Consumer Health Data Privacy Notice

This Consumer Health Data Privacy Notice supplements Meridian Vitality LLC's Privacy Policy. It describes how Meridian collects, uses, and discloses "consumer health data" and how individuals may exercise rights under state consumer health privacy laws, including the Washington My Health My Data Act, when those laws apply.

This Notice applies to consumer health data controlled by Meridian. It does not replace a healthcare provider's HIPAA Notice of Privacy Practices. Protected health information controlled by an independent healthcare provider may be governed by HIPAA and the provider's notice instead of, or in addition to, this Notice.

1. Consumer health data we collect and why

Consumer health data means personal information that identifies or can reasonably be linked to an individual and that relates to or can be used to infer physical or mental health status. Depending on how you use the Services, Meridian may collect:

• Basic health and body information, such as age, height, weight, body composition, activity, nutrition, sleep, and health goals. We use this information to process requested assessments, support account features, and organize information for you and licensed providers.
• Health history and status, such as current or past conditions, symptoms, allergies, family or personal history, and safety-screening responses. We use this information to support eligibility screening, provider review, care coordination, and safety.
• Medication and treatment information, such as current or prior medications and supplements, prescriptions or services ordered by a provider, treatment response, and side effects you report. We use this information to support provider review, coordination, fulfillment, follow-up, and safety.
• Reproductive and pregnancy-related information you provide during safety screening. We use this information for eligibility, safety, and provider review.
• Laboratory and measurement information, such as test orders, uploaded results, reported values, or measurements from a device or wearable you choose to connect. We use this information to display and organize results and changes over time for review.
• Healthcare communications and service information, such as intake responses, notes, provider communications, appointment or consultation information, service status, and requested pharmacy or laboratory coordination. We use this information to provide and administer the service you requested.
• Identifiers and technical information linked to health activity, such as account identifiers, contact details, IP address, device identifiers, or interaction with a health-related page when that information identifies or can reasonably be linked to you and your health interests. We use this information for authentication, security, operation of the Services, request fulfillment, and legal compliance.
• Organized summaries or inferences, such as a summary or trend generated from the information you submit. We use this information to present information for review. Technology does not independently diagnose, prescribe, or replace licensed provider judgment.

Meridian collects and uses consumer health data only with consent where required or to the extent reasonably necessary to provide a product or service you request.

2. Sources of consumer health data

We may collect consumer health data:

• directly from you through assessments, intake forms, uploads, connected-service choices, account activity, messages, and support interactions;
• from your device or browser when technical information is linked to health-related use of the Services;
• from licensed providers, MDI, pharmacies, laboratories, and other organizations participating in a service you request;
• from a wearable, device, or third-party service that you choose to connect; and
• from service providers acting on our behalf, such as security, identity, communications, hosting, and payment providers, when their information relates to your requested service.

3. Consumer health data we disclose

Depending on the service you request, we may disclose the categories of consumer health data listed in Section 1 to:

• licensed healthcare providers and independent physician groups for clinical review and requested care;
• MD Integrations and other care-coordination or clinical technology providers supporting the independent providers;
• licensed pharmacies, laboratories, carriers, and other fulfillment organizations when a provider order or your request requires their services;
• processors that provide hosting, data storage, security, authentication, communications, customer support, document management, payment support, or limited analytics on Meridian's behalf;
• legal, compliance, regulatory, licensing, accreditation, or certification recipients when disclosure is required or permitted by law; and
• a person or organization you direct or authorize.

The specific data disclosed depends on what is reasonably necessary for the requested service, the recipient's role, and your instructions or consent.

Specific affiliates. As of the effective date, Meridian does not disclose consumer health data to a corporate affiliate. MDI, independent providers, pharmacies, laboratories, and other service participants are third parties, not Meridian corporate affiliates. If Meridian begins disclosing consumer health data to a corporate affiliate, we will identify the affiliate in this Notice as required by law.

4. Sale and advertising

Meridian does not sell consumer health data. Meridian does not use or disclose consumer health data for targeted advertising. Meridian does not operate a geofence around a healthcare facility to identify, track, collect data from, or send health-related messages or advertising to an individual.

5. Your consumer health data rights

Subject to applicable law and exceptions, you may have the right to:

• confirm whether Meridian is collecting, disclosing, or selling consumer health data about you;
• access consumer health data and receive a list of third parties and affiliates to which it was disclosed or sold, including available contact information;
• delete consumer health data;
• withdraw consent from future collection or disclosure;
• correct inaccurate consumer health data where applicable law provides that right;
• appeal Meridian's refusal to act on a request; and
• exercise a right without unlawful discrimination.

Meridian does not sell consumer health data, so there is no sale authorization to withdraw.

6. How to exercise your rights

Submit a request by:

• emailing support@meridian-vitality.com with the subject line "Consumer Health Data Request";
• calling 404-805-5761; or
• writing to: Privacy Officer, Meridian Vitality LLC, 11175 Cicero Drive, Ste. 100, Alpharetta, GA 30022.

You do not need to create a new account to submit a request, although we may ask you to use an existing account when that is a secure and reliable way to verify the request. We may request information reasonably necessary to authenticate your identity and authority. Do not send sensitive health information or identity documents through ordinary email unless we provide a secure method.

We will respond without undue delay and within 45 days when that period is required by law. We may extend the response once by up to 45 additional days when reasonably necessary and permitted, and will explain the extension. Requests generally are free of charge, although applicable law may permit a reasonable fee or denial for requests that are manifestly unfounded, excessive, or repetitive.

To appeal a denial, email support@meridian-vitality.com with the subject line "Consumer Health Data Appeal" within 30 days after receiving our decision and explain why you believe the decision should be reconsidered. We will respond within the period required by applicable law and, if we deny the appeal, provide information about how to contact the appropriate regulator where required.

7. Deletion and withdrawal

When required by law, a verified deletion request will be applied to Meridian's active systems and communicated to processors and other recipients as required. Deletion from archived or backup systems may occur on the schedule permitted by law. We may retain information where an exception applies, including to complete a transaction you requested, protect security and integrity, comply with law, preserve legal claims, or maintain records controlled under HIPAA or medical-record laws.

Withdrawing consent applies to future collection or disclosure based on that consent. It does not affect processing that already occurred lawfully. Withdrawal may prevent Meridian from providing a service that requires the affected information.

8. Security and retention

Meridian restricts access to consumer health data to personnel, processors, and contractors that need access for the purposes described in this Notice or to provide a service you request. We use administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of consumer health data.

We retain consumer health data only as long as reasonably necessary for the disclosed purposes, to provide requested services, and to meet legal, security, and recordkeeping obligations. Clinical records controlled by an independent provider are retained under the provider's policies and applicable law.

9. Changes to this Notice

We may update this Notice by posting a revised version and changing the effective date. Before collecting, using, or disclosing new categories of consumer health data for materially different purposes, we will provide any additional notice and obtain any affirmative consent required by law.

10. Contact

Privacy Officer
Meridian Vitality LLC
11175 Cicero Drive, Ste. 100
Alpharetta, GA 30022
Email: support@meridian-vitality.com
Phone: 404-805-5761