Consumer Health Data Privacy Policy

1. Regulated entity

Everglo Wellness Technology Limited (“Everglo,” “we,” “us”) is the regulated entity responsible for the consumer health data described in this notice.

Registered address: RM Q, 5/F, Tong Nam Ah Central Comercio, 180 Alameda Dr. Carlos d’Assumpção, Macau.

Contact for consumer health data requests: privacy@everglo.app.

2. Categories of consumer health data we collect

Everglo collects the following categories of consumer health data when you use the Everglo iOS app.

• Information about menopause stage and reproductive health, including perimenopause, menopause, and post-menopause status.
• Bodily functions and health conditions, including symptoms such as hot flashes, sleep quality, mood, energy levels, joint aches, and libido.
• Information that identifies a consumer’s attempt to seek health services, including use of the Everglo app itself.
• Information derived or extrapolated from non-health information when combined with other data we hold, such as the Glo Score wellness indicator.

Everglo does not collect biometric data, genetic data, precise geolocation data near healthcare facilities, or information about gender-affirming care.

3. Sources of consumer health data

The only source of consumer health data is you, the user, through information you enter directly into the Everglo iOS app. We do not collect consumer health data from data brokers, third-party trackers, public records, or any other source.

4. Purposes of collection and processing

We process consumer health data for these purposes only.

• Providing the Everglo service and keeping your account working.
• Computing the Glo Score wellness indicator from your check-ins.
• Generating Insights and the doctor-ready PDF reports you export.
• Responding to support messages from you.
• Security, fraud prevention, and backup integrity.
• Meeting legal obligations that apply to us.

We do not use consumer health data for advertising, marketing, profiling, or any form of behavioural advertising. We do not sell consumer health data. We do not share consumer health data for targeted advertising.

5. Categories of third parties and named affiliates

Consumer health data is shared only with the following named third-party processors. Each one operates under a signed data processing agreement with Everglo Wellness Technology Limited and is bound to use the data solely to provide the contracted service.

• Supabase, Inc. — managed Postgres database and authentication. Receives account, profile, and consumer health data. supabase.com/privacy.
• RevenueCat, Inc. — subscription receipt validation. Receives a transaction identifier and an anonymous app user ID. Does not receive consumer health data. revenuecat.com/privacy.
• PostHog, Inc. — product analytics, gated by your App Tracking Transparency choice. Receives anonymized event telemetry. PII filters strip identifiers before events leave the device. Does not receive consumer health values. posthog.com/privacy.
• Functional Software, Inc. (Sentry) — crash reporting. Receives device model, iOS version, stack traces, and breadcrumb logs. PII scrubbing is configured so consumer health values are not attached to events. sentry.io/privacy.

Everglo has no parent companies, subsidiaries, or affiliates beyond Everglo Wellness Technology Limited. We do not share consumer health data with any party other than the four processors named above.

6. Sharing and sale of consumer health data

We do not sell consumer health data. We have not sold consumer health data in the past, and we have no plans to sell consumer health data.

The Washington My Health My Data Act prohibits the sale of consumer health data without a separate, signed written authorization. We do not seek such authorization.

We do not share consumer health data for cross-context behavioural advertising or for any third-party advertising purpose.

7. Your rights under the Act

If you are a Washington resident, you have the following rights with respect to your consumer health data.

• Right to confirm. You can ask us to confirm whether we are collecting, sharing, or selling your consumer health data.
• Right to a list of third parties. You can ask for the specific third parties and affiliates with whom we have shared your consumer health data, including their contact information.
• Right to withdraw consent. You can withdraw consent for our collection and sharing of your consumer health data.
• Right to delete. You can ask us to delete your consumer health data. We will pass the request to all third-party processors who have received it.
• Right to appeal. If we deny any request, you may appeal by replying to our denial email. We will respond to appeals within 45 days. If we deny your appeal, you may file a complaint with the Washington Attorney General at www.atg.wa.gov/file-complaint.

8. How to exercise your rights

To exercise any of the rights above, send an email to privacy@everglo.app with the subject line “Washington MHMDA Request.”

State which right you are exercising and the email address tied to your Everglo account.

We will respond to verified requests within 45 days. We may extend this period once by a further 45 days when reasonably necessary, and we will tell you if we do.

9. How we authenticate your request

We authenticate consumer health data requests using a one-time passcode flow.

1. You email privacy@everglo.app from the email address on your Everglo account.
2. We reply with a six-digit passcode sent to that same email address.
3. You confirm receipt by replying with the passcode.
4. Once we match the passcode to the address on the account, we process your request.

This method protects you from impersonation and avoids asking for additional sensitive information. If you no longer have access to the email address on your account, contact us and we will work with you on another reasonable verification method.

10. Consent

Where the Washington My Health My Data Act requires opt-in consent, we obtain it before collecting or sharing the relevant consumer health data. Consent is presented separately from any general terms of service or privacy policy. You can withdraw consent at any time using the rights above.

11. No geofencing

Everglo does not use geofencing within 2,000 feet of any healthcare facility for advertising, data collection, or for sending notifications. The Everglo app does not request precise geolocation permission at all.

12. Changes to this notice

We will update this notice if our practices change in a way that affects your consumer health data. The Last Updated date at the top reflects the latest version. Material changes will be communicated by an in-app banner and an email to the address on your Everglo account.

13. Contact

For consumer health data questions, write to privacy@everglo.app.

Postal mail:
Everglo Wellness Technology Limited
RM Q, 5/F, Tong Nam Ah Central Comercio
180 Alameda Dr. Carlos d’Assumpção
Macau

Phone: +61 481 392 099.