Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy supplements our Privacy Policy and is provided under the Washington My Health My Data Act and Nevada's consumer health data law (SB 370). It applies to "consumer health data" of Washington and Nevada residents and of consumers whose consumer health data is collected in Washington or Nevada.

Prana Force, Inc. ("Prana," "we") is the regulated entity that determines the purposes and means of processing consumer health data under this policy.

1. Consumer health data we collect

We collect the following categories of consumer health data:

• Blood biomarkers and laboratory results — panels ordered through the Service and lab documents you upload
• Body composition data — DEXA and similar scan results, weight, height, and derived body metrics
• Medications — medication names, doses, schedules, and dose history you log
• Vital signs and physiological measurements — heart rate, resting heart rate, and heart rate variability
• Sleep data — sleep stages and durations
• Nutrition data — logged meals, nutrients consumed, food photos you submit
• Physical activity data — workouts and exercise sessions, sets and loads, cardio, steps, distance travelled, and active and total calories burned
• Health conditions, symptoms, and goals — information you share in onboarding, questionnaires, or conversations with the Prana coach
• Demographic data used for health analysis — date of birth, sex, height
• Inferences and derived health data — analytics, scores, trends, insights, and reports we generate from the data above
• Health service usage data — records of testing and scan purchases and fulfillment, and app-usage records that can indicate you use health-tracking features

We do not use geofencing around any facility that provides in-person health care services.

2. Sources of consumer health data

• Directly from you (information you enter, log, upload, or say in chat)
• From your device's health platform with your permission (Apple Health, Health Connect)
• From laboratories and practitioners that fulfill testing you purchase through the Service
• From third-party applications you connect at your direction — AI clients you authorize through the MCP connector can write health entries (such as meals, workouts, weight, sleep, and medication doses) into your Prana record
• Generated by us (analytics and insights derived from your data)

3. Why we collect and use it

• To provide the products and services you request: health tracking, analytics, insights, AI coaching, reports, and fulfillment of testing and scans you purchase
• To operate, secure, debug, and improve those features
• To communicate with you about the Service, including reminders you set
• For internal research to improve our health analytics. If you delete your account we retain a copy of your health measurements for this purpose, de-identified as described in Section 7 of the Privacy Policy
• To comply with law

We collect only the consumer health data reasonably necessary for these purposes, with your consent where required.

4. What we share and with whom

We share consumer health data only with processors acting on our instructions, with fulfillment providers involved in services you purchase, and at your direction. The categories of third parties are:

Affiliates: Prana has no affiliates with whom consumer health data is shared.

We do not sell consumer health data, and we do not share it for advertising. We will not sell or offer to sell consumer health data without first obtaining a valid written authorization signed by you, as required by law.

A note on analytics and payment providers. Rather than claim these fall outside this policy, we describe them plainly. Our analytics provider receives your account identifier, email address, and events describing your use of the app — which screens you opened, when you signed in, which onboarding steps and subscription events occurred. Depending on which screens you visit, that can indicate that you use health-tracking features. Our payment processors receive your email address and, for a testing purchase, the amount, the status, and identifiers describing which panel you bought — which, because panels differ by sex, can indicate your sex at birth. Neither receives substantive health records: no biomarker values, medication names or doses, body-composition measurements, sleep or nutrition data, laboratory results, or the contents of your coaching conversations. We do not use either category for advertising, and we do not sell it.

5. Consent

Where required, we collect consumer health data only with your consent, obtained separately from your acceptance of the Terms of Service — for example, when you grant health-platform permissions, enable health features, purchase testing, or connect an MCP client. We do not collect or share consumer health data for purposes beyond those disclosed here without first obtaining your separate consent, and we do not condition the core Service on consent to non-essential processing.

6. Your rights

If you are a Washington or Nevada resident (or your consumer health data was collected there), you have the right to:

• Know and access — confirm whether we collect, share, or sell your consumer health data; access it; and receive a list of the third parties with whom we have shared it (Section 4 above; on request we will confirm which apply to your data), with contact information where required

• Withdraw consent — withdraw your consent to our collection and sharing of consumer health data at any time

• Delete — request deletion of your consumer health data. We will delete it from our systems, including archives and backups (on backup rotation schedules permitted by law), and we will notify all processors, contractors, and third parties to whom we provided your consumer health data of your deletion request and direct them to delete it as well. Some of those recipients are independent healthcare providers — the laboratories and practitioners who performed testing for you — and they may be separately required by law to retain their own records of your test for a minimum period. We will pass on your request; their retention obligations and privacy practices are their own, and you may also contact them directly. Two further limits apply: we cannot reach data you exported to a third-party application through the MCP connector, and we cannot remove data written to your own device's health record, which you control in your device settings.

  On research data: when an account is deleted we retain a de-identified copy of the health measurements (Section 7 of the Privacy Policy). That copy is not consumer health data, because we have applied reasonable technical and organizational measures so it is no longer reasonably linkable to you — name, email, date of birth and account identifiers are removed, age is reduced to a range, and the identifier is random rather than derived from anything about you. As required for de-identified data, we publicly commit to maintain and use it only in de-identified form, we do not attempt to re-identify it or re-associate it with any individual, and we contractually require any recipient to accept the same obligations. It therefore falls outside the scope of this deletion right, and we have no means of locating it to delete it.

• Non-discrimination — we will not discriminate against you for exercising these rights

To exercise these rights, email aditya@prana.health with the subject "Consumer Health Data Request," or use the deletion option in the app's Settings. We will verify your request using your account email and respond within 45 days (extendable once by 45 days where permitted, in which case we will tell you).

7. Appeals

If we decline your request, you may appeal by replying to our decision or emailing aditya@prana.health with the subject "Consumer Health Data Appeal" within a reasonable time. We will respond to appeals within 45 days (Washington) or as required by applicable law. If your appeal is denied, you may contact:

• Washington: the Washington State Attorney General at www.atg.wa.gov/file-complaint
• Nevada: the Nevada Attorney General at ag.nv.gov

8. Changes and contact

We will post changes to this policy here and update the date above, with advance notice of material changes.

Prana Force, Inc. 2261 Market St. STE 10271, San Francisco, CA 94114 aditya@prana.health