WellPD — Consumer Health Data Privacy Policy (Washington and Nevada)

Effective: 20 October 2026

This Consumer Health Data Privacy Policy ("Policy") supplements the WellPD Privacy Notice for the United States at https://www.empatica.com/wellpd/privacy-policy/us-en. It applies to "consumer health data" subject to the Washington My Health My Data Act ("MHMDA") and to Nevada Senate Bill 370 (2023), collected through the WellPD wearable, the WellPD mobile application, the User Portal and the Subscription Service (together, the "Services"). The Services are provided by Empatica Care, Inc., 1 Broadway, 14th Floor, Cambridge, MA 02142, USA ("Empatica", "we", "us"). This Policy does not apply to information or practices that those laws do not cover, such as publicly available information, or job applicant and employee information.

1. The categories of consumer health data we collect

Because these laws define "consumer health data" broadly, much of the information we collect to provide WellPD may be consumer health data. We collect the following categories:

• Individual health conditions, treatment, diseases or diagnosis — for example that you live with Parkinson's disease, and the symptoms and notes you record;
• Use or purchase of prescribed medication — the medication plan and log you enter in the App, and your prescription;
• Bodily functions, vital signs, symptoms or measurements — the physiological signals recorded by your wearable (for example movement data from its accelerometer), the motor-symptom, sleep and activity measures computed from them, and the Insights generated from your data;
• Data that identify you as seeking health care services — for example your purchase of WellPD and your prescriber's details;
• Information derived or extrapolated from non-health information that associates you with the categories above.

2. Why we collect and use consumer health data

• To provide WellPD, which you requested: to create and manage your account and subscription, pair your wearable, record and display your measurements and Insights, and send you service messages;
• To verify your prescription before we ship your order, as federal law requires;
• To answer your support requests and handle warranty claims and returns;
• To monitor the safety and performance of WellPD, handle adverse-event reports and meet our medical-device obligations;
• To keep the Services and your data secure, and to detect and prevent fraud and security incidents;
• To improve WellPD and for research, only with your separate consent, which you can withdraw at any time;
• To comply with our legal and regulatory obligations.

We do not use consumer health data for marketing or advertising.

3. Where we collect consumer health data from

• Directly from you;
• Your wearable and your phone;
• A person authorized to act on your behalf; and
• The healthcare provider who issued your prescription, when we need to clarify it.

4. The categories of consumer health data we share

We share the categories of consumer health data listed in section 1, only as described in section 5 and only with your consent or as necessary to provide WellPD. We do not sell consumer health data.

5. With whom we share consumer health data

• Empatica S.r.l. (Italy), which operates the WellPD platform on our behalf, and Empatica, Inc. (United States), which provides hosting operations, technical support and customer success on our behalf;
• Service providers acting on our instructions (processors), such as cloud hosting and storage, identity and access management, customer support, communications delivery and shipping, listed at https://www.empatica.com/wellpd/privacy-policy/sub-processors;
• Government entities and regulators, such as the U.S. Food and Drug Administration, where the law requires it;
• The healthcare provider who issued your prescription, when we need to clarify it; and
• A person authorized to act on your behalf.

You can also export a report from the App or the User Portal and share it with anyone you choose. We do not send it on your behalf.

6. Your rights

Under the MHMDA and Nevada law, you have the right to:

• Confirm whether we collect, share or sell your consumer health data, and access those data, including a list of the third parties and affiliates with whom we have shared them and their contact information;
• Withdraw your consent to our collection and sharing of your consumer health data;
• Have your consumer health data deleted; and
• Not be discriminated against for exercising these rights.

How to exercise your rights. Email privacy@empatica.com. Before we act on your request, we may need to verify your identity, or the authority of a person acting on your behalf, for example by sending a link to your e-mail address. We respond within 45 days; where reasonably necessary we may extend this once by another 45 days and will tell you why. Requests are free of charge up to twice a year.

Withdrawing consent. You can withdraw your consent to collection and sharing in the App settings or by emailing privacy@empatica.com. If you withdraw your consent to collection, your wearable stops recording and we can no longer provide the Services; you can then cancel your subscription in the User Portal and ask us to delete your account.

Appeals. If we deny your request, we will tell you why and how to appeal. If your appeal is unsuccessful, you can complain to the Washington State Attorney General (www.atg.wa.gov/file-complaint) or, in Nevada, to the Nevada Attorney General (ag.nv.gov).

7. Changes and contact

We update this Policy when our practices or the law change, and change the "Effective" date above. Questions: privacy@empatica.com — Empatica Care, Inc., 1 Broadway, 14th Floor, Cambridge, MA 02142, USA (attention: Privacy).