What Is Consumer Health Data

"Consumer health data" means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. Medifoodz currently collects the following consumer health data in connection with the Glyvance program:

• Continuous glucose readings received through user-authorized CGM device connections

• Body composition metrics including weight received through user-authorized body composition scale connections

• Program participation data that identifies your dietary health goals or health-related behaviors

• Communications with the Vance AI coach that relate to your physical health status

Consumer health data does not include data that has been de-identified such that it cannot reasonably be used to identify you. This section will be updated as additional data streams are added to the platform.

How We Collect Consumer Health Data

✓ We collect consumer health data only with your affirmative consent or as necessary to provide the services you have requested. Consent to collect and consent to share are obtained separately.

We collect consumer health data through the following sources:

• Directly from you through the Glyvance application and program enrollment

• From connected health devices you authorize to share data with the Glyvance platform, including through Apple Health and Android Health Connect integrations

• Through your interactions with the Vance AI coaching platform

We do not collect consumer health data through geofencing, location tracking near healthcare facilities, or any passive surveillance mechanism.

How We Use Consumer Health Data

We use consumer health data for the following purposes:

• To deliver the Glyvance meal program and personalize your program experience

• To operate the Vance AI coaching platform and provide coaching responses

• To share with healthcare providers you have authorized through the Glyvance provider portal

• To fulfill orders, process payments, and provide customer support

• To maintain the security and integrity of our platform

• To comply with applicable legal obligations

• In de-identified, aggregated form, for product improvement, product development, and regulatory submissions

✓ We do not sell consumer health data
✓ We do not use it for targeted advertising
✓ We do not share it beyond what is described below

How We Share Consumer Health Data

Healthcare Providers

We share your consumer health data with healthcare providers you have authorized through the Glyvance provider portal. This sharing occurs only at your direction and may be revoked at any time through your account settings.

Service Providers

We share consumer health data with third-party service providers who process data on our behalf, including application hosting, data storage, and technical infrastructure providers. All service providers are bound by written contracts limiting their use to performing services on our behalf.

Third-Party Device Platforms

When you connect third-party devices through Apple Health, Android Health Connect, or direct API integrations, data flows between those device manufacturers and Medifoodz through your user-authorized connections. You may contact the manufacturer of any connected device directly using the contact information in that device's product documentation.

Legal Disclosures

We may disclose consumer health data where required by law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of Medifoodz, our customers, or others.

Your Rights

You have the following rights with respect to your consumer health data. To exercise any of these rights, contact us at privacy@medifoodz.com. We will respond to verified requests within 45 days.

• Right to Confirm & Access: Confirm whether we collect your health data and access it, including a list of all third parties with whom it has been shared.

• Right to Withdraw Consent: Withdraw consent to collection and sharing at any time through your account settings or by contacting us.

• Right to Delete: Request deletion of your consumer health data. We will delete it and direct our service providers to do the same, subject to legal retention obligations.

• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

• Authorized Agents: You may designate an authorized agent to submit requests on your behalf. We may require verification of the agent's authority before processing.

Security

Medifoodz maintains administrative, technical, and physical data security practices appropriate to the volume and nature of the consumer health data we process. These practices are consistent with our HIPAA compliance program and applicable industry standards, and include access controls, encryption of data in transit and at rest, audit logging, and written security requirements for all service providers who access consumer health data.

Data Retention

We retain consumer health data for as long as your account is active and for a period following account closure as required by applicable law. Upon a verified deletion request, we will delete your consumer health data subject to any conflicting legal retention obligations.

De-identified data derived from consumer health data is not subject to deletion requests and may be retained indefinitely for product development and regulatory purposes.

Consent

Where required by applicable law, we obtain your affirmative consent before collecting or sharing consumer health data. Consent to collect and consent to share are obtained separately at enrollment.

You may withdraw consent at any time through your account settings. Withdrawal of consent may affect our ability to deliver the Glyvance program to you.

Connected Device Third Parties

Medifoodz currently receives continuous glucose readings and body composition metrics including weight through user-authorized device connections. These connections are established through Apple Health, Android Health Connect, or direct device API integrations.

When you connect any device through these mechanisms, data flows between that device manufacturer's platform and Medifoodz through your authorization. You may contact the manufacturer of any device you connect directly using the contact information in that device's product documentation or on the manufacturer's website.

Medifoodz is not responsible for the data practices of any third-party device manufacturer on their own platforms. This section will be updated as additional device integrations are added to the platform.

Contact Us

For questions about this policy or to exercise your consumer health data rights:

Privacy inquiries: privacy@medifoodz.com

General support: support@medifoodz.com

Tampa, Florida