1. Categories of Consumer Health Data We Collect, and Why

"Consumer health data" is data that identifies a consumer's past, present, or future physical or mental health status. Within JOY, the categories of data that may fall within this definition, and the purposes for which we collect and use them, are:

We collect and process this data only as necessary to provide the features you or your family have requested, or where we have obtained your consent (see Section 6).

2. Sources of Consumer Health Data

We collect consumer health data from the following categories of sources:

• Directly from the senior user, through their responses and recordings during a daily session.
• From a connected caregiver or Memory Companion, to the extent content they provide (photo captions, voice messages) references the senior's health.
• Generated within the service, such as scores and completion records produced as the user interacts with JOY.

We do not purchase consumer health data, and we do not collect it from data brokers or other third-party data sources.

3. Categories of Consumer Health Data We Share

JOY is a private, family-only service. We share consumer health data only in the following limited ways:

• Within your family account: A connected caregiver can see the categories of data described in our Family Sharing Policy. A Memory Companion sees only session-completion status.
• With service providers acting on our behalf, as listed in Section 4, solely to operate the service.

We do not share consumer health data for advertising, marketing, or any purpose unrelated to operating JOY.

4. Third Parties and Affiliates With Whom We Share Consumer Health Data

MHMDA requires us to name the specific affiliates and the categories of third parties with whom consumer health data is shared.

Service providers / processors (specific entities)

Affiliates

Joy Health Technologies LLC has no corporate affiliates with whom consumer health data is shared.

Categories of third parties

Beyond the service providers above, we may disclose consumer health data only: (a) to comply with a legal obligation or valid legal process; (b) to protect against fraud or harm; or (c) in connection with a business transfer, in which case we will provide notice.

5. We Do Not Sell Consumer Health Data

We do not sell consumer health data, as "sell" is defined under RCW 19.373. We have not sold consumer health data, and we do not seek authorization to do so.

6. Basis for Collection and Processing

All consumer health data described in Section 1 is collected and processed because it is necessary to provide the specific JOY features you or your family have requested — the daily wellness session, family connection, and caregiver visibility. We do not collect consumer health data for advertising, analytics sold to third parties, or any purpose beyond operating these features.

We do not currently collect or use consumer health data for any purpose that would require separate opt-in consent under RCW 19.373. If we introduce any such use in the future, we will obtain your explicit opt-in consent before doing so and update this policy accordingly.

You may request withdrawal of access to your data at any time by exercising your rights under Section 7. Withdrawal does not affect data already collected while the service was being provided to you.

7. Your Rights and How to Exercise Them

Under RCW 19.373.040, if you are a Washington consumer you have the right to:

• Confirm and access whether we are collecting, sharing, or selling your consumer health data, and access that data.
• Withdraw consent to our collection and sharing of your consumer health data.
• Delete your consumer health data. When you request deletion, we will delete it from our active and backup systems and notify the service providers and any third parties listed in Section 4 to delete it as well.

How to make a request

Submit a request by emailing joy@joyhealthtechnologies.com with the subject line "Washington Health Data Request" and the email address associated with your JOY account. We use this to verify your identity. We will not require you to create a new account to make a request.

We will respond within 45 days. If we need more time, we may extend once by an additional 45 days and will tell you why. You may make requests free of charge up to twice per year.

Appeals

If we decline your request, we will explain why and tell you how to appeal. If you wish to appeal, reply to our decision with the subject line "Appeal." We will respond in writing within 45 days. If your appeal is denied, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint.

8. Data Security and Retention

We restrict access to consumer health data to the systems and personnel that need it to operate the service, and we apply the safeguards described in our Security Policy. We retain consumer health data only as long as needed to provide the service or as required by law. For specific retention periods by data type, see our Data Retention Policy.

9. Changes to This Policy

If we collect new categories of consumer health data, use it for new purposes, or share it with new third parties, we will update this policy and, where required, obtain your consent before doing so.