Washington Consumer Health Data Policy

Washington Consumer Health Data Privacy Policy

Pursuant to the Washington My Health My Data Act

1. About This Policy

Natalie Bode Media LLC d/b/a House of Nat (“House of Nat,” “we,” “us,” or “our”) provides this Washington Consumer Health Data Privacy Policy (this “Policy”) to explain how we collect, use, disclose, and protect consumer health data when Washington residents and other consumers whose consumer health data is collected in Washington use houseofnat.com, the House of Nat mobile applications, and related services (collectively, the “House of Nat Services”).

This Policy supplements our general Privacy Policy. It is a disclosure of our practices and does not itself constitute consent. Where applicable law requires affirmative consent to collect or share consumer health data, we request that consent separately before the applicable collection or sharing occurs.

2. Categories of Consumer Health Data We Collect

Depending on how you use the House of Nat Services, we may collect the following categories of consumer health data:

Wellness selections. Optional daily selections are limited to: “Tired,” “Sore,” “Stressed,” or “Low energy.”

Fitness and activity information. Fitness-goal selections, workout schedules, workout selections, workout-completion information, workout history, streaks, and saved workouts, to the extent this information identifies or is used to infer your physical or mental health status.

Derived or inferred information. Recovery-oriented workout suggestions and related information that House of Nat generates internally from your wellness selections, fitness goals, or workout activity.

Associated identifiers. Account and user identifiers that we use to associate you with the information described above.

House of Nat does not request that users provide diagnoses, treatment information, prescribed-medication information, reproductive or sexual health information, genetic data, biometric identifier templates, or precise location information. If you voluntarily provide health-related information through the House of Nat Services, we will treat it as consumer health data under this Policy.

3. Sources of Consumer Health Data

We collect consumer health data from the following sources:

• Directly from you when you submit a wellness selection or fitness goal
• From your interaction with the House of Nat Services, such as when you schedule, select, save, or complete a workout; and

Through recommendations or classifications that House of Nat generates internally from your wellness selections, fitness goals, or workout activity.

4. Purposes for Collection

We collect and use consumer health data to:

• Display your daily workout
• Suggest a lighter workout session when you report feeling tired, sore, or stressed
• Maintain and display your workout history, progress, and streaks
• Operate, secure, and support your account; and

Comply with applicable legal obligations.

House of Nat uses a rule-based process operating within its Supabase-hosted systems to generate workout suggestions based on the consumer’s own recent workout history, daily wellness selection, and workout duration. House of Nat does not use artificial intelligence or machine learning for this purpose.

We will not collect, use, or share an additional category of consumer health data, or collect, use, or share consumer health data for an additional purpose not disclosed in this Policy, without first updating this Policy and obtaining your affirmative consent before the additional collection, use, or sharing begins.

5. Processors and Sharing of Consumer Health Data

We use service providers that process consumer health data on our behalf:

Supabase. Supabase hosts and processes account, fitness, activity, and wellness information on behalf of House of Nat.

Mux. Mux hosts and streams House of Nat workout videos. When you play a workout, Mux may process your IP address, device or network information, and the identifier of the requested workout to deliver and secure the video stream.

Resend. Resend transmits privacy correspondence, including an email containing a time-limited link through which a consumer may retrieve a requested data export. The consumer health data is stored in a private House of Nat storage location and is not included in the email body or attachment.

Our processors are authorized to process consumer health data only for the purposes described in this Policy and in accordance with House of Nat’s documented instructions.

House of Nat does not sell consumer health data. Under our current practices, House of Nat does not share consumer health data with third parties or affiliates as “sharing” is defined by the Washington My Health My Data Act.

House of Nat has no affiliates with which it shares consumer health data.

We may disclose information where required by applicable law.

6. Consent

House of Nat collects consumer health data only:

• With your consent for a specified purpose; or

To the extent necessary to provide a product or service that you request.

We process fitness goals, workout schedules, workout selections, workout-completion information, workout history, streaks, saved workouts, and related classifications to provide the workout features you request.

Before you submit, and before House of Nat otherwise accesses, receives, or stores, your first optional wellness check-in selection, we will request your separate affirmative consent. The consent request will clearly and conspicuously describe the categories of consumer health data to be collected, the specific purposes and uses, the categories of entities with which the data will be shared, if any, and how you may withdraw consent from future collection and delete your wellness history without the need of closing your account.

You may decline the optional wellness check-in and continue to use the other House of Nat Services.

If House of Nat later proposes to share consumer health data with a third party or affiliate in a manner requiring consent, House of Nat will obtain a separate and distinct affirmative consent before the sharing occurs.

7. Your Washington Consumer Health Data Rights

Subject to applicable law, you may:

• Confirm whether House of Nat is collecting, sharing, or selling consumer health data relating to you
• Access your consumer health data
• Obtain a list of third parties and affiliates with which House of Nat has shared or sold your consumer health data, together with an available email address or other online contact mechanism
• Withdraw your consent for the collection or sharing of your consumer health data at any time, without the requirement of closing your account, including through the in-app Privacy Requests screen
• Request deletion of your consumer health data, including deletion of health data while retaining your account; and

Appeal House of Nat’s refusal to act on a request.

House of Nat will not unlawfully discriminate against you for exercising these rights.

8. How to Exercise Your Rights

You may exercise your rights by:

• In-app: Profile → Settings → Privacy Requests (where you can submit data access requests, withdraw consent to future wellness-data collection, request deletion of your wellness history while retaining your account, request deletion of your full account, or submit an appeal)

Email: hello@houseofnat.com

Appeals: Submit an appeal through the in-app Privacy Requests screen (Profile → Settings → Privacy Requests) or by email to hello@houseofnat.com with “Privacy Appeal” in the subject line.

You are not required to create a new account to submit a request, although we may require you to use an existing account or provide information reasonably necessary to authenticate the request.

We will respond without undue delay and no later than 45 days after receiving your request. When reasonably necessary, we may extend the response period once by an additional 45 days, provided that we notify you during the initial 45-day period and explain the reason for the extension.

When we respond to a request for a copy of your consumer health data, we make the copy available through a time-limited retrieval link that remains active for 48 hours. The data is not sent as an email attachment.

If we decline to act on a request or you are dissatisfied with our response, you may appeal the decision. To submit an appeal, you may use the in-app Privacy Requests screen (Profile → Settings → Privacy Requests) or send an email to hello@houseofnat.com with “Privacy Appeal” in the subject line. Your appeal should include your name, the date of your original request, a description of the decision you are appealing, and any additional information you believe supports your appeal. We will respond in writing within 45 days after receiving the appeal and explain the action taken or the decision not to act and the reasons for it. If we deny the appeal, we will provide contact information for the Washington Office of the Attorney General.

When we grant a deletion request, we will delete the applicable consumer health data from our active systems and notify applicable processors and other recipients. Deletion from archived or backup systems may be delayed as necessary to administer those systems. Under House of Nat’s current backup practices, backup copies expire through the ordinary backup cycle and, in all events, within 90 days after authentication of the request.

9. Data Security

We restrict access to consumer health data to employees, contractors, and processors that need access to provide the House of Nat Services or carry out the purposes described in this Policy.

We maintain reasonable administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of your consumer health data. Any information you send to us electronically, while using the House of Nat Services or otherwise interacting with us, may not be secure when it is transmitted to us. Please be aware, despite our best efforts, no security measures are perfect or impenetrable, and we cannot guarantee “perfect security.”

10. Geofencing

We do not implement a geofence around any entity that provides in-person health care services for the purpose of collecting consumer health data, identifying or tracking consumers, sending notifications or advertisements, or any other purpose prohibited by law.

11. Changes to This Policy

We may update this Policy to reflect changes in our practices or applicable law. If we make material changes, we will notify you through the app or by other appropriate means and obtain your consent where required by law. The “Last Updated” date at the top of this Policy indicates when it was most recently revised.

12. Contact Us

If you have questions about this Policy or wish to exercise your rights:

Natalie Bode Media LLC

Attn: Privacy

3680 Wilshire Blvd, Ste P04 #A166

Los Angeles, CA 90010

Email: hello@houseofnat.com