Ada Health, Inc. Consumer Health Data Privacy Policy

Ada Health, Inc. (“Ada”), its parent company, Ada Health GmbH, and affiliates are committed to processing, using, transferring, and managing personal information in accordance with applicable privacy laws and this Policy. This Consumer Health Data Privacy Policy (“Policy”) details how Ada collects, uses, transfers, and shares your “Consumer Health Data” as defined by the Washington My Health My Data Act (“MHMDA”), the Nevada Consumer Health Data Privacy Act (“NCHDPA”), the Connecticut Data Privacy Act (“CDPA”) or other US health privacy laws. This Policy amends Ada’s general Privacy Policy.

This Policy applies to the Consumer Health Data we obtain when you interact with Ada using our digital health and symptom assessment (“Ada Assess”) and other online services or otherwise connect with us (collectively, the “Services”). Please note that Ada’s COVID-19 Risk Severity and Authorized Oral Antiviral Potential Eligibility Questionnaire is subject to a dedicated Privacy Policy that can be found here.

In this Policy, "we", "us" and "our" refers to Ada, and "you" refers to any individual about whom we collect personal information.

1. Categories of Consumer Health Data we collect

Ada’s services are medical in nature and rely on you providing us with your Consumer Health Data. When you use our Services, we will collect the following categories of Consumer Health Data when you engage with us.

• Information about your health that you provide when using our Services, e.g. description of your symptoms, allergies, medication, medical and surgical history, etc.
• Information about your health that you provide when you give us feedback, issue a complaint, or get in touch with us for any other reason
• Information about your physical condition (e.g. height, weight, age)
• Information about risk factors concerning your health (smoking, diabetes, pregnancy status, hypertension, etc.)
• Information about your health that we generate based on your input, e.g. likely causes for your symptoms, risk status, treatment eligibility status, medical advice, etc.
• Any additional information relating to you that you provide to us directly through our Services or by other means such as over the phone, via email, or in person
• Information you provide to us via voluntary feedback or surveys

2. What are the Categories of Sources from which we collect Consumer Health Data

We only collect Consumer Health Data directly from you through our Services. Based on your input, we will generate additional Consumer Health Data such as likely causes for your symptoms, your risk or treatment eligibility status or other information about your past, present or future physical or mental health status.

3. For which purposes do we collect your Consumer Health Data

Ada collects and uses Consumer Health Data for the following purposes

• To provide you with the Services that you request;
• To contact you in order to follow up with you about your use of our Services or provide you with relevant updates about your health assessment;
• To ensure that our Services are functioning and safe to use;
• For quality control and administration and assisting us to develop new and improved products and Services;
• To comply with any requirement of any applicable statute, regulation, rule, and/or good practice;
• To respond to your requests, questions, complaints, and other general inquiries;
• To contact you if additional information is needed to perform the assessment requested by you or if your assessment presents anomalous results;
• Researching, developing and expanding our Services;
• Uses made at your direction and with your consent;
• To prevent or detect abuse of our Services or any of our rights (and attempts to do so), and to enforce or apply this Policy and/or any other agreement, and to protect our (or others') property or rights.

4. Which Categories of Consumer Health Data do we share?

We do not share your Consumer Health Data. We will make your Consumer Health Data available to our service providers acting as processors to Ada for the purposes listed above. This includes Ada’s parent company Ada Health GmbH and other Ada affiliates. All our service providers have signed a data processing agreement ensuring processing occurs only according to Ada’s instructions.

We reserve the right to disclose your personal information as required by law, when we believe disclosure is necessary or appropriate to comply with a regulatory requirement, judicial proceeding, court order, government request, or legal process served on us, or to protect the safety, rights, or property of our customers, the public, us or others.

We reserve the right to transfer the information we maintain in the event we sell or transfer all or a portion of our business or assets. If we engage in such a sale or transfer, we will make reasonable efforts to direct the recipient to use your Consumer Health Data in a manner that is consistent with this Policy. After such a sale or transfer, you may contact the recipient with any inquiries concerning the recipient’s privacy practices.

5. How to exercise your rights regarding your Consumer Health Data

As a resident of Washington, Nevada, Connecticut or any other state whose health data privacy laws apply to Ada’s services, you may have certain rights regarding the processing of your Consumer Health Data:

• The right to confirm whether Ada is collecting, sharing, or selling your consumer health data, and to access this data, including a list of all third parties and affiliates with whom Ada has shared or sold the consumer health data and a contact to these third parties (email or other),
• The right to withdraw consent from the collection, sharing and selling of your consumer health data (where applicable),
• The right to have your Consumer health data deleted.

You can exercise your rights by contacting us via email at [email protected].

When you exercise these rights and submit a request to us, we will verify your identity by asking you to authenticate your identity via standard authentication procedures. For example, we may ask for your email address, full name, etc. We also may use a third-party verification provider to verify your identity. Please note that Services that do not require registration Ada might not be able to identify and authenticate individual users. In these cases, Ada is neither able nor required under the law to accommodate your request to exercise the rights as described above.

In case of a refusal to exercise your rights, you can appeal that decision via email at [email protected]. If your appeal is unsuccessful, you can file a complaint with the relevant government body in your state, including:

• Washington State Attorney General at https://www.atg.wa.gov/file-complaint.
• Nevada State Attorney General at https://ag.nv.gov/Complaints/CSU_Complaints___FAQ/.

6. Updates to this Policy

Ada may amend this Policy from time to time, with or without notice to you. We recommend that you visit our Services regularly to keep up to date with any changes. We also try to let you know about major changes to this Policy (for example by putting a notice up on our website).

7. Contact us

The contact details for Ada are as follows:

E: [email protected]
Postal: Ada Health, Inc., The Flamingo House, 33 SE 4th Street, Suite 100, Boca Raton, 33432 Florida, USA