Consumer Health Data Privacy Policy

1. Consumer health data covered by this policy

Beluga Health, P.A. is responsible for all medical consultations available through Sinta. Pharmacy fulfillment is provided by Beluga's approved pharmacy partners, which independently dispense prescribed medications. Junction's network physicians approve and review laboratory orders handled through their network; their responsibility is limited to laboratory orders approved by that network and does not extend to other laboratory orders. Independent laboratories perform laboratory testing. Sinta does not provide medical consultations, prescribe medication, or dispense medications.

Consumer health data is personal information that identifies or can reasonably be linked to a person and relates or can be used to infer that person's physical or mental health status.

Depending on how you use the Services, this may include:

• Health goals, symptoms, conditions, medical history, medications, allergies, and treatment interests;
• Height, weight, vital measurements, age, sex, activity, nutrition, sleep, and other wellness information;
• Laboratory orders, results, biomarker information, health scores, trends, educational insights, and health-related inferences;
• Program category, eligibility and enrollment status, appointments, communications, and service history;
• Information that can reveal an attempt to obtain or receive health services; and
• Identifiers, device information, and technical information when linked to the health or wellness information above.

2. Sources of consumer health data

We may collect consumer health data from:

• You directly, including through website, enrollment, intake, consent, and account forms;
• Your portal activity, messages, chat interactions, customer-support communications, and other interactions with the Services;
• The wellness business or Partner through which you access or use the Services;
• Beluga Health, P.A. and its licensed healthcare providers;
• Junction and its network physicians for laboratory orders approved by that physician network;
• Pharmacies, laboratories, fulfillment partners, and other healthcare or service providers involved in providing or supporting the Services;
• The Vitalis Lab Intelligence Engine when it generates summaries, scores, trends, insights, or plan components from information submitted to the Services; and
• Your browser, device, or interaction with the Services when technical information is linked to health-related activity and collection is permitted by applicable law.

Partners and their authorized personnel may also provide information related to Partner Wellness Services, client engagement, wellness support, progress tracking, and other information submitted through or in connection with the Services.

3. Why we collect and use it

We collect and use consumer health data as reasonably necessary to provide the Services you request, including to:

• Help intake information reach the appropriate independent clinical entity;
• Coordinate program status, appointments, laboratory and pharmacy workflows, and nonclinical support;
• Operate accounts, maintain security, prevent fraud, and troubleshoot the platform;
• Use the Vitalis Lab Intelligence Engine to organize laboratory data, identify patterns, and generate AI-assisted educational summaries, scores, trends, and plan components such as lifestyle changes, dietary recommendations, and supplement considerations. Vitalis does not independently diagnose, prescribe, determine medical eligibility, or make clinical decisions. Patient-specific clinical interpretations and recommendations are reviewed by a licensed healthcare provider before delivery;
• Support Partner Wellness Services, including authorized wellness education, healthy-habit support, accountability, progress tracking, and client engagement facilitated through the Services;
• Respond to requests and comply with legal, security, recordkeeping, and contractual obligations; and
• Create aggregated or de-identified information that cannot reasonably be linked to you.

Sinta does not use identifiable consumer health data to train general-purpose AI models for Sinta. Where enabled and permitted for the relevant service, authorized AI service providers may process identifiable patient information on Sinta's behalf to provide educational summaries, scores, trends, and draft wellness insights. This processing is subject to applicable privacy, security, contractual, and authorization requirements, including a Business Associate Agreement where required.

We do not use consumer health data to make medical, diagnostic, treatment, prescribing, or other clinical decisions. Those clinical decisions are made by licensed healthcare providers.

4. How consumer health data may be shared

We may share the minimum reasonably necessary consumer health data with:

• Beluga Health, P.A. and its licensed healthcare providers, as necessary to provide medical evaluation, treatment, prescribing, and related clinical services;
• Junction and its network physicians, as necessary to approve and review laboratory orders handled through and approved by that physician network;
• Laboratories, Beluga's approved pharmacy partners, and other fulfillment partners involved in the services you request;
• Your participating wellness business or Partner, where permitted by applicable law, appropriate authorization or consent, and applicable agreements, and only to the extent reasonably necessary to support authorized Partner Wellness Services, client engagement, program administration, or other permitted functions;
• Processors that support hosting, security, communications, identity verification, customer service, payment processing, authorized AI-assisted functionality, platform functions, and other contracted technology and operational services; and
• Authorities or other parties when required by law or reasonably necessary to protect users, the Services, or legal rights.

Partners do not receive unrestricted access to consumer health information solely because a consumer accesses the Services through that Partner. Partner access may be limited according to the Partner's role, authorization, permitted purpose, applicable agreements, and applicable law. Access to clinical information may be further restricted based on the Partner's role and authorization.

Sinta does not currently share consumer health data with any corporate affiliates.

Sinta does not sell consumer health data.

We also do not use consumer health data for targeted advertising, permit third parties to use consumer health data for their own targeted advertising purposes, or permit third parties to collect consumer health data over time across unrelated websites or online services.

We do not use geofences around healthcare facilities to identify, track, or collect consumer health data.

Where required by applicable law, we will obtain appropriate consent or authorization before sharing consumer health data.

5. Consent and control

Where applicable law requires consent to collect, use, or share consumer health data beyond what is necessary to provide a service you requested, we will request consent separately and describe the categories, purposes, and recipients involved.

Where required, we may obtain your authorization or consent before disclosing certain consumer health information to a Partner or other third party.

You may withdraw consent or revoke an authorization for future collection or sharing by contacting us. Withdrawal or revocation will not affect processing that occurred before the withdrawal or revocation and may prevent certain services or functionality from continuing where the information is necessary to provide those services.

If Sinta's practice regarding the sale of consumer health data changes, we will update this policy and obtain a separate authorization before any sale where required by law.

Where applicable law permits us to collect, use, or disclose information without separate consent, we may do so consistent with that law and this policy.

6. Your rights

Subject to applicable law and appropriate identity verification, you may ask us to:

• Confirm whether we collect, share, or sell your consumer health data;
• Provide access to the consumer health data we maintain about you or provide a copy where required;
• Where required by applicable law, provide a list of third parties and affiliates with whom we have shared or sold your consumer health data and an active email address or other online method for contacting them. Sinta does not sell consumer health data;
• Correct inaccurate consumer health data;
• Delete consumer health data, including by notifying applicable processors or other recipients where required;
• Provide a portable copy of eligible data; or
• Withdraw consent for future collection or sharing.

Use our consumer health data request form to submit a request. We may take reasonable steps to verify your identity and authority before fulfilling it.

You may also call (561) 475-1218 for help submitting a request. You do not need to create a new account to exercise your rights, although we may ask you to use an existing account where permitted. Please describe the assistance you need without submitting medical records, detailed health information, payment card information, or identity documents through the public contact form. We will explain any verification steps and secure method needed to handle your request.

For requests governed by Washington's My Health My Data Act, we respond without undue delay and within 45 days of receiving the request. When reasonably necessary, we may extend that period once by up to 45 additional days and will explain the extension within the initial response period. Information is provided free of charge up to twice annually; manifestly unfounded, excessive, or repetitive requests may be subject to a reasonable administrative fee or declined as permitted by law. We honor any shorter deadlines or additional protections required by other applicable laws.

We will not unlawfully discriminate against you for exercising an applicable consumer health data right.

Please note that some consumer health data used during the clinical services process may be maintained by Beluga Health, P.A., Junction or its network physicians, other licensed healthcare providers, pharmacies, laboratories, or other healthcare organizations. Those organizations may maintain information under their own legal, professional, and record-retention obligations.

For records maintained independently by Beluga Health, P.A., Junction or its network physicians, a pharmacy, or a laboratory, contact the responsible organization using its privacy notice or patient portal. Sinta can help identify the appropriate contact but cannot independently change or delete another organization's records. This does not limit Sinta's duties to act on requests or notify recipients when required by applicable law.

If we deny or are unable to fulfill a request, you may appeal by replying to the decision with “Consumer Health Data Appeal” in the subject line or submitting a new message labeled “Consumer Health Data Appeal” through our contact form. We will respond within the period required by applicable law and explain any further complaint options available to you. For appeals governed by Washington's My Health My Data Act, we will respond in writing within 45 days, explain our decision, and, if the appeal is denied, provide a way to submit a complaint to the Washington Attorney General.

7. Retention and security

We retain consumer health data only as reasonably necessary for the purposes described above and as required by applicable legal, contractual, security, recordkeeping, and operational obligations.

We use administrative, technical, and physical safeguards designed to protect the data.

When required by applicable law, a verified deletion request will also be communicated to processors, affiliates, and other recipients required to delete the applicable data. Information in secure backups may remain until deletion occurs through the ordinary backup cycle, subject to applicable law, and will not be restored for ordinary business use after a valid deletion request.

For authenticated deletion requests governed by Washington's My Health My Data Act, any permitted delay in deleting data from archived or backup systems will not exceed six months from authentication. An ordinary backup cycle does not extend an applicable legal deadline.

Deleting your Sinta account does not necessarily delete information maintained by Beluga Health, P.A., Junction or its network physicians, other licensed healthcare providers, pharmacies, laboratories, or other third parties that have independent legal or professional obligations to retain records.

8. Changes and contact

We may update this policy when our services, partners, or legal obligations change. We will post the revised policy with a new last-updated date and provide notice of material changes through an appropriate method, which may include a prominent website, portal, or email notice.

Where required by law, we will obtain affirmative consent before collecting, using, or sharing additional categories of consumer health data or using existing data for materially different purposes.

Questions or requests may be submitted through our contact form or through the contact information below.