CONSUMER HEALTH DATA PRIVACY NOTICE

Sword Health, Inc. — Business-to-Business Services

This Consumer Health Data Privacy Notice ("Notice") supplements Sword Health's Privacy Notice. It applies to individuals whose consumer health data is collected in connection with Sword Health's services — including services offered to employers, health plans, and other organizational clients — in Washington (under Washington's My Health, My Data Act, RCW 19.373), Nevada (under Nevada's Consumer Health Data Privacy Law, NRS 603A.490–.520), and Connecticut (under the Connecticut Data Privacy Act, Conn. Gen. Stat. §§ 42-515 to 42-526).

This Notice does not apply to protected health information ("PHI") governed by HIPAA and processed under a Business Associate Agreement ("BAA"). Where a BAA applies, HIPAA governs. This Notice covers consumer health data outside the scope of HIPAA and any BAA.

What Does This Notice Cover

"Consumer health data" means personal information linked or reasonably linkable to you that identifies your past, present, or future physical or mental health status, as defined by applicable law. It does not include PHI under HIPAA and a BAA, publicly available information, or de-identified information.

Categories of Consumer Health Data We May Collect

Outside the scope of a BAA, the following may constitute consumer health data under applicable law:

Information submitted through pre-enrollment interest forms or eligibility verification (e.g., responses indicating a health condition or interest in services)
Information collected through wellness program signups or health assessments via an employer or health plan portal
Website analytics and browsing data from employer-facing landing pages that may indicate interest in or intent to seek health care services

What Are the Purposes for Collecting, Using, and Sharing Consumer Health Data

To provide information about Sword Health services, including outreach and marketing communications
To improve and personalize the enrollment experience
To provide customer service and respond to your requests and inquiries
To operate our business, including billing, accounting, and analytics
To maintain security and detect illegal, fraudulent, or suspicious activity
To meet our legal obligations
For other purposes with your consent

Categories of Sources From Which We Collect Consumer Health Data

Provided directly by you through pre-enrollment forms, interest surveys, or eligibility questionnaires
Provided by your employer or health plan in connection with eligibility determination or program enrollment
Collected indirectly from you when you visit our websites through the use of cookies and other tracking technologies
Collected from our affiliates where you use other services we provide (as applicable)

How We Share Consumer Health Data

We share consumer health data with service providers, affiliates, and organizational clients only as necessary to provide services, maintain security, prevent fraud, and comply with law. Service providers are bound by written agreements restricting their use to purposes we specify, requiring reasonable security, and obligating deletion or return of data when services conclude.

Where required by applicable law, we will obtain your affirmative consent before we collect or share your consumer health data. Consent requests will clearly disclose: (i) the categories of consumer health data to be collected or shared; (ii) the purpose, including how the data will be used; (iii) the categories of entities with whom data will be shared; and (iv) how you may withdraw consent. Consent for sharing is obtained separately and distinctly from consent for collection.

Categories of Third Parties and Affiliates With Whom We May Share Consumer Health Data

Our service providers acting as processors on our behalf to facilitate eligibility verification, enrollment, and program delivery
Your employer or health plan, to the extent necessary to administer the program and as permitted by applicable law
Channel partners or benefits platforms through which Sword Health services are offered
Corporate transactions such as a merger, financing, acquisition, bankruptcy, dissolution, or sale or transfer of all or a portion of our business or assets
Governmental agencies, as required by law
Affiliates of Sword Health: Sword Health SA

No third party independently collects consumer health data through our B2B services unless separately disclosed.

Data Retention

We retain consumer health data as long as reasonably necessary to fulfill the purposes in this Notice or as required by law. When data is no longer needed, we securely delete or de-identify it.

Your Rights (Washington, Nevada, and Connecticut Residents)

Right to Know — You may confirm whether we collect, share, or sell your consumer health data, access that data, and obtain a list of third parties and affiliates with whom we have shared it, including their contact information.
Right to Correct or Delete — You may request correction of inaccurate consumer health data or deletion of your data. Upon a verified request, we will delete it from our systems and notify our affiliates, processors, and third parties to do the same.
Right to Withdraw Consent — You may withdraw consent for our processing of your consumer health data at any time, and we will cease processing as soon as practicable.

How to Exercise Your Rights

Email privacy@swordhealth.com or write to the address below. We will respond within 45 days (extendable by 45 days with notice). These rights may be exercised free of charge up to twice per year.

For Connecticut Residents

Consumer health data is "sensitive data" under the Connecticut Data Privacy Act. We obtain affirmative opt-in consent before processing it. Only employees and contractors bound by confidentiality obligations may access your consumer health data. Other Connecticut privacy rights are described in our Privacy Notice.

Changes to This Notice

We will notify you of material changes by posting an updated Notice with a revised effective date and, where required by law, providing additional notice. We encourage periodic review.

Contact Us

Questions, comments or appeals? Contact us at:

Sword Health, Inc.

ATTN: Privacy Office

169 Madison Ave

Suite 15501

New York, New York 10016

privacy@swordhealth.com

Effective Date: July 10, 2026

Last Updated: July 10, 2026