Empatica, Inc.

Consumer Health Data Privacy Policy

Effective: March, 31 2025

This Consumer Health Data Privacy Policy (this “Policy”) supplements Empatica Inc.’s (“Empatica”) Privacy Notice at https://emp.is/epimonitor-privacy-policy-us and applies to the collection of “consumer health data” subject to the Washington My Health My Data Act (“MHMDA”) collected through the EmbracePlus watch, our mobile application, and web portal (collectively, the “Services”). This Policy does not apply to information or practices that are not subject to the MHMDA, such as publicly available information, personal information governed by the Fair Credit Reporting Act, or job applicant and employee information.

1. The Categories of Consumer Health Data We Collect

Due to the broad definition of “consumer health data” under MHMDA, many of the categories of data we collect could also be considered consumer health data. We may collect the following categories of “consumer health data”:

• Individual health conditions, treatment, diseases, or diagnosis;
• Social, psychological behavioral, and medical interventions;
• Use or purchase of prescribed medication;
• Bodily functions, vital signs, symptoms, or measurements of the information described in this Section 1;
• Data that identifies a consumer seeking healthcare services, including ;
• Information processed to associate or identify a consumer with the data described above that is derived or extrapolated from non-health information.

1. Purposes of Collection and How Empatica Uses Consumer Health Data

Generally, we may collect and use the consumer health data that we collect for the purposes set forth below:

• As reasonably necessary to provide you with the products or services you have requested;
• To provide support in connection with the use of our products and services;
• To enroll you in our membership plans and/or subscriptions;
• To communicate with you;
• To establish and manage your account;
• To administer the services/products and our relationship with you;
• To send you updates about Empatica and the products and services we offer;
• To detect security incidents;
• To protect against malicious or illegal activity;
• To ensure the appropriate use of our products and services;
• To improve our products and services and to develop new products and services;
• For short-term transient use of online identifiers;
• For quality and safety assurance;
• For internal research and development to evaluate the effectiveness of our products and services;
• For purposes of marketing, advertising, and product promotion, including to contact you regarding our programs, products, and services, surveys, and topics that be of interest or useful to you; and
• To comply with our legal and regulatory obligations.

1. The Categories of Sources From Which We Collect Consumer Health Data

In general, we may collect consumer health data from the following categories of sources:

• Directly from you;
• Those authorized to provide personal information on your behalf, such as your guardian, caregiver, or authorized representative; and
• Your device(s).

1. The Categories of Consumer Health Data That We Share

We may share the following categories of consumer health data with third parties and affiliates:

• Individual health conditions, treatment, diseases, or diagnosis;
• Social, psychological behavioral, and medical interventions;
• Use or purchase of prescribed medication;
• Bodily functions, vital signs, symptoms, or measurements of the information described in Section 1;
• Data that identifies a consumer seeking healthcare services, such as internet, network, or other electronic activity relating to your interaction with our websites or advertisements;
• Information processed to associate or identify a consumer with the data described above that is derived or extrapolated from non-health information.

1. The Categories of Third Parties and Specific Affiliates with Whom We Share Consumer Health Data

Empatica may share the categories of consumer health data included in Section 4 with the following categories of third parties and specific affiliates:

• Empatica srl;
• Government entities;
• Regulators; and
• Those authorized to act on your behalf, such as your guardian, caregiver, or authorized representative.

1. Your Privacy Rights

MHMDA provides consumers with the following rights:

• Know/Access: The right to confirm whether Empatica collects, shares, or sells your consumer health data and the right to access such consumer health data;
• Withdraw consent: The right to withdraw consent from Empatica’s collection and sharing of your consumer health data; and
• Deletion: The right to have your consumer health data deleted.

Exercising Your Privacy Rights

Requests to Know/Access and Delete

To make a request to know/access or delete your consumer health data, please email us at privacy@empatica.com. Before completing your request, we may need to verify your identity or your authority to make a request on behalf of another person. Solely for the purpose of verifying your identity, depending on the type of your request, we may send you a link to verify your email address, may request additional documentation or information, may send you a code to verify your phone number, or ask you anagraphic information.

Requests to Withdraw Consent

• Collection: To opt out of Empatica’s collection of your consumer health data, you can cancel at any time your subscription through our customer portal and write to us at privacy@empatica.com to request us to cancel your account permanently. Please note that if you withdraw your consent to Empatica’s collection of your consumer health data, we will no longer be able to provide our services to you.
• Sharing: To opt out of Empatica’s sharing of your consumer health data with third parties and affiliates, the “Help” portion of the toolbar on most browsers will tell you how to prevent your device from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to delete cookies.

If your request to exercise a right under the MHMDA is denied, we will provide instructions for how you can appeal our decision. If your appeal is unsuccessful, you can file a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.