Consumer Health Data Privacy Notice

Effective: October 6, 2026

What this Notice covers. Primary Diagnostics, Inc. d/b/a Primary.Health and the affiliates listed at the end of this Notice (“Primary,” “we,” “us”) provide this Notice to describe how we collect, use, and share consumer health data. “Consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status, as defined in Washington’s My Health My Data Act, Nevada’s consumer health data law, Connecticut’s consumer health data provisions, and similar state laws (“Consumer Health Data Laws”). This Notice supplements our Privacy Policy at https://www.primary.health/privacy-policy/ and controls over it with respect to consumer health data.

What it does not cover. This Notice does not apply to (a) protected health information governed by HIPAA, which is governed by our Notice of Privacy Practices (https://www.primary.health/privacy-practices-notice-of/) or, when we act on behalf of a health care provider, by that provider’s notice; (b) information we process on behalf of an employer, school, public health agency, or other organization, which is governed by that organization’s notices and our agreement with it; (c) de-identified information; or (d) other information that the Consumer Health Data Laws exempt.

CONSUMER HEALTH DATA WE COLLECT

Depending on how you use our services, we may collect the following categories of consumer health data:

• health conditions, symptoms, and treatments you report, and health-related survey responses;
• test orders and results, and immunization and vaccination information;
• prescriptions and the pharmacy you choose;
• reproductive or sexual health information, where you seek those services;
• information about the health services you seek or receive, such as appointments and locations;
• precise location information, if you allow our mobile application to collect it; and
• inferences we derive from the information above to provide the services you request.

Where we get it. We collect consumer health data from you; from your devices and your use of our services; from laboratories, pharmacies, immunization registries, and clinicians involved in your care; from organizations that sponsor your access to a program, where the law permits; and from service providers that act on our behalf.

HOW WE USE IT

We collect only the consumer health data necessary to provide the service you request, unless you consent to more. We use it to:

• provide the services you request, including scheduling, delivering test results, retrieving immunization records, providing telehealth, and sending transactional messages about them;
• communicate with you about your care and respond to your requests;
• secure our services, prevent fraud, and comply with law; and
• with your consent, for other purposes we describe when we ask.

We do not use consumer health data for advertising or marketing without your consent.

HOW WE SHARE IT

We share consumer health data only:

• with service providers that process it on our behalf under contracts that limit their use of it;
• with laboratories, pharmacies, immunization registries, clinicians, and public health authorities as needed to provide the service you request or as the law requires;
• with the organization through which you receive a program, as described when you enroll and with your consent;
• with the affiliates listed below, only to provide our services;
• at your direction;
• with a successor in a merger, acquisition, or similar transaction, subject to this Notice; and
• to comply with law, legal process, or a valid request from a government authority.

We do not sell consumer health data, and we would not do so without the separate, signed authorization that the Consumer Health Data Laws require. We do not use geofencing around facilities that provide in-person health care.

YOUR RIGHTS

Under the Consumer Health Data Laws, you may:

• Confirm and access. Confirm whether we collect, share, or sell your consumer health data and access it, including a list of the third parties and affiliates with whom we have shared it and how to contact them.
• Withdraw consent. Withdraw your consent to our collection or sharing of your consumer health data.
• Delete. Have your consumer health data deleted, including by our affiliates and service providers, subject to the exceptions the law allows.

To exercise these rights, visit our Privacy Center at https://privacy.primary.health, email privacy@primary.health, or call 1-855-970-3223. We will verify your identity, may accept requests from an authorized agent, and will respond within 45 days (we may extend once by 45 days with notice). We will not discriminate against you for exercising your rights. If we deny your request, you may appeal by replying to our response or by emailing privacy@primary.health with the subject line “Privacy Request Appeal.” If we deny your appeal, you may contact your state attorney general; Washington residents may contact the Washington Attorney General at www.atg.wa.gov.

CHANGES AND CONTACT

We may update this Notice. We will post the current version here, with its effective date, and will give you notice of material changes as described in our Privacy Policy.

Primary Diagnostics, Inc. d/b/a Primary.Health, Attn: Privacy Officer, 595 Pacific Ave, Floor 4, San Francisco, CA 94133 | privacy@primary.health | 1-855-970-3223 | https://privacy.primary.health

Affiliates covered by this Notice: Primary Diagnostics Medical Group P.A. d/b/a Primary.Health Medical.