Consumer Health Data Privacy Notice

Effective date: September 14, 2026

This notice describes how Crates Health Inc. (“Crates,” “we,” “us”) handles consumer health data and how to exercise rights under applicable consumer health data laws, including the Washington My Health My Data Act and Nevada's consumer health data law. It supplements our Privacy Policy and controls if there is a conflict concerning the consumer health data it covers. The applicability of these laws and their exemptions depends on the relevant entity, information and activity. A separate clinical privacy notice may govern certain records. Nothing in this notice limits protections that otherwise apply to you.

Consumer health data we collect and why

Depending on the service you request, we collect:

• Health and patient information: conditions, health and family history, patient identity and date of birth, questionnaire answers, the reasons for a request, and information in clinical review records and medical-necessity documents. We use this information to process your request, facilitate review and provide the resulting documentation.
• Health-related purchase and reimbursement information: receipts, products or services purchased, amounts and dates, supporting records, administrator and account information, signatures and other information needed for a reimbursement request. We use this information to organize documentation and prepare, transmit and track requests you authorize.
• Information inferred from the above: information about a potential health need or eligibility for a requested service, including information revealed by your purchases or request. We use it to organize and evaluate the requested service, subject to appropriate review.
• Health-related communications and service interactions: questions, correspondence, support records and use of service features where the information identifies or reasonably permits an inference about your health. We use it to respond, maintain accurate records, troubleshoot and provide the requested service.

We also process the relevant information to protect accounts and systems, detect fraud, resolve disputes and comply with applicable law, within the limits those laws permit. We collect and share consumer health data with the consent required by law or as necessary to provide a product or service you request where the law permits that basis. Additional purposes or categories requiring consent will be disclosed and separately authorized before that processing begins.

How we process this information

We store and organize information in electronic records, associate supporting documents with the relevant request, prepare documents, and transmit records through the service channels used for your request. Automated tools may assist processing. Authorized support and operations personnel may access relevant information only as needed to deliver and support the requested service. Clinical determinations remain with the licensed reviewer. Any more specific restrictions in a connected-service notice also apply. These processing methods do not authorize a separate use of health data for advertising or model training.

We may use contracted AI and document-processing providers to extract, organize, and analyze information as needed to provide the services you request. We do not permit these providers to use your health information to train their own models. Any more specific restrictions in a connected-service notice also apply.

Sources

We receive consumer health data from you; a patient or representative authorized to provide it; professionals involved in requested clinical review; administrators or recipients involved in your requests; and providers processing information for those services. Where an optional account connection is available and you authorize it, we receive the health-related information described in its connection notice. We may derive health-related information from the records and interactions described above.

Sharing and recipients

The categories of consumer health data we share are the health and patient information, purchase and reimbursement information, relevant inferences, and health-related communications described above, limited to what is relevant to the purpose and permitted by law.

Recipients include:

• Professionals involved in the clinical review you request.
• Benefit administrators and other recipients you authorize to receive supporting records or reimbursement requests.
• Technology and operational service providers acting on our behalf for hosting, storage, security, document processing, communications, payments or support, to the extent their role requires the information and applicable law permits it. Their processing is subject to appropriate contractual restrictions.
• Legal authorities or other recipients when disclosure is required or otherwise specifically permitted by applicable law.
• A successor involved in a business transaction, subject to applicable legal and source-specific restrictions and any required consent.

We do not sell consumer health data. We do not use or share consumer health data for targeted advertising, including advertising for Crates. This includes medical questionnaire answers, health information derived from receipts, and information about clinical interactions. A general analytics or advertising disclosure in our Privacy Policy does not authorize that use. Connection-specific limitations also apply to health data obtained from that connection.

Tracking across websites and services

Third-party analytics and support providers may collect information about your interactions over time across our website and application. Depending on the page or interaction, this information can reveal health interests or other consumer health data. Third-party technologies on our marketing website may also collect browsing information across other websites or services. Our restrictions on the use and sharing of consumer health data, including the prohibition on targeted advertising described above, apply to this processing.

Your rights and how to exercise them

Where applicable law provides these rights, you may ask whether we collect or share your consumer health data; access that data; obtain information about relevant recipients; withdraw consent to collection or sharing; and request deletion. Withdrawing consent may prevent us from continuing a service that needs the information, but we will not unlawfully discriminate against you for exercising a right.

Our team handles these requests. Email info@crateshealth.com with the subject “Health data privacy request.” Describe the request without attaching medical records or sensitive identifiers to the initial message. We will verify the request using a secure process and request only information reasonably needed for verification. Where permitted, an authorized representative may make a request on your behalf.

You may also use this contact process to ask to review or correct information. We will explain how a correction can be made and any applicable limitation, including when a clinical record requires review or an amendment instead of replacing the original record.

We respond within applicable legal deadlines. If we deny a request in whole or in part, we explain the reason and how to appeal. To appeal, reply with “Health data privacy appeal” and explain why you disagree. We will provide a decision within the applicable deadline. If your appeal is denied, you may raise a complaint with your state's Attorney General, including the Washington Attorney General or Nevada Attorney General, as applicable.

For an applicable deletion request, we delete covered data from our records and notify processors and other recipients as required by law. Backup deletion follows the applicable statutory requirements. We identify any legally permitted retention exception in our response rather than treating a general business purpose as an exception.

Changes to this notice

We post the current notice with its effective date. For material changes affecting how we handle consumer health data, we provide notice through an account message, email or a prominent notice before the change takes effect, as appropriate and required by law. Where a change requires consent, we obtain that consent before the new collection, use or sharing begins.

Contact

Crates Health Inc.

Email: info@crateshealth.com

Mailing address: 945 Market Street, Floor 5, San Francisco, CA 94103, United States