Consumer Health Data Privacy Policy

Summary

This policy explains how Nimbus Healthcare Corporation handles consumer health data. Consumer health data is personal information that identifies your past, present or future physical or mental health status and that is not protected health information under HIPAA. We collect it and share it only with your consent or as the law allows, such as when it is necessary to provide a service you asked for, and we ask for consent to collect and consent to share separately. We do not sell it without your valid authorization. You can confirm, access, copy, withdraw consent for, and delete your consumer health data, and you can appeal if we decline a request.

Who this policy covers

Nimbus Healthcare Corporation, a Delaware corporation with its principal office at 12005 Bee Cave Road, Suite 1A, Austin, Texas 78738 ("Nimbus Healthcare", "Nimbus", "we", "us" and "our"), is responsible for this Consumer Health Data Privacy Policy. It applies to consumer health data that we collect through the website at nimbushealthcare.com (the "Site"), the Nimbus member app, and the services offered through them (together, the "Services"), including the patient programs offered through the Services (the "Patient Programs").

This policy is written to meet the Washington My Health My Data Act, Nevada Senate Bill 370 and the consumer health data provisions of the Connecticut Data Privacy Act, and it applies to residents of Washington, Nevada and Connecticut. As a matter of practice, we follow it for everyone, wherever you live.

This policy does not apply to protected health information under HIPAA. Our Notice of Privacy Practices governs that information. This policy adds to our Privacy Policy, which governs all other personal information. The Site is a marketing site and does not collect health information.

What consumer health data is

Depending on the Patient Program and the features you use, consumer health data that we collect can include:

• Health conditions and symptoms, and the treatments you use or ask about.
• Medications that you take, ask about or are prescribed through the Services.
• Measurements and results, such as weight, vital signs and laboratory results that you share or that are ordered for you.
• Reproductive or sexual health information, including information about hormone health.
• Biometric data, only if you use a feature that collects it.
• Precise location, only where you enable it on your device.
• Inferences, which are conclusions about your health status that we draw from other information, including through software.

Where we get it

We collect consumer health data from:

• You, when you complete intake questions, send messages, fill in forms or use features in the member app.
• Your devices and connected health applications, when you choose to connect them.
• Licensed clinicians, laboratories and pharmacies that are involved in your care.
• Your use of the Services, such as the actions you take in the member app.

Why we collect it and how we use it

We collect and use consumer health data to:

• Provide the Patient Programs and the member app features that you ask for.
• Connect you with licensed clinicians, who decide whether a treatment is appropriate for you.
• Send prescriptions to the pharmacy you choose, and support orders and shipping.
• Confirm your identity and protect your account from fraud and misuse.
• Communicate with you about your care and your account.
• Operate, maintain and secure the Services, and provide the features described in our How Nimbus Uses Artificial Intelligence.
• Meet legal obligations.

We do not use consumer health data for advertising. No advertising technology runs on any page that collects health information or that describes a patient program, a medication or a health condition.

We use de-identified data, which cannot reasonably be linked to you, to improve our services, including our artificial intelligence features. Where your state's law requires your separate consent before consumer health data that identifies you is used for a purpose beyond providing the service you asked for, we ask for that consent first and honor your choice. In other states, these uses are on by default and you can turn them off in the Notification and Privacy Center in your account. We do not sell consumer health data, and we do not sell or share it for the purpose of training third-party large language models.

How we share it

We share the categories of consumer health data listed in What consumer health data is, and each recipient receives only the categories it needs for its role.

Affiliates. The only affiliate with which we share consumer health data is Lake Hills Pharmacy, a Texas-licensed compounding pharmacy at 12005 Bee Caves Road, Suite 1-A, Austin, Texas 78738. Lake Hills Pharmacy is owned by an affiliate of Nimbus Healthcare Corporation. A licensed pharmacist independently reviews every prescription and may decline, clarify, delay or transfer it when professional judgment or law requires. You may choose another pharmacy at any time, and your clinician will send your prescription to the pharmacy you choose where the law and the pharmacy permit. Lake Hills Pharmacy issues its own privacy notice at lakehillsrx.com.

You may ask us for the list of affiliates and third parties that have received your consumer health data, with an email address or other online way to contact each of them.

Third parties and service providers. We share consumer health data with these categories of recipients:

• Licensed clinicians who provide care through the Patient Programs.
• Laboratories.
• Pharmacies.
• Hosting providers.
• Payment processing providers.
• Identity verification providers.
• Messaging providers.
• Shipping providers.

We may also disclose consumer health data when the law requires it, to respond to a valid legal request, or to protect the safety of a person.

Consent for collection and separate consent for sharing

We ask for your consent to collect consumer health data, and we ask for your consent to share it separately. Each consent is a clear, affirmative choice that you make on its own. We never bundle either consent with your cookie choices, with your acceptance of the Terms of Use, or with any other agreement.

If the law allows us to collect or share consumer health data without consent because it is necessary to provide a product or service that you asked for, we collect or share only what is necessary for that purpose.

You may withdraw either consent at any time by contacting us as described below. If you withdraw consent, we stop the collection or sharing that the consent covered. We may not be able to provide a Patient Program that needs the data. Withdrawal does not affect records that the law requires us to keep.

No sale without authorization

We do not sell consumer health data. We will not sell it unless you first give us a valid authorization. A valid authorization is separate from every other consent, is signed by you, describes the data, the buyer and the purpose, and can be revoked.

Your rights

You have the right to:

• Confirm whether we are collecting, sharing or selling your consumer health data.
• Access your consumer health data and receive a copy of it.
• Review and correct the consumer health data we hold about you.
• Withdraw consent to our collection or sharing of it.
• Delete your consumer health data. We delete it from our records and tell our affiliates, service providers and third parties to delete it too, including from backups and archives.
• Receive a list of the affiliates and third parties with which we have shared your consumer health data.
• Appeal a decision on your request.

Deletion requests are completed within 30 days after we verify your identity, and the Privacy Policy explains how long we keep records and which records the law requires us to keep. The page Delete Your Account explains how to ask for deletion of your whole account.

How to exercise your rights

To make a request, email privacy@nimbushealthcare.com or write to Nimbus Healthcare Corporation, Attention: Privacy Official, 12005 Bee Cave Road, Suite 1A, Austin, Texas 78738. Please say which right you want to use and give the email address on your account.

Verification. We match the details in your request to the information we hold. If we need more to be sure that it is you, we will ask for it, and we will ask only for what is necessary.

Timing. We respond within 45 days after we receive your request. When the law allows an extension and we need one, we will tell you before the first 45 days end and explain why.

Appeals. If we decline to act on your request, you may appeal by emailing privacy@nimbushealthcare.com with the subject "Appeal". A person who was not involved in the original decision will review your appeal. We will respond in writing within 45 days after we receive it and will explain the outcome. If we deny your appeal, you may raise a concern with the attorney general of your state, and we will tell you how to contact that office.

No geofencing around healthcare facilities

We do not use a geofence around any facility that provides in-person health care services in order to identify consumers who seek health care, to collect consumer health data from them, or to send them messages or advertisements.

Changes to this policy

We may update this policy from time to time. We post the new version on the Site with a new date, and we will not collect additional categories of consumer health data or use the data for new purposes without your consent. This version was last updated on October 11, 2026. This version is effective October 11, 2026. If we make a material change to this policy, we tell you by email or in the member app before the change takes effect.

Dispute resolution

Nothing in our Terms of Use limits your rights under this policy, including your right to file a complaint with us or with a regulator.

Contact

• Email: privacy@nimbushealthcare.com
• Mail: Nimbus Healthcare Corporation, Attention: Privacy Official, 12005 Bee Cave Road, Suite 1A, Austin, Texas 78738