Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy supplements our main Privacy Policy and applies specifically to the "consumer health data" that Algorithm Overland LLC ("we", "us", "our") collects through AO:Coach — Trail Fit Trainer. It is provided to meet the requirements of Washington's My Health My Data Act (MHMDA), Nevada's SB 370, and comparable consumer-health privacy laws.

In short: AO:Coach collects fitness and biometric data only with your consent, uses it solely to power your training features, never sells it, and never shares it for advertising. You can withdraw consent and delete your data at any time.

"Consumer health data" means personal information that identifies your past, present, or future physical or mental health status. This policy governs such data collected through AO:Coach. Data collected by our website and other apps is governed by our general Privacy Policy. Where the two overlap, this policy controls for consumer health data.

To provide AO:Coach's training features, we may collect:

• Biometrics Heart rate and related cardiovascular readings.
• Activity Running pace, distance, duration, interval and workout performance, and other exercise metrics.
• Conditioning Fitness level, training history, progress, and recovery indicators derived from the above.
• Your inputs Goals, fitness self-assessments, and preferences you choose to enter.

We collect only the data needed to operate the features you use. We do not collect consumer health data for advertising.

We collect consumer health data directly from you — from information you enter and from your device's motion and health sensors while you use AO:Coach, subject to the permissions you grant on your device. We do not purchase consumer health data or obtain it from data brokers.

We use your consumer health data solely to:

• Deliver Generate personalised conditioning programs, workouts, and progress reports.
• Adapt Tailor training recommendations to your fitness level and activity.
• Operate Maintain, secure, and troubleshoot the app and your account.

We do not use consumer health data for targeted advertising, to profile you for unrelated purposes, or to train third-party machine-learning models.

We do not sell your consumer health data, and we do not share it with third parties for their own purposes or for advertising. We share it only with service providers ("processors") who host, store, or process data on our behalf and under written contract that limits them to providing services to us and prohibits any other use.

The categories of recipients are:

• Infrastructure Cloud hosting and database providers that securely store the data.
• Legal Government or law-enforcement bodies, only where required by law and to the minimum extent necessary.

We do not share consumer health data with any affiliate or third party for cross-context behavioral advertising. Any transfer for a purpose beyond those listed here would occur only with your separate, valid authorization.

We will never sell your consumer health data. Consistent with the MHMDA, we will not sell or offer to sell any consumer health data without first obtaining your valid written authorization that meets the law's requirements. We have no current plans to seek such authorization.

Regardless of where you live, you may:

• Access Confirm whether we are collecting or sharing your consumer health data and request a copy, including a list of any third parties with whom it has been shared.
• Withdraw Withdraw your consent to our collection and sharing at any time.
• Delete Request deletion of your consumer health data. On a valid request we will delete it from our active systems and direct our processors to do the same, within 30 days.
• Appeal If we decline a request, you may appeal by replying to our decision; we will respond within 45 days. Washington residents may also file a complaint with the Washington State Attorney General.

We will not deny you goods or services, or charge a different price, for exercising these rights. To make a request, use the contact details below; we may need to verify your identity before acting.

Consent. We collect and process consumer health data only after you grant the relevant device permissions and consent within AO:Coach, and we obtain separate consent before any sharing beyond what is necessary to provide a feature you have requested.

Security. Consumer health data is encrypted in transit and at rest, access is restricted to personnel who need it to operate the service, and it is logically separated where practicable.

Retention. We retain consumer health data only for as long as needed to provide AO:Coach or as required by law, and we delete it on request or when your account is closed. If AO:Coach is discontinued, associated health data is deleted from our active infrastructure, with advance notice where operationally feasible.

To exercise any right, withdraw consent, or ask about this policy, contact our privacy team: