APPLE HEALTH APP PRIVACY NOTICE

This Notice explains how the Personally Apple Health companion app collects, uses, stores, and protects information you choose to share from Apple Health (HealthKit), and the choices you have. It is provided in addition to our main Privacy Policy. Where this Notice and the main Privacy Policy differ regarding Apple Health (HealthKit) data, this Notice controls for that data.

The App is provided by Supplement Technology Inc ("Personally," "we," "us," or "our"), the U.S. company that provides all Personally products and services. Our products and services are currently available only to residents of, and for delivery within, Colorado, Texas, Arizona, and Oregon.

The App can read health and activity data from Apple Health only if you grant permission, and only the specific categories you approve. Apple Health puts you in control: you decide which categories to share and can change or revoke your permissions at any time in the Apple Health app or in iOS Settings.

The App requests only the small set of categories our personalization actually uses:

• Steps;
• Heart rate;
• Resting heart rate;
• Heart rate variability (HRV); and
• Sleep analysis.

We request the minimum categories needed to personalize your health and wellness recommendations, and we do not request categories we do not use. If we add a feature that needs an additional category in the future (for example, cycle-based personalization), we will request it separately, with your fresh permission, and explain why.

We use Apple Health (HealthKit) data for one purpose only: to help you manage your health and wellness by personalizing the nutrition and supplement recommendations we prepare for you. Those recommendations are generated by our rules-based, deterministic engine; we do not use Apple Health data to train or improve any artificial-intelligence model.

We will never:

• use Apple Health data, or any attribute derived from it, for advertising or marketing;
• use Apple Health data for use-based data mining or profiling unrelated to your formulation;
• sell Apple Health data or exchange it for anything of value;
• disclose Apple Health data to any third party for that party's own advertising, marketing, or data-mining purposes; or
• share Apple Health data with our analytics, marketing, email, or advertising vendors.

This is consistent with Apple's App Store requirements for health data and with our own commitments in Section 5 below.

How the data reaches us. When you grant permission, Apple Health data is read on your device by the software development kit (SDK) of our integration partner, Terra (Terra Enabling Developers Ltd), and transmitted to Terra, which processes it and delivers it to our systems in the United States. Terra acts as our processor under a Data Processing Addendum, maintains SOC 2 Type II and ISO 27001 certifications, and is contractually restricted to using the data only to provide this service to us. A current list of Terra's sub-processors is available from us on request.

Where it is processed. Terra's primary processing facilities are in the United Kingdom, so your Apple Health data may be processed in the United Kingdom and then stored in the United States. These transfers are made under the European Standard Contractual Clauses and the UK International Data Transfer Addendum.

Who else receives it. Apart from Terra (as our processor) and our U.S. cloud database and hosting providers, we do not share Apple Health data with anyone. Our manufacturing operation receives only the resulting formulation specification — not your underlying Apple Health data. Apple Health data is not shared with any analytics, marketing, or advertising vendor.

Storage and security. Apple Health data we hold is stored in the United States on our secured infrastructure, encrypted in transit and at rest, protected by access controls and authentication, and accessible only to personnel who need it. We do not store your Apple Health (HealthKit) personal health information in iCloud. No system is completely secure, and we cannot guarantee absolute security.

Apple's App Store Review Guideline 5.1.3 requires that apps using HealthKit not use or disclose health data for advertising or other use-based data mining, and that they clearly disclose their data practices. We meet these requirements: Apple Health data is used solely to help manage your health and wellness by personalizing your recommendations, is walled off from all marketing and advertising tools and vendors, and is never sold.

• Grant or revoke access: You control which Apple Health categories the App can read, and you can revoke access at any time in the Apple Health app or iOS Settings. Revoking access stops future reads immediately.
• Delete your data: You can ask us to delete the Apple Health data we hold by contacting us (Section 8) or through your account settings. When you disconnect Apple Health or delete your account, we promptly delete the Apple Health data held in our systems and instruct Terra to delete its copy; under our agreement, Terra deletes its copy within 90 days of our request, except where retention is required by law.
• Withdraw consent: Because we process this data based on your consent, you may withdraw consent at any time; withdrawal does not affect processing before withdrawal.

The App and our services are for adults only. You must be at least 18 years old to use the App. We do not knowingly collect Apple Health data from anyone under 18.

Privacy Officer — Supplement Technology Inc Email: [email protected] Phone: (720) 350 0429 Address: 4699 Nautilus Crt, Unit 504, Boulder, CO 80301

We may update this Notice to reflect changes in the App or the law. We will update the "Last Updated" date and, for material changes, provide notice in the App or by email and obtain your consent where required.