Health Data Privacy Policy

Effective Date: April 1, 2026

FOREVERHER, INC ("ForeverHer," "we," "us," or "our") is committed to transparency regarding how we collect, use, share, and protect your consumer health data. This Consumer Health Data Privacy Policy supplements our general Privacy Policy and is provided in accordance with the Washington My Health My Data Act (RCW 19.373), Connecticut Public Act No. 23-56 (as it relates to consumer health data), Nevada Senate Bill 370, and other applicable state consumer health data protection laws.

This policy applies to individuals who are residents of states with consumer health data protection laws and whose consumer health data we collect or process through our website at shopforeverher.com, our telehealth platform, or our related services.

1. What Is Consumer Health Data

Consumer health data means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. Under applicable state laws, this includes but is not limited to:

• Individual health conditions, treatment records, diseases, or diagnoses
• Social, psychological, behavioral, and medical interventions
• Health-related surgeries or procedures
• Use or purchase of prescribed medications or wellness treatments
• Bodily functions, vital signs, or biometric data
• Reproductive or sexual health information
• Gender-affirming care information
• Information that identifies a consumer seeking healthcare services or supplies
• Precise location data that could reasonably indicate a consumer's attempt to acquire or receive health services
• Data that derives or extrapolates health status from non-health information (such as proxy, algorithm, or inferential data)

2. Consumer Health Data We Collect

In the course of providing our telehealth, e-commerce, and wellness services, we may collect the following categories of consumer health data:

• Health Questionnaire Responses: Information you provide about your health history, current conditions, allergies, and medications when completing our intake forms or telehealth consultations.
• Treatment and Prescription Data: Records of prescribed treatments, dosages, treatment protocols, and provider consultation notes associated with your care.
• Product Purchase History: Records of health-related products you purchase through our platform, including prescribed treatments and related wellness products.
• Telehealth Interaction Data: Information generated during your telehealth consultations, including session metadata and clinical documentation.
• Self-Reported Health Information: Any health-related information you voluntarily provide through customer support interactions, feedback forms, or account profile updates.

3. How We Collect Consumer Health Data

We collect consumer health data through the following means:

• Directly from you: When you complete health intake forms, participate in telehealth consultations, create an account, place orders, or communicate with our support team.
• From healthcare providers: Licensed physicians and nurse practitioners who conduct your consultations and prescribe treatments through our platform.
• From service providers: Compounding pharmacies and shipping partners involved in fulfilling your prescriptions and orders.
• Automatically: Through cookies and similar technologies when you interact with our website, to the extent such data constitutes consumer health data (for example, browsing behavior on treatment-specific pages).

4. How We Use Consumer Health Data

We process your consumer health data for the following purposes:

• Providing Healthcare Services: Facilitating telehealth consultations, generating personalized treatment protocols, processing prescriptions, and coordinating with compounding pharmacies.
• Order Fulfillment: Processing, packaging, and delivering your prescribed treatments and health-related products.
• Treatment Coordination: Communicating with licensed providers, pharmacies, and other parties necessary for your care.
• Patient Safety: Monitoring for adverse reactions, drug interactions, and ensuring clinical appropriateness of prescribed therapies.
• Customer Support: Responding to your inquiries, resolving issues, and providing information about your treatments or orders.
• Legal Compliance: Meeting obligations under HIPAA, state telehealth laws, pharmacy regulations, and other applicable legal requirements.
• Service Improvement: Analyzing de-identified and aggregated data to improve our platform, treatment offerings, and patient experience.

We do not sell your consumer health data. We do not use consumer health data for advertising or marketing purposes without your express, separate consent.

5. Who We Share Consumer Health Data With

We may share your consumer health data with the following categories of recipients, and only for the purposes described in this policy:

• Licensed Healthcare Providers: Board-certified physicians and nurse practitioners who provide your telehealth consultations and prescribe treatments.
• Compounding Pharmacies: FDA-compliant licensed pharmacies that prepare and dispense your prescribed treatments and medications.
• Shipping and Fulfillment Partners: Carriers that deliver your orders in discreet, temperature-controlled packaging. These partners receive only the minimum information necessary for delivery.
• Technology Infrastructure Providers: Cloud hosting, data storage, and communication platform providers who support our systems under strict data processing agreements that prohibit independent use of your data.
• Payment Processors: Secure third-party processors that handle payment transactions. These processors do not have access to your health data.
• Legal and Regulatory Authorities: When required by law, court order, subpoena, or to comply with regulatory obligations.

Before sharing your consumer health data with any new category of third party not described above, we will obtain your affirmative consent, unless the disclosure is required by law or necessary to provide you with a service you have requested.

6. Your Rights

Under applicable state consumer health data protection laws, you have the following rights:

6.1 Right to Know and Access

You have the right to confirm whether we are collecting, sharing, or selling your consumer health data, and to request access to the specific consumer health data we have collected about you. Upon a verified request, we will provide your data in a readable format.

6.2 Right to Delete

You have the right to request that we delete your consumer health data. Upon receiving a verified deletion request, we will delete your consumer health data and direct our processors to do the same, unless retention is required or authorized by law (for example, medical record retention requirements).

6.3 Right to Opt Out of Sale and Sharing

You have the right to opt out of the sale of your consumer health data. ForeverHer does not sell consumer health data. If we ever change this practice, we will provide a clear and conspicuous opt-out mechanism before any such sale occurs.

6.4 Right to Withdraw Consent

Where we process your consumer health data based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6.5 Right to Non-Discrimination

We will not discriminate against you for exercising any of your rights under applicable consumer health data protection laws. You will not receive a different level or quality of service as a result of exercising your rights.

7. How to Exercise Your Rights

To exercise any of the rights described in Section 6, you may submit a request by contacting us through our website.

When submitting a request, please include your full name, email address associated with your account, and a description of the right you wish to exercise. We will verify your identity before processing your request to protect against unauthorized access to your data.

We will respond to verified requests within the timeframes required by applicable law:

• Washington residents: Within fifteen (15) calendar days, with the possibility of a fifteen-day extension if reasonably necessary.
• Connecticut residents: Within forty-five (45) calendar days, with the possibility of a forty-five-day extension if reasonably necessary.
• Nevada residents: Within sixty (60) calendar days, with the possibility of a thirty-day extension if reasonably necessary.

If we deny your request in whole or in part, we will explain the basis for the denial and inform you of your right to appeal.

8. Consent

Where required by law, we will obtain your affirmative consent before collecting or sharing your consumer health data. This consent will be separate and distinct from any other consent you may provide, and will be obtained through a clear and conspicuous disclosure.

For Washington residents, we will obtain consent before collecting consumer health data that is not strictly necessary to provide a product or service you have requested. We will also obtain consent before sharing your consumer health data with third parties, except where required by law or necessary for treatment purposes.

9. Data Security

We implement appropriate administrative, technical, and physical safeguards to protect your consumer health data against unauthorized access, use, disclosure, alteration, or destruction. Our security measures include:

• Encryption of consumer health data in transit and at rest using industry-standard protocols
• Role-based access controls limiting data access to authorized personnel on a need-to-know basis
• Regular security assessments, vulnerability testing, and penetration testing of our systems
• Employee training on data privacy and security practices
• Contractual requirements for third-party service providers to maintain equivalent security standards
• Incident response procedures for identifying, containing, and remediating security incidents

While we take extensive measures to safeguard your data, no method of electronic storage or transmission is completely secure. If you become aware of any unauthorized access to your account, please contact us immediately.

10. Geofencing

In compliance with the Washington My Health My Data Act, ForeverHer will not implement any geofencing technology around healthcare facilities or locations that would be used to identify or track consumers seeking health services, collect consumer health data, or send notifications, messages, or advertisements to consumers related to their health data.

11. Changes to This Policy

We may update this Consumer Health Data Privacy Policy from time to time. When we make material changes, we will:

• Update the "Effective Date" and "Last Updated" dates at the top of this page
• Post the revised policy on our website
• Notify affected consumers by email or through a prominent notice on our platform

Where required by applicable law, we will obtain your consent before making material changes to how we process your consumer health data. We encourage you to review this policy periodically.