‍

FUNCTION HEALTH: CONSUMER HEALTH DATA PRIVACY POLICY

‍

Last Updated: August 1, 2025

‍

This Consumer Health Data Privacy Policy (“Consumer Health Data Privacy Policy”) describes how Function Health, Inc. and its corporate affiliates (collectively, “Function,” “we,” “us” or “our”) process consumer health data as applicable US state laws may define that term (“Consumer Health Data”), that we collect through our digital or online properties or services that link to this Consumer Health Data Privacy Policy (including as applicable, our website, mobile application, and social media pages) as well as our marketing activities, and other activities described in this Consumer Health Data Privacy Policy (collectively, the “Service”). This Consumer Health Data Privacy Policy applies to the extent required by applicable US state laws. 

‍

This Consumer Health Data Privacy Policy supplements our general Privacy Policy. In the event of a conflict between our Privacy Policy and the Consumer Health Data Privacy Policy, the Consumer Health Data Privacy Policy applies to the extent that it is consistent with applicable US state law.

‍

This Consumer Health Data Privacy Policy does not apply to Consumer Health Data that we process on behalf of our enterprise customers while providing Function services to them. For example, to the extent that we receive your Consumer Health Data from your employer related to your eligibility for our Service, our use of that Consumer Health Data may be governed by our agreements (including, as applicable, a business associate agreement) with the relevant enterprise customer. If you have questions regarding your Consumer Health Data that we process on behalf of an enterprise customer, please direct your questions to the relevant enterprise customer. 

‍

Consumer Health Data we collect:

Consumer Health Data you may provide to us through the Service or otherwise includes:

• Contact data, such as your first and last name, salutation, email address, billing and mailing addresses, and phone number.
• Demographic data, such as your city, state, country of residence, postal code, age, date of birth, gender or gender identity, racial or ethnic identity, and sexual orientation.
• Account data, such as the username and password that you may set to establish an online account on the Service, date of birth, biographical details, photograph or picture, links to your profiles on social networks, preferences, information about your participation in our promotions or surveys, and any other information that you add to your account profile.  
• Service-eligibility data, if you are accessing the Service as part of an enterprise customer-provided benefit, you may provide us with relevant information such as your employer or other enterprise customer name, eligibility data, and relevant enterprise customer identification number.
• Health-related data, such as mental or physical history, conditions and diagnoses, treatments, medications, medical images, biomarkers, lab samples, lab results, clinical notes, and other physical or mental health information. This may include personal information that you provide directly to us when you complete electronic forms designed for you to self-report your physical or mental health status, upload medical records, or link a wearable or Internet of Things device to our Services.
• Genetic data, certain of the lab tests available through the Service may produce data that relates to inherited characteristics.
• Audiovisual recording data, such as video and audio recordings of you.
• Transactional data, such as information relating to or needed to complete your orders on or through the Service, including order numbers and transaction history.
• Communications data based on our exchanges with you, including when you contact us through the Service, chat features, social media, or otherwise. 
• Relationship data, such as familial or other relationship to third parties whose personal information you may provide to us.
• Payment data needed to complete transactions, including payment card information or bank account number.
• Marketing data, such as your preferences for receiving our marketing communications and details about your engagement with them.
• User-generated content data, such as photos, images, music, videos, comments, questions, messages, and other content or information that you generate, transmit, or otherwise make available on the Service, as well as associated metadata. Metadata includes information on how, when, where and by whom a piece of content was collected and how that content has been formatted or edited. Metadata also includes information that users can add or can have added to their content, such as keywords, geographical or location information, and other similar data.
• Other data not specifically listed here, which we will use as described in this Consumer Health Data Privacy Policy or as otherwise disclosed at the time of collection.

Consumer Health Data we collect automatically. When you use our services, we collect some information through certain technical tracking technologies that may be considered Consumer Health Data. For example:

• Device data, such as your computer or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., Wi-Fi, LTE, 3G), and general location information such as city, state or geographic area.
• Precise geolocation data, when you authorize our mobile application to access your device’s location.
• Online activity data, such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to the Service, navigation paths between pages or screens, information about your activity on a page or screen, access times and duration of access, and whether you have opened our emails or clicked links within them.
• Communication interaction data such as your interactions with our email, text or other communications (e.g., whether you open and/or forward emails) – we may do this through use of pixel tags (which are also known as clear GIFs), which may be embedded invisibly in our emails. 

Consumer Health Data we obtain from third-party sources. We also obtain the types of Consumer Health Data described above from third parties. These third-party sources may include, for example:

• Corporate affiliates. We may obtain your Consumer Health Data from our corporate affiliates (including Ezra AI, Inc. and Ezra Health of Florida, PLLC).
• Lab and Provider Partners, including third party healthcare services providers, laboratory services providers, and other providers of medical and medical-adjacent services.
• Our enterprise customers, such as employers, gyms and other entities that may provide us with your personal information.
• Linked third-party services, such as Google or other third-party service that you use to log into, or otherwise link to, your Service account. This data may include your username, profile picture and other information associated with your account on that third-party service that is made available to us based on your account settings on that service.
• Linked third-party devices, such as wearable or Internet of Things devices that you link to your Service account. This data may include your username, profile picture and other information associated with your account on that third-party service that is made available to us based on your account settings on that service. This may include your device’s health app information historical data related to your use of the wearable device.

• Third parties that you designate such as lab providers with whom we do not have a contractual relationship.

• Service providers. Third parties that collect or provide Consumer Health Data in connection with work they do on our behalf.

Consumer Health Data we may create, infer or generate. We may create, infer or generate Consumer Health Data from other data we collect, including using automated means to generate information about your likely preferences or other characteristics. We may create aggregated, de-identified, and/or anonymized information from Consumer Health Data by removing certain data components (such as your name, email address, or linkable tracking ID) that makes the data identifiable, or through aggregation, obfuscation or other means. For example, we may de-identify any information and data provided and/or generated in connection with your use of our Services (including without limitation your health-related data), in compliance with applicable law. Except as required or permitted by applicable law, we will not attempt to re-identify any data that has been aggregated, de-identified, and/or anonymized. Subject to applicable law, our use of such aggregated, de-identified, and/or anonymized information is not Consumer Health Data.

‍

How we use your Consumer Health Data

We use Consumer Health Data for purposes described in this Consumer Health Data Privacy Policy or as otherwise disclosed to you. For example, we use Consumer Health Data for the following purposes: 

‍

‍

How we share your Consumer Health Data

We may “share” (as the applicable law may define that term) Consumer Health Data with your consent or as we determine necessary to complete your transactions, provide the Service to you, or as otherwise permitted or required by law. For example, we may share your Consumer Health Data to: 

Corporate affiliates. We may share your Consumer Health Data with our corporate affiliates (including Ezra AI, Inc. and Ezra Health of Florida, PLLC).

Payment processors. Any payment card information you use to make a purchase on the Service is collected and processed directly by our payment processors, such as Stripe. Stripe may use your payment data in accordance with its privacy policy, https://stripe.com/privacy.

Research partners. We may share Consumer Health Data with research partners to conduct research.

Lab and Provider Partners. We will share your Consumer Health Data with healthcare services providers, laboratory services providers, and other providers of medical and medical-adjacent services.

Linked third-party services or devices. If you log into the Service with a third-party service such as Google, or choose to link a wearable or Internet of Things device to your Service account, we may share your personal information with that third-party service. The third party’s use of the shared information will be governed by its privacy policy or other relevant terms and the settings associated with your account with the third-party service.

Legal and law enforcement. We will access, share, and preserve Consumer Health Data when we believe that doing so is necessary to comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies. We will also share Consumer Health Data if we believe it is necessary to protect our customers and/or the rights or property of ourselves or others.

For more information on how we may otherwise disclose your Consumer Health Data, please view the How we may share your personal information section in our Privacy Policy.

Your Consumer Health Data choices 

You may have certain rights to your Consumer Health Data under applicable law. Any of the rights discussed below may be subject to certain limitations (for example, a monetary charge).  If you wish to exercise these rights, please email us at privacy@functionhealth.com. 

Withdraw consent. To the extent we rely upon your consent for either our collection or sharing of your Consumer Health Data, you have the right to withdraw such consent from any future collection or sharing. 

Access and confirm. You have the right to ask us to confirm whether we have collected, shared or sold your Consumer Health Data. Further, you have the right to access (in other words, request a copy of) the Consumer Health Data that we have collected, shared or sold. You also have a right to access a list of all “third parties” (as applicable law may define that term) and affiliates with whom we have shared or sold your Consumer Health Data and receive certain corresponding information.

Correction. You have the right to ask us to correct inaccuracies in your Consumer Health Data.

Deletion. You have the right to ask us to delete your Consumer Health Data. 

Appeal. You have the right to appeal our denying a right you have attempted to exercise. We will provide details on how to appeal our denial in connection with such action. 

To exercise your rights above and make a Consumer Health Data rights request, please email us at privacy@functionhealth.com.  We may need to verify your identity in order to process your request. To confirm your identity, we may ask you to verify personal information we already have on file for you. If we cannot verify your identity based on the information we have on file, we may request additional information from you, which we will only use to verify your identity, and for security or fraud-prevention purposes. 

Declining to provide information. We need to collect Consumer Health Data to provide certain services. If you do not provide the information we identify as required or mandatory or if you request that any required Consumer Health Data be deleted or withdraw your consent for future collection or sharing of any required Consumer Health Data, we may not be able to provide those services.

Linked third-party platforms. If you log into the Service with a third-party service such as Google, or choose to link a wearable or Internet of Things device to your Service account, you may be able to use your settings in your account with that platform to limit the information we receive from it. If you revoke our ability to access information from such third-party platform, that choice will not apply to information that we have already received from that third party.

Changes to this Consumer Health Data Privacy Policy 

We reserve the right to modify this Consumer Health Data Privacy Policy at any time. If we make material changes to this Consumer Health Data Privacy Policy, we will notify you by updating the date of this Consumer Health Data Privacy Policy and posting it on the Service or other appropriate means. Any modifications to this Consumer Health Data Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your use of the Service after the effective date of any modified Consumer Health Data Privacy Policy indicates your acknowledging that the modified Consumer Health Data Privacy Policy applies to your interactions with the Service and our business.

Please click here to view the previous version of our Consumer Health Data Privacy Policy.

‍

How to contact us

Email: privacy@functionhealth.com

‍

‍

FUNCTION HEALTH: CONSUMER HEALTH DATA PRIVACY POLICY

Effective Date: November 20, 2024

‍

This Consumer Health Data Privacy Policy (“Policy”) applies only to residents of the states of Connecticut, Nevada, and Washington to the extent such states’ respective laws apply to Function Health, Inc. (“Function”, “we”, “our”, “us”) and the relevant consumer health data.

‍

This Policy provides information about how Function collects, stores, and uses your Consumer Health Data arising out of and/or relating to you and/or your use of our Services –which include your use of the Site and any other technologies, features, mobile applications, and content we offer Without Limitation, this Policy applies to Connecticut, Nevada, or Washington residents about whom we collect “consumer health data” (“Consumer Health Data”) as defined by applicable laws such as the Connecticut Data Privacy Act (“CTDPA”), Nevada SB 370, and Washington’s My Health, My Data Act (“MHMD”).

‍

We encourage you to review our Privacy Policy to learn more about Function’s privacy practices. This Policy supplements our Privacy Policy in its entirety, and any capitalized terms in our Privacy Policy have the same meaning herein unless otherwise noted.

‍

This Policy does not apply to third-party websites, applications, products, services, or other properties, even if they may link to our Sites or our Sites may link to them. We recommend you review the privacy practices of those third parties before connecting with and/or accessing third party offerings and sharing any Personal Information.

‍

1. Consumer Health Data We Collect

For purposes of this Policy, “Personal Information” means information that identifies or is reasonably capable of being associated or linked, directly or indirectly, with an individual in Connecticut, Nevada, and Washington. Personal information does not include de-identified data or publicly available information. “Consumer Health Data” means Personal Information that is linked or reasonably linkable to an individual and that identifies the individual’s past, present, or future health status or mental health status, as may be applicable.

‍

Our Services involve the collection of Lab Results and Self-Reported Health Information, as well as Consumer Health Data gathered via Cookies. Accordingly, we may collect, or have collected, the following categories of Consumer Health Data about you:

‍

• Name and contact information
• Demographic information
• Account profile information
• Individual health treatments, conditions, or diseases
• Social, psychological, behavioral, or medical interventions
• Health-related surgeries or procedures
• Use or purchase of prescribed medication
• Diagnosis or diagnostic testing, treatment, or medication
• Gender affirming care information
• Reproductive or sexual health information
• Genetic data
• Bodily functions
• Vital signs, symptoms, or measurements of the above categories
• Precise location information that could reasonably indicate your attempt to acquire or receive health services or supplies
• Data that identifies you seeking health care services
• Device information (such as IP address, device identifiers, mobile app identifiers, device operating system information)
• Any information that we or our service providers process to associate or identify you with the above information that is derived from non-health information (such as inferred data).

‍

We may create aggregated, de-identified, or anonymized information from Consumer Health Data by removing certain data components (such as your name, email address, or linkable tracking ID) that makes the data identifiable, or through aggregation, obfuscation or other means. For example, we may de-identify any information and data provided and/or generated in connection with your use of our Services (including without limitation your Lab Results and Self-Reported Health Information, as those terms are defined below), in compliance with applicable law. Subject to applicable law, our use of such aggregated, de-identified, or anonymized information is not Personal Information.

‍

2. Categories of Sources of Consumer Health Data

‍

We may collect Consumer Health Data from the following categories of sources:

• Directly from you through your interactions with us, such as when you use the Sites or Services, create an account with us, complete electronic forms, upload medical records to our Site or Services, link a wearable and/or Internet of Things device to our Sites or Service, or otherwise contact us via chat, email, phone, or text (altogether “Self-Reported Information”).
• From third party healthcare services providers, laboratory services providers, and other providers of medical and medical-adjacent services, (our “Lab and Provider Partners”), with your permission and in accordance with applicable law and the context in which you provided the data.
• Through linked wearable devices connected to our Services (which may include historical data related to your use of the wearable devices).
• From other third parties, such as our business partners and affiliates.
• From third parties that you choose (such as lab providers).
• From automatic tracking technologies.
• From our creation, inference or generation of Personal Information about you.

**Although Function generally uses third-party Cookies and analytics services for tracking activity on our websites, our websites implement measures designed not to deploy non strictly necessary Cookies for individuals accessing our services who are located in Connecticut, Nevada, or Washington.

‍

3. How We Use Consumer Health Data

‍

We use the Consumer Health Data we collect about you to provide customer service; provide and maintain our Services; product improvement, development and research; internal business purposes, including general business administration; marketing; and for any purpose consistent with your preferences.

‍

We limit our sharing of your test results with third parties. In order to deliver our product and services to you, it may be necessary for us to provide certain information to our Lab and Provider Partners. We do so when such recipients agree to limitations regarding the use of your personal information.

‍

4. To Whom We Disclose Consumer Health Data

We may “share” (as applicable law defines that term) Consumer Health Data with your consent or as we determine necessary to complete your transactions, provide the services you have requested or authorized, or as otherwise permitted or required by applicable law. For example, at your request, we may share Consumer Health Data, such as your Lab Results, with your general practitioner, your specialist, or your provider’s health system.

‍

Under certain circumstances, we may be required to disclose your Consumer Health Data if required to do so by law, in response to valid requests by public authorities, and/or in response to a threat of harm involving an individual’s health and/or safety.

‍

Notwithstanding anything herein to the contrary, we may transfer and assign all right, title, interest, and obligations in and or your Consumer Health Data in connection with an actual or potential merger, acquisition, sale of all or substantially all of our assets with respect to our company or the business unit therein that primarily utilizes your Consumer Health Data, reincorporation, consolidation, reorganization, and/or any other change of control or corporate transaction.

‍

5. Consumer Health Data Privacy Rights

a. Your Rights as a Resident of Nevada, Washington, or Connecticut

‍

Nevada and Washington residents have the following rights in relation to your Consumer Health Data, subject to certain exceptions:

‍

• Right to know. You have the right to know what Consumer Health Data we collect, share, or sell, as those terms are defined under applicable law. You also have the right to obtain a list of all third parties and affiliates with whom we have shared or sold your Consumer Health Data, and an active email address or other mechanism that you may use to contact these third parties. If you are a Washington resident or otherwise subject to Washington law, you also have the right to access your Consumer Health Data that we collect, share, or sell.

• Right to withdraw consent. You have the right to withdraw consent from the future collection or sharing of your Consumer Health Data to the extent we rely upon such consent.

• Right to delete. You have the right to request that we, as well as our service providers and contractors, delete the Consumer Health Data that we collect about you.

• Right to non-discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described above.

‍

Connecticut residents have the following rights in relation to your Consumer Health Data, subject to certain exceptions:

‍

• Right to know and access. You have the right to know what Consumer Health Data we collect, use, disclose, and/or sell or share as those terms are defined under applicable law. You may ask us to provide you a portable copy of this information up to two times in a rolling twelve-month period.

• Right to delete and erase. You have the right to request under certain circumstances that we, as well as our service providers and contractors, delete the Consumer Health Data that we collect about you.

• Right to correct inaccurate Consumer Health Data. You have the right to request the correction of inaccurate Consumer Health Data.

• Right to non-discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described above.

• Right to opt out. You have the right to opt-out of targeted advertising, the sale of your personal data, and profiling decisions that could produce legal or similarly significant effects concerning the consumer.

• Rights concerning sensitive personal data. If you are a Connecticut resident, we cannot process your Consumer Health Data, or use your Consumer Health Data for certain purposes without your affirmative consent.

‍

‍b. Exercising Your Rights as a Resident of Nevada, Washington or Connecticut

‍

Please use the following information to exercise your rights. Please note that any request you submit to us is subject to an identification and residency verification process as permitted under applicable law, as well as certain other procedural requirements that may be noted in the sections below. Additionally, all requests are subject to certain exceptions under applicable law, which may vary. If you are a visually-impaired customer, a customer who has another disability or a customer who seeks support in other language, you may access your privacy rights by emailing us at legal@functionhealth.com.

‍

We do not charge a fee to process or respond to your verifiable consumer request unless its excessive, repetitive, manifestly unfounded, or in accordance with applicable law. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

‍

Depending on applicable law, you may be limited in how many verifiable or authenticated consumer requests you make within a twelve (12) month period. If we have inadvertently collected information on your minor child, you may exercise the above rights on behalf of your minor child. Additionally, in some jurisdictions, you may designate an authorized agent to submit a request on your behalf, and if so, we may require proof of the agent’s authorization by you and/or verification of the agent’s own identity. Generally, a rights request must include:

‍

Sufficient information that allows us to reasonably verify you are the person about whom we collected Consumer Health Data or an authorized representative, which must include, at a minimum, your first and last name and email address.

Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to the request.

‍

We cannot respond to your request or provide you with Consumer Health Data if we cannot verify or authenticate your identity or authority to make the request and confirm that the Consumer Health Data relates to you. We will only use Consumer Health Data provided in a verifiable or authenticated consumer request to verify your (or your authorized agent’s as applicable) identity or authority to make the request.

‍

You are not required to create an account with us to submit a verifiable or authenticated consumer request. However, we do consider requests made through your password protected account sufficiently verified when the request relates to Consumer Health Data associated with that specific account. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

‍

We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please contact legal@functionhealth.com. Except where otherwise noted, we will respond to your request within forty-five (45) days after receipt and we reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days. As described below, in some jurisdictions, an authorized agent may submit a request to exercise your rights on your behalf.

‍

How to submit a request. To exercise any of the rights described in this Privacy Policy, please send your request(s) using one of the following methods:

• Emailing us at legal@functionhealth.com.

• Visiting the contact page at our Site at https://www.functionhealth.com/contact.

• Calling us at (512) 814-6593.

‍

How to appeal decisions about your rights.

‍

• Connecticut. If you are a Connecticut resident and want to appeal our decision with regard to a request that you have made, please Contact Us. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Connecticut’s Office of the Attorney General by phone at (860) 808-5420 or by submitting a form here.

• Nevada. If you are a Nevada resident or located in Nevada and want to appeal our decision with regard to a request that you have made, please Contact Us. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Nevada’s Office of the Attorney General by phone at (702)486-3132 or by submitting a form here.

• Washington. If you are a Washington resident or located in Washington and want to appeal our decision with regard to a request that you have made, please Contact Us. Within forty-five (45)days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Washington’s Office of the Attorney General by phone at (800) 551-4636 or by submitting a form here.

‍

6. Changes to This Policy

We may update our Policy from time to time. We will notify you of any changes by posting the new Policy on this page or other appropriate means. Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). We recommend reviewing Policy periodically for any changes. Your use of the Service after the effective date of any modified Policy indicates your acknowledging that the modified Policy applies to your interactions with the Service and our business.

‍

7. Contact Us

Please contact legal@functionhealth.com if you have any questions about this Policy, or if anything in here does not make sense or seem right to you. We are always open to feedback around our privacy policies and practices. Because email communications are not always secure, please do not include any sensitive information in your email to us. You can also write to us at: 600 Congress Ave, 14th Floor, Austin, TX 78701.