Team Clarity, Inc. DBA Iron Gorilla Consumer Health Data Privacy Notice

This Notice applies only when Team Clarity directly determines the purposes and means of collecting or processing Consumer Health Data in a consumer or household context and the processing is not exempt under applicable law. It does not replace a customer's consumer health privacy notice when Iron Gorilla processes data solely on the customer's behalf.

1. Consumer Health Data

Consumer Health Data means personal information linked or reasonably linkable to a consumer that identifies or permits an inference about physical or mental health, treatment, diagnosis, medication, bodily functions, reproductive or sexual health, gender-affirming care, precise location related to health services, genetic or biometric data, or a person's efforts to seek health services. The definition may be broader than protected health information under HIPAA.

2. Categories We May Collect

• Health-related information intentionally submitted through an activated consumer-health feature.

• Interaction, support, consent, preference, deletion, and communication records related to that feature.

• Device, account, security, and usage data associated with a health-related request or service.

• Inferences or classifications about health only where expressly disclosed and legally permitted.

Where Team Clarity stores or processes Consumer Health Data on behalf of a customer through the Services, the categories of Consumer Health Data are those the customer submits, connects, or configures for its use case. Those categories are generally consistent with the health-related information customers expect to process for their authorized workflows. Allocation of responsibility between Team Clarity and Customer for notices, consents, disclosures, and feature activation is governed by the Shared Responsibility Model in the Terms of Service and the Data Processing Addendum. When Team Clarity is the controller for Consumer Health Data, Team Clarity does not collect an undisclosed additional category without the notice and affirmative consent required by applicable law.

3. Sources

Sources may include the consumer, the consumer's device, a caregiver or authorized representative, a connected service selected by the consumer, service providers acting for Team Clarity, and information generated through use of the activated feature. We do not obtain Consumer Health Data from data brokers for advertising or profiling.

4. Purposes

• Provide the product or service requested by the consumer.

• Authenticate the consumer, maintain preferences, provide support, and secure the service.

• Comply with law, investigate incidents, prevent fraud or abuse, and protect rights and safety.

• Other specifically disclosed purposes for which the consumer gives legally valid consent.

We do not use Consumer Health Data for targeted advertising, cross-context behavioral advertising, sale, general model training, or an unrelated purpose unless applicable law permits it and we first provide the separate notice, consent, or authorization required by law. Our standard position is that we do not sell Consumer Health Data.

5. Sharing

We may share Consumer Health Data with processors and service providers necessary to provide the requested service (including providers identified on our Subprocessor List), with a person or connected service at the consumer's or customer's direction, with professional advisers subject to confidentiality, or when required or permitted by law. When Team Clarity processes Consumer Health Data solely on a customer's behalf, sharing follows the customer's instructions and the Shared Responsibility Model in the Terms of Service and DPA; the customer is responsible for identifying categories of third parties and affiliates in its own notices where required. When Team Clarity is the controller, consent to share must be separate from consent to collect when applicable law requires separate consent.

6. Consumer Rights

• Confirm whether we collect, share, or sell Consumer Health Data and access the data.

• Receive a list of relevant third parties or affiliates where required.

• Correct inaccurate data where applicable.

• Withdraw consent from future collection or sharing.

• Delete Consumer Health Data, including required downstream deletion and backup handling.

• Appeal a refusal to act and contact the applicable regulator where required.

Submit a request or appeal to legal@teamclarity.ai. We will authenticate and respond within the period required by applicable law. You do not need to create a new account solely to exercise a right, although we may use an existing account and request information reasonably necessary to authenticate the request.

7. Sale Authorization

We do not sell Consumer Health Data. If that position changes, Team Clarity must not sell data without a separate, plain-language authorization containing all legally required elements, including the data, seller and purchaser, purpose, expiration, revocation, redisclosure warning, signature, and date. The authorization may not be combined with other documents or made a condition of receiving a product or service where prohibited.

8. Geofencing

We do not use a geofence around an in-person health care facility to identify or track consumers seeking health care, collect Consumer Health Data, or send health-related messages or advertisements.

9. Security and Retention

We restrict access to persons and processors that need the data for a disclosed purpose and maintain administrative, technical, and physical safeguards appropriate to the nature and volume of the data. Retention is limited to the disclosed purpose, legal requirements, security, dispute resolution, and backup cycles. A deletion request will be propagated to processors and applicable third parties as required, with backup deletion handled within the maximum period allowed by law.

10. Changes

We will not materially change the categories or purposes described in this Notice without first providing notice and obtaining consent where required. The effective date and version history should be displayed prominently.