Consumer Health Data Privacy Policy

1. Overview

This Consumer Health Data Privacy Policy ("Policy") is published by Delta Auxilium Sp. z o.o. ("Delta," "we," "our," or "us") in compliance with the Washington My Health My Data Act ("MHMDA," RCW Ch. 19.373), the Nevada Consumer Health Data Law ("SB 370"), and other applicable consumer health data privacy laws (collectively, "Applicable State Laws").

This Policy describes how Delta collects, uses, and shares Consumer Health Data in connection with the Delta Auxilium AI fitness mobile application ("App"), and explains the rights available to consumers under Applicable State Laws. It supplements our General Privacy Policy (DELTA-PP-001) and, where the two documents address the same subject matter, should be read together with it. Capitalised terms not defined here have the meanings given in the General Privacy Policy.

For EU and EEA residents: your health data is additionally protected as Special Category Data under GDPR Article 9. EU-specific rights and protections are described in the General Privacy Policy and in our Data Subject Rights Procedures (DELTA-DSR-001).

2. What Is Consumer Health Data?

For purposes of this Policy and Applicable State Laws, "Consumer Health Data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. This includes:

• individual health conditions, treatment, diseases, or diagnoses;
• social, psychological, behavioural, and medical interventions;
• health-related surgeries or procedures;
• use or purchase of prescribed medication;
• bodily functions, vital signs, symptoms;
• diagnoses or diagnostic testing, treatment, or medication;
• gender-affirming care information;
• reproductive or sexual health information;
• biometric data used to identify or diagnose a health condition or a mental health condition;
• precise geolocation data that could reasonably indicate a consumer's attempt to acquire health care services or supplies;
• any information that Delta processes to associate or identify a consumer with the above data that is derived or extrapolated from non-health information (such as proxy, derivative, inferred, or emergent data produced by algorithms or AI).

The last category above is particularly significant for the App: because Delta's AI analyses multiple data inputs simultaneously to generate personalised recommendations, outputs and inferences derived by the AI from user data can themselves qualify as Consumer Health Data even if the underlying inputs were not individually health-related.

3. Categories of Consumer Health Data We Collect

The following categories of Consumer Health Data may be collected by the App. All collection is voluntary. Providing this data is not required to create an account, but improves the accuracy and personalisation of AI-generated plans.

Data categories not listed above — including email address, name, device information, and usage analytics — are personal information but do not constitute Consumer Health Data under Applicable State Laws. They are covered by the General Privacy Policy (DELTA-PP-001).

4. Sources of Consumer Health Data

Delta collects Consumer Health Data from the following sources:

5. How We Use Consumer Health Data

Delta collects and uses Consumer Health Data solely for the following purposes. We do not use Consumer Health Data for any purpose not listed below without first obtaining your separate, specific consent.

6. Consent — Affirmative Opt-In Required

Under MHMDA (RCW 19.373.030) and SB 370 (Sec. 18), Delta may not collect or use Consumer Health Data without your prior, affirmative opt-in consent. Under GDPR Article 9(2)(a), Delta requires explicit consent before processing Special Category health data.

Delta implements consent as follows:

7. Sharing and Disclosure of Consumer Health Data

Delta shares Consumer Health Data only in the limited circumstances described below. We do not sell Consumer Health Data. We do not share Consumer Health Data with third parties for their own commercial purposes.

In all sharing scenarios above, Delta does not share Consumer Health Data with: advertising networks, data brokers, supplement vendors, commercial partners for promotional purposes, or any third party for their own independent commercial use.

8. AI Processing Disclosure

All Consumer Health Data processed under this Policy is analysed exclusively by automated AI systems. No human professional (doctor, dietitian, trainer, pharmacist, or other specialist) reviews, supervises, or validates the processing of your Consumer Health Data or the recommendations generated from it. This is consistent with the disclosures in our AI Disclosure Statement (DELTA-AID-001) and Terms of Service (DELTA-TOS-001).

This automated processing constitutes automated decision-making within the meaning of GDPR Article 22. Delta's position is that the AI does not make legally significant or consequential decisions about healthcare access, eligibility, or treatment. You have the right to receive meaningful information about the logic involved in AI processing and to contest AI-generated outputs. Contact privacy@aiadvisor.fitness with any query.

9. Data Security

Delta implements appropriate technical and organisational security measures to protect Consumer Health Data, consistent with MHMDA RCW 19.373.050, GDPR Article 32, and the standards described in our Information Security Policy (DELTA-ISP-001) and Access Control Policy (DELTA-ACP-001). These measures include:

• Encryption of Consumer Health Data at rest (AES-256) and in transit (TLS 1.2 or higher);
• Separate encrypted storage for the most sensitive data categories (bloodwork, medications, laboratory results);
• Role-based access controls limiting staff access to Consumer Health Data on a need-to-know basis;
• Zero standing privileged access to production health data — all administrative access is time-limited and requires dual approval;
• Mandatory multi-factor authentication for all staff with any system access;
• Data Processing Agreements with all processors that access Consumer Health Data;
• Pre-deployment review of all third-party SDKs and pixels to confirm no unauthorised access to Consumer Health Data.

In the event of a breach of Consumer Health Data, Delta will notify affected individuals and regulators in accordance with applicable law, including MHMDA, the FTC Health Breach Notification Rule, GDPR Article 33/34, and Delta's Incident Response Plan (DELTA-IRP-001) and FTC HBNR Compliance Procedure (DELTA-HBNR-001).

10. Your Rights Regarding Consumer Health Data

Subject to applicable law, you have the following rights in relation to your Consumer Health Data. These rights apply to Washington and Nevada residents under MHMDA and SB 370 respectively, and to all users under GDPR where applicable. Full procedures are set out in DELTA-DSR-001.

To exercise any of the above rights, use one of the following channels:

• In-App: Menu 'More' → Profile → Legal and Privacy → Data Subject Access Request (recommended — identity verified by existing authentication);
• Email: privacy@aiadvisor.fitness;
• Post: Delta Auxilium Sp. z o.o., Ul. Bonarka 19/5, Kraków, Malopolskie, 30-415, Poland, Attn: Privacy Team.

Response timeline: Delta will respond to verified requests within 45 days (MHMDA / SB 370 standard; may be extended by a further 45 days with notice) or within 30 days (GDPR standard; may be extended by up to 2 additional months for complex requests). Full procedures are in DELTA-DSR-001.

11. Appeals

If Delta declines to act on your rights request, in whole or in part, you may submit an appeal within 30 days of receiving our response. Submit your appeal to:

Delta will respond to your appeal in writing within 45 days, explaining the basis for any continued denial and your further options. If your appeal is not resolved to your satisfaction, you may escalate to:

• Washington State: Washington State Attorney General — https://ago.wa.gov • data.breach@atg.wa.gov;
• Nevada: Nevada Attorney General — https://ag.nv.gov;
• All US states: FTC Consumer Response Center — https://reportbreaches.ftc.gov;
• EU/EEA users: UODO (Polish data protection authority) — https://uodo.gov.pl • kancelaria@uodo.gov.pl, or the supervisory authority in your EU country of habitual residence.

12. Retention of Consumer Health Data

Delta retains Consumer Health Data for as long as your account is active and for a period necessary to fulfil the purposes described in this Policy. Specifically:

13. Children

The App is exclusively for users aged 18 and over. Delta does not knowingly collect Consumer Health Data from individuals under 18. If you believe a person under 18 has submitted Consumer Health Data to the App, please notify us immediately at privacy@aiadvisor.fitness, and we will delete such data promptly.

14. Updates to This Policy

Delta may update this Policy from time to time to reflect changes in our data practices, applicable law, or regulatory guidance. Any changes will be reflected by publishing an updated version within the App and on our website, together with a revised effective date and a clear summary of material changes.

Where changes are material — including any expansion of the categories of Consumer Health Data collected, any new third-party sharing, or any change to how consent is obtained — Delta will provide advance notice of at least 30 days through the App or by email before changes take effect, and will obtain fresh consent where required by law. If you do not agree with the updated Policy, you may withdraw your consent and delete your account as described in Sections 6 and 10.

15. Contact Us