Consumer Health Data Privacy Policy

Last updated: December 28, 2025

This Consumer Health Data Privacy Policy describes how Rythm Health, Inc. (“Rythm”, “we”, “us”) collects, uses, shares, and protects "consumer health data" as defined under applicable U.S. state laws, and the privacy rights and choices you have in connection with our services.

This Consumer Health Data Privacy Policy supplements our Privacy Policy and applies only to consumer health data relating to Connecticut, Nevada, and Washington state residents, in each case, only to the extent required by applicable law.

Categories of Consumer Health Data We Collect

Depending on your use of the Services, we may collect certain consumer health data as described in our Privacy Policy. Consumer health data includes:

• Information about your health conditions, treatments, or diagnoses;

• Social, psychological, behavioral, and medical interventions;

• Health-related surgeries or procedures;

• Use or purchase of prescribed medication;

• Bodily functions, vital signs, symptoms, or measurements;

• Diagnoses or diagnostic testing, treatment, or medication;

• Reproductive or sexual health information;

• Genetic data;

• Data that identifies a consumer seeking health care services; and

• Recommendations, insights, and other inferences derived from the foregoing.

We collect consumer health data directly from you and from our lab partners, connected accounts and devices, and provider networks.

Our Purposes For Collecting and Using Consumer Health Data

We collect and use your consumer health data with your consent or as reasonably necessary to provide you with Services you request.

For example, we may use consumer health data to:

• Arrange for and perform lab tests;

• Display and organize lab results;

• Provide personalized insights and recommendations;

• Provide consultations and resources for analyzing your consumer health data;

• Allow you to access AI coaching and recommendation features; and

• Grant access to other features of the Services.

We may also use consumer health data to:

• Operate, manage, and maintain our business, and to accomplish our business purposes and objectives;

• Conduct or facilitate research in accordance with applicable laws, including peer-reviewed scientific research, or research involving deidentified data; and

• Detect, investigate, and help prevent security incidents and other malicious, deceptive, fraudulent, or illegal activity and help protect the rights and property of Rythm and others, and to comply with applicable laws.

Data Sharing

We may share your consumer health data with:

• Accredited labs and healthcare providers, where necessary to provide the Services to you or at your direction;

• Service providers or processors that assist us in the provision of the Services;

• Law enforcement, government agencies or other third parties, where we believe in good faith it is necessary or appropriate to comply with applicable laws or protect our legitimate interests; and

• Business transferees, in the event of a merger, sale, acquisition, bankruptcy or other transaction in which that third party assumes control of our business or data (in whole or in part).

Your Rights and Choices

Depending on your state residency, you may have certain the following rights in relation to your consumer health data:

• Withdraw consent. To the extent we rely upon your consent for our collection, use or sharing of your consumer health data, you have the right to withdraw such consent from future collection, use or sharing.

• Access and confirmation. You have the right to ask us to confirm whether we have collected, shared or sold your consumer health data. You can also access the consumer health data that we have collected from or about you and ask for information about how we processed it.

• Correction. You have the right to ask us to correct inaccuracies in your consumer health data.

• Deletion. You have the right to ask us to delete your consumer health data.

• Appeal. You have the right to appeal our denial of your request. If your appeal is denied, you may issue a complaint with appropriate regulatory enforcement authorities.

To submit a request or to appeal a request you submitted, please contact us at [email protected].

We will not discriminate against you for exercising your rights described above.