Washington and Nevada Consumer Health Data Privacy Policy

Effective October 1, 2026

1. About this Policy

This Consumer Health Data Privacy Policy (“Policy”) applies to people who live in Washington or Nevada, and to anyone whose Consumer Health Data is collected in either state. It supplements the Bond Privacy Policy and is provided by Dots Connected Inc. (“Bond,” “we,” “us”). If this Policy conflicts with the Privacy Policy on a matter involving Consumer Health Data, this Policy controls.

This Policy explains how we collect, use and disclose personal information that may be considered “Consumer Health Data” under the Washington My Health My Data Act and Nevada’s consumer health data law (Nevada Revised Statutes Chapter 603A).

“Consumer Health Data” means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status, as those laws define it. It does not include de-identified information that cannot reasonably be linked to you or your device.

Capitalized terms such as Stories, Memories and Simulations have the meanings in the Key terms of our Terms of Service. In short: Stories are your posts, Memories are the facts about your life Bond builds from them, and Simulations are research questions businesses ask that Bond answers using Royalty Program participants’ de-identified Memories.

2. Why Bond may have Consumer Health Data

Bond is built around the stories and memories you choose to share about your life. Some of what you write, say or post may describe your health, for example an injury, a diagnosis, a workout routine, a pregnancy, or how you were feeling on a given day. Bond’s systems may also derive information about your health from that content. We treat this information as Consumer Health Data.

We don’t ask you to share health information, and you decide what to include in your stories and memories. You can edit or delete any story or memory at any time.

3. Categories of Consumer Health Data we may collect

Depending on what you choose to share, we may collect:

• information about health conditions, symptoms, diseases, diagnoses, injuries or treatment;
• information about mental health, emotional wellbeing, therapy or counseling;
• information about medications, including prescribed medications;
• information about surgeries or other health-related procedures;
• information about bodily functions, vital signs, fitness, sleep or diet, to the extent it identifies a health status;
• reproductive or sexual health information;
• gender-affirming care information;
• photos, videos and voice recordings, to the extent they reveal health information;
• precise location information, to the extent it could indicate an attempt to obtain health services; and
• inferences about your health that Bond’s systems derive from any of the above or from your other content.

4. Sources of Consumer Health Data

• You, through the stories, backstories, memories, chat messages and Q&A answers you provide.
• Other users, when they share content that mentions you.
• Your device, including precise location if you enable Location Services and location information stored in photos you upload.
• Bond’s systems, which may derive inferences from the content above.

5. How we use Consumer Health Data

We collect and use Consumer Health Data only as reasonably necessary to provide the features you request, or with your consent. This includes:

• storing and organizing your stories and memories, and showing them to you and to the people you choose;
• generating personalized answers and recommendations from your content when you or your connections ask for them;
• keeping Bond safe and secure, including detecting spam, fraud and content that violates our Terms of Service;
• communicating with you about your account and our services; and
• complying with the law.

Royalty Program. If you join the Bond Royalty Program, memories that Bond identifies as relating to your health are not used in Simulations unless you separately opt in. Photos, videos and voice recordings are never used in Simulations. You can opt in or out at any time in Settings > Royalties > Sensitive Topics. If you opt in, those memories are de-identified and combined with other participants’ information to generate aggregated answers for businesses. Businesses never receive your name, contact details, images, raw content or account identifiers.

What we don’t do. We don’t use Consumer Health Data for targeted advertising. We don’t sell Consumer Health Data. We don’t set up geofences around locations that provide in-person health care services.

6. Who we share Consumer Health Data with

We may disclose Consumer Health Data to:

• People you choose to share with, such as your connections or the public, according to the visibility settings you select;
• Service providers that process information on our behalf under contracts that limit how they may use it, including cloud hosting, AI and large language model providers, customer support tools, and security and analytics providers;
• Law enforcement, courts or other parties, when required by law or needed to prevent harm;
• A new owner, if all or part of Bond or its assets is sold, merged or transferred, subject to this Policy.

Bond does not have affiliates that receive Consumer Health Data.

Synthetic Simulation results provided to businesses through the Royalty Program are de-identified and are not Consumer Health Data.

7. Consent

When we need your consent to collect or share Consumer Health Data, we ask for it clearly and separately in the app, and we tell you what we will collect or share, why, and with whom. You can withdraw consent at any time in Settings > Privacy or by contacting us. Withdrawing consent doesn’t affect your ability to use the parts of Bond that don’t depend on it.

8. Your rights

Depending on where you live, you have the right to:

• confirm whether we collect, share or sell your Consumer Health Data;
• get a list of the third parties and affiliates with whom we have shared or sold your Consumer Health Data, with a way to contact them;
• access your Consumer Health Data;
• delete your Consumer Health Data, including from our archives and backups, and have us tell our service providers and any third parties we shared it with to delete it too;
• withdraw your consent to our collection and sharing of your Consumer Health Data, or ask us to stop collecting or sharing it; and
• appeal our decision on any of these requests.

We won’t discriminate against you for exercising these rights.

9. How to exercise your rights

You can submit a request by:

• emailing support@bond.now with the subject line “Consumer Health Data Request”; or
• using Settings > Privacy > Your Data in the app.

We’ll verify your identity before responding, usually by confirming you control your account, email address or phone number. An authorized agent may submit a request for you, but we may ask for your written permission and ask you to verify your identity with us directly.

We’ll respond within 45 days. If we need more time, we may extend that by up to 45 more days and will tell you why. We’ll respond to up to two requests from you in a 12-month period free of charge.

10. Appeals

If we decline your request, you can appeal by emailing support@bond.now with the subject line “Consumer Health Data Appeal” within 60 days of our decision. We’ll respond in writing within 45 days and explain our decision. If your appeal is denied, you may contact the Washington Attorney General at atg.wa.gov or the Nevada Attorney General at ag.nv.gov.

11. How we protect Consumer Health Data

We use administrative, technical and physical safeguards to protect Consumer Health Data. We limit access to the employees, contractors and service providers who need it to provide the services described in this Policy.

12. Changes to this Policy

We’ll notify you in the app before we make material changes to this Policy. We won’t collect, use or share Consumer Health Data in ways that are materially inconsistent with this Policy without asking for your consent first.

13. Contact us

Questions about this Policy can be emailed to support@bond.now or mailed to Dots Connected Inc., 8 The Green Ste A Dover, DE 19901.