Consumer Health Data Privacy Notice

This Consumer Health Data Privacy Notice (“Notice”) explains what consumer health data Digital Therapeutics, Inc. dba Pelago (“Pelago,” “we,” “us,” or “our”) collects from visitors of our websites pelagohealth.com, hellosona.com, sona.pelagohealth.com, and any related websites or webpages (the “Sites”), how we collect and use that information, and to whom we disclose it. This Notice is for Washington residents about whom we collect consumer health data and is intended to provide notices in compliance with Washington’s My Health, My Data Act. This Notice incorporates our Terms of Use and the Privacy Policy, which we encourage you to review to learn more about our privacy practices.

This Notice does not apply to information we collect from individuals in a business-to-business or employment context or to information that is subject to certain federal and state regulations, such as “protected health information” or “PHI” that is subject to the Health Insurance Portability and Accountability Act (“HIPAA”). You can find more information about our collection and use of PHI in our Notice of Privacy Practices.

Please note that we are providing the following disclosures and rights in this Notice in the interest of transparency. Such disclosures and rights are not intended to waive any applicable exemptions under state and federal law.

For purposes of this Notice, “personal data” means information that identifies or is reasonably capable of being associated or linked, directly or indirectly, with an individual in Washington. Personal data does not include de-identified data or publicly available information. “Consumer health data” means personal data that is linked or reasonably linkable to an individual and that identifies the individual’s past, present, or future health status or mental health status, as may be applicable.

In connection with your use of our Sites, we may collect information that we or our service providers process to associate or identify you information relating to physical or mental health treatments, conditions, or statuses that may be derived from non-health information (such as inferred data), which may be considered consumer health data.

• Directly from you through your interactions with us, such as when you visit the Sites, contact us, or otherwise interact with us.
• Our service providers (including those providing hosting and analytics services), in accordance with applicable law and the context in which you provided the data.

We may use cookies and other tracking technologies such as web beacons, embedded scripts, and tags (collectively, “Cookies”) on our Site that collect data to enhance experience on the Sites and to analyze usage on the Sites. However, we do not use Cookies that could be considered a “sale” of consumer health data.

We use the consumer health data we collect:

• To provide, operate, maintain, develop, improve, personalize, and expand the Sites.
• To perform internal analytics, research, and development.
• For marketing and promotional purposes.
• For internal business purposes, including general business administration.
• For systems and data security, including to prevent unauthorized, improper, or illegal activities on the Sites.
• To comply with our legal obligations, including responding to subpoenas, court orders, or legal process; and to establish or exercise our legal rights or defenses against legal claims.
• To enforce the legal or contractual terms that govern the Sites.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which consumer health data held by us about the users of the Sites is among the assets transferred.
• For purposes disclosed at the time you provide your information or as otherwise set forth in this Notice, for purposes consistent with your consent or expressed preferences, or as otherwise required or permitted by applicable law.

We may disclose any or all the above categories of consumer health data to the following parties, in accordance with applicable law and the context in which you provided the information:

• Our service providers (including those hosting or analyzing data on our behalf).
• Corporate affiliates, including parent entities, subsidiaries, business units, and other companies that share common ownership.
• Business transferees, if we are involved in a merger, acquisition, asset sale, or other corporate combination.
• Other third parties with your consent.

Additionally, under certain circumstances, we may be required to disclose your consumer health data if required to do so by law, in response to valid requests by public authorities, or in response to a threat of harm involving an individual’s health or safety.

Washington residents and individuals located in Washington have the following rights in relation to your consumer health data, subject to certain exceptions:

• Right to know. You have the right to know what consumer health data we collect, share, or sell, as those terms are defined under applicable law. You also have the right to obtain a list of all third parties and affiliates with whom we have shared or sold your consumer health data, and an active email address or other mechanism that you may use to contact these third parties. You also have the right to access your consumer health data that we collect, share, or sell.
• Right to withdraw consent. You have the right to withdraw consent from the collection and sharing of your consumer health data.
• Right to delete. You have the right to request that we, as well as our service providers and contractors, delete the consumer health data that we collect about you.
• Right to non-discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described above.

You may submit a request pursuant to any of these rights by contacting us at privacy@pelagohealth.com.

We do not charge a fee to process or respond to your request unless it is excessive, repetitive, manifestly unfounded, or in accordance with applicable law. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. We will respond to your request within forty-five (45) days after receipt, and we reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary, provided consumer notification of the extension is made within the first forty-five (45) days.

We cannot respond to your request or provide you with consumer health data if we cannot verify or authenticate your identity or authority to make the request and confirm that the consumer health data relates to you. We will only use consumer health data provided in a verifiable or authenticated consumer request to verify your identity.

To appeal our decision regarding a request that you have made, please contact us. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact Washington’s Office of the Attorney General by phone at (800) 551-4636 or by submitting a complaint here.

We may update this Notice from time to time. We will notify you of any changes consistent with applicable law, including by posting the new Notice on this page and updating the “effective date” at the top of this Notice. Changes to this Notice are effective when they are posted on this page.

If you have any questions or concerns about this Notice, or if you seek support in another language or format, please email us at privacy@pelagohealth.com or write to us at Digital Therapeutics, Inc. 1632 1st Ave. #20163 New York, NY 10028.