not itself provide medical care or treatment. Capitalized terms not defined in this policy have the meanings given in our Privacy Policy.

"Consumer health data" means personal information that is linked or reasonably linkable to an individual and that identifies the individual's past, present, or future physical or mental health status. Depending on how you interact with our platform and applicable law, we may collect the following categories of CHD:

• Individual health conditions, treatments, diseases, or diagnoses — e.g., information you provide when seeking healthcare services or medications through RestartRX.
• Social, psychological, behavioral, and medical interventions — e.g., medical history collected as part of the treatment services you seek.
• Health-related surgeries or procedures — e.g., surgical history included in your medical intake forms.
• Use or purchase of prescribed medication — e.g., prescriptions facilitated through our platform or pharmacy partners.
• Bodily functions, vital signs, symptoms, or measurements — e.g., health information submitted when seeking care through our platform.
• Diagnoses, diagnostic testing, treatment, or medication — e.g., information collected as part of your medical history or provider review.
• Gender-affirming care information — e.g., as part of medical history collected by or through RestartRX.
• Reproductive or sexual health information — e.g., as part of medical history or treatment services sought through RestartRX.
• Genetic data — e.g., where included in medical history you provide.
• Information that identifies a consumer seeking health care services — e.g., data collected during registration or intake.
• Inferences derived from the above — i.e., data that could be used to infer, derive, or extrapolate information related to your health.

We collect CHD from the following sources:

• Directly from you — when you complete intake forms, communicate with our platform, or submit health-related information.
• Automatically through your use of our Services — e.g., usage data, interactions, and technical information collected via cookies or similar technologies on our website.
• From healthcare providers or pharmacies — involved in your care, as permitted by applicable law.
• From other third-party sources — as described in our Privacy Policy, where permitted by law.

We use CHD only as directed by you, with your consent, or as otherwise permitted by applicable law. Specific uses include:

• Providing and managing the Services — including facilitating connections with licensed healthcare providers and coordinating prescription fulfillment through licensed pharmacies.
• Supporting provider review and treatment decisions — by sharing relevant intake information with the independent providers you engage through our platform.
• Communicating with you — regarding your use of the platform, your care, or updates to our services.
• Improving platform functionality and user experience — through analysis of how our services are used.
• Advertising and marketing — only with your explicit consent and only where permitted by applicable law, as described in our Privacy Policy. RestartRX does not use consumer health data for targeted advertising without your explicit consent.
• Legal and compliance purposes — including complying with applicable laws, establishing or defending legal rights, and responding to lawful government requests.

We do not sell consumer health data. We do not share consumer health data for third-party advertising purposes without your consent. Subject to applicable law, we may share CHD with the following categories of recipients:

RestartRX reserves the right to create aggregated or de-identified data derived from CHD. Once de-identified in accordance with applicable law, such data is no longer considered consumer health data and is not subject to this policy.

Depending on your state of residence, you may have the following rights with respect to your consumer health data. We will respond to verified requests in accordance with applicable law.

6.1 Rights Available to Washington, Nevada, and Connecticut Residents

1. Right to confirm — You may request confirmation of whether we are collecting, sharing, or selling your CHD.
2. Right to access — You may request a copy of the CHD we hold about you.
3. Right to delete — You may request deletion of your CHD, subject to legal exceptions.
4. Right to correct — You may request that we correct inaccuracies in your CHD.
5. Right to withdraw consent — Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

6.2 How to Submit a Request

To exercise any of the rights above, please contact us using the information in Section 9. We may ask you to verify your identity before processing your request. RestartRX will never ask you for sensitive financial information or your account password during identity verification.

6.3 Appeals

If we deny your request in whole or in part, you may appeal by contacting us and stating that you wish to appeal. We will review your appeal and respond within the timeframe required by applicable law.

If your appeal is denied, you may escalate your complaint to your state's Attorney General:

We retain consumer health data only for as long as necessary to fulfill the purposes described in this policy, including:

• Providing services to you;
• Complying with legal and regulatory obligations;
• Resolving disputes; and
• Enforcing our agreements.

When CHD is no longer needed for these purposes, we will delete or de-identify it in accordance with our data retention practices and applicable law.

RestartRX uses reasonable and appropriate administrative, technical, and physical safeguards designed to protect consumer health data against unauthorized access, disclosure, alteration, or destruction. However, no system or transmission of data over the internet can be guaranteed to be completely secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.

If you have questions about this policy or wish to exercise your rights, please contact us:

We reserve the right to update this policy at any time to reflect changes in the law, our data practices, or the features of our Services. The most current version will always be available on our website, and the effective date at the top of this document will be updated accordingly.

If we make a material change to this policy, we will provide appropriate notice as required by law — for example, by email or a prominent notice on our website. Your continued use of our Services after such notice constitutes your acknowledgment of the updated policy.