Berry Street Privacy Notice

Categories and Uses of Consumer Health Data We Collect

We only collect your Consumer Health Data as needed to provide you with the products or services you request or with your explicit consent.

We may collect the following categories of Consumer Health Data:

• Individual health condition, treatment, disease, or diagnosis information;

• Social, psychological, behavioral, and medical intervention information;

• Health-related surgery or procedure information;

• Use or purchase of prescribed medication information;

• Bodily function, vital sign, symptoms, or measurement of health information;

• Diagnosis or diagnostic testing, treatment, or medication information;

• Biometric data;

• Information about your access to healthcare, including precise location information that could reasonably indicate an attempt to acquire or receive health services or supplies; or

• Information processed to associate or identify an individual with the data listed above that is derived or extrapolated from non-health information.

We may process the categories of Consumer Health Data described above to the extent necessary to provide requested products or services, or with your consent, including:

• To determine and verify program, product, and service eligibility and coverage;

• To enroll you in our programs and provide our products and services to you;

• To administer, manage, analyze, and improve our programs, products, and services;

• To procure vendor/supplier products and services, including to manage and satisfy related vendor/supplier contractual obligations;

• To analyze and better understand your needs, preferences, and interests, as well as those of other consumers;

• To conduct internal business analysis and market research;

• To monitor, investigate, and enforce compliance with our policies, product/service terms and conditions, and legal and regulatory requirements;

• To comply with legal and regulatory obligations; or

• For our everyday business purposes.

Sources of Consumer Health Data

We collect Consumer Health Data from the following sources:

• Directly from you, if you:

  • request health-related products and services;

  • enroll in our biometric access programs;

  • register to use our health or wellness-related apps;

  • join our email lists or loyalty programs; or

  • volunteer the information in connection with surveys or promotions.

• Indirectly from you (gathered directly by social media, other websites, or apps) if you:

  • interact with us by using our apps, accessing our systems, or entering our facilities;

  • enable certain mobile app functions, such as location tracking;

  • enable data syncing between our website and your enrolled health-related app;

  • make your health data publicly available on social media or other websites; or

  • like, follow, or comment about health-related products on our social media sites.

• From our vendors, suppliers, consultants, professional advisers, and other third parties, when:

  • Business contact information, financial information, and other data is necessary for the purpose of managing and operating our business.

• From third parties who provide program enrollment, benefit verification, or product fulfillment services.

• Health Insurance Companies or other payors, when:

  • Information is necessary for the purpose of providing our products and services;

  • Information is necessary to determine program eligibility; or

  • Information is necessary to comply with legal and regulatory obligations.

• Your authorized legal representative, family members, or caregivers.

How We May Share Consumer Health Data

We only share or disclose your Consumer Health Data as needed to provide you with the products or services that you request, or with your explicit consent. We may share or disclose any or all the above categories of Consumer Health Data to the following entities, who shall use the data only as permitted for the purposes set forth above, and within the bounds of our contracts with them:

These general categories of third parties:

• Business Collaborators

• Product co-promotion partners

• Product co-development partners

• Marketing and Advertising Agencies

• Social Media Companies and Platforms

• Service Providers (including those hosting or analyzing data on our behalf, those assisting with fraud prevention, those assisting in program administration, those assisting in incident management and reporting, those administering our call center and websites, and those who assist with our information technology and security programs)

• Emergency Personnel,

• Health insurance companies, health plans, and/or other payors,

• Authorized/legal representatives, family members, and caregivers,

• Third parties (including those with whom Company has joint marketing and similar arrangements, those who provide marketing and data analytics services, those who provide program enrollment or product fulfillment, payment, and authorization, other third parties as necessary to complete transactions and provide products/services, or where required by law),

• Company  lawyers, auditors, and consultants, or

• Legal and regulatory bodies.

In addition, we may share or disclose Consumer Health Data as permitted or required by law, such as (i) to an acquiring organization if we are involved in a sale or a transfer of our business, (ii) as needed to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, (iii) in situations that may involve violations of our terms of use or other rules, (iv) to protect our rights and the rights and safety of others, (v) as needed to support external auditing, compliance and corporate governance functions, (vi) as needed to preserve the integrity or security of our systems, or (vii) to investigate, report, or prosecute those responsible for any action that is illegal under applicable state or Federal law.

Your Consumer Health Data Privacy Rights

Subject to certain legal limitations and exceptions, you have the following rights with respect to any Consumer Health Data we may collect about you:

• The right to confirm whether we are collecting, sharing, or selling your Consumer Health Data and to access such data, including to receive a list of affiliates or specific third parties with whom we have shared or sold your information, along with contact information such as an active email address for each third party;

• The right to review and request corrections to your Consumer Health Data;

• The right to withdraw consent from our collection or sharing of your Consumer Health Data; and

• The right to request that we delete your Consumer Health Data.

You may submit a request pursuant to any of these rights by contacting us as described in “Contact Us.”

We will not discriminate against you for exercising any of your rights. We will make reasonable efforts to respond promptly to your requests in accordance with applicable laws. Please allow 45 days for a response.  We may, after receiving your request, require additional information from you to authenticate your request and verify your identity. Please be aware that we may be unable to afford these rights to you under certain circumstances, such as if we are legally prevented from doing so.

If we deny your request, you have the right to appeal that denial by contacting us support@berrystreet.co. We will process and respond to your appeal within the time permitted by applicable law. If you are a Washington resident and your appeal is unsuccessful, you may file a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

Changes to Our Consumer Health Data Privacy Notice

We may update this Consumer Health Data Privacy Notice from time to time. When we do update it, for your convenience, we will make the updated statement available on this page. Our intention is to use Consumer Health Data in accordance with the Consumer Health Data Privacy Notice in place at the time the Consumer Health Data was collected.

Nevada Supplemental Consumer Health Data Privacy Notice

This Supplement applies to Nevada consumers for purposes of providing additional disclosures required by Nevada's Consumer Health Data Privacy Law. We collect, use, process, and share Consumer Health Data for the purposes and manners described above in our Consumer Health Data Privacy Notice.

Third Party Collection of Consumer Health Data on Company Websites. We limit third party collection of Consumer Health Data over time and across different Internet websites or online services when Nevada consumers use our websites or online services. We do this by disabling certain cookies or by ensuring that entities whose cookies, web beacons, pixels, and other online trackers we use on our websites and online services are our service providers or processors under applicable U.S. state privacy or consumer health data privacy laws. Nonetheless, please note that other third parties may still be able to process Consumer Health Data from you over time and across different websites depending on your browser, browser settings and add-ons, and associated permissions you have set on your device. This collection of Consumer Health Data by those third parties is unrelated to the Company processing of Consumer Health Data from you, and we encourage you to review your browser settings and review those third parties’ privacy notices for more information about their Consumer Health Data practices.

Review and Revision of Consumer Health Data. If you would like to review and/or revise your Consumer Health Data, you may submit a request to us via any of the methods listed in this Notice.