Consumer Health Data Privacy Notice

Effective Date: December 20, 2024

1. Introduction
   This Consumer Health Data Privacy Notice (the “Notice”) provides additional information regarding the consumer health data (defined below) that Kandu Health™, Inc., its affiliated entities, and its partnered professional corporations in various states (collectively, “Kandu”, “we,” “us” or “our”) collects, how we use it, what sources it is derived from, and to whom we disclose it. This Notice also provides information regarding rights of individuals who are residents of Connecticut, Nevada, and Washington, or who are otherwise subject to those laws, pursuant to Connecticut’s SB3, amending the Connecticut Data Privacy Act (“CTDPA”), Nevada’s SB 370, and Washington’s My Health My Data Act (“MHMD”). For the purposes of this Notice, “consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future health status or mental health status, as may be applicable.

This Notice applies to information we collect from visitors to www.kandustroke.com and all related websites, mobile apps, and web-based services, including the Kandu Mobile App (collectively, the “Services”). This Notice does not apply to information we collect from visitors of www.kanduhealth.com, information we otherwise collect from an individual in a business-to-business or employment context, or data that is already subject to certain federal and state regulations, such as protected health information.

This Notice also does not apply to third-party websites, mobile applications, products, or services, even if they may link to our Services or our Services may link to them. We recommend you review the privacy practices of those third parties before accessing third party websites and sharing any personal data.

We encourage you to review our Privacy Policy to learn more about our privacy practices and our commitments to you.

2. Consumer Health Data We Collect
   We may collect, or have collected, the following categories of consumer health data about you:

• • Social, psychological, behavioral, or medical interventions
  • Health-related surgeries or procedures
  • Use or purchase of prescribed medication
  • Diagnosis or diagnostic testing, treatment, or medication
  • Gender affirming care information
  • Biometric data
  • Genetic data
  • Bodily functions
  • Vital signs, symptoms, or measurements of the above categories
  • Data that identifies you seeking health care services
  • Any information that we or our service providers process to associate or identify you with the above information that is derived from non-health information (such as inferred data).

3. Categories of Sources of Consumer Health Data
   We may collect consumer health data from the following categories of sources:

• • Directly from you, through your interactions with us, such as when you use our Services, complete electronic forms, or otherwise contact us via chat, email, or phone.
  • From third parties, including our service providers, business partners, and affiliates, in accordance with applicable law and the context in which you provided the data.

4. How We Use Consumer Health Data
   We use the consumer health data we collect about you to provide customer service; provide and maintain our Services; market our products and Services; market the products and services of others; internal business purposes, including general business administration; and for any purpose consistent with your preferences.

5. To Whom We Disclose Consumer Health Data
   We will only disclose your consumer health data with your consent. Under certain circumstances, we may disclose your data if required to do so by law or in response to valid requests by public authorities. We do not share consumer health data with any third-party advertisers.

6. Consumer Health Data Privacy Rights
   Connecticut residents have the following rights in relation to your consumer health data, subject to certain exceptions:

• • Right to Know and Access. You have the right to know what consumer health data we collect, use, disclose, and/or sell or share as those terms are defined under applicable law, and the right to access such data.
  • Right To Delete. You have the right to request that we, as well as our service providers and contractors, delete the consumer health data that we collect about you.
  • Right to Correct Inaccurate Personal information. You may have the right to request the correction of inaccurate personal information.
  • Right to Opt-Out. You have the right to opt-out of targeted advertising, our sale of your personal data, and profiling decisions that could produce legal or similarly significant effects.
  • Right to Provide Affirmative Consent. You have the right to opt-out of targeted advertising, our sale of your personal data, and profiling decisions that could produce legal or similarly significant effects.
  • Right to Non-Discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described above.

Nevada and Washington residents have the following rights in relation to your consumer health data.

• • Right to Know. You have the right to know what consumer health data we collect, share, or sell, as those terms are defined under applicable law. You also have the right to obtain a list of all third parties and affiliates with whom we have shared or sold your consumer health data, and an active email address or other mechanism that you may use to contact these third parties. If you are a Washington resident or otherwise subject to Washington law, you also have the right to access your consumer health data that we collect, share, or sell.
  • Right To Delete. You have the right to request that we, as well as our service providers and contractors, delete the consumer health data that we collect about you.
  • Right to Withdraw Consent. You have the right to withdraw consent from the collection and sharing of your Consumer Health Data.

How to exercise your rights. If you wish to exercise any of the rights listed above, please send your request(s) using one of the following methods:

• • Email: [email protected]
  • Mail: 210 E. Hacienda Ave Campbell, CA 95008-6617

We do not charge a fee to process or respond to your verifiable consumer request unless it’s excessive, repetitive, manifestly unfounded, or in accordance with applicable law. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

How we verify and respond to requests. We will respond to your request within forty-five (45) days after receipt and we reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days. As described below, in some jurisdictions, an authorized agent may submit a request to exercise your rights on your behalf.

If you have an account with us, we will deliver our written response to that account or via electronic mail. If you do not have an account with us, we will deliver our written response by electronic mail.

However, we cannot respond to your request or provide you with personal data if we cannot verify or authenticate your identity or authority to make the request and confirm that the personal data relates to you. Generally, a rights request must include:

• • Sufficient information that allows us to reasonably verify you are the person about whom we collected personal data or an authorized representative, which must include, at a minimum, your first and last name and email address.
  • Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to the request.

You are not required to create an account with us to submit a verifiable or authenticated consumer request. However, we do consider requests made through your password-protected account sufficiently verified when the request relates to personal data associated with that specific account. We will only use personal data provided in a verifiable or authenticated consumer request to verify your (or your authorized agent’s, as applicable) identity or authority to make the request.

Depending on applicable law, you may be limited in how many verifiable or authenticated consumer requests you make within a twelve (12) month period. If we have collected information on your minor child, you may exercise the above rights on behalf of your minor child. Additionally, in some jurisdictions, you may designate an authorized agent to submit a request on your behalf, and if so, we may require proof of the agent’s authorization by you and/or verification of the agent’s own identity.

How to appeal decisions about your rights.

• • If you are a Connecticut resident and your request is denied, you may appeal our decision and we will provide the steps to appeal as part of responding to your request. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If your appeal is not successful, you may contact Connecticut’s Attorney General by phone at (860) 808-5420 or by submitting a complaint here.
  • If you are a Nevada resident and your request is denied, you may appeal our decision and we will provide the steps to appeal as part of responding to your request. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If your appeal is not successful, you may submit a complaint with the Nevada Attorney General here.
  • If you are a Washington resident or located in Washington and want to appeal our decision with regard to a request that you have made, please Contact Us. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Washington’s Office of the Attorney General by phone at (800) 551-4636 or by submitting a complaint here.

7. Changes to this Notice
   We may change this Notice from time to time to reflect new services or changes in our data practices or relevant laws. We will let you know via email and/or a prominent notice on our Sites, prior to the change becoming effective, and update “effective date” at the top of this Notice. We recommend periodically reviewing this Notice for any changes. Changes to this Notice are effective when they are posted on this page.

8. Contact Us
   If you have any questions about this Notice, please contact us at:
   • Email: [email protected]
   • Mail: 7033 Hayvenhurst Ave, Van Nuys, CA 91406