Consumer Health Data Privacy Policy

For Washington Residents (My Health My Data Act) | Effective Date: June 10, 2026

This Consumer Health Data Privacy Policy ("CHD Policy") describes how MedGrid, LLC ("MedGrid," "we," "us," or "our") collects, uses, and shares Consumer Health Data of Washington residents, and the rights available to them, under the Washington My Health My Data Act (RCW 19.373) (the "Act"). This CHD Policy supplements, and is incorporated into, the MedGrid Privacy Policy.

Relationship to HIPAA. This CHD Policy applies only to Consumer Health Data that is not protected health information governed by the Health Insurance Portability and Accountability Act ("HIPAA") or otherwise exempt from the Act. Information that MedGrid handles as a business associate under HIPAA is governed by HIPAA and the applicable Business Associate Agreement, not by this CHD Policy.

"Consumer Health Data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status, as defined by the Act.

1. Categories of Consumer Health Data We Collect

We may collect the following categories of Consumer Health Data:

• Information about health conditions, treatments, symptoms, diagnoses, or interventions a consumer searches for or expresses interest in through our Services.
• Information about products or protocols a consumer views, inquires about, or orders that relates to a health condition.
• Information a consumer provides in inquiries, intake, or communications relating to health or treatment.
• Data that identifies a consumer's attempt to acquire health-related products or services.
• Any inferences derived from the above that are used to associate a consumer with a health condition.

2. Sources of Consumer Health Data

We collect Consumer Health Data directly from the consumer when the consumer uses our Services or communicates with us; automatically through the consumer's interaction with our websites and applications; and, where applicable and permitted, from the consumer's healthcare provider or from service providers acting on our behalf.

3. How We Use Consumer Health Data

We use Consumer Health Data only for purposes that are necessary to provide the products and services the consumer requests, to operate and secure our Services, to communicate with the consumer, and to comply with our legal obligations. We do not collect, use, or share Consumer Health Data for any purpose beyond what is disclosed in this CHD Policy without first obtaining the consumer's consent, and, where the Act requires, a separate authorization.

4. How We Share Consumer Health Data

We may share Consumer Health Data with the following categories of recipients, only to the extent permitted by the Act and, where required, with the consumer's consent:

• Service providers (processors): vendors that process Consumer Health Data on our behalf under a written contract that requires them to comply with the Act.
• Pharmacies and product vendors: as necessary to fulfill a consumer's request or order.
• Affiliates: entities under common ownership with MedGrid, for the purposes described in this CHD Policy.
• Legal and safety recipients: where required to comply with law or legal process or to protect rights and safety.

No sale without authorization. We do not sell Consumer Health Data. We will not sell Consumer Health Data without first obtaining a valid authorization that meets the requirements of the Act. We do not collect or use Consumer Health Data to deny services, and we do not use geofencing around any health care facility to identify, track, or collect data from consumers or to send health-related advertisements.

5. Your Rights

If you are a Washington resident, you have the right to:

• Confirm whether we are collecting, sharing, or selling your Consumer Health Data, and to access that data, including a list of the third parties and affiliates with whom we have shared or to whom we have sold it.
• Withdraw your consent to our collection and sharing of your Consumer Health Data.
• Have your Consumer Health Data deleted, including by our affiliates and service providers, subject to the limited exceptions permitted by the Act.
• Not be discriminated against for exercising any of these rights.

To exercise any of these rights, submit a request using the contact information in Section 7. We will verify and respond to your request within the timeframe required by the Act. If we deny a request, you may appeal as described in our response.

6. Data Security and Retention

We maintain administrative, technical, and physical safeguards designed to protect Consumer Health Data, and we restrict access to those who need it to perform their functions. We retain Consumer Health Data only as long as necessary for the purposes described in this CHD Policy or as required by law, after which we delete or de-identify it.

7. Contact and Changes

We may update this CHD Policy from time to time and will post the updated policy with a revised effective date. To exercise your rights or ask questions about this CHD Policy, contact us at:

MedGrid, LLC

MedGrid, LLC, 1691 Michigan Ave, Ste 360, Miami, Florida, USA

privacy@medgrid.com