Consumer Health Data Privacy Notice

This Notice describes what CHD we collect, how we collect and use it, who we disclose it to and why, and the choices you may have regarding our use or disclosure of your CHD. This Notice applies only to CHD, which is a subset of personal information that identifies your past, present, or future physical or mental health status.

This Notice does not apply to any personal information other than CHD subject to applicable consumer health data laws. CHD does not include information generated by your interactions with us (such as browsing or account activity) that does not identify your health status. CHD also does not include publicly available information, protected health information subject to HIPAA, or personal information that has been deidentified in accordance with applicable law.

Relationship to our HIPAA Notice of Privacy Practices. When you become a patient of the licensed providers affiliated with Ongo and receive clinical evaluation, prescriptions, or treatment, the information created in that clinical relationship is protected health information governed by HIPAA and by our separate Notice of Privacy Practices. This Notice instead covers CHD we collect outside that clinical relationship — for example, through our website, eligibility quiz, marketing, and account activity — and does not duplicate or replace the HIPAA notice.

To the extent we process deidentified information, we will maintain and use it in deidentified form and will not attempt to reidentify it, unless otherwise permitted by applicable law.

We may collect or receive the following categories of CHD. Not all categories apply to every individual.

• Health information you provide in an intake, eligibility, or screening questionnaire, including height, weight, BMI, medical history, current medications, allergies, comorbidities (such as type 2 diabetes), and symptoms
• The medications or treatment plans you view, select, order, or receive and your refill or subscription schedule
• The fact that you visited a page about a specific medication, treatment, or weight-related health condition
• Information from which any of the above could reasonably be inferred, including a product-specific web address, a medication name inside an analytics or advertising event, or a purchase amount that corresponds to a single product
• Precise location information that could reasonably indicate an attempt to obtain health services or supplies
• Biometric data, such as photographs you upload for provider review
• Information identifying the purchase of prescribed medication, unless that information constitutes protected health information subject to HIPAA
• Measurements of the information listed above
• Information that identifies your intention to seek health care services, including data generated when you begin or complete our eligibility quiz
• Information that we derive or extrapolate from data that is not itself CHD, and then use to associate you with the information listed above

We retain CHD for as long as necessary to fulfill the purposes described in this Notice and comply with our legal obligations, after which we securely delete or deidentify it.

We may obtain CHD from:

• Information you provide directly through questionnaire responses, your account, or other communications with us
• Information collected from a device associated with you
• Information collected automatically through cookies, pixels, or similar tracking technologies on our website or app
• Information collected from another company within our family of companies or affiliated entities
• Third parties and service providers

We may collect and use CHD to:

• Provide you with products and services you request, including displaying eligibility results, completing your purchase, facilitating your consultation with an affiliated provider, and suggesting products or content that may be of interest based on your activity
• Fulfill your requests, such as processing subscription renewals, refills, and customer service activities
• Communicate with you, including reminders to complete an eligibility questionnaire or notifications about your order or subscription
• Fulfill our legal functions or obligations, such as maintaining and auditing compliance
• Help ensure the security and integrity of our systems, including detection and prevention of security incidents
• Detect or prevent harmful behavior such as identity theft, fraud, harassment, or deceptive activities
• Market and advertise our services, subject to your consent where required by law
• For other purposes with your consent

We share your CHD only: (a) with your consent; (b) with service providers under contract, solely to the extent strictly necessary to provide a product or service you have specifically requested; or (c) as otherwise required or permitted by applicable law. We do not share CHD for marketing or advertising purposes without your prior, affirmative, opt-in consent, obtained separately from your general acceptance of our Privacy Policy or Terms of Service.

We may share CHD with the following categories of recipients:

• Healthcare providers. We share CHD with the licensed physicians and other healthcare providers who evaluate and treat you through our platform.
• Compounding and dispensing pharmacies that fill and ship your prescriptions. For example, we share your prescription and relevant clinical information with the pharmacy preparing your medication so it can be dispensed and shipped to you.
• Payment processors. For example, we share your billing information with Stripe to charge your monthly subscription and medication costs.
• Telehealth platform, hosting, and customer support vendors to deliver our services. For example, we share your video/voice consultation data with 100ms to host your provider consultations, and your chat data with Twilio to deliver secure messaging.
• Advertising and marketing technology providers, such as Google Ads and Meta Ads. We do not share consumer health data with these providers for advertising purposes; any information shared with them is limited to non-health engagement data necessary for basic analytics.
• Governmental agencies and legal bodies, where required by law or valid legal process.
• Purchasers of, or successors to, our business or assets, as part of a merger, acquisition, financing, or similar transaction. For example, if Ongo is acquired by another company, your CHD may be transferred to the acquiring party as part of that transaction.
• Other parties with your consent. For example, if you ask us to share your treatment history with your primary care doctor, we will do so once you've given consent.

Sale of consumer health data. We do not sell your consumer health data. We will not sell CHD without first obtaining your valid, signed written authorization meeting the requirements of applicable law.

Third-party tracking. We do not allow third parties to collect or use consumer health data over time and across different Internet websites or online services.

Consistent with Washington, Nevada, and other applicable state laws, we do not implement a geofence around any facility that provides in-person health care services in order to identify or track consumers seeking health care, collect their CHD, or send them related notifications, messages, or advertisements.

If applicable law provides you rights with respect to your CHD, you may have the right to:

• Confirm whether we are collecting, sharing, or selling your CHD, and access such data
• Withdraw your consent to our collection or sharing of your CHD
• Delete your CHD
• Appeal a denial of any request you have made

When you ask us to delete your CHD, we will delete it from our own records and direct any service providers, processors, or affiliates to whom we disclosed it to do the same, except where retention is required by law or necessary to complete a transaction you requested.

We will not deny you goods or services, or provide a different level of service, because you exercised your rights under this Notice.

You can submit these requests by writing to us at info@ongoweightloss.com or phone: (1-888-655-5267). We take commercially reasonable steps to authenticate your request before processing it, and may ask you for additional information for that purpose. We will respond within the timeframes required by applicable law (generally 45 days, with one permitted 45-day extension).

You may appeal our decision concerning your request by contacting us at info@ongoweightloss.com or phone: (1-888-655-5267). If your appeal is unsuccessful, you may raise a concern with the Washington State Attorney General at http://www.atg.wa.gov/filecomplaint or, for Nevada residents, the Nevada Attorney General at https://ag.nv.gov/Complaints/CSU_Complaints___FAQ/.

For important information about compounded medications, including that they are not FDA-approved and that the FDA does not evaluate their safety, effectiveness, or quality, see our Medical Disclaimer.

If we change this Notice, we will post the revised version here and update the "Last updated" date, and, where required by applicable law, provide additional notice and obtain your consent before any new collection, use, or sharing of CHD takes effect.

Ongo Weight Loss, LLC

• Email: info@ongoweightloss.com
• Phone: 1-888-655-5267
• Mailing Address: 8 The Green Ste Suite A, Dover, DE 19901, USA