Consumer Health Data Privacy Notice

Alexis Life LLC, a Delaware limited liability company (“Alexis,” “Alexis Life,” “we,” “us,” or “our”), respects the privacy of information relating to your health.

This Consumer Health Data Privacy Policy describes how Alexis collects, uses, shares, and protects “Consumer Health Data,” as that term or a substantially similar term may be defined under applicable consumer health privacy laws, including the Washington My Health My Data Act and Nevada consumer health data law.

This Policy supplements the Alexis Life Privacy Policy.

This Policy does not replace any Notice of Privacy Practices that may apply to protected health information maintained by a healthcare Provider or Medical Practice under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

Alexis Life LLC is not a medical practice. Healthcare services available through Alexis are provided by independent licensed healthcare professionals (“Providers”) practicing through independent professional medical entities (“Medical Practices”).

1. What Is Consumer Health Data?

For purposes of this Policy, Consumer Health Data generally means personal information that is linked or reasonably linkable to an individual and identifies or may be used to infer information concerning the individual’s past, present, or future physical or mental health status.

Consumer Health Data may include information relating to:

• physical or mental health conditions;
• symptoms;
• diagnoses or potential diagnoses;
• treatments;
• medications;
• prescriptions;
• medication use or acquisition;
• medical history;
• allergies;
• laboratory testing or results;
• height, weight, body composition, or other health measurements;
• health goals;
• reproductive or sexual health;
• pregnancy or breastfeeding status;
• healthcare services requested or received;
• treatment preferences;
• attempts to obtain healthcare services;
• communications concerning health or treatment;
• photographs or other information submitted for clinical review;
• information concerning Providers, treatments, medications, Pharmacies, or healthcare services associated with you; and
• inferences derived from other information that identify or may reasonably identify your health status.

Consumer Health Data does not necessarily include information that is exempt from applicable consumer health privacy laws, including certain information governed by HIPAA or other healthcare privacy laws.

2. Consumer Health Data We Collect

Depending upon how you interact with Alexis and the Services you request, we may collect the following categories of Consumer Health Data:

Health and Medical Information

This may include:

• health history;
• medical conditions;
• symptoms;
• allergies;
• current or prior medications;
• prior treatments;
• treatment outcomes;
• laboratory information;
• adverse reactions; and
• other information relevant to evaluating requested healthcare services.

Physical and Health Measurements

This may include:

• height;
• weight;
• body mass index;
• body-composition information;
• blood pressure or other measurements where requested; and
• changes in measurements over time.

Treatment and Prescription Information

This may include:

• treatment requested;
• medications or formulations requested or prescribed;
• dosage-related information;
• refill or renewal information;
• treatment eligibility;
• fulfillment information;
• Pharmacy information; and
• treatment history.

Sexual and Reproductive Health Information

Where relevant to a Service you request, this may include information concerning:

• sexual health;
• sexual function;
• reproductive health;
• pregnancy;
• breastfeeding; and
• related symptoms or treatment history.

Healthcare Communications

This may include information contained in:

• clinical intake questionnaires;
• communications with customer support concerning healthcare Services;
• communications relating to treatment, prescriptions, fulfillment, or side effects;
• forms or questionnaires; and
• other health-related communications submitted through the Alexis Platform.

Images and Documents

Where relevant, you may provide:

• photographs;
• laboratory reports;
• medical records;
• prescription information; or
• other documents submitted for clinical review or healthcare coordination.

Health-Related Inferences

Information concerning your browsing, treatment selections, account activity, purchases, communications, or other activity may indicate or permit an inference that you are interested in, seeking, or receiving a particular healthcare Service.

We treat such information as Consumer Health Data where applicable law requires us to do so.

3. Why We Collect and Use Consumer Health Data

Alexis may collect and use Consumer Health Data when reasonably necessary to provide a product or Service you request, including to:

• facilitate access to licensed Providers;
• facilitate clinical review of information you submit;
• connect you with the appropriate Medical Practice;
• administer clinical intake processes;
• coordinate appointments or telehealth interactions;
• facilitate communication relating to your requested care;
• facilitate prescription transmission after a Provider issues a prescription;
• coordinate prescription fulfillment;
• coordinate with Pharmacies and laboratories;
• administer your treatment program;
• provide order, refill, or fulfillment information;
• provide customer support;
• administer your Alexis account;
• process transactions relating to requested Services;
• maintain the safety and security of the Platform;
• authenticate users and prevent fraud;
• comply with legal obligations;
• establish, exercise, or defend legal claims; and
• perform other activities reasonably necessary to provide Services you request.

Where applicable law requires consent for a collection, use, or sharing that is not reasonably necessary to provide a product or Service you requested, Alexis will obtain the required consent before engaging in that activity.

4. Sources of Consumer Health Data

Alexis may collect Consumer Health Data from the following categories of sources:

Directly From You

Including through:

• intake forms;
• questionnaires;
• account registration;
• treatment selections;
• communications;
• photographs;
• documents;
• customer-support requests; and
• other information you voluntarily provide.

Providers and Medical Practices

Alexis may receive limited information from Providers or Medical Practices where necessary to administer or facilitate Services, such as:

• eligibility status;
• treatment status;
• prescription status;
• fulfillment-related information; or
• other information necessary to coordinate requested Services.

OpenLoop Health, Inc.

Alexis works with OpenLoop Health, Inc. to facilitate access to Providers and Medical Practices and may receive or transmit Consumer Health Data through that clinical-services infrastructure as necessary to provide Services you request.

Pharmacies

Alexis may receive information from independent Pharmacies concerning:

• prescription processing;
• fulfillment status;
• shipping;
• medication availability;
• refill status; or
• issues requiring coordination.

Laboratories and Healthcare Service Providers

Where testing or related healthcare services are requested, Alexis may receive information reasonably necessary to coordinate those Services.

Service Providers

We may receive information from technology, identity-verification, communications, security, customer-support, payment, fulfillment, and other service providers acting on our behalf.

5. Consumer Health Data We Share

Depending upon the Services you request, Alexis may share the following categories of Consumer Health Data:

• identity and contact information associated with healthcare Services;
• clinical-intake information;
• medical history;
• symptoms;
• physical measurements;
• treatment information;
• prescription information;
• medication information;
• laboratory-related information;
• treatment preferences;
• healthcare communications;
• photographs or records submitted for clinical purposes; and
• other Consumer Health Data reasonably necessary to facilitate a Service you request.

Alexis limits sharing of Consumer Health Data to what is reasonably necessary for the applicable purpose or as otherwise permitted or required by law.

6. Parties With Whom We May Share Consumer Health Data

Alexis may share Consumer Health Data with the following categories of third parties where reasonably necessary to provide Services you request or otherwise permitted by law.

Providers and Medical Practices

Consumer Health Data may be provided to licensed Providers and Medical Practices to:

• evaluate treatment eligibility;
• establish or support a clinician-patient relationship;
• diagnose or treat a medical condition;
• make prescribing decisions;
• monitor treatment; and
• provide healthcare Services.

Clinical Services Infrastructure

Alexis works with OpenLoop Health, Inc. to facilitate access to the independent Providers and Medical Practices involved in delivering healthcare Services.

Pharmacies

Where a Provider issues a prescription, Consumer Health Data may be shared with an independent licensed Pharmacy as necessary to:

• receive the prescription;
• verify information;
• prepare or compound medication where applicable;
• dispense medication;
• communicate with the patient or Provider;
• fulfill the prescription; and
• ship medication.

Laboratories and Other Healthcare Service Providers

Where laboratory testing or another healthcare service is requested, information may be shared as reasonably necessary to provide that Service.

Technology and Operational Service Providers

Consumer Health Data may be processed by service providers performing authorized functions such as:

• secure hosting;
• cloud infrastructure;
• communications;
• identity verification;
• customer support;
• fraud prevention;
• security;
• account administration;
• data storage;
• pharmacy or fulfillment coordination; and
• other operational functions necessary to provide requested Services.

These service providers may process Consumer Health Data only for authorized purposes and subject to applicable contractual and legal requirements.

Legal and Regulatory Recipients

Consumer Health Data may be disclosed where required or expressly authorized by applicable law, legal process, court order, regulatory requirement, or other lawful authority.

Parties You Direct or Authorize

We may share Consumer Health Data with another person or entity when you specifically direct or authorize us to do so.

Affiliates

Alexis does not currently identify any corporate affiliate with which Consumer Health Data is shared solely because of a common corporate affiliation.

If this changes, this Policy will be updated as required by applicable law.

7. Sale of Consumer Health Data

Alexis does not sell Consumer Health Data.

Alexis does not exchange Consumer Health Data for monetary or other valuable consideration in a manner that constitutes a sale under applicable consumer health privacy law.

If Alexis ever proposes to engage in an activity that constitutes a sale of Consumer Health Data, Alexis will first obtain any separate written authorization required by applicable law.

Alexis will not condition the availability of a product or Service on your authorization to sell Consumer Health Data where prohibited by law.

8. Advertising and Cross-Site Tracking

Alexis does not use identifiable Consumer Health Data collected in connection with seeking or receiving healthcare Services for cross-context behavioral advertising.

Alexis does not intentionally provide:

• clinical-intake responses;
• diagnosis information;
• prescription information;
• medication information;
• sexual-health information;
• laboratory information; or
• similar identifiable Consumer Health Data

to advertising networks for targeted advertising.

Alexis does not authorize third-party advertising technologies to collect Consumer Health Data over time and across unrelated websites or online services from clinical intake forms or authenticated healthcare portions of the Platform.

Public-facing portions of alexislife.com may use ordinary analytics or marketing technologies as described in the Alexis Life Privacy Policy.

Alexis does not intentionally combine information collected through those technologies with identifiable clinical Consumer Health Data for targeted advertising.

9. How Consumer Health Data Is Processed

Consumer Health Data may be processed electronically through systems used to:

• receive information you submit;
• securely transmit information for clinical review;
• facilitate communications;
• administer accounts;
• coordinate requested healthcare Services;
• facilitate prescription fulfillment;
• provide customer support;
• maintain records;
• detect and prevent fraud;
• maintain security; and
• comply with applicable law.

Alexis limits access to Consumer Health Data to personnel, contractors, service providers, Providers, Medical Practices, Pharmacies, and other authorized parties who reasonably require access to perform an authorized function.

10. Security of Consumer Health Data

Alexis maintains administrative, technical, and physical safeguards designed to protect Consumer Health Data against unauthorized access, acquisition, disclosure, alteration, destruction, or loss.

Safeguards may include, as appropriate:

• access controls;
• authentication;
• encryption;
• secure communications;
• vendor-management practices;
• contractual restrictions;
• security monitoring;
• data minimization; and
• other reasonable security measures.

No information system or transmission method can be guaranteed to be completely secure.

11. Your Consumer Health Data Rights

Depending upon applicable law, you may have the right to:

Confirm Collection, Sharing, or Sale

You may request confirmation of whether Alexis is collecting, sharing, or selling Consumer Health Data concerning you.

Access Your Consumer Health Data

You may request access to Consumer Health Data Alexis maintains concerning you.

Obtain Information About Sharing

You may request information concerning third parties and affiliates with whom Consumer Health Data relating to you has been shared or sold.

Where required by applicable law, Alexis will provide available contact information or an online mechanism for contacting such parties.

Withdraw Consent

Where Alexis relies upon your consent to collect or share Consumer Health Data, you may withdraw that consent for future collection or sharing.

Withdrawal of consent does not necessarily affect processing that occurred lawfully before the withdrawal became effective.

If particular Consumer Health Data is reasonably necessary to provide a Service you requested, withdrawing consent may prevent Alexis from continuing to facilitate that Service.

Request Deletion

You may request deletion of Consumer Health Data concerning you, subject to applicable legal requirements and exceptions.

Where required by applicable law, Alexis will notify applicable affiliates, processors, contractors, or other third parties of a valid deletion request so that they may also take required action.

Information stored in archives or backup systems may be deleted according to legally permitted restoration or deletion schedules.

Request Correction

Where provided by applicable law, you may request correction of inaccurate Consumer Health Data maintained by Alexis.

Cease Certain Processing

Where provided by applicable law, you may request that Alexis cease certain collection, sharing, or other processing of Consumer Health Data.

Appeal a Decision

If Alexis refuses to take action on a Consumer Health Data request and applicable law provides a right to appeal, you may appeal that decision as described below.

Alexis will not unlawfully discriminate against you for exercising an applicable Consumer Health Data right.

12. How to Exercise Your Rights

To submit a Consumer Health Data request, email:

[email protected]

with the subject line: CONSUMER HEALTH DATA REQUEST

Please identify:

• your name;
• the email address associated with your Alexis account, if applicable;
• the right you wish to exercise; and
• sufficient information for us to understand and locate the information associated with your request.

Alexis may take reasonable steps to authenticate your identity before providing access to, correcting, or deleting Consumer Health Data.

We will not require you to create a new account solely to exercise a privacy right.

If you already maintain an Alexis account, we may use reasonable account-authentication procedures.

Where applicable law permits an authorized agent to act on your behalf, we may require reasonable evidence that the agent is authorized to submit the request.

13. Response to Requests

Alexis will respond to authenticated Consumer Health Data requests without undue delay and within the period required by applicable law.

Where Washington law applies, Alexis will generally act on an applicable request within 45 days of receipt.

Where reasonably necessary because of the complexity or number of requests, the response period may be extended once by up to an additional 45 days where permitted by law, provided that Alexis informs you of the extension and the reason for it within the initial response period.

Responses will be provided without charge where required by law, subject to legally permitted exceptions for manifestly unfounded, excessive, or repetitive requests.

14. Deletion Requests

A valid deletion request may require Alexis to delete applicable Consumer Health Data from Alexis systems and, where required by law, notify processors, contractors, service providers, or other third parties that received the Consumer Health Data of the request.

Deletion rights are subject to applicable legal exceptions.

Certain information may need to be retained for purposes including:

• legal compliance;
• fraud prevention;
• security;
• transaction records;
• dispute resolution;
• enforcement of agreements; or
• other purposes permitted by law.

Medical records maintained independently by a Provider or Medical Practice may be subject to separate healthcare record-retention requirements.

A deletion request submitted to Alexis does not necessarily require an independent Provider or Medical Practice to destroy a medical record that applicable law requires that entity to maintain.

15. Appeals

If Alexis denies a Consumer Health Data request and applicable law gives you a right to appeal, you may appeal the decision by emailing:

[email protected]

with the subject line: CONSUMER HEALTH DATA APPEAL

Please identify the original request and explain why you believe the decision should be reconsidered.

Alexis will review the appeal and respond within the time required by applicable law.

Where required, if an appeal is denied, Alexis will provide information concerning how you may submit a complaint to the applicable state attorney general or other regulator.

16. Consent

Where Consumer Health Data is collected or shared only because it is reasonably necessary to provide a product or Service you specifically requested, Alexis may process that information as permitted by applicable law.

Where applicable law requires affirmative consent for an additional collection, use, or sharing of Consumer Health Data, Alexis will request that consent separately.

Alexis will not rely solely upon your acceptance of this Policy as consent where applicable law requires a separate affirmative action.

17. Geofencing

Alexis does not use geofencing technology around healthcare facilities for purposes prohibited by applicable consumer health privacy laws, including to:

• identify or track consumers seeking healthcare Services;
• collect Consumer Health Data;
• infer a person’s health status;
• target health-related advertising based upon a person’s presence at a healthcare facility; or
• send health-related messages based upon presence within a prohibited geofence.

18. De-Identified and Aggregated Information

Alexis may create or receive information that has been de-identified or aggregated so that it cannot reasonably be linked to an identified or identifiable person.

Where required by applicable law, Alexis will:

• take reasonable measures to ensure that de-identified information cannot be associated with an individual;
• maintain the information in de-identified form; and
• not attempt to re-identify the information except where permitted by law.

Properly de-identified or aggregated information may be used for lawful purposes.

19. Changes to This Policy

Alexis may update this Consumer Health Data Privacy Policy from time to time.

The Effective Date above identifies when the Policy was most recently updated.

If a change would result in Alexis collecting, using, or sharing a materially new category of Consumer Health Data or using Consumer Health Data for a materially new purpose, Alexis will provide notice and obtain affirmative consent where required by applicable law before engaging in that activity.

Material changes will be communicated in the manner required by applicable law.

20. Relationship to Other Privacy Documents

This Consumer Health Data Privacy Policy supplements the Alexis Life Privacy Policy.

Healthcare records created or maintained by a Provider or Medical Practice may be governed separately by the Provider’s or Medical Practice’s Notice of Privacy Practices and applicable healthcare privacy law.

If this Policy conflicts with a legally required Notice of Privacy Practices regarding protected health information maintained by a Medical Practice, the applicable Notice of Privacy Practices governs that Medical Practice’s handling of the protected health information.

21. Contact Us

Questions, complaints, or requests concerning this Consumer Health Data Privacy Policy may be directed to:

Alexis Life LLC

[email protected]