Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy supplements our Privacy Policy and applies to "consumer health data" as defined by the Washington My Health My Data Act and similar laws (including Nevada SB 370). It applies to Washington and Nevada residents and to data collected in those states.

1. Consumer Health Data We Collect

In operating a wellness marketplace, we may collect data that could identify your past, present, or future health status, including:

• Booking data for wellness services: the type of wellness space you book or search for (e.g., sauna, cold plunge, float tank, halotherapy, hyperbaric, PEMF), session dates, and frequency of use
• Messages and support requests in which you choose to share health-related information (e.g., describing a health condition to a Host, or reporting an injury)
• Incident reports you submit, which may include injury type, severity, and whether medical attention was sought
• Reviews in which you choose to include health-related information

We do not collect diagnoses, medical records, or biometric identifiers, and we do not use geofencing around health care facilities.

2. Why We Collect and Use It

We collect and use consumer health data only to:

• Provide the services you request (process bookings, facilitate sessions, send confirmations and access codes)
• Facilitate communication between you and Hosts/Guests for a booking
• Respond to your support requests and resolve disputes
• Investigate and document safety incidents
• Comply with legal obligations and protect the safety of users

3. Sources of Consumer Health Data

We collect consumer health data directly from you (bookings, searches, messages, reports, reviews) and generate it through your use of the platform (booking history).

4. Sharing of Consumer Health Data

We share consumer health data only:

• With your Host or Guest as necessary to complete a booking you initiated
• With service providers acting on our behalf under contracts restricting their use of the data (payment processing, hosting, database, email delivery)
• With your consent
• As required by law or to protect safety

We do not sell consumer health data. We do not share the wellness-service type associated with your bookings with advertising platforms.

5. Your Rights

Washington and Nevada residents have the right to:

• Access the consumer health data we hold about you, including a list of third parties with whom we have shared it
• Withdraw consent to collection or sharing
• Delete your consumer health data

To exercise these rights, contact us at hello@usethrml.com or submit a request through our privacy request form at usethrml.com/privacy-request. We will respond within the timeframes required by law. If we deny your request, you may appeal by replying to our response with "Appeal" in the subject line; if your appeal is denied, you may contact the Washington Attorney General at www.atg.wa.gov.

6. Changes

We will notify you of material changes to this policy by email or platform notice before they take effect.

7. Contact

thrml LLC — hello@usethrml.com — usethrml.com/privacy-request