Qare Consumer Health Data Privacy Notice

This Consumer Health Data Privacy Notice (“Notice”) explains how Lōkahi Therapeutics Inc. (“we,” “us,” or “our”) collects, uses, discloses, and protects Consumer Health Data when you use the Qare mobile application (the “App”) or the Qare website (the “Website”), Qare-app.com (collectively, the “Services”).

This Notice is designed to be read together with, and to supplement, the Qare Privacy Policy. This Notice applies to Washington and Nevada consumers who interact with us in an individual or household capacity and applies only to personal information defined as “Consumer Health Data” subject to the Washington My Health My Data Act and the Nevada Consumer Health Data Act. As used in this Notice, the term “Consumer Health Data” refers to information that is linked or reasonably linkable to a Washington or Nevada consumer and that identifies the consumer’s past, present, or future physical or mental health status.

Scope

This Notice does not apply to any other websites or online services that we operate but that do not include a link to this Policy. Those websites and online services may be subject to their own privacy notices. This Notice also does not apply to anonymous or de-identified data that is not associated with a particular individual or to clinical trial data collected or maintained by Lōkahi Therapeutics.

While we may collect and process your personal information through both the App and the Website, the Website is primarily intended for informational purposes and to allow you to submit general questions, requests, and feedback to us. Please do not submit health-related information to us through the Website.

In addition, while we may collect and process information related to your health through the App, please note that we are not a covered entity subject to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), and that HIPAA's requirements do not apply to the health information we collect and process through the App. The App provides wellness-related insights only and is not intended to diagnose, treat, cure, or prevent any medical condition.

Categories of Consumer Health Data We Collect

The Services may collect the following categories of Consumer Health Data:

• Health and medication data, including your medications, dosages, dosing frequency, health history, baseline health metrics (such as energy levels, mood, side effects, and relevant biometrics), and outcome data you track over time (such as symptom relief, adherence, weight changes, or other health indicators).
• Inferences drawn from your health and medication data, such as inferences about your health outcomes and medication effectiveness.

Sources of Consumer Health Data

The Services may collect Consumer Health Data from the following sources:

• Directly from you when you input health and medication data, and other information through the Services.
• Automatically from your device and your interactions with the Services.

Purposes for Which We Collect and Use Consumer Health Data

We collect and use Consumer Health Data for purposes including:

• Providing and maintaining the Services, including providing the App’s health and medication tracking, developing anonymous cohort groups, and providing related services and monitoring usage of the Services.
• Communicating with you (e.g., responding to inquiries, fulfilling requests, and promoting the App and our products, services, and offerings).
• Operating, developing, and improving the Services.
• Enabling third-party integrations, services, features, and offerings.
• Creating aggregated and de-identified data, including for the purpose of developing anonymous cohort groups so that you can compare your experience with similar anonymous users in your cohort.
• Analyzing usage of the Services, including for product improvement, A/B testing, and bug detection.
• Securing the Services, including protecting against and responding to fraud, illegal activity (such as hacking or misuse), claims, and other liabilities, and enforcing our Terms of Service.
• Complying with legal or regulatory requirements, judicial process, and company policies (including due diligence and contracting activities).
• Evaluating or conducting a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our business, assets, or stock.
• Any other purpose you authorize or direct at the time we collect your information.

We may also use information that has been aggregated or de-identified such that it cannot reasonably be linked to an identified or identifiable individual or device for any purpose as permitted by applicable law.

Disclosures of Consumer Health Data

We may disclose Consumer Health Data described in the “Categories of Consumer Health Data We Collect” section above to the following parties:

• Contractors, service providers, and other third parties that support our organization, including, for example, providers of cloud hosting solutions.
• An actual or potential investor, buyer, successor, or other person or organization in connection with an actual or potential merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our business, assets, or stock (including in connection with bankruptcy, liquidation, or similar proceedings).
• Third parties when necessary to comply with any court order, law, or legal process; to respond to government or regulatory requests; and to enforce or apply our policies and other agreements.
• Any other parties disclosed by us at the time you provide the information, or authorized or directed by you.

We may also disclose information that has been aggregated or de-identified such that it cannot reasonably be linked to an identified or identifiable individual or device for any purpose as permitted by applicable law.

Your Choices

Subject to certain limitations and exceptions, Washington and Nevada residents may have certain rights with respect to their Consumer Health Data. When you make a request, we may provide more detailed information regarding any legal requirements applicable to your request and whether any exception or limitation applies.

If you are a resident of Washington or Nevada, you have the right to:

• Request access to your Consumer Health Data.
• Confirm whether we collect, share, or sell (as those terms are defined by the Washington My Health My Data Act and the Nevada Consumer Health Data Act) your Consumer Health Data.
• Withdraw your consent or authorization relating to your Consumer Health Data if we are relying on your consent to collect or share your Consumer Health Data.
• Delete your Consumer Health Data.

If we deny your request, you may appeal our decision.

To exercise these rights or to authorize an agent to make a request on your behalf, please contact us at [email protected] or postal address:

Contact Us

If you have questions about this Notice or our handling of Consumer Health Data, or if you would like to exercise your rights, please contact us at [email protected].