Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy describes how Idra Health Inc. ("Idra Health," "we," "us," or "our") collects, uses, and shares consumer health data ("health data"), as defined under applicable U.S. state laws, in connection with the Idra mobile application ("Idra"), the website at idrahealth.com, and related services (together, the "Services").

It supplements our Privacy Policy.

1. What health data we may collect

We may collect the following health data when you use our Services:

• Data you provide — such as health and wellness information you log or share in your chats with Idra, including information about your habits, routines, and how you feel.
• Data we derive — such as chat responses, recommendations, and insights based on the data you provide.

We collect health data directly from you, and derive it from what you provide. We do not collect it from other sources.

2. How we may use your health data

We may use your health data to:

• Provide our Services — such as delivering coaching tailored to you.
• Support your safety — such as identifying potential crisis signs and displaying crisis resources when appropriate.
• Secure and maintain our Services — such as preventing misuse and fraud, monitoring, and troubleshooting.
• Improve Idra with your chats and logs, if you have opted in — such as evaluating Idra's responses and training or fine-tuning artificial intelligence models used for Idra.
• Comply with law — such as meeting legal obligations.

3. How we may share your health data

We may share the categories of health data described above, only as needed for the purposes described above, with:

• Service providers — that process data on our behalf, such as for data storage, artificial intelligence, notifications, and error monitoring services.
• Platform providers — such as operating system providers, when you use features they supply, such as speech recognition or notifications.
• Legal authorities — when required by law.

We do not sell or rent your health data, or share it with affiliates.

4. How long we may keep your health data

We retain your health data for as long as necessary to fulfill the purposes described in this Consumer Health Data Privacy Policy, or as required by law.

5. Your health data rights

You have the right to:

• Access a copy of your health data, and confirm whether we collect, share, or sell it.
• Obtain a list of the third parties and affiliates with whom we have shared it.
• Delete your account and health data, subject to certain legal exceptions. You can request deletion in the app's privacy settings. When you do, we delete your account and health data, including chats and logs used to improve Idra, except where we are required to retain it by law. Residual copies, such as those in backups or held by service providers, are removed within 30 days.
• Withdraw consent to its collection or sharing, including its use to improve Idra, via the app's privacy settings.
• Appeal our decision on any of these requests.

To exercise any of these rights or appeal a decision, please contact us at privacy@idrahealth.com. We will verify your request using data associated with your account and respond in accordance with applicable law. If we deny your appeal, you may contact your state's Attorney General.

6. Contact us

If you have questions, concerns, or requests regarding this Consumer Health Data Privacy Policy, please contact us at privacy@idrahealth.com.