RESSA HEALTH
Consumer Health Data Privacy Policy
Washington, Nevada, Illinois Residents
Effective Date: September 1, 2026 Version 1.1
Who we are. Metabolic Terrain Omics, Inc., a Delaware corporation doing business as Ressa Health (“Ressa,” “we,” “us,” or “our”), 2 East Congress Street, Suite 900, Tucson, AZ 85701, <u>privacy@ressahealth.com</u>.
A “Professional” is an individual who uses the Services in connection with providing healthcare, health education, nutrition, wellness, coaching, or related professional services, including licensed healthcare providers and non-licensed health and wellness professionals. Each Professional User may use the Services only within the scope of their applicable education, training, credentials, licensure, and governing law.
What this policy does not cover. This policy does not apply to protected health information that we handle as a business associate under the federal Health Insurance Portability and Accountability Act and its implementing regulations (“HIPAA”) on behalf of a Professional you have connected, or to information that has been de-identified in accordance with 45 C.F.R. Part 164. That information is governed by HIPAA, by our business associate agreement with the Professional, and by Sections 8 and 9 of the Ressa Health Terms of Service.
Part A — Washington Residents
This Part is the consumer health data privacy policy required by RCW 19.373.020. It describes the categories of consumer health data Ressa collects and why, the sources it comes from, the categories we share, who receives it, and how you exercise your rights under RCW 19.373.040.
A-1. Categories of Consumer Health Data We Collect, Why We Collect It, and How We Use It
| Category of consumer health data | Why we collect it | How we use it |
|---|---|---|
| Individual health conditions, treatment, diseases, and diagnoses | To assemble the personal health record we call your Health Vault, at your request. | We store it in your Health Vault, organize it, display it back to you, generate Insights from it, and make it visible to a Professional you approve. |
| Laboratory and diagnostic testing results, including metabolic panels | To hold results you upload, results a Professional you approved uploads, and results returned by a laboratory partner for testing you requested. | We store and display results, compare values against configured reference ranges and mark values that fall outside them, chart values over time, and make results visible to a Professional you approve. |
| Genetic and genomic data, including genotype and sequence data | To hold genetic testing information you or a Professional you approved uploads. | We store and display it and make it visible to a Professional you approve. We do not disclose it to any insurer, employer, or educational institution. |
| Symptoms, measurements, vital signs, and bodily functions | To hold your responses to structured symptom assessments, intake questionnaires, and health history tools. | We store your responses and use them to generate Insights and organize your record. |
| Health-related surgical procedures, medications, and interventions | To hold the medical records, notes, imaging reports, and history you or a Professional you approved uploads. | We store and display it and make it visible to a Professional you approve. |
| Data from health-related devices and applications you connect | To receive data from a device or application only where you have chosen to connect it. | We add it to your Health Vault and use it to generate Insights. |
| Information about your acquisition or use of health care services | To administer testing you request through the Service and the Professional connections you approve. | We transmit your testing request to the laboratory partner, receive the result, and maintain a record of the Professionals you have approved and when. |
| Bodily functions and biological characteristics inferred from the above | Inferences arise from the pattern analysis you asked the Service to perform on your own record. | We present patterns, trends, and comparisons to you, and we present them to a Professional you approve. |
| Identifiers and account information linked to the categories above | To associate your health data with your account and only your account, and to authenticate you. | We use it to authenticate you, protect your account, and route your information correctly. |
Optional Uses You Choose. In addition to the requested service purposes in the table, we may use health and genetic information, test-order or test-use information, derived health insights and the necessary account and contact information for an optional purpose you select: creating qualifying deidentified datasets for health research and commercial health, wellness, pharmaceutical and life-sciences uses; or selecting and sending messages from Ressa about its own and its partners’ offerings, including paid sponsored messages. These uses require the applicable effective permission described in the Research, Data and Marketing Authorization and any other required state or practitioner authorization. They are not necessary to receive your subscription service. We do not sell identifiable consumer health data or disclose it to sponsors or advertising platforms under those permissions.
Two things we do not collect. We do not collect precise location information that could reasonably indicate your attempt to acquire or receive health services or supplies. We do not collect biometric data for the purpose of identifying you.
We use consumer health data only for the purposes stated above. If we ever want to collect an additional category, or to use or share consumer health data for an additional purpose, we will disclose the addition and obtain your affirmative consent before we do it.
A-2. Categories of Sources From Which We Collect Consumer Health Data
-
Directly from you, when you upload a document, complete an assessment, enter information, or request testing.
-
From a Professional you have approved, who may upload laboratory results, records, and other information about you.
-
From an independent laboratory partner, which returns the result of testing you requested through the Service.
-
From a third-party health device or application that you have chosen to connect.
-
From our own processing of the information above, where the Service derives a pattern, trend, or comparison from your own record.
We do not obtain consumer health data from data brokers, we do not buy it, and we do not receive it from advertising platforms, social media platforms, or any other source not listed above.
A-3. Categories of Consumer Health Data We Share
We share consumer health data only as described in this section. “Share” has the meaning given in RCW 19.373.010.
| Category we share | With whom | Why |
|---|---|---|
| All categories listed in Part A-1 | A Professional you have approved. | Because you approved that Professional. Section 8 of the Terms of Service describes what an approved Professional can see and what happens when you remove them. |
| All categories listed in Part A-1 | Our cloud hosting provider and our software development vendor. | Because the Service cannot be hosted, maintained, or supported without them. Each is bound by a business associate agreement or an equivalent written data protection agreement. |
| Laboratory and diagnostic testing results; identifiers necessary to route them | An independent laboratory partner. | To transmit testing you requested and to receive the result. |
| All categories listed in Part A-1 | Our artificial-intelligence processing provider, within our own cloud environment. | To generate the Insights you asked the Service to generate. The provider does not retain prompts and does not use them to train its models. |
| All categories listed in Part A-1 | Our independent security assessor. | To test the security of the systems that hold your data, under time-limited, logged, least-privilege access and written confidentiality and data protection obligations. |
| Any category, as you direct | Any person or service you tell us to send it to. | Because you told us to. |
| Any category, where legally compelled | A court, regulator, or law enforcement agency. | Where we are required by law or valid legal process. We disclose no more than the request requires. We will not disclose genetic information to law enforcement except pursuant to a valid court order or as otherwise compelled by law. |
Limits on Use and Sharing. We do not sell consumer health data or disclose it to advertising platforms, advertising networks, data brokers or social-media advertising services. Ressa may use it to send personalized messages only under the applicable effective authorization. A sponsor does not receive your identifiable health or genetic information under that authorization. Contracted providers may handle only the information necessary to perform an authorized task on Ressa’s behalf. We do not use individually identifiable consumer health data to train AI models, disclose it to insurers, employers or educational institutions, or implement, commission or permit a geofence around a facility providing in-person health care services. The optional dataset permission covers creation and transfer only of information meeting the applicable legal requirements for deidentification; it is not an authorization to sell identifiable consumer health data.
A-4. Third Parties and Affiliates With Whom We Share Consumer Health Data
Categories of third parties. Professionals you approve; our cloud hosting and infrastructure provider; our software development and technical operations vendor and its approved subcontractors; independent laboratory partners; our artificial-intelligence processing provider; our independent security assessors; and, where legally compelled, courts, regulators, and law enforcement agencies.
Named third parties
Amazon Web Services (AWS) provides cloud hosting, infrastructure, and Amazon Bedrock, a managed generative AI platform used to power AI functionality.
NebulaWorks provides software development and technical support.
HighLevel LLC (GoHighLevel) provides customer relationship management, marketing automation, communications, and reporting services.
Evexia Diagnostics and Quest Diagnostics provide laboratory services.
Specific affiliates. Ressa has affiliated entities under common ownership or control, as Section 13.7 of the Terms of Service states.
Terrain Holding Company, LLC
Metabolic Regen Company
Mitovida, Inc.
Use of consumer health data to present an affiliate’s offering. Where the Service presents an affiliate’s product, service, or educational content, we will not use your consumer health data to select, target, or personalize that presentation without your separate written authorization. See Section 13.7 of the Terms of Service.
Payment data. Our payment processor, Stripe, Inc., receives payment and transaction information. It does not receive consumer health data.
A-5. Your Rights, and How to Exercise Them
Under RCW 19.373.040 you have the rights below. We offer them to you free of charge and we will not deny you the Service, charge you a different price, or give you a different level or quality of service because you exercised one.
-
Confirm and access. You may confirm whether we collect, share, or sell your consumer health data and obtain a copy of it, together with a list of all third parties and affiliates with whom we have shared or sold it and an active email address or other online mechanism for contacting each one. You may also download the contents of your Health Vault from the Service at any time.
-
Withdraw consent. You may withdraw your consent to our collection of your consumer health data, and separately your consent to our sharing of it, at any time and as easily as you gave it, through your account settings or by contacting us. Withdrawing consent does not undo a use or disclosure we already made in reliance on it.
-
Delete. You may ask us to delete your consumer health data. When we receive a verified deletion request we will delete it from our records, including from archived and backup systems, and we will notify all of our affiliates, processors, contractors, and other third parties with whom we have shared your consumer health data of the request. Information stored in encrypted backups will be removed through our ordinary backup rotation, but no later than six months after we authenticate your deletion request..
How to make a request. Email <u>privacy@ressahealth.com</u> with your request.
How we verify you. Because consumer health data is sensitive, we confirm your identity before we act. For an account holder we verify through your authenticated account and the second authentication factor on it. If we cannot verify you, we will tell you why.
Our timeline. We will respond within forty-five days of receiving your request. Where reasonably necessary we may extend that period once by an additional forty-five days, and we will tell you before we do, with the reason.
Appeals. If we decline your request in whole or in part, we will tell you why and how to appeal. You may send an appeal through any of the methods listed under “How to make a request” above. Include with the word “appeal” in the subject line. A person not involved in the original decision will review it and respond in writing within forty-five days with the reasons for the decision. If we deny your appeal, you may submit a complaint to the Washington Attorney General at https://www.atg.wa.gov/file-complaint or by writing to the Consumer Protection Division, Office of the Attorney General, 800 Fifth Avenue, Suite 2000, Seattle, WA 98104. If you are a Nevada resident, see Part B-2 for the appeal process that applies to you..
Part B — Nevada Residents
This Part is the consumer health data privacy policy required by NRS 603A.495. Parts A-1 through A-4 describe the categories of consumer health data we collect and the manner in which we use it, the sources we collect it from, the categories we share, the categories of third parties and affiliates with whom we share it, and the purposes for collecting, using, and sharing it; those descriptions apply to Nevada residents as well. This Part adds the disclosures Nevada requires in addition.
B-1. The Manner in Which We Process Consumer Health Data
Consumer health data reaches us when you upload it, when a Professional you approved uploads it, when a laboratory partner returns a result, or when a device or application you connected sends it. It is transmitted over an encrypted connection and stored encrypted in our cloud environment. Access is restricted by role to the minimum necessary for a workforce member or contractor to do their job, requires multi-factor authentication, and is logged. The Service processes your data to organize it, to compare values against configured reference ranges, to chart values over time, and to generate Insights, using algorithmic and artificial-intelligence tools that run inside our own cloud environment under a business associate agreement. Your data is made visible to a Professional only when you approve that Professional. It is retained and deleted as described in Section 15 of the Terms of Service and Section 12 of the Ressa Health Privacy Policy.
B-2. Submitting a Request, Reviewing or Requesting Changes to Your Data, and Appeals
You may submit a request through your account settings, by emailing <u>privacy@ressahealth.com</u>. You may review your consumer health data at any time by signing in to your Health Vault, and you may correct or update much of it there yourself. Where you cannot change something in the Service, ask us and we will correct it or tell you why we cannot. We will respond to a request to confirm, access, or correct within forty-five days, extendable once by forty-five days with notice to you, and we will complete a verified deletion request within thirty days.
Appeals. If we decline your request in whole or in part, we will tell you why and how to appeal. Under NRS 603A.520 you may appeal that decision, and you may submit your appeal by any of the methods described in the first paragraph of this Part B-2. If you appeal by email, please include the word “Appeal” in the subject line. A person not involved in the original decision will review your appeal and will respond to you in writing within forty-five days, stating the action we have taken and the reasons for it. If we deny your appeal, you may submit a complaint to the Nevada Attorney General at <u>https://ag.nv.gov/Complaints/File_Complaint/</u> or by writing to the Office of the Attorney General, 100 North Carson Street, Carson City, NV 89701.
B-3. Whether Third Parties May Collect Consumer Health Data Over Time and Across Sites
No. We do not permit any third party to collect consumer health data over time and across different internet websites or online services through the Ressa Health website or applications. We do not allow third-party advertising, analytics, session-recording, heat-mapping, chat, or social-media tracking technologies to operate on any authenticated page, on any page or screen that displays, collects, or discusses health information, on any upload or results flow, or in our applications. On public pages, any optional measurement is subject to the limits and choices in Section 7 of our Privacy Policy. It must not disclose consumer health data to advertising platforms or track consumer health data across websites or services.
B-4. Notice of Material Changes to This Policy
If we make a material change to this policy — including a change to the categories of consumer health data we collect, the purposes for which we use it, the categories of consumer health data we share, or the third parties and affiliates with whom we share it — we will post the revised policy with a new effective date and notify you by email or through the Service before the change takes effect. Where the law requires your affirmative consent before an additional category or an additional purpose, we will obtain that consent first and will not apply the change to consumer health data we already hold until we have.
B-5. Effective Date
This policy is effective as of September 1, 2026. It replaces any prior consumer health data privacy policy published by Ressa. We keep prior versions and will provide one on request.
B-6. Sale of Consumer Health Data
We do not sell consumer health data. The optional dataset program described in the Research, Data and Marketing Authorization permits only the licensing or sale of information that satisfies the applicable legal requirements for deidentification. It does not authorize sale of identified or identifiable health or genetic information. No acceptance of this Policy or the Terms of Service authorizes such a sale.
Part C — Illinois Residents
Illinois Biomarker and Genetic Information Authorization
I authorize Metabolic Terrain Omics, Inc., d/b/a Ressa Health (“Ressa Health”) to receive, collect, maintain, store, process, access, and use biomarker testing information, genetic information, laboratory test results, and other related health information that I provide to Ressa Health or authorize another person or organization to provide to Ressa Health.
I understand that this information may include laboratory values, test results, biomarkers, biomarker testing information, genetic information, and other information derived from blood, tissue, biological samples, laboratory testing, or other health assessments.
I authorize Ressa Health to use this information for the purpose of providing the products, services, assessments, reports, health information tools, data-storage services, and other features that I request through the Ressa Health platform.
I also authorize Ressa Health to maintain and process this information through service providers acting on Ressa Health's behalf when reasonably necessary to operate, secure, maintain, or provide the Ressa Health platform and its services, subject to applicable privacy and security requirements.
I further authorize Ressa Health to disclose my biomarker testing information, genetic information, laboratory results, and related health information to a healthcare Professional, healthcare provider, or other person when I specifically select, authorize, or direct Ressa Health to share that information with that recipient, or when disclosure is otherwise permitted or required by applicable law.
I understand that biomarker testing information and genetic information may be considered confidential and privileged under Illinois law. I understand that providing this authorization is voluntary and that, by providing this authorization, I am specifically authorizing Ressa Health to receive, maintain, process, use, and disclose this information for the purposes described above.
This authorization will remain effective while I maintain my Ressa Health account or otherwise use Ressa Health's services, unless I withdraw the authorization. Withdrawal of this authorization will not affect uses or disclosures that occurred before the withdrawal and will not require Ressa Health to delete or destroy information that it is required or permitted to retain under applicable law.