Nevada Consumer Health Data Privacy Policy

• Directly from you through Zoya’s website, questionnaires, account registration, checkout, patient-facing interfaces, support channels, communications, and uploads.

• From the independent professional medical entity and licensed Provider responsible for your care.

• From the dispensing Pharmacy, pharmacy-network or fulfillment administrator, laboratory, shipping carrier, and other parties involved in the requested product or service.

• From processors and service providers supporting technology, hosting, identity, payment, communications, security, analytics, and related operations on Zoya’s behalf.

• From information generated through the requested service, including transaction, fulfillment, security, and health-service inferences.

Zoya may share the categories described in Section 1, to the extent necessary to provide the product or service requested, with affirmative voluntary consent where required, or as otherwise permitted by law, with:

• Independent professional medical entities and licensed Providers.

• Independent licensed Pharmacies, pharmacy-network or fulfillment administrators, and laboratories.

• Payment processors and financial institutions for transaction processing, settlement, refunds, fraud prevention, and disputes.

• Identity-verification, communications, customer-support, and shipping providers.

• Professional advisers, auditors, insurers, and governmental, legal, public-health, or safety recipients when required or permitted by law.

Zoya currently has no corporate affiliate that is separately authorized by this policy to use consumer health data for the affiliate’s own purposes. Processors acting under Zoya’s written instructions may process consumer health data only as authorized by their contracts and applicable law.

Zoya collects and shares consumer health data only with affirmative, voluntary consent where required, to the extent necessary to provide a product or service requested by the consumer, or as otherwise authorized by law. A request for consent will describe the categories involved, the purpose and manner of use, the categories of recipients where applicable, and how consent may be withdrawn. Consent to sharing is separate and distinct from consent to collection when Nevada law requires separate consent.

Zoya does not sell consumer health data. Zoya will not sell or offer to sell consumer health data without first obtaining the separate written authorization required by Nevada law, and will not condition a product or service on such authorization.

Zoya does not authorize a third party to collect consumer health data over time and across unrelated websites or online services through Zoya’s clinical intake, health-information checkout fields, or authenticated patient portal for advertising, profiling, or marketing. Public marketing pages may use analytics or campaign-measurement technologies that collect online identifiers and browsing activity; those technologies are not authorized to receive clinical questionnaire responses, prescription details, Provider communications, or patient-portal content.

A Nevada consumer may, subject to applicable exceptions and authentication: (a) confirm whether Zoya is collecting, sharing, or selling consumer health data concerning the consumer; (b) receive a list of all third parties with whom Zoya shared that data or to whom Zoya sold it; (c) review and request correction of inaccurate consumer health data maintained by Zoya; (d) withdraw consent and request that consent-based collection, sharing, or sale cease; and (e) request deletion. Account and contact information may be reviewed or corrected through the account when that functionality is available; other corrections and all statutory requests may be submitted using the method below.

Email Hello@JoinZoya.com with the subject line “NEVADA CONSUMER HEALTH DATA REQUEST.” Do not send detailed medical information in ordinary email. Zoya may request information reasonably necessary to authenticate the requester and the request. Zoya will respond without undue delay and not later than 45 days after authenticating the request, subject to one additional extension of up to 45 days where reasonably necessary and accompanied by timely notice. For an authenticated deletion request, Zoya will delete covered data and notify applicable affiliates, processors, contractors, and other third parties within 30 days as required by Nevada law. Data stored or archived on backup systems may be retained only for the restoration period permitted by law, currently not more than two years after authentication of the request, and may not be used for another purpose during that delay except as permitted by law.

If Zoya refuses to act on a request, the consumer may appeal by emailing Hello@JoinZoya.com with the subject line “NEVADA CONSUMER HEALTH DATA APPEAL.” Zoya will provide a written response within 45 days after receiving the appeal. If the appeal is denied, the response will provide a method to contact the Nevada Attorney General, where applicable.

If Zoya makes a material change to this policy, it will provide notice to affected Nevada consumers through the website, account, email, or another reasonably appropriate channel before applying the change where required. Zoya will disclose and obtain affirmative, voluntary consent before collecting, using, or sharing additional categories of consumer health data, sharing with additional third parties or affiliates, or using data for additional purposes when Nevada law requires consent.

Effective date: August 12, 2026. Zoya Health LLC | 2108 N Street, Suite N, Sacramento, California 95816 | Hello@JoinZoya.com | (818) 823-8178 | joinzoya.com