Consumer Health Data Privacy Policy

Version 1.0 — Last updated: September 21, 2026

This Consumer Health Data Privacy Policy (“Policy”) provides you with information about how Tuly Health (“Tuly,” “we,” or “us”) may collect, use, share, or otherwise process your “Consumer Health Data,” as defined under Washington's My Health My Data Act and Nevada's SB 370. This Policy serves as a supplement to our Privacy Policy.

We may update this Policy from time to time. Any updated Policy will be effective when posted. Please check this Policy periodically for updates. If required by law, we will contact you directly to provide you with an updated Policy.

1. Types of Consumer Health Data we collect

The Consumer Health Data that we may collect includes:

• Individual health conditions, treatment, diseases, or diagnoses;
• Social, psychological, behavioral, and medical interventions;
• Health-related surgeries or procedures;
• Use or purchase of prescribed medication;
• Bodily functions, vital signs, symptoms, or measurements of the information described in this section;
• Diagnoses or diagnostic testing, treatment, or medication;
• Gender-affirming care information;
• Reproductive or sexual health information;
• Biological samples and related data. Where at-home testing becomes available, our collection may include physical samples provided in connection with your use of our products and services (such as a vaginal swab) and the data derived from them;
• Inferences about health derived from other health or non-health data. For example, we may infer interests or conditions based on portions of our website you visit or purchases or attempted purchases.

2. Sources of Consumer Health Data

• Data you provide. When you contact us, join our waitlist, create an account, fill out questionnaires, log information in the app, or provide physical samples.
• Information automatically collected. We may collect Consumer Health Data, subject to applicable law, using automated data collection technologies as described in the “Cookies & tracking” section of our Privacy Policy and our Cookie Policy.
• From third parties. We may collect Consumer Health Data from third parties, such as service and content providers, our affiliated companies, financial institutions and payment processors, or laboratory and clinical partners who interact with us on your behalf.
• From publicly available sources. We may collect Consumer Health Data about you from publicly available sources, such as public profiles and websites.

3. How we use Consumer Health Data

We may use Consumer Health Data for the following purposes:

• To provide you products and services. For example, to make our website, products, and services available; register, verify, and maintain your account; deliver the goods and services you request; and provide customer service.
• For our internal business purposes. For example, to maintain internal business records, enforce our policies and rules, produce management reporting, conduct auditing, and support IT security and administration.
• For internal research and product improvement. For example, to measure and improve our products or services, design new features, evaluate the effectiveness of our efforts, and debug and repair errors with our systems.
• For research studies. To support scientific discoveries related to women's health, we may remove personal identifiers from Consumer Health Data and maintain it in anonymized and aggregated form. Any anonymized and aggregated statistical information we share, publicly or privately, will be handled so that no specific individual can be identified by its use.
• For legal, safety, or security reasons. For example, to comply with legal and reporting requirements; investigate and respond to claims; establish, exercise, or defend legal claims; protect the safety, property, or rights of you, us, and third parties; and detect, prevent, and respond to security incidents and fraudulent or illegal activity.
• In connection with a business transaction. For example, if we sell or transfer all or a portion of our business or assets. We will inform impacted parties if this occurs.

We may use anonymized, de-identified, or aggregated information for any purpose permitted by law.

4. Types of Consumer Health Data we may share

We may share each of the categories of Consumer Health Data that we collect, as described above, with the categories of recipients described below. We do not sell your Consumer Health Data.

5. Disclosure of Consumer Health Data

We may disclose the Consumer Health Data described above to third parties, including:

• Service providers. Vendors or agents (“processors”) working on our behalf may access Consumer Health Data for the purposes described above — for example, companies we've hired to provide customer support or to protect and secure our systems and services.
• Financial institutions & payment processors. When you make a purchase or enter into a financial transaction, we will disclose payment and transactional data to banks and other entities as necessary for payment processing and related financial services.
• Clinical & laboratory partners. When you request testing or care, limited to what is needed to deliver it and subject to appropriate safeguards.
• Law enforcement, government agencies, and others for legal, security, or safety purposes. For example, to comply with law, to enforce our Terms of Service and other agreements, and to protect the safety, property, or rights of us, our customers, or third parties.
• Other entities in connection with a corporate transaction. For example, to an acquirer in connection with a sale or transfer of all or a portion of our business or assets.
• The public. For example, if you leave comments or reviews in public areas of our online services, that content may be read, collected, or used by others.
• Entities to which you have consented to the disclosure.

6. Your rights

Washington and Nevada consumers have certain rights regarding their Consumer Health Data, including:

• Right to access. You have the right to confirm whether we process your Consumer Health Data and to obtain information about how we process that data.
• Right to delete. You have the right to request that we delete your Consumer Health Data.
• Right to withdraw consent. If you provided consent for our processing of your Consumer Health Data, you may have the right to withdraw that consent.
• Right to correct. You have the right to ask that we correct the Consumer Health Data that we collect.

To exercise your rights, please contact us at privacy@tulyhealth.com. We will not discriminate against you for exercising your rights, and you may appeal a decision by replying to our response.

7. Contact us

If you have questions regarding this Consumer Health Data Privacy Policy, please contact us at privacy@tulyhealth.com or write to us at:

Tuly Health
265 Denison Drive
Mount Pleasant, MI 48858