Consumer Health Data Privacy Policy

Effective date: August 6, 2026 Last updated: August 6, 2026 Controller: JL App Studio LLC ("SleepQi," "we," "us," or "our")

This Consumer Health Data Privacy Policy (the "CHD Policy") is a standalone supplement to the SleepQi Privacy Policy. It explains how we collect, use, disclose, and protect information that may qualify as "Consumer Health Data" under applicable U.S. state laws, including:

• Washington's My Health My Data Act (RCW Chapter 19.373)
• Nevada's Consumer Health Data Privacy Law (NRS Chapter 603A, as applicable)
• Connecticut's Data Privacy Act provisions governing consumer health / sensitive data (as applicable)

This CHD Policy does not replace the SleepQi Privacy Policy, Terms of Service, or any future clinical / Notice of Privacy Practices document. Where this CHD Policy and the general Privacy Policy differ on Consumer Health Data, this CHD Policy controls.

Wellness product notice (current scope). SleepQi is a consumer sleep and wellness application. It is not a medical device, is not intended to diagnose, treat, cure, or prevent any disease, and is not a substitute for professional medical advice, diagnosis, or care. At this time we are not operating as a HIPAA "covered entity" or "business associate" for App use described here. If we later offer clinical, provider, or HIPAA-covered services, those services will be governed by additional notices and consents, and we will update this CHD Policy before such processing begins.

1. Scope and Who This Policy Covers

This CHD Policy applies to Consumer Health Data we collect through the SleepQi mobile application and related online services (the "App"), including when we:

• Conduct business in a covered state, or
• Offer the App in a manner that may reach consumers in a covered state, or
• Collect Consumer Health Data in a covered state,

as those concepts are defined under applicable law.

It applies to natural persons acting in an individual or household context. It does not apply to individuals acting solely in an employment context.

Account information used for eligibility and login (for example, email and date of birth for the 18+ age gate) is described in the Privacy Policy. Date of birth is collected for age eligibility and account administration; it is not used as a health diagnosis or clinical record.

2. What We Treat as Consumer Health Data

"Consumer Health Data" is defined by applicable state law and is broader than traditional medical records. Because SleepQi is a sleep and wellness app, the following categories of information you enter or generate in the App may qualify as Consumer Health Data when linked or reasonably linkable to you:

We do not currently collect, as part of the App described in this CHD Policy:

• Biometric identifiers or biometric templates used to identify you (for example, face, fingerprint, or voice templates)
• Continuous biometric sensor streams from HealthKit, Google Fit, medical wearables, or similar (any wearable UI shown today is not a live clinical or device integration and does not persist biometric sensor data to our servers)
• Precise location information used to infer health-service seeking
• Data from medical devices, clinical labs, electronic health records, or provider systems
• Genetic data
• Insurance / claims data

If we later collect any of the above (or any new Consumer Health Data category), we will update this CHD Policy and obtain any required affirmative consent before that collection begins.

Sources of Consumer Health Data

We collect the categories above directly from you, through what you enter or select in the App.

We do not purchase, license, or otherwise obtain Consumer Health Data about you from data brokers or other third parties for App operation.

We do not infer Consumer Health Data about you from advertising networks for advertising purposes.

3. Purposes of Collection and Use

We collect and process Consumer Health Data only for the following purposes:

1. Provide core App features — sleep tracking, journaling, history review, and related account functionality you request
2. Generate in-App personalization — insights and recommendations shown to you based on your own logs and assessments
3. Secure and operate the service — authentication, abuse prevention, integrity, backup, and customer support when you contact us about your account or data
4. Optional research program (separate consent only) — if you opt in under Settings, limited use of de-identified / pseudonymous records as described in Section 5.4
5. Legal compliance — respond to lawful requests, enforce terms, and protect rights, safety, and security as permitted by law

Uses we do not make of Consumer Health Data

We do not:

• Sell Consumer Health Data
• Share Consumer Health Data for targeted advertising, cross-context behavioral advertising, or ad profiling
• Use Consumer Health Data to personalize third-party ads
• Train public generative-AI models on your identifiable journal text or sleep/mood logs outside the separate research program described in Section 5.4

Analytics and crash tools (for example, PostHog or Sentry, when enabled) are configured to process limited technical or account-identifier data as described in the main Privacy Policy. We do not intentionally send the substance of your sleep logs, mood entries, journal text, or assessment answers to those tools as advertising or analytics event content. We design product analytics to avoid raw health-content payloads; crash reporting may include technical diagnostics and limited account identifiers (such as user id), and we take steps to avoid including Consumer Health Data content in those reports.

4. Consent for Collection and Processing

Separate affirmative consent

Before you can enter sleep, mood, journal, assessment, or other health-related information into the App, we ask you to provide separate affirmative consent to SleepQi collecting and processing that Consumer Health Data as described in this CHD Policy.

That consent is:

• Requested on its own (not obtained merely by accepting Terms of Service or a general privacy checkbox)
• Specific to Consumer Health Data processing described here
• Recorded with timestamp and consent version in your account profile where technically feasible

Withdrawal

You may withdraw Consumer Health Data consent at any time in Settings.

• Withdrawal stops new collection and processing going forward for App features that require that consent
• Withdrawal does not by itself delete Consumer Health Data you already entered
• To delete data already stored, use the deletion rights in Section 8 (or delete your account, which removes associated App data as described in the Privacy Policy)

If you withdraw consent, some sleep / wellness logging features may become unavailable until consent is restored.

Material changes require new consent

We will not collect, use, or disclose additional categories of Consumer Health Data, or use existing Consumer Health Data for additional purposes not disclosed here, without first updating this CHD Policy and obtaining any required new affirmative consent.

5. Sharing vs. Processors (Important Legal Distinctions)

Washington's My Health My Data Act distinguishes "sharing" Consumer Health Data with a third party or affiliate from disclosure to a processor acting on our behalf to provide the App.

5.1 Sale

We do not sell Consumer Health Data and do not offer Consumer Health Data for sale.

5.2 Sharing with third parties and affiliates

Categories of identifiable Consumer Health Data shared with third parties or affiliates: none.

Research disclosures are only as described in Section 5.4 and are not advertising uses.

Affiliates that receive Consumer Health Data: none. We currently have no affiliates that receive Consumer Health Data. If that changes, we will name the specific affiliates here and update this CHD Policy before any such sharing begins.

We do not share Consumer Health Data for targeted or cross-context behavioral advertising.

5.3 Processors (not "sharing" under Washington MHMDA when used to operate the App)

We disclose Consumer Health Data to the following processors solely to operate the App on our behalf, under contracts that require them to process such data only for that purpose and consistent with this CHD Policy:

Infrastructure used only for non-health content (for example, Cloudflare R2 for soundscape audio files) and advertising SDKs that do not receive your sleep/mood/journal/assessment content are described in the main Privacy Policy and are not Consumer Health Data processors for the categories above.

If we add a new processor that will process Consumer Health Data, or change processors in a way that materially affects how Consumer Health Data is handled, we will update this CHD Policy first and obtain any required consent before that processing begins.

5.4 Research participation (separate optional program)

If you separately opt into research participation in Settings, that choice is optional and separate from Consumer Health Data consent.

• Research participation is never required to use core App features
• Research exports, if run, use a consent-gated administrative process: only designated operators with privileged backend access may run the export function, and the App's normal user features do not trigger it
• That process is designed to: include only users with active research consent; replace account identifiers with a non-reversible subject key; export allowlisted fields (and counts rather than raw free-text journal or note content); and suppress the export if fewer than 20 consented subjects would be included
• Exports are audited, and generated artifacts are set to expire by default after 90 days under our internal research export controls
• As of this CHD Policy's date, we do not operate an active commercial or third-party research-dataset licensing program. Opting in records your consent so that, if we later use research exports for internal research, AI/model improvement, or external/commercial research datasets, we can do so only for users who remain opted in
• Before any external or commercial research use begins, we will update this CHD Policy, describe what is involved, and obtain any additional consent required by law
• De-identified research exports are never used to personalize advertising, and are not "sharing" of identifiable Consumer Health Data with third-party advertisers under the MHMDA definitions used in this Policy
• Opting out stops inclusion in future exports; handling of any previously generated artifacts is subject to legal/privacy review as described in the Privacy Policy

Valid public-interest research that meets applicable legal and ethical requirements may be treated differently under certain state definitions; we still require separate opt-in for our research program as implemented in the App.

See the main Privacy Policy for general research disclosures and Canada-specific information.

5.5 Legal disclosures

We may disclose Consumer Health Data if required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect the rights, property, or safety of SleepQi, our users, or others, consistent with applicable law. Where legally permitted, we will narrow such disclosures to what is necessary.

6. No Geofencing Around Health Care Facilities

We do not use geofencing technology around health care facilities or similar locations to collect Consumer Health Data, identify or track consumers seeking health care services, or send messages or advertisements related to Consumer Health Data.

7. Retention

We retain Consumer Health Data for as long as needed to provide the App features you use, maintain your account history you expect to review, comply with legal obligations, resolve disputes, and enforce our agreements.

When you delete specific logs (where the App permits) or delete your account, we delete or de-identify associated Consumer Health Data in accordance with our deletion processes and the main Privacy Policy, subject to limited retention required for security, fraud prevention, legal compliance, or backup cycling.

8. Your Rights

Subject to applicable law and identity verification, you have the right to:

1. Confirm / Access — know whether we are collecting, sharing, or selling Consumer Health Data about you, and access such Consumer Health Data
2. Delete — request deletion of Consumer Health Data we hold about you, including, where legally required, that we notify processors that received it from us to delete it as well (subject to legal exceptions)
3. Withdraw consent — withdraw consent for future collection or processing at any time (Section 4)
4. Non-discrimination — exercise these rights without discriminatory treatment (for example, we will not deny the App solely because you exercised a privacy right; note that if consent is required to provide a feature, withdrawing consent may limit that feature)
5. No forced account creation for rights — where required by law, you may exercise applicable Consumer Health Data rights without being required to create a new account if you do not already have one

Authorized agents may submit requests where permitted by law; we may require proof of authorization and consumer identity verification.

We do not sell Consumer Health Data, so a "do not sell" request is not applicable to a sale practice; if our practices change, we will update this CHD Policy and provide any required authorization mechanism before any sale.

Logged-in users may also download a copy of their App data from Settings (data export).

9. How to Exercise Your Rights

Email: support@sleepqi.com Subject line suggestion: "Consumer Health Data Request"

Please include:

• The email address associated with your SleepQi account (if any)
• The type of request (access, deletion, consent withdrawal confirmation, or other)
• Enough information for us to locate your data and verify your identity

Response timing. We will respond within 45 days of receipt. If we need more time due to complexity or volume, we will notify you before that period ends and may take up to an additional 45 days, where permitted by law.

We may need to verify your identity before completing certain requests. If we cannot reasonably verify your identity, we may request additional information or decline the request, consistent with applicable law.

You may also withdraw Consumer Health Data consent directly in the App under Settings.

10. Security

We implement administrative, technical, and organizational measures designed to protect Consumer Health Data against unauthorized access, disclosure, alteration, or destruction. These include access controls, encryption in transit, and contractual limits on processors.

No method of transmission or storage is completely secure. We cannot guarantee absolute security. If we become aware of a breach affecting your Consumer Health Data in a way that triggers legal notice duties, we will provide notices required by applicable law.

Additional security and incident practices are described in the main Privacy Policy.

11. Age Restrictions

The App is intended for users 18 years of age or older. We do not knowingly collect Consumer Health Data from children under 18. If you believe we have collected such data, contact support@sleepqi.com and we will take appropriate steps to delete it.

12. Future Clinical, Medical, or HIPAA-Covered Features

If SleepQi later introduces features that:

• Connect to medical devices, EHRs, labs, or providers,
• Are offered as clinical decision support or regulated medical software,
• Involve processing protected health information (PHI) as a HIPAA covered entity or business associate, or
• Otherwise expand Consumer Health Data categories or purposes beyond this CHD Policy,

then before such collection or processing begins we will:

1. Update this CHD Policy (and, if applicable, publish a HIPAA Notice of Privacy Practices or similar notice),
2. Obtain any required new affirmative consents / authorizations, and
3. Update in-App disclosures and store listings as required.

Until that happens, do not treat the App as a clinical record system or medical-care channel.

13. Relationship to Other Policies and International Users

• Privacy Policy: general personal data practices (account, ads infrastructure, analytics toggles, etc.)
• Terms of Service: contract terms for using the App
• This CHD Policy: Consumer Health Data under applicable U.S. state health-privacy laws

Soft launch / primary commercial focus is the United States. If you use the App from another country, your information may be processed in the United States. Additional rights (for example under GDPR or PIPEDA) may apply as described in the main Privacy Policy; those frameworks do not reduce the Consumer Health Data commitments in this CHD Policy where U.S. state law applies.

We do not currently target or direct marketing at consumers in the European Economic Area or United Kingdom. References to EEA/UK concepts elsewhere in our policies describe how we would handle such data if applicable and do not, by themselves, constitute an offer of the App in those regions.

14. Changes to This CHD Policy

We may update this CHD Policy from time to time. The "Last updated" date at the top will change when we do.

If we materially change:

• categories of Consumer Health Data collected,
• purposes of collection/use, or
• who receives Consumer Health Data (including new sharing, new research disclosure practices, or new processors processing CHD),

we will update this CHD Policy and, where required by law, obtain new affirmative consent before the change takes effect.

We encourage you to review this page periodically.

15. Contact Us

JL App Studio LLC 7901 4th St N, Ste 300 St. Petersburg, FL 33702, US

Email: support@sleepqi.com

For Consumer Health Data rights requests, see Section 9.