Consumer Health Data Privacy Policy

About This Policy

Some of the information you share with Holistic Health is about your health — and health information deserves extra care. This policy explains, in plain terms, what consumer health data we collect, how we use it, who we do (and don't) share it with, and the specific rights you have to control it. It supplements our general Privacy Policy; where this policy speaks specifically about health data, it applies alongside that broader notice.

This policy exists in part because of Washington's My Health My Data Act (MHMDA) and Nevada's SB370, which give residents of those states specific protections for their consumer health data. If you live in Washington or Nevada, these rights are guaranteed to you by law. Because we think everyone's health data deserves the same respect, we extend these protections to all of our users, wherever you live.

What Consumer Health Data We Collect

"Consumer health data" means information that identifies your past, present, or future physical or mental health. For us, that's the health-related things you choose to tell your guide, such as:

• Symptoms you're experiencing and how you're feeling
• Health conditions or diagnoses you mention
• Your wellness and health goals
• Supplements, medications, or lab results you share or upload
• Pregnancy, breastfeeding, or trying-to-conceive status
• What we generate from what you share, such as your care plan and supplement recommendations
• The supplements you buy from us and your order history, which may reveal information about your health
• Reactions or side effects you report to us
• Other wellness inputs you provide in conversation, in the intake, or in your health profile

You're always in control of what you share. You never have to disclose anything you're not comfortable with.

How We Collect It

We collect consumer health data directly from you — through your conversations with your guide over Messages, through your care plan and health profile, through checkout when you buy a supplement pack, and through any labs or documents you choose to send us.

We do not buy health data from third parties, data brokers, or anyone else.The only health information we hold is what you've shared with us yourself.

How We Use It

We use your consumer health data to serve you, specifically to:

• Generate your personalized care plan, including suggestions for supplements we sell
• Check suggested supplements against what you told us, such as medications and pregnancy status
• Prepare, ship, and support supplement packs you choose to buy
• Follow up on reactions you report and handle product recalls, and keep the records the law requires
• Power your guide so it can remember context and follow up meaningfully
• Improve the service we provide to you

We do not use your consumer health data for advertising, marketing, or any purpose unrelated to providing you the service you asked for.

Who We Share It With

We keep the circle small and share consumer health data only in these limited ways:

• Service providers who help us operate: A small set of processors — for example, cloud hosting, the AI providers that power your guide, our messaging and payment providers, and internal support tools — process data strictly on our behalf, only to run the service, and only under confidentiality and data-protection terms.
• Our manufacturing and fulfillment partner: When you buy a pack, the partner that prepares and ships it receives your name, contact details, shipping address, and the supplements in your pack, which may reveal information about your health. It uses this only to prepare and ship your order on our behalf. It does not receive your conversations, medical history, medications, or pregnancy status. Shipping carriers receive only your name and address.
• Clinics and practitioners you ask us to contact: Only when you ask us to help you find care, as described in our Privacy Policy.
• Anything else — only with your affirmative consent: We will not share your consumer health data for any other purpose unless you give us clear, separate permission first.

We never sell consumer health data. We never share your health details, conversations, or orders with advertising or marketing platforms.The one exception to be aware of: if a Meta ad brought you to us, our server may send Meta up to two generic events: "StartConsultation" when you start a text and "OpenedPlan" the first time you open your plan link. Each carries only Meta's own click identifier and the click and event times, so we can measure our ads. They never include your phone number, messages, symptoms, care plan contents, orders, or anything you tell your guide. You can turn them off at any time through Your Privacy Choices in the footer, and Global Privacy Control turns them off automatically. We never send them for people located in Washington, Nevada or Connecticut.

Your Rights

Under the My Health My Data Act, Nevada SB370, and our own commitment to you, you have the right to:

• Access & confirm: Ask us whether we hold consumer health data about you, and get a copy of it
• Withdraw consent: Take back any consent you've given for us to collect or share your consumer health data
• Delete: Request deletion of your consumer health data, and we'll delete it (including asking our processors to do the same), except records the law requires us to keep, such as order records and reports of reactions to supplements
• No discrimination: We will never deny you service, charge you differently, or degrade your experience for exercising any of these rights

To exercise any of these rights, email us at support@holistic.health (or reach us any of the ways listed in our Privacy Policy). We'll confirm your request and respond within the timeframes the law requires. If we ever decline part of a request, we'll tell you why and how to appeal.

Consent

We only collect the consumer health data we need to provide the service you asked us for. Before we collect consumer health data beyondwhat's necessary for that service, we ask for your consent first.

And before we would ever share your consumer health data for a purpose beyond operating the service, we obtain separate, specific authorizationfrom you. You can withdraw either consent at any time, and doing so won't affect the care you receive.

Data Security

We use industry-standard security measures to protect your consumer health data, consistent with our general Privacy Policy:

• Encryption in transit (TLS) between your browser or app and our servers
• Encryption at rest for stored data
• Access controls limiting who can view your data, and ongoing security review
• Employee training on data protection

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security — but we treat your health data with the highest level of care we can.

Contact Us

If you have questions about this policy or want to exercise any of your rights over your consumer health data, please reach out:

Email: support@holistic.health