Clinexa Health, Inc.

CONSUMER HEALTH DATA PRIVACY NOTICE

Effective Date: July 18, 2026

1. What This Notice Is and How It Fits With Our Other Policies

This Consumer Health Data Privacy Notice (this “Notice”) describes how Clinexa Health, Inc. (“Clinexa,” “we,” “us,” or “our”) collects, uses, shares, and protects your consumer health data, and the rights you have with respect to that data. This Notice supplements, and should be read together with, our Privacy Policy and our Terms of Service.

Order of precedence. This Notice governs consumer health data specifically. If anything in this Notice conflicts with our general Privacy Policy with respect to consumer health data, this Notice controls. Our Terms of Service govern the contractual terms of your use of our services generally. To the extent any information we hold about you is regulated as Protected Health Information (“PHI”) under the federal Health Insurance Portability and Accountability Act (“HIPAA”), that information is governed by our obligations under HIPAA (including any applicable business associate agreement and, if we are ever required to publish one, a HIPAA Notice of Privacy Practices), rather than by this Notice. Where we would disclose or sell PHI, we do so only under a signed authorization that satisfies HIPAA (45 C.F.R. § 164.508) — the authorization described in Section 7 is intended to serve this purpose.

2. How This Notice Works Across States

A growing number of states have enacted laws that give residents specific rights over their health-related data. Rather than maintain a separate notice for each state, Clinexa applies a single, unified standard that meets or exceeds the requirements of every state health-data law that applies to us. In practice, this means we extend the most protective applicable treatment to your consumer health data regardless of where you live, except where a particular right or obligation is, by its terms, limited to residents of a specific state.

The laws that inform this Notice, and that are currently in effect, include:

• Washington — My Health My Data Act (RCW ch. 19.373), effective March 31, 2024.
• Nevada — Consumer Health Data Privacy Law, SB 370 (NRS ch. 603A), effective March 31, 2024.
• Connecticut — Connecticut Data Privacy Act, as amended by SB 3 to add consumer health data protections (health-data provisions effective October 1, 2023).
• Minnesota — Minnesota Consumer Data Privacy Act, effective July 31, 2025.
• Indiana — Indiana Consumer Data Protection Act, effective January 1, 2026.
• Maryland — Maryland Online Data Privacy Act (MODPA), effective October 1, 2025 (enforcement from April 1, 2026).

Together with any other applicable state consumer health privacy laws, in each case as amended and as and when they become effective (including any implementing regulations), the laws listed above are referred to in this Notice as the “Consumer Health Data Laws.”

Other applicable laws. A number of comprehensive state privacy laws also treat health data as “sensitive data” requiring opt-in consent and apply to us where their thresholds are met — including Texas, Oregon, Montana, Delaware, New Jersey, Tennessee, Kentucky, and Rhode Island. We also monitor proposed legislation, such as the New York Health Information Privacy Act (passed in 2025, vetoed in December 2025, and reintroduced in revised form in 2026), and will conform our practices as new laws take effect.

3. What Is Consumer Health Data?

Under the Consumer Health Data Laws, “consumer health data” broadly means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. For Clinexa, this can include:

• Health conditions, diagnoses, symptoms, or treatments you describe to us, and any reason for visit you provide;
• The type of medical specialist, provider, or appointment you are seeking;
• Appointment requests, booking history, and scheduling records;
• Insurance or coverage information relevant to a booking; and
• Inferences drawn from any data that could indicate your health status.

Consumer health data does not include data that is de-identified in accordance with the standard described in Section 12, aggregate data, or publicly available information. To the extent information is regulated as PHI under HIPAA, it is governed as described in Section 1.

4. Consumer Health Data We Collect

Information You Provide Directly

• The type of medical specialist or appointment you are seeking (e.g., rheumatologist, neurologist);
• Symptoms or health concerns you describe when requesting an appointment, and the reason for visit or type of care you indicate;
• Insurance type or coverage information relevant to your booking; and
• Any other health-related details you voluntarily share through our service.

Where you provide symptoms, health concerns, or a reason for visit, Clinexa relays that information to the healthcare provider; we do not assess or interpret it, and we do not make clinical decisions based on it.

Information Collected Automatically

• Device identifiers, IP address, and usage data collected when you use our web-based service; and
• Inferences we may draw from your appointment requests about the care you are seeking.

Information From Third Parties

• Insurance eligibility information from payers or clearinghouses (if applicable); and
• Provider directory information used to match you with appropriate specialists.

5. How We Use Consumer Health Data

We use your consumer health data only for the following purposes:

• To fulfill your appointment booking request and connect you with appropriate healthcare providers;
• To verify insurance eligibility or inform you of relevant coverage details;
• To communicate with you about your appointment status, confirmations, or follow-ups;
• To present relevant appointment options, including care modality (e.g., in-person or telehealth), matching your request;
• To provide customer support and resolve issues with your booking; and
• To comply with our legal obligations.

We do not use your consumer health data for targeted advertising or to infer characteristics unrelated to the service you requested, and we do not sell it except pursuant to a separate, signed authorization as described in Section 7. Consistent with the data-minimization requirements of laws such as the Maryland Online Data Privacy Act, we limit our collection and use of consumer health data to what is reasonably necessary to provide the service you have requested or as you have authorized.

6. How We Share Consumer Health Data

We do not sell your consumer health data except pursuant to a separate, signed authorization as described in Section 7, and we do not share it for targeted advertising. We share consumer health data only in the limited circumstances described below.

Healthcare Providers

We share the information necessary to schedule and confirm your appointment with the healthcare provider you select.

Service Providers

We share information with vendors who help us operate our service (e.g., cloud hosting, scheduling infrastructure, communications platforms), under contracts that require them to protect your data, use it only as we direct, and — where they handle PHI — comply with HIPAA as our business associates.

Pharmaceutical and Brand Partners

Clinexa does not sell your consumer health data except pursuant to a separate, signed authorization as described in Section 7. Where Clinexa reports to pharmaceutical or brand partners on the outcomes of a campaign, that reporting is limited to de-identified or aggregate information — for example, the total number of bookings attributable to a campaign or de-identified insights about the care sought — that has been de-identified in accordance with the standard in Section 12. We do not disclose information that identifies you to a pharmaceutical or brand partner unless you have first given the separate, signed authorization described in Section 7.

Legal Requirements

We may disclose information when required by law, court order, or governmental authority, or to protect the rights and safety of individuals.

Business Transfers

In connection with a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before such a transfer, and the successor will be bound by this Notice or a notice at least as protective.

7. Consent, Authorization, and the Washington Authorization Requirement

Consistent with the Consumer Health Data Laws, Clinexa relies on the following consent and authorization framework:

• Consent to collect. We obtain your affirmative, opt-in consent before collecting consumer health data beyond what is necessary to provide the specific service you have requested.
• Separate consent to share. We obtain a separate affirmative, opt-in consent before sharing consumer health data, other than sharing that is necessary to provide the service you requested (such as sharing with the provider you select).
• Signed authorization to sell or to disclose identifiable data to partners. We will not sell your consumer health data, and will not disclose data that identifies you to a pharmaceutical or brand partner, unless you have signed a separate, valid authorization that is distinct from the consents above.

Washington Residents — Authorization Requirement

Under the Washington My Health My Data Act, before we collect or share your consumer health data for any purpose beyond providing the service you requested, we will present you with a request for your consent, and — for any sale of consumer health data — a separate, signed valid authorization. A valid authorization is a standalone document, separate from this Notice and from any consent, and includes: a description of the consumer health data to be disclosed; the name and contact information of Clinexa and of any recipient; the purpose of the disclosure; a statement that your goods or services will not be conditioned on signing; a statement of your right to revoke and how to do so; a statement that the data may be subject to redisclosure by the recipient; an expiration date no later than one year from signing; and your signature and date.

8. Your Rights Regarding Consumer Health Data

Depending on your state of residence, you have some or all of the following rights:

• Right to know and access. To know what consumer health data we have collected, the purposes for which we collected it, the categories of third parties with whom we have shared it, and to obtain a copy.
• Right to delete. To request deletion of your consumer health data, including, where required, from our archives and backups, subject to limited legal exceptions.
• Right to withdraw consent. To withdraw any consent or revoke any authorization at any time; withdrawal does not affect the lawfulness of processing before withdrawal.
• Right to non-discrimination. To exercise your rights without receiving a lower quality of service or being denied access to our platform.
• Right to appeal. Where provided by your state’s comprehensive privacy law (e.g., Connecticut, Minnesota, Indiana), to appeal our refusal to act on a request.

9. How to Exercise Your Rights

To submit a request, contact us by email at privacy@tryclinexa.com or by mail at 131 Continental Dr, Suite 305, Newark, DE 19713. We will acknowledge your request within 10 business days and respond substantively within 45 days (extendable by an additional 45 days, with notice, for complex requests). We will not charge a fee for reasonable requests. If we cannot fulfill a request, we will tell you why. If you are an authorized agent submitting a request on behalf of a resident, please contact us at the address above with proof of authorization.

10. How We Protect Your Consumer Health Data

Clinexa implements administrative, physical, and technical safeguards appropriate to the sensitivity of consumer health data, including encryption in transit and at rest, access controls, contractual confidentiality obligations on personnel and vendors who may access the data, and regular security reviews. We have adopted HIPAA-level security standards as a baseline.

11. Data Retention

We retain consumer health data only as long as reasonably necessary for the purposes described in this Notice, to comply with our legal obligations, and to resolve disputes, after which we delete or de-identify it. Our retention practices distinguish between operational data and compliance records:

• Operational consumer health data (e.g., appointment booking records) is retained for the duration of the applicable sponsorship program and for at least twelve (12) months from your most recent activity, unless a longer period is required by law. We delete operational consumer health data within thirty (30) days of a verified deletion request, and following termination of the applicable program after reasonable notice.
• Compliance records (e.g., signed consents and authorizations, and our HIPAA-required documentation) are retained for six (6) years, consistent with 45 C.F.R. § 164.530(j) and the Washington My Health My Data Act’s six-year authorization-retention requirement.

You may request deletion at any time, subject to the exceptions above. Where a deletion request covers data we are required to retain as a compliance record, we will delete the operational data and retain only the minimum compliance record required by law.

12. De-Identified and Aggregate Data

Where we de-identify consumer health data, we (a) take reasonable measures to ensure the data cannot be associated with you, (b) publicly commit to maintain and use the data only in de-identified form and not to attempt to reidentify it, and (c) contractually obligate any recipient to the same commitments. We apply this standard, which reflects the heightened de-identification requirements of the Washington My Health My Data Act, to de-identified consumer health data company-wide, and we apply the HIPAA de-identification standard (45 C.F.R. § 164.514) to any data that is PHI.

13. State-Specific Disclosures

Washington. This Notice serves as our “Consumer Health Data Privacy Policy” for purposes of the My Health My Data Act and is linked separately on our homepage. Washington residents have the rights described in Section 8, the authorization protections in Section 7, and may enforce the Act through Washington’s Consumer Protection Act.

Nevada. Nevada residents have the rights described in Section 8. The Nevada law is enforced by the Nevada Attorney General.

Connecticut, Minnesota, and Indiana. Where these comprehensive privacy laws apply to us, your consumer health data is treated as “sensitive data” that we process only with your opt-in consent, and you have the rights described in Section 8, including the right to appeal.

Other states. If you reside in another state whose Consumer Health Data Laws apply to us, we extend to you the protections of this Notice to the extent those laws require.

14. Changes to This Notice

We may update this Notice from time to time. If we make material changes, we will post the updated Notice and, where required by law, notify you directly and obtain new consent or authorization. The “Effective Date” at the top reflects when this Notice was last updated.

15. Contact Us

Privacy Officer, Clinexa Health, Inc. | Email: privacy@tryclinexa.com | 131 Continental Dr, Suite 305, Newark, DE 19713. If you believe we have violated your rights under the Consumer Health Data Laws, you may also file a complaint with your state attorney general.