Consumer Health Data Privacy Notice

This Consumer Health Data Privacy Notice ("Notice") supplements Virta Health Corp.'s Privacy Policy and applies to consumers who are residents of Washington State or Nevada, or whose consumer health data is otherwise subject to Washington's My Health My Data Act or Nevada's SB 370 (collectively, "Applicable Laws"). This Notice describes how we collect, use, and share consumer health data and explains your rights under Applicable Laws.

1. Categories of Consumer Health Data We Collect

We may collect the following categories of consumer health data:

• Health conditions and diagnoses: Information about diabetes, obesity, metabolic conditions, and related health conditions.
• Health measurements: Weight, body measurements, blood glucose levels, ketone levels, blood pressure, and other physiological measurements.
• Nutrition and dietary information: Food intake, meal logs, dietary preferences, and nutritional data.
• Physical activity data: Exercise habits, step counts, and activity levels.
• Health-related communications: Messages exchanged with healthcare providers, coaches, and care teams through our platform.
• Medication information: Current medications, dosages, and medication history relevant to your treatment.
• Lab results and health records: Laboratory test results and health information you provide or authorize us to obtain.

2. Purposes for Collection and Use

We collect and use consumer health data for the following purposes:

• To provide, personalize, and improve our diabetes reversal and metabolic health services.
• To facilitate communication between you and your care team, including physicians, health coaches, and other healthcare providers.
• To monitor your health progress and treatment outcomes.
• To fulfill our contractual obligations to you and your health plan or employer sponsor.
• To conduct research and develop new features and services (using de-identified or aggregated data where appropriate).
• To comply with legal and regulatory requirements.
• To detect and prevent fraud, security incidents, and other harmful activities.

3. Categories of Third Parties With Whom We Share Consumer Health Data

We may share your consumer health data with the following categories of third parties:

• Healthcare providers and care teams: Physicians, nurses, health coaches, and other professionals involved in your care.
• Health plans and employer sponsors: Entities that sponsor or administer your access to Virta's services, as necessary to coordinate benefits and report on program outcomes.
• Service providers: Third parties that assist us in delivering our services, including cloud hosting providers, analytics providers, and customer support platforms, subject to contractual obligations to protect your data.
• Affiliates: Virta Medical P.C., Virta Medical, P.A., Virta Medical Kansas, P.A., and other affiliated entities.
• Legal and regulatory authorities: When required by law, court order, or governmental request.

We do not sell your consumer health data.

4. Your Rights

Under Applicable Laws, you have the following rights with respect to your consumer health data:

• Right to Know: You have the right to confirm whether we are collecting, sharing, or selling your consumer health data and to access the consumer health data we have collected about you.
• Right to Deletion: You have the right to request that we delete your consumer health data, subject to certain exceptions (such as data required for legal compliance or ongoing treatment).
• Right to Withdraw Consent: You have the right to withdraw your consent to the collection and sharing of your consumer health data. Please note that withdrawing consent may affect our ability to provide services to you.
• Right to Appeal: If we deny your request, you have the right to appeal that decision.

5. How to Exercise Your Rights

To exercise any of the rights described above, please contact us at:

Email: privacy@virtahealth.com
Subject Line: "Consumer Health Data Request"

Please use the email address associated with your Virta account. We will respond to your request within the timeframes required by Applicable Laws.

You may also designate an authorized agent to submit a request on your behalf. We may require verification of your identity and the agent's authority before processing the request.

6. Consent

By using Virta's services, you consent to the collection, use, and sharing of your consumer health data as described in this Notice and our Privacy Policy. You may withdraw your consent at any time by contacting us using the information above.

7. Changes to This Notice

We may update this Notice from time to time. If we make material changes, we will notify you by posting the updated Notice on our website and updating the "Last Updated" date above.

8. Contact Us

If you have questions about this Notice or our consumer health data practices, please contact us at:

Email: privacy@virtahealth.com
Mail: Jamie Anderson, Privacy Officer
Virta Health Corp.
440 Barranca Ave #5386
Covina, CA 91723