Consumer Health Data Privacy Policy

Supernatural Health LLC

Effective date: October 21, 2026

1. Who this policy covers

This policy applies to you if you are a resident of Washington or Nevada, or if your consumer health data is collected in Washington or Nevada. It describes how Supernatural Health LLC (“Supernatural,” “we,” “us”) collects, uses, shares, and protects consumer health data, and the rights you have over it, under the Washington My Health My Data Act and the Nevada consumer health data privacy law (SB 370).

This policy supplements our Privacy Policy. For consumer health data, if the two documents conflict, this policy controls.

2. What consumer health data means

Consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. It does not include information that cannot reasonably be linked to you or your device, or information that we have de-identified.

Most of what we collect is not consumer health data. Your account details, which workouts you completed, your points, your streaks, your start date, and your Founding Member status identify your activity in Supernatural, not your health. This policy covers the narrower set of information described in section 3.

3. Consumer health data we collect

Depending on how you use Supernatural, we may collect the following categories of consumer health data:

• Body measurements you give us. Weight, height, age, and sex, if you choose to provide them so we can estimate calories burned.
• Exercise measurements. Estimated calories burned and workout intensity derived from your movement during a workout.
• Health-related settings. Accessibility, seated, adaptive, or intensity settings you select, to the extent they could indicate a physical limitation or condition.
• Information you choose to tell us. Information about an injury, condition, pregnancy, disability, or other health matter that you include in a support email, a survey response, a community post you direct to us, or a conversation with a coach.
• Inferences. A performance score we derive from your workout data.

We do not collect genetic data, biometric data used to identify you, reproductive or sexual health information, gender-affirming care information, or precise location information. We check the country you are connecting from, based on your IP address, to enforce regional availability; we do not use it to learn anything about your health, and we do not use geofencing around any physical location. Hand and eye tracking in the headset are used to control the experience and are not retained in a form that identifies you.

4. Where consumer health data comes from

• You, when you enter information in the app or on our website, write to us, answer a survey, or talk with a coach.
• Your devices, including the headset you use.
• Our service providers, which process data on our behalf and on our instructions (for example, our hosting and analytics providers), and which may generate derived measurements for us.

We do not receive consumer health data from Meta Platforms. Meta operates the Horizon Store and the headset under its own privacy policy, and what we receive from Meta is limited to your account identifier and store entitlement.

5. How we use consumer health data

We collect consumer health data only to the extent necessary to provide the products and services you have requested, or with your consent.

We use it to:

• Provide and operate the workouts, meditations, and features you use, including estimating calories burned, adapting a workout to the intensity or accessibility settings you choose, and showing you your own results.
• Respond to your support requests and to things you tell us.
• Keep the service safe and secure, and prevent fraud and abuse.
• Comply with law and enforce our terms.
• Improve the service using data that has been de-identified or aggregated so that it cannot reasonably be linked to you.

We do not use consumer health data for advertising, and we do not sell it.

6. Who we share consumer health data with

We do not share consumer health data with third parties, except in the following limited situations:

• Service providers (processors) that act on our behalf and under a written contract that restricts how they use the data. The categories are: cloud hosting and database services, product analytics, customer support and email services, and video and content delivery. These providers may not use consumer health data for their own purposes.
• Legal requirements, such as responding to a subpoena, court order, or lawful request from a public authority, or to protect the safety of a person.
• Business transfers, if Supernatural is involved in a merger, acquisition, financing, or sale of assets, in which case we will give you notice before your data becomes subject to a different policy.
• With your separate consent, for any other purpose, which you can withdraw at any time.

Affiliates. Supernatural Health LLC has no affiliates with which it shares consumer health data.

Other members. Nothing you see in Supernatural about other members, and nothing they see about you, includes consumer health data unless you choose to share it yourself.

You may request a list of the specific third parties and affiliates with which we have shared your consumer health data, together with a contact for each, by using the request process in section 8.

7. Consent

We will not collect consumer health data beyond what is necessary to provide the product or service you requested without first getting your clear, affirmative consent, and we will not share it without a separate consent. Consent is never obtained through our Terms of Use or Privacy Policy on their own, through a pre-checked box, or by a design that pushes you toward agreeing. You can withdraw consent at any time using the process in section 8, and withdrawing consent will not affect the lawfulness of what we did before you withdrew it.

8. Your rights and how to exercise them

You have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data, and to access that data.
• Receive a list of the third parties and affiliates with which we have shared or sold your consumer health data, with an email address or other online contact for each.
• Withdraw consent to our collection and sharing of your consumer health data.
• Delete your consumer health data. When you ask us to delete, we will delete it from our records, including archived and backup systems, and we will instruct our service providers and any third party we shared it with to delete it too.

How to make a request. Email support@wearesupernatural.comwith the subject line “Consumer Health Data Request,” or write to us at the address in section 11. Tell us which right you want to exercise and the email address on your Supernatural account. We will take reasonable steps to verify that the request comes from you, and we may ask for more information to do that. You may use an authorized agent if the agent can show us you authorized them.

Timing and cost. We will respond within 45 days of receiving your request. If we need more time, we will tell you within that period and may take up to 45 additional days. Requests are free up to twice in a 12-month period; for requests beyond that, we may charge a reasonable fee or decline requests that are manifestly unfounded, excessive, or repetitive.

Appeals. If we decline your request, we will tell you why and how to appeal. You can appeal by replying to our decision or by emailing support@wearesupernatural.comwith the subject line “Consumer Health Data Appeal.” We will respond within 45 days with the outcome and the reasons. If your appeal is denied, you may contact the Washington State Attorney General or the Nevada Attorney General.

No discrimination. We will not deny you service, charge you a different price, or provide a lower quality of service because you exercised a right under this policy.

9. Security and retention

We restrict access to consumer health data to employees, contractors, and service providers who need it to deliver the services described above, and we use technical and organizational safeguards appropriate to the data. We keep consumer health data for as long as needed to provide the services you use, and we delete it when you delete your account or make a deletion request, subject to legal retention obligations.

10. Changes to this policy

We will notify you before we make material changes to this policy, and we will give you a chance to review the revised policy before it applies to you. We will post the current version at wearesupernatural.com/consumer-health-privacy with its effective date.

11. Contact us