Washington Consumer Health Data Privacy Policy

• Directly from you through Zoya’s public website, health questionnaires, account registration, checkout, patient-facing interfaces, support channels, communications, and uploaded materials.

• From the independent professional medical entity and licensed Provider responsible for your care.

• From the dispensing Pharmacy, pharmacy-network or fulfillment administrator, laboratory, shipping carrier, and other parties involved in the product or service you requested.

• From processors and service providers that support technology, hosting, identity verification, payment, communications, security, and related operations on Zoya’s behalf.

• From information generated through the requested service, including transaction, fulfillment, security, and health-service inferences.

• Health conditions, symptoms, medical history, medications, allergies, body measurements, treatment interests, and related information submitted for clinical evaluation.

• Information showing that you sought or received health care services or products, including prescription, refill, fulfillment, shipping, and support information.

• Health-related documents, photographs, laboratory information, and communications submitted for care or fulfillment.

• Identifiers, contact information, transaction information, and other data linked to the foregoing categories when reasonably necessary to provide the requested product or service, protect security, prevent fraud, or comply with law.

Zoya may share consumer health data, as “share” is defined by the Act, with the following categories of third parties to the extent necessary for the product or service you requested, with consent where required, or as otherwise permitted by law:

• Independent professional medical entities and licensed Providers that evaluate and treat patients.

• Independent licensed Pharmacies, pharmacy-network or fulfillment administrators, and laboratories.

• Payment processors and financial institutions, but only the information reasonably necessary to process, settle, refund, or protect a transaction.

• Identity-verification, communications, customer-support, and shipping providers where the disclosure constitutes sharing under the Act.

• Professional advisers, auditors, insurers, and governmental, legal, public-health, or safety recipients when required or permitted by law.

Zoya currently has no corporate affiliate that is separately authorized by this policy to receive consumer health data for the affiliate’s own purposes. Service providers acting solely as processors under Zoya’s instructions and a compliant processor contract are not treated as third parties to the extent the Act so provides.

Subject to applicable exceptions and authentication, a Washington consumer may: (a) confirm whether Zoya is collecting, sharing, or selling consumer health data concerning the consumer and access that data; (b) obtain a list of third parties and affiliates with whom it was shared or sold and an available contact mechanism for each; (c) withdraw consent to future collection or sharing where processing depends on consent; and (d) request deletion of consumer health data. A valid deletion request will be handled as required by the Act, including notice to applicable affiliates, processors, contractors, and other recipients and deletion from archived or backup systems within the statutory period.

Submit a request by emailing Hello@JoinZoya.com with the subject line “WASHINGTON CONSUMER HEALTH DATA REQUEST.” Do not send detailed medical information in ordinary email. Zoya may request information reasonably necessary to authenticate the requester and the request, but will not require a consumer to create a new account solely to exercise a right. Zoya will respond within the period required by the Act and will provide information free of charge up to the frequency required by law, subject to the Act’s rules for manifestly unfounded, excessive, or repetitive requests.

If Zoya refuses to act on a request, the consumer may appeal by emailing Hello@JoinZoya.com with the subject line “WASHINGTON CONSUMER HEALTH DATA APPEAL.” Zoya will provide a written response within the time required by the Act. If the appeal is denied, the response will provide an available method to contact the Washington Attorney General.

Zoya Health LLC | 2108 N Street, Suite N, Sacramento, California 95816 | Hello@JoinZoya.com | (818) 823-8178 | joinzoya.com