Consumer Health Data Policy

REDSALT CONSUMER HEALTH DATA POLICY

Effective: November 11, 2026

Some states, including Washington, require companies to publish a policy about "consumer health data." This policy supplements our Privacy Policy and Additional Notice for the REDSALT Apps. It applies to consumer health data we process through the Reward Wallet and the Challenge app.

1. Categories of consumer health data we collect. The categories depend on which App you use and what you choose to enter:

• Habit check-ins, including hydration, movement, recovery, nutrition-related habits and daily intentions.
• Workout logs and training progress.
• Weight and waist measurements, if you choose to enter them (Challenge).
• Notes, reflections and progress photos, if you choose to enter them (Challenge). These can reveal health information.
• Information we infer from activity, such as check-in streaks.

2. Sources. Directly from you when you enter it, and automatically from how you use the Apps.

3. Why we collect and use it. To provide the Apps and the services you asked for: your plan and progress, points and rewards, coaching in the Challenge, reminders you turned on, and support. Also to keep the Apps secure and working, to improve them, and to comply with the law. We also use Wallet check-in activity to segment marketing emails, as described below.

4. Categories we share. In the Wallet, check-in type and date, streak length and points earned are sent with your name and email to Klaviyo. Wallet check-ins, streaks and related points are stored with Supabase. In the Challenge, Supabase stores check-ins, workouts, optional measurements and progress photos, notes, and call attendance. Challenge coaches can access check-ins, workouts, measurements and notes. Your team can see your first name, daily points and check-in status.

5. Who we share it with.

• Supabase stores app data and provides sign-in and private photo storage. Netlify hosts the apps.
• Klaviyo receives Wallet check-in activity for email marketing and segmentation. Resend processes sign-in and account emails. Judge.me supports Wallet review verification.
• Shopify and Loop provide order and membership information to the Wallet for account matching and points. Google Meet and Drive support Challenge calls and recordings.
• Apple, Google and Mozilla browser notification services receive the push address and generic reminder text when you turn on reminders.
• Challenge coaches Kayla Durden and Jacob Gise use the Challenge data listed above to coach you. Your Challenge team receives only the information described in section 4.
• Authorities or successors may receive information when the law requires it or in a business sale or merger.

We do not sell consumer health data.

6. Your consent and choices. You can choose whether to enter a Wallet check-in or optional Challenge information, and you can stop entering it at any time. Push reminders require separate browser permission and can be turned off in the app or on your device. To withdraw consent to collection or sharing, email jacob@redsaltsupps.com for the Wallet or challenge@redsaltsupps.com for the Challenge.

7. Your rights and how to use them. You can ask whether we collect, share, or sell your consumer health data and ask to access or delete it. You can withdraw consent and request a list of the third parties and affiliates we shared or sold it to, with a way to contact them. Email jacob@redsaltsupps.com (Wallet) or challenge@redsaltsupps.com (Challenge). We will verify your identity and respond within 45 days. Withdrawing consent may mean we can no longer provide parts of the App. We process deletion requests and notify recipients as required by applicable law.

8. Appeals. If we deny a request, reply to our answer within 60 days and ask for an appeal. We will respond within 45 days. If you are still not satisfied, you can contact your state attorney general.

9. Updates. We will post changes here and change the effective date.