CONSUMER HEALTH DATA PRIVACY POLICY — SALUD AI

Effective Date: August 2025

Last Updated: August 2025

Salud AI (“we,” “our,” or “us”) provides a wellness application that helps you log health information, organize records, and generate summaries you can share. This Consumer Health Data Privacy Policy (“Policy”) explains how we collect, use, share, and protect Consumer Health Data (CHD) and describes your rights and choices.

This Policy is provided separately from our general Privacy Policy because certain states (including Washington and Nevada) require distinct disclosures and consents for Consumer Health Data.

“Consumer Health Data (CHD)” means personal information that identifies or is reasonably capable of being associated with you and that is linked to your past, present, or future physical or mental health status.

Examples include:

• Health conditions, diseases, or diagnoses you log.
• Symptoms, medications, treatments, or wellness goals you record.
• Lab results, prescriptions, or medical bills you upload.
• Fitness and activity data (e.g., steps, heart rate, sleep) from connected services such as Apple Health or Google Fit.
• Reproductive or sexual health information you choose to log.
• Biometric or sensor data from your device (if enabled).
• Inferences drawn from any of the above.

We may collect the following categories of CHD, depending on how you use the Service:

• Self-reported health data: symptoms, medical history, medications, lifestyle habits.
• Uploaded documents: lab reports, prescriptions, test results, insurance bills.
• Wellness and activity data: heart rate, steps, sleep, or nutrition data from integrations you connect.
• Device-enabled data: photos or images if you choose to upload them, audio notes if you use dictation.
• Communications: messages you send to us (support requests, feedback).

We do not collect CHD without your separate opt-in consent.

• You directly: data you enter, upload, or consent to share.
• Your device integrations: only when you authorize connections to Apple Health, Google Fit, or other services.
• Automatically: technical data tied to health app use (e.g., logs of your health-related entries).

We use CHD for the following purposes only:

• To provide and operate our wellness features.
• To generate summaries and reports you can view or share.
• To improve our Service and AI models (using de-identified or aggregated data whenever possible).
• To maintain security, detect misuse or fraud, and comply with applicable law.

We do not use CHD for targeted advertising.

We may share CHD only in the following limited ways:

• Vendors/Processors: cloud hosting, storage, analytics, email delivery, and other service providers under strict contracts.
• Integrations you authorize: if you connect Apple Health, Google Fit, or other systems, data flows per your authorization.
• At your direction: if you request us to share a summary with your doctor, insurer, or another third party.
• Legal and safety obligations: when required by law, subpoena, or to protect rights and security.
• Business transfers: in a merger or acquisition, subject to continuity of this Policy.

We do not sell CHD. If that ever changes, we will first seek your valid, written authorization that meets state law requirements.

CHD may be shared with our corporate affiliates and subsidiaries that operate under this Policy and only for the same purposes.

We do not use geofencing to track, identify, or target you based on visits to health care facilities.

Depending on your state of residence, you may have the following rights regarding CHD:

• Right to Access: obtain a copy of your CHD.
• Right to Delete: request deletion of CHD we maintain (subject to legal obligations).
• Right to Correct: request corrections to inaccurate CHD.
• Right to Withdraw Consent: revoke consent for collection or sharing at any time.
• Right to Appeal: if we deny your request, you may appeal and we will provide a written response.

We will not discriminate against you for exercising these rights.

You may exercise your rights by:

• Emailing info@salud.love
• Using in-app privacy settings under “Privacy Center”

We may verify your identity before fulfilling requests. We will respond within legally required timelines (generally 45 days).

We retain CHD only as long as reasonably necessary to provide the Service, for security and legal compliance, or as otherwise disclosed. If you request deletion, we will delete within applicable timeframes unless law requires retention.

We implement administrative, technical, and physical safeguards to protect CHD, including:

• Encryption in transit and at rest.
• Access controls and audit logging.
• Vendor due diligence and contracts (DPAs/BAAs).

No system is 100% secure, but we maintain reasonable and appropriate measures to minimize risk.

If there is a breach of CHD not subject to HIPAA, we will comply with the FTC Health Breach Notification Rule and state CHD laws, notifying you and regulators as required.

We may update this Policy from time to time. The updated version will be posted with a new Effective Date. Material changes will be communicated (e.g., via email or in-app notice).

If you have questions or requests, contact us at:

Salud AI Privacy Team

Email: info@salud.love

You may also contact our Grievance Officer at the same email address if you are located in India.

⚖️ Conservative protections built-in:

• No CHD sale without separate written authorization.
• Explicit prohibition of geofencing.
• Clear disclosure of CHD categories, purposes, sources, third parties, and affiliates.
• Granular consent, withdrawal, appeal rights.
• Breach notification aligned with FTC HBNR + CHD state laws.
• Retention and security provisions.