This Consumer Health Data Privacy Policy ("CHD Policy") applies to Endo360 LLC ("Endo360," "we," "us," or "our") and describes how we collect, use, and disclose "consumer health data" and the rights available to residents of Washington and Nevada.

This CHD Policy is intended to be a standalone policy for purposes of the Washington My Health My Data Act and Nevada's consumer health privacy law. It supplements (and does not replace) the Endo360 Privacy Policy.

1. What Is Consumer Health Data

"Consumer health data" generally means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. This includes health conditions, symptoms, reproductive or sexual health information, and other health-related information you enter into the Service.

2. Categories of Consumer Health Data We Collect

Depending on how you use the Service, we may collect the following categories of consumer health data:

• Symptoms and symptom tracking (e.g., pain level and location, gastrointestinal symptoms, fatigue, mood, triggers, and other endometriosis-related symptoms).
• Menstrual and reproductive health information (e.g., cycle dates, flow, and related symptoms).
• Medical information you choose to provide (e.g., diagnosis status, surgery history, medications, allergies, and comorbid conditions).
• Lifestyle and wellness information you choose to provide (e.g., sleep, stress, diet, exercise).
• Derived insights and summaries generated from your entries (e.g., trends, correlations, and AI-assisted insights).
• Community information you choose to share that relates to your health (e.g., forum posts about symptoms or treatment experiences).

3. Sources of Consumer Health Data

We collect consumer health data from:

• You, when you enter information into the Service or post content in community features.
• Your device or browser, when you access the Service (limited technical data such as IP-derived approximate location and diagnostic logs).
• Optional sign-in providers (Apple Sign-In / Google Sign-In) for account authentication (account identifiers; not your passwords).

4. Purposes for Collecting and Using Consumer Health Data

We collect and use consumer health data to:

• Provide, operate, and maintain the Service (including storing your entries and generating dashboards).
• Personalize and improve the Service (including improving features and troubleshooting).
• Provide customer support and respond to requests.
• Protect the safety, integrity, and security of the Service (including fraud prevention).
• Comply with legal obligations and enforce our Terms of Service.

5. Consent (Collection and Sharing)

Where required by law, we obtain affirmative express consent before collecting consumer health data. Consent is obtained through clear in-app prompts (for example, a checkbox or toggle) and is not obtained solely by acceptance of our Terms of Service or general Privacy Policy.

Separate consents. Where required, we present separate, non-bundled choices for:

• Consent to collect consumer health data for specified purposes; and
• Consent to share consumer health data with third parties (if sharing occurs beyond what is necessary for a service provider to process data on our behalf).

When we request consent, we will describe (i) the categories of consumer health data involved, (ii) the purpose(s) of collection or sharing, (iii) the categories of entities the data may be shared with, and (iv) how you can withdraw consent.

You may withdraw your consent at any time by changing your in-app settings (where available) or by contacting us as described in Section 8 below.

6. How We Share Consumer Health Data

We do not sell consumer health data. We do not share consumer health data with data brokers or for targeted advertising.

We may share consumer health data only in the following situations:

• Service providers (processors). We share consumer health data with service providers that process it on our behalf to operate the Service (for example, our cloud hosting provider).
• With your direction. If you choose to export your data, share a report, or post content in a community forum, you are directing us to disclose that information.
• Legal and safety. We may disclose information to comply with law, respond to lawful requests, and protect the rights, property, and safety of Endo360, our users, and others.

Categories of third parties with whom we share consumer health data: cloud hosting and infrastructure providers.

Current cloud hosting provider: DigitalOcean (cloud hosting and infrastructure).

7. Affiliates

Endo360 does not share consumer health data with corporate affiliates because Endo360 does not have corporate affiliates that receive consumer health data at this time.

8. Your Consumer Health Data Rights and How to Submit Requests

Washington and Nevada residents may have rights regarding consumer health data, including:

• Access/confirm: request confirmation of whether we collect, share, or sell consumer health data and access to such data.
• Deletion: request deletion of consumer health data.
• Withdrawal of consent: withdraw consent for collection and/or sharing of consumer health data.
• Appeal: appeal a denial of a consumer health data request, where applicable.

How to submit a request: email [email protected] with the subject line "Consumer Health Data Request".

Identity verification: we may need to verify your identity before fulfilling a request. Verification typically involves confirming control of the email address or phone number associated with your account and may require additional information.

Timing: we will respond without undue delay and, in all cases, within 45 days of receiving your request. Where permitted, we may extend this period once by an additional 45 days when reasonably necessary and will notify you if an extension is needed.

9. Deletion of Consumer Health Data

Upon a verified deletion request, we will delete consumer health data concerning you from our records, including from all parts of our network (including archived or backup systems). We will also notify our service providers and other third parties with whom we have shared consumer health data and require them to honor the deletion request.

If consumer health data is stored on archived or backup systems, deletion from those systems may be delayed solely to enable restoration of the archived or backup systems, but any such delay will not exceed six months from authenticating the deletion request.

10. Appeals

If we deny your consumer health data request, you may appeal by emailing [email protected] with the subject line "Consumer Health Data Appeal". We will respond to an appeal within 45 days. If an appeal is denied, we will provide an online mechanism or other method through which you may contact the relevant state authority to submit a complaint.

11. Geofencing

We do not use geofences around in-person healthcare facilities for purposes such as identifying consumers, collecting consumer health data, or sending health-related notifications, advertising, or messages.

12. Changes to This Policy

We may update this CHD Policy from time to time. If we make material changes, we will update the "Last Updated" date above and provide notice in the app where appropriate.

13. Contact

Endo360 LLC
Attn: Lucas Pejovic-Nezhat
835 Wilshire Blvd, Ste 500 #565
Los Angeles, CA 90017

Email: [email protected]