Additional United States Privacy Disclosures

These disclosures supplement the information contained in our Privacy Notice by providing additional information about the privacy rights available to individual residents of certain states in the United States and our personal data processing practices relating to those individuals. For a detailed description of how we collect, use, disclose, and otherwise process personal data, please read our Privacy Notice.

Nevada Residents

If you are a resident of the state of Nevada in the United States, you have the right to opt out of the sale of your personal data. Although we do not currently sell personal data of Nevada residents (as defined under Nevada law), you may submit a request to opt-out of the sale of your personal data by completing our online form found here.

California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Nebraska, New Hampshire, New Jersey, Maryland, Minnesota, Montana, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia Residents

If you are a resident of the state of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Nebraska, New Hampshire, New Jersey, Maryland, Minnesota, Montana, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia in the United States the following supplementary disclosures apply to you.

Personal Data Disclosures, Sales and Targeted Advertising

We disclose all of the categories of personal data we collect to the categories of recipients set forth in the Our Disclosure of Personal Data section of our Privacy Notice. However, we do not sell personal data, and we do not process or otherwise share personal data for the purpose of displaying advertisements that are selected based on personal data obtained or inferred over time from an individual’s activities across non-affiliated businesses or websites, applications, or other services (otherwise known as “targeted advertising” or “cross-context behavioral advertising”).

Sensitive Personal Data

The following personal data elements we collect may be classified as “sensitive” under certain privacy laws:

• Health information as described here.
• Personal data collected about a child under the age of 13, but only if provided by their parents and guardians.

We may use sensitive personal data for the purposes set forth in the Our Collection and Use of Personal Data and Additional Uses of Personal Data sections of our Privacy Notice. Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to limit, or withdraw your consent for, our processing of sensitive personal data (as described in the Your Additional U.S. Privacy Choices section below).

Deidentified Information

We may at times receive, or process personal data to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

Automated Decision-Making and Profiling

We do not conduct automated processing of personal data for the purposes of evaluating, analyzing, or predicting an individual’s personal aspects in furtherance of decisions that produce legal or similarly significant effects. As a result, we do not provide a right to exercise control over such forms of automated decision-making and profiling.

Your Additional U.S. Privacy Choices

Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights:

Right to Know: The right to confirm whether we are processing personal data about you and, for residents of California and Oregon only, to obtain certain personalized details about the personal data we have collected about you, including:

• The categories of personal data collected;
• The categories of sources of the personal data;
• The purposes for which the personal data were collected;
• The categories of personal data disclosed to third parties (if any), and the categories of recipients to whom this personal data were disclosed;
• The categories of personal data shared for targeted advertising purposes (if any), and the categories of recipients to whom the personal data were disclosed for these purposes;
• The categories of personal data sold (if any) and the categories of third parties to whom the personal data were sold; and
• For Oregon residents only, a list of specific third parties to whom personal data have been disclosed.

Right to Access & Portability: The right to obtain access to the personal data we have collected about you and, where required by law, the right to obtain a copy of the personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.

Right to Correction: The right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of the personal data.

Right to Control Over Sensitive Personal Data: The right to exercise control over our collection and processing of certain sensitive personal data.

Right to Opt-Out of Targeted Advertising: The right to direct us not to use or share personal data for certain targeted advertising purposes (if any).

Right to Opt-Out of Sales: The right to direct us not to sell personal data to third parties (if any), including the right to opt-out of the disclosure of personal data to third parties for the third parties’ direct marketing purposes under California’s Shine the Light Law.

Right to Deletion: The right to have us delete personal data we maintain about you.

Depending on your state of residency, you may also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights. However, the exercise of the rights described above may result in a different price, rate or quality level of product or service where that difference is reasonably related to the impact the right has on our relationship or is otherwise permitted by law.

Submitting Privacy Rights Requests

Please submit a request specifying the right you wish to exercise by:

• Completing our online form found here.
• Contacting us at privacy@takestasis.com.

Before processing your request to exercise certain rights (including the Right to Know, Access & Portability, Correction, and Deletion), we will need to verify your identity and confirm you are a resident of a state that offers the requested right(s). In order to verify your identity, we will generally either require the successful authentication of your account, or the matching of sufficient information you provide us to the information we maintain about you in our systems. As a result, we require requests submitted through our online form and email address to include first and last name, email address, state of residency and/or the date of your last transaction with us.

In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate your information in our systems, or where you are not a resident of one of the eligible states.

Submitting Authorized Agent Requests

In certain circumstances, you are permitted to use an authorized agent to submit requests on your behalf through the designated methods set forth above where we can verify the authorized agent’s authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided and your state of residency, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request.

Appealing Privacy Rights Decisions

Depending on your state of residency, you may be able to appeal a decision we have made in connection with your privacy rights request. All appeal requests should be submitted by replying to the communication resolving your original request.

Additional California-Specific Disclosures

The following disclosures only apply to residents of the State of California.

California Categories of Personal Data

California law requires we provide disclosures to you about what personal data we collect by reference to the enumerated categories of personal data set forth within California law. To address this obligation, we have identified the relevant enumerated California personal data category for the personal data described in the Our Collection and Use of Personal Data section of our Privacy Notice below:

• Identifiers, such as first and last name, and email address.
• Internet / network information, such as device identifiers and usage data.
• Sensitive personal data, such as your child’s health information, to the extent you provide it to us as part of the Services.
• Inferences, such as health-related patterns derived from logs.

California’s “Shine the Light” Law

California's "Shine the Light" law (Civil Code Section §1798.83) provides certain rights to California residents that have an established business relationship with us with regard to the disclosure of certain types of personal information to third parties for their direct marketing purposes. The App does not disclose personal information to third parties for their direct marketing purposes.

Washington and Nevada Consumer Health Data Privacy Notice

This Consumer Health Data Privacy Notice (the “Consumer Health Notice”) supplements the Synthesis Privacy Notice and explains how we collect, use, disclose, and otherwise processes Consumer Health Data (as defined below) of residents of the state of Washington or Nevada, or individuals whose Consumer Health Data is collected in those states through our Services.

Please note that this Consumer Health Notice is not a contract and does not create any legal rights or obligations not otherwise provided by law.

Our Collection and Use of Consumer Health Data

The term “Consumer Health Data” as used in this Consumer Health Privacy Notice means any personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status as defined in the Washington My Health My Data Act or the Nevada Consumer Health Data Privacy Law (the “Consumer Health Privacy Laws”). The Consumer Health Data we collect depends on the context of your interactions with us and, in most cases, is information that you decide to share with us. This includes information collected through your communications with us, or from your other interactions with our Services. Consumer Health Data does not include information that is considered deidentified under the Consumer Health Privacy Laws.

Examples of Consumer Health Data that we may collect include:

• your child’s diagnosis, medications, dosage, and medication schedule, your child’s prescriber and healthcare providers, and information about your child’s mood, sleep, focus, appetite, and your other observations, where you choose to share this information with us. We do not collect health information directly from your children. We use this information to provide you with our Services.
• Other information that may be used to infer or derive data related to the above or other health-related information.

We may process and/or use your Consumer Health Data (including with your consent where required by the Consumer Health Privacy Laws) for the following purposes:

• To manage and provide the Services.
• To manage, provide, maintain, and improve our business.
• To respond to your questions, concerns, and other requests for assistance.
• To customize your experience on the Services.
• For market research and providing insights into consumer health behaviors/conditions.
• To create anonymous, aggregated, or de-identified data.

We may also combine your Consumer Health Data with other personal data we collect directly from you or receive from other sources.

Sources of Consumer Health Data

The Consumer Health Data we collect depends on the context of your interactions with our Services and, in most cases, is information that you decide to share with us. We and our service partners may collect this type of information through the Services. For more information, please see the Our Collection and Use of Personal Data section of our Privacy Notice.

Our Disclosure of Consumer Health Data

We may share the categories of Consumer Health Data set forth above as follows:

To you: As part of our Services, we provide you with the opportunity to export the log summaries so that you may provide them to your child’s healthcare providers.

To Service Providers: We work with a variety of service providers who help us process your Consumer Health Data, such as to facilitate the operation of our Services.

In relation to Business Transactions: We may take part in or be involved with a business transaction, such as a merger. We may disclose Consumer Health Data to a third-party during the negotiation of or in connection with such a transaction.

In relation to Legal Obligations and Rights: We may disclose Consumer Health Data to third parties in connection with the establishment, exercise, or defense of legal claims; to comply with laws or to respond to lawful requests and legal processes; to protect our rights and property and the rights and property of others, including to enforce our agreements and policies; to detect, suppress, or prevent fraud; to protect the health and safety of us and others; or as otherwise required by applicable law.

With Your Consent: We may disclose Consumer Health Data about you to other service providers or publicly with your consent or at your direction. For example, with an individual’s consent or at their direction we may post their testimonial on our Services.

Your Privacy Rights

The Consumer Health Privacy Laws provide the following rights with respect to Consumer Health Data we collect about you:

Right to Access / Confirm: You may have the right to confirm whether we are collecting, sharing, or selling Consumer Health Data about you and with whom we may be disclosing such Consumer Health Data, and to access such data.

Right to Withdraw Consent: If you have provided your consent for our processing or sharing of your Consumer Health Data, you may have the right to withdraw your consent.

Right to Delete: You may have the right to request that we delete your Consumer Health Data and that all third parties to whom we have disclosed your Consumer Health Data delete such data.

How to Exercise Your Privacy Rights

To exercise any of the privacy rights set forth above or to review or request changes to data, please submit a request to complete our online form found here.

Before processing your request, we will need to authenticate your identity. To authenticate your identity, we will generally require matching a minimum amount of information you provide us with the information we maintain about you in our systems. This process may require us to request additional information from you, including, but not limited to, your email address.

In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to authenticate your identity or locate your information in our systems. If we are unable to comply with all or a portion of your request, we will explain the reasons for our decision.

Appealing Privacy Rights Decisions

If your request to exercise a right under the Consumer Health Privacy Laws is denied, you may appeal that decision by contacting us at privacy@takestasis.com. If the appeal is unsuccessful, you may raise a concern or lodge a complaint with the applicable State Attorney General.

Changes to this Consumer Health Data Privacy Notice

We may update this Consumer Health Notice from time to time. When we make changes to this Consumer Health Notice, we will notify you by changing the date at the beginning of this Consumer Health Notice. If we make material changes to this Consumer Health Notice, we will notify individuals by email to their registered email address, by prominent posting on this website or our other platforms, or through other appropriate communication channels. All changes shall be effective from the date of publication unless otherwise specified.