Consumer Health Data Privacy Policy

OVERVIEW

GUUD AG and GUUD USA LLC (collectively, “GUUD,” “we,” or “our”) recognizes the importance of protecting the privacy of information we collect from you. GUUD is committed to respecting your privacy and protecting your personal information.

This Consumer Health Data Privacy Policy (“Policy”) applies to personal data defined as Consumer Health Data under the Washington State My Health My Data Act, the Nevada Security and Privacy of Consumer Health Data Statute, and the Connecticut Data Privacy and Online Monitoring Act (“Consumer Health Data Acts”) that is collected from you by GUUD. This Policy will be amended as needed if additional state consumer privacy laws are enacted. This Policy supplements the GUUD Privacy Policy. In the event of a conflict between any other policy, statement, or notice and this Policy, this Policy will prevail as to Consumer Health Data collected under the Consumer Health Data Acts. For purposes of this Policy, unless otherwise noted, all references to GUUD include the GUUD website, www.guud.app, and its subdomains, GUUD’s divisions and affiliated entities, and other interactions with GUUD through which Consumer Health Data may be collected.

Consumer Health Data under the Consumer Health Data Acts means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. This Policy does not apply where an exception or exemption applies, such as information regulated by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, and others. Not all of the data GUUD collects and uses is data subject to the Consumer Health Data Acts, because the data may not qualify as Consumer Health Data, or the data may be subject to other privacy laws. See our Privacy Policy and other privacy notices that provide disclosures about personal information that is not Consumer Health Data subject to the Consumer Health Data Acts.

WHAT CONSUMER HEALTH DATA DO WE COLLECT?

As described in the GUUD Privacy Policy, personal data we collect depends on the context of your interactions with GUUD, the choices you make, the tools and features you use, your location, and applicable law. Consumer Health Data is broadly defined and some of the categories of data we collect would be Consumer Health Data if it otherwise does not qualify for an exception or exemption.

We may collect the following categories of personal information, which may be Consumer Health Data if not excluded from the Consumer Health Data Acts:

Information you voluntarily provide us:

- Account Registration: First and last name, date of birth, gender, physical aspects (eye color, skin color, hair color, height, and weight), shipping country, email address, and phone number;
- Order Placement: Personal information when you place an order from us, such as first and last name, delivery address, postal code, email address, phone number, payment account or credit card information;
- Payment Information: payment card information, shipping and billing addresses, and phone numbers;
- Customer Support: when you engage with our support team and customer support providers, we may collect records, copies of your correspondence (including email addresses), or additional information you choose to share with us;
- Newsletter Sign-ups: You may choose to provide us your email address if you wish to receive promotional emails from us with news & exclusive offers.
- Health: You may choose to provide us information about your health-related conditions, symptoms, status, diagnoses, testing, or treatments including, but not limited to:
  - personal and familial health history;
  - use of prescribed medication or supplements;
  - reproductive health information;
  - allergies;
  - substance use;
  - dietary restrictions or intolerances;
  - measurements of bodily characteristics, including height and weight and genetic data;
  - bioimpedance data, including body composition data, such as body mass index, body fat percent, visceral fat percent, metabolic rate, protein percent, muscle percent, bone percent, water percent, body age; and
  - nature and degree of exercise or energy levels.

Information We Automatically Collect. To the extent permitted under the applicable law, we may automatically collect certain types of personal information about you when you use the GUUD website or interact with GUUD services.
- Usage Data. When you browse the GUUD websites, we automatically collect data such as Internet or Network Activity Information essential to running our website such as Internet Protocol (“IP”) address, browser type, domain names, referring and exit pages and URLs, pages viewed and the order of these page views, the date and time you access our servers, and other diagnostic data which could identify your attempt to seek information on our products, including services that allow you to assess or improve, or learn about your or another person’s health.
- Device Information. When you use your desktop or mobile devices to access our services, we may be able to identify your device’s unique device identifier, MAC address, operating system, and your mobile device’s advertising ID.
- Location Information. When you use our services, we may infer the generic physical location and geographic regions of your device from your Wi-Fi, Bluetooth and other device settings. For example, your IP address may indicate your general geographic region. You may choose not to share your location details with us by adjusting your mobile or desktop device’s location services settings. For instructions on changing the relevant settings, please contact your service provider or device manufacturer.
- Cookies and other tracking technologies such as web beacons: Information that may be collected by cookies when you use GUUD websites may include, without limitation: the pages you visit within the site; the date and time of your visit to the site; the amount of time you spend using the site; the IP address used to connect your computer to the Internet; and/or your computer and connection information such as your browser type and version, operating system and platform. We may place cookies from third-party service providers who may use information about your visits to other websites to target advertisements for products and services available from us. We do not control the types of information collected and stored by these third-party cookies. You should check the third-party’s website for more information on how they use cookies. For more information about cookies and related collection practices, review our Privacy Policy.

Additional categories of information we may collect:
- Commercial information such as records of products or services purchased, obtained, or considered by you, transaction records, and payment information;
- Other information that may be used to infer or derive data related to the above or other health information.

FROM WHAT SOURCES DO WE COLLECT CONSUMER HEALTH DATA?

GUUD does not collect your Consumer Health Data unless you voluntarily provide it to us. We collect personal information, including Consumer Health Data, from the following categories of sources:

Directly from you when you use our services, attend GUUD programs or events, engage with customer service, and any other way that you may be able to interact with us. With your permission, we may also collect Consumer Health Data from another source provided by you like your connected device or profile.
From GUUD affiliates and third-party service providers, including analytics providers. Certain third-party providers may process information on our behalf to support the Services.
From websites and mobile applications and automatically from devices you use to connect to our Services. For more information about this, please see our Privacy Policy, and any privacy policies and Terms of Use specific to individual mobile applications.

HOW DO WE USE YOUR CONSUMER HEALTH DATA?

To the extent we collect personal information, including Consumer Health Data, as described above, we may use it for the following purposes:

To provide you with information about the recommended supplements that you have requested or authorized,
Delivering the services and their features, including personalization of certain features,
Ensuring the secure and reliable operation of the services and the systems that support them including troubleshooting and improving the services,
Essential business operations that support the provision of the services such as analyzing our performance, meeting our legal obligations, developing our workforce, and conducting research and development,
For marketing and promotional purposes, such as sending marketing, advertising, and promotional communications by email, text messages or postal mail, and
Other purposes for which we give you choices or obtain your consent as required by law – for example, for advertising or marketing purposes.

Where we require your consent to collect personal information for a specified purpose, a description of those purposes is provided to you at the time of collection.

TO WHICH THIRD PARTIES DO WE SHARE YOUR DATA?

GUUD will only share your Consumer Health Data with employees and trusted partners and only for the services you have consented to or to the extent necessary to provide a product or service that you have requested or comply with applicable law. All such third parties are prohibited from using your Consumer Health Data except to provide these services to GUUD and they are required to maintain the confidentiality of your Consumer Health Data.

As necessary for the purposes described above, we may share personal information, including Consumer Health Data, with the following categories of third parties:

Subsidiaries. We enable access to data across our subsidiaries and related companies, for example, where we share common data systems or where access helps us to provide our services and operate our business.
Service providers. Vendors or agents (“processors”) working on our behalf may access Consumer Health Data for the purposes described above.
Government agencies. We disclose data to law enforcement or other government agencies when we believe doing so is necessary to comply with applicable law or respond to valid legal process.
Other third parties. In certain circumstances, it may be necessary to provide data to other third parties, for example, to comply with the law or to protect our rights or those of our customers.
Other users and individuals. If you use our services to interact with other users of the service or products or other recipients of communications, we will share data, including Consumer Health Data, as directed by you and your interactions.
The public. You may select options available through our services and products to publicly display and disclose certain information, such as an endorsement, demographic data, content and files, or other data, which may include Consumer Health Data.

HOW DO I EXERCISE MY RIGHTS UNDER THE ACT?

The Consumer Health Data Acts provide certain rights with respect to Consumer Health Data, including the right to access, delete, or withdraw consent relating to your Consumer Health Data, subject to certain exceptions. You also have the right to confirm collection, sharing, or selling of your Consumer Health Data. Further, in Washington State and Nevada, you have a right to request a list of all third parties to whom your Consumer Health Data is sold or shared, and in Washington State, that includes an email address for those third parties. You may exercise any of your rights by contacting us directly using the contact details found in this Policy. The written request should include sufficient information to verify your identity and specify the right(s) you wish to exercise. For any questions or assistance, you may also reach out using the contact information below. You have the right to receive a response to your request.

If your request to exercise a right under the Consumer Health Data Acts is denied, you may appeal that decision by contacting our legal team. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint, the Nevada Attorney General, or the Connecticut Attorney General.

CHANGES TO THIS POLICY

GUUD reserves the right to change this Policy from time to time. For example, when there are changes in our services, changes in our data protection practices, or changes in the law. When changes to this Policy are significant, we will inform you through this policy page.

This Consumer Health Data Policy is Effective as of January 01, 2026.

CONTACT INFORMATION

If you have any questions with respect to this Policy, or if you have notices or requests, they should be written and sent by email and: (i) personal service (which, for the purposes of this Policy, shall include courier/overnight delivery); or (ii) by certified mail to:

GUUD USA LLC – Attn: Legal Department

2595 N Dallas Pkwy, Suite 350 Frisco TX 75034

or email us: info@guud.app