Consumer Health Data Privacy Policy

Through the waitlist form and the pages that lead to it, we collect:

• The condition you tell us about, if you choose to enter one. This field is optional, and you can join the waitlist without it.
• Your email address, together with the fact that you asked to be told when clinical trial matching opens.
• How you reached the Site, meaning the campaign label in the link that brought you here, which identifies the page or advertisement. Where that page or advertisement relates to a specific condition, we treat that as consumer health data.
• Information about your visit, such as your IP address, general location derived from it, and the pages you view. Where those pages relate to a specific condition, this can show that you are seeking information about that condition, and we treat it as consumer health data.

We do not ask for your medical records, test results, genetic information, medications, or precise location through the waitlist form.

We collect it from you, or from someone legally authorized to act on your behalf, and automatically from your browser when you visit the Site, including through our analytics provider acting on our behalf. We do not buy it or obtain it from other companies.

We use it to:

• email you when clinical trial matching opens;
• tell you about trials that may be relevant to the condition you entered, if you entered one;
• respond to you if you contact us;
• keep the Site secure and prevent fraud and abuse;
• understand which of our pages and advertisements bring people to the Site and how the Site is used, which we review in aggregate or at the campaign level; and
• comply with law and legal process and protect our rights and the rights of others.

Categories we share. We share your email address, the fact that you joined the waitlist, how you reached the Site, information about your visit, and, if you entered one, the condition you gave us, with our service providers (such as our hosting, database, analytics, and email delivery providers) as needed to operate the waitlist.

Categories of third parties. We may share consumer health data with:

• Service providers, which act on our behalf under contracts restricting their use of the data, such as website hosting, database, analytics, and email delivery providers.
• Professional advisors, such as lawyers and auditors, under duties of confidentiality.
• Government authorities, courts, and law enforcement, when required by law.
• A successor or acquirer in a merger, acquisition, or similar transaction, subject to this Policy.
• Anyone else you direct us to share it with.

Affiliates. We have no affiliates.

We ask for your consent separately before we collect the condition you enter, and before we save with your sign-up a campaign label that relates to a specific condition. Accepting our Terms of Use or Privacy Policy is not that consent.

You may withdraw your consent at any time by contacting us as described in “How to exercise your rights,” below. You can also unsubscribe from our emails at any time using the link in each email.

Subject to applicable law, you have the following rights:

• Confirm and access. You can ask whether we collect, share, or sell your consumer health data, and request a copy of it.
• Recipient list. You can request a list of the third parties and affiliates with whom we have shared or sold your consumer health data, together with an email address or other online contact for each.
• Withdraw consent. You can withdraw your consent to our collection and sharing of your consumer health data.
• Deletion. You can ask us to delete your consumer health data, including from archived and backup systems. We will also notify the service providers and third parties with whom we shared it of your request.
• Correction. You can ask us to correct your consumer health data.
• Appeal. You can appeal our decision on your request, as described below.

Nondiscrimination. We will not discriminate against you for exercising these rights.

Making a request. Email us at privacy@saturnhealth.com with the subject line “Consumer Health Data Request.”

Verification. We will take reasonable steps to verify your identity before acting on a request, such as by sending a confirmation link to the email address you signed up with. If you are acting on behalf of someone else, we may ask for proof of your authority.

Timing. We will respond within 45 days of receiving your request. If we need more time, we may extend that period once by up to 45 additional days and will tell you why. Where deleted data is stored on archived or backup systems, deletion from those systems may be delayed as permitted by law, but not by more than six months. We do not charge a fee to respond to a request, unless applicable law allows otherwise.

Appeals. If we decline to take action on your request, you can appeal by replying to our decision or by emailing privacy@saturnhealth.com with the subject line “Consumer Health Data Appeal.” We will respond in writing within 45 days, explaining any action taken or not taken and the reasons. If your appeal is denied, you may contact the Washington State Attorney General (atg.wa.gov), the Nevada Attorney General (ag.nv.gov), or the Connecticut Attorney General (portal.ct.gov/ag).

Sale. We do not sell consumer health data. De-identified and aggregated data is not consumer health data under these laws, and this Policy does not apply to it.

Third-party tracking. We do not allow third parties to collect consumer health data about your online activities over time and across different websites or online services when you use the Site. If we do, we will update this Policy before we start and ask for your consent where the law requires it.

Analytics. We may use a third-party analytics provider to understand how visitors use the Site. The analytics provider processes this information only on our behalf, as our processor under a written contract, and may not use it for its own purposes or combine it with information from other websites. We configure it so that it does not receive the condition you enter on the waitlist form or any campaign label or page address that identifies a health condition.

Advertising. We do not use advertising pixels or other advertising technologies on the Site. We advertise on third-party platforms, such as Meta, which report aggregate ad performance to us. We do not share consumer health data with those platforms.

We will post any update to this Policy on this page with a new effective date, and we will notify you by email of any material change. Before we collect additional categories of consumer health data, including when clinical trial matching opens, or use or share it for purposes not described in this Policy, we will ask for your consent where the law requires it.

If you have questions about this Policy, or would like to exercise any of the rights described above, please contact us:

Email: privacy@saturnhealth.com