Consumer Health Data Privacy Policy

1. Purpose of This Policy

This Consumer Health Data Privacy Policy describes how PRTCL (operated by Align to Grind LLC) collects, uses, shares, and protects consumer health data, and the rights you have under the Washington My Health My Data Act (RCW 19.373) and Nevada's Consumer Health Data Privacy Law (NRS 603A.400-.420).

This policy is separate and distinct from our general Privacy Policy. To the extent there is any conflict between this policy and the general Privacy Policy with respect to consumer health data, this policy controls for Washington and Nevada residents.

2. Categories of Consumer Health Data We Collect

PRTCL collects only the categories of consumer health data that you actively enter into the App. These include:

• Treatment information: Peptide names, dosing schedules, and protocol configurations you choose to set up.
• Use of medication: Dose log entries (substance, amount, time, notes), including ad-hoc dose entries.
• Bodily functions and health conditions: Optional notes you may add to dose entries or your profile (such as how a dose felt or side effects you choose to record).
• Health-related supply information: Vial inventory, reconstitution data, and supply expiration dates.
• Health-related location data: Injection site selections you log within the App's body map. This is anatomical position information, not GPS or geolocation data.
• Wellness goals: Goals and experience-level information you optionally provide during onboarding.

PRTCL does not collect biometric data, genetic data, GPS or precise geolocation data, gender-affirming care data, reproductive or sexual health data, or any consumer health data inferred from outside sources. We collect only what you choose to enter.

3. Categories of Sources

All consumer health data is collected directly from you through the App's interface. We do not receive consumer health data from third-party data brokers, advertising networks, public records, or any other external source.

4. Purposes of Collection and Use

We collect and use consumer health data only to provide the features you actively request through the App:

• To store and display your dose logs, protocols, and inventory
• To deliver the dose reminders you configure
• To populate the injection site map you choose to use
• To synchronize your data across your devices
• To respond to support requests you initiate

Your collection of consumer health data is anchored in the statutory exception for data that is "necessary to provide a product or service that the consumer has requested" (RCW 19.373.030(1)(b)). We do not collect, use, or process consumer health data for any purpose beyond providing the features you request.

5. Categories of Third Parties That Receive Consumer Health Data

We do not sell consumer health data. We share the minimum necessary consumer health data with the following service providers, each of which is contractually restricted to using your data only to provide the listed service to PRTCL:

• Supabase - database hosting. Stores your dose logs, protocol data, inventory, and injection site selections.
• Vercel - web hosting. May process consumer health data in transit when you access the App via the web.
• Apple - iOS App Store and push notification delivery. Apple does not receive the contents of your dose logs or other consumer health data, but does process the technical metadata required to deliver scheduled reminders to your device.

We do not share consumer health data with the following:

• Advertising networks or marketing platforms
• Data brokers
• Sentry, RevenueCat, Stripe, Google, Anthropic, or Supadata.ai (these services support other features of the App but do not receive consumer health data)

6. We Do Not Sell Consumer Health Data

PRTCL does not sell consumer health data, has not sold consumer health data in the past, and has no intention of selling consumer health data in the future. We will not enter into any "valid authorization" arrangement to sell your consumer health data.

7. Your Rights

Washington Residents

Under the Washington My Health My Data Act, you have the right to:

• Confirm whether PRTCL is collecting, sharing, or selling your consumer health data, and to access that data
• Withdraw consent from PRTCL's collection and sharing of your consumer health data
• Have your consumer health data deleted, including from PRTCL's records and from any affiliates or processors with whom PRTCL has shared it
• Appeal a denial of any of the above requests

Nevada Residents

Under Nevada's Consumer Health Data Privacy Law, you have the right to:

• Receive confirmation of whether PRTCL is collecting, sharing, or selling your consumer health data
• Receive a list of third parties with whom we have shared your consumer health data
• Request that we stop collecting, sharing, or selling your consumer health data
• Request deletion of your consumer health data

8. How to Exercise Your Rights

Most data can be reviewed or deleted directly in the App: open Profile to view, edit, or delete your dose logs, protocols, inventory, and injection site history. To delete your account and all associated consumer health data, use the in-app account deletion option or email us.

To exercise any of the rights above, including a request for a list of third parties or to withdraw consent, contact:

Email: support@prtclapp.com
Subject line: "Consumer Health Data Request"

We will verify your identity before responding and will respond within 45 days. If we deny your request, you may appeal by replying to our response. If you are not satisfied with the outcome of your appeal, you may file a complaint with the Washington Attorney General (atg.wa.gov/file-complaint) or the Nevada Attorney General (ag.nv.gov), as applicable.

9. Data Security

Consumer health data is encrypted in transit using TLS/SSL and at rest where supported by our infrastructure providers. Access to consumer health data is restricted to your account through Supabase Row-Level Security policies. PRTCL personnel access your consumer health data only when required for support, debugging, or legal compliance, and only with your knowledge or under appropriate confidentiality controls.

10. Data Retention

Consumer health data is retained for as long as your account is active. Upon account deletion, consumer health data is permanently removed within 30 days, except where retention is required by law.

11. Changes to This Policy

If we materially change this Consumer Health Data Privacy Policy, we will notify you in the App or by email and update the "Last updated" date above.