SHIFTS APP LLC

This Notice applies to consumer health data and is separate from our general Privacy Policy. It is provided under the Washington My Health My Data Act, the Nevada consumer health data law (SB 370), and the Connecticut Data Privacy Act. If you live in Washington or Nevada, or if you are a Connecticut resident, this Notice describes how we handle information about you that relates to your health, and the rights you have over it.

SHIFTS APP LLC ("Shifts," "we," or "us") operates the SHIFTS: EATING DISORDER HELP mobile application (the "App") and the website at https://theshiftsapp.com (the "Website"). We are the entity responsible for the consumer health data described here.

1. What We Treat as Consumer Health Data

The App provides audio content for people working on eating disorder recovery. Because of what the App is, the simple fact that you have it or use it says something about your health. We therefore treat all of the following as consumer health data:

• The fact that you have downloaded, installed, registered for, or used the App.
• Your name and email address, when connected to your account.
• The fact that you signed in using Apple or Google.
• Whether you hold a paid subscription.
• Technical information your device sends when you use the App, such as device type and IP address.
• Anonymous information about how the App is used, which is not linked to your name or email address.

We do not collect information about your diagnosis, symptoms, weight, body measurements, food intake, treatment, or care providers. The App has no journaling feature and no free-text entry. Some of our audio content invites you to journal or reflect on your own, but you do that outside the App, and we never see it. We do not collect precise location data, and we do not collect biometric data.

2. Where It Comes From

• From you, when you create an account or contact us for support.
• From Apple or Google, when you sign in. Apple gives us your name and an email address, and lets you hide your real address behind a private relay address. Google gives us your email address and the first or full name on your Google profile.
• Automatically from your device, in the form of basic technical information needed to run the App.

3. Why We Collect It

We use consumer health data only to:

• Create and operate your account and let you sign in.
• Provide the App and its content to you.
• Manage your subscription and billing through the app store.
• Respond when you contact us for support.
• Keep the App running and fix technical problems.
• Keep the App secure, fix technical errors, and comply with the law.
• Understand how the App is used, in anonymous form, so we can improve it.

We do not use consumer health data for advertising or marketing based on your health, for profiling, or for any automated decision that produces legal or similarly significant effects. We do not use it to train artificial intelligence models.

4. Who We Share It With

We do not sell consumer health data. Washington and Nevada law prohibit selling it without a valid written authorization, and we do not seek one. We share consumer health data only with the following service providers, each of which is contractually required to process it only on our instructions and only to run the App:

• Supabase, Inc., which hosts our database and handles account sign-in. Our database is located in Stockholm, Sweden.
• Mixpanel, Inc., which provides product analytics. Mixpanel identifies you only by an anonymous, randomly generated identifier created on your device. It does not receive your name, email address, advertising identifier, IP-based location, or any free text, and event names do not describe the specific content you view.
• Google LLC, through Firebase Crashlytics, which records technical errors and crashes. Crashlytics receives the type and model of your device, its operating system and app version, and the technical state of the App at the time of the error. It does not receive your name or email address.
• Cloudflare, Inc., which stores our audio and media files.
• Directus GmbH, hosted on Vultr Holdings LLC, which runs our internal content management system.
• Google LLC, through Firebase Cloud Messaging, which delivers push notifications.
• AppsFlyer Ltd., which powers the shareable links that open specific content inside the App. We use AppsFlyer only to route links. We have disabled its advertising attribution features, switched off data sharing with all advertising partners, and configured it not to collect advertising identifiers.
• RevenueCat, Inc., for subscription management. RevenueCat receives an anonymous app user identifier, your subscription status, and purchase events. It does not receive your name or email address.
• Apple Inc. and Google LLC, as app store operators, for account sign-in and subscription processing.
• Hotshots Labs, our software development contractor, which maintains the App and has administrative access to our systems.

We do not use advertising networks or advertising analytics providers, and we do not share consumer health data with any advertising network, ad measurement service, or data broker.

We may also disclose consumer health data where the law requires it, such as in response to a court order or lawful government request, or to protect the safety of any person. If our business is sold or transferred, we will give you notice before your consumer health data becomes subject to a different privacy notice.

5. Consent

We ask for your consent before we collect consumer health data that is not strictly necessary to provide the App you asked for, and we ask separately before we would share it beyond what is described above. You can withdraw consent at any time in the App settings or by emailing privacy@theshiftsapp.com. Withdrawing consent does not affect anything we did before you withdrew it, and we will pass the withdrawal on to our service providers.

6. How Long We Keep It

• Account information, including name and email address: deleted within 30 days after you delete your account.
• Anonymous analytics data: deleted within 12 months of collection.
• Technical error and crash records: deleted within 90 days of collection.
• Billing and tax records: kept for as long as the law requires.

7. Your Rights

If you live in Washington or Nevada, you have the right to:

• Confirm whether we collect, share, or sell your consumer health data.
• Access your consumer health data, including a list of all third parties with whom we have shared it, and contact information for each.
• Withdraw consent to our collection or sharing of your consumer health data.
• Have your consumer health data deleted.

If you are a Connecticut resident, consumer health data is sensitive data under Connecticut law. We process it only with your consent, and you have the rights to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising, sale, and profiling. As stated above, we do none of those three things.

When you ask us to delete consumer health data, we will delete it from our records, including from any backups, and we will tell every service provider and third party that received it to do the same.

8. How to Exercise Your Rights

Email privacy@theshiftsapp.com, or write to us at SHIFTS APP LLC, 1 E Erie St, Suite 525-2136, Chicago, IL 60611. Put "Consumer Health Data Request" in the subject line and tell us which right you want to exercise.

We will confirm your request within ten (10) days and respond within forty-five (45) days. If we need more time, we will tell you why and may take up to forty-five (45) additional days. There is no charge for this, and we will not treat you differently for asking. We may need to verify your identity before acting, and we will only use what you give us for that purpose.

You may use an authorized agent to make a request on your behalf if you give them written permission and we can verify it.

9. If We Deny Your Request

If we deny your request, we will tell you why and how to appeal. To appeal, reply to our response or email privacy@theshiftsapp.com with "Appeal" in the subject line. We will decide the appeal within forty-five (45) days and explain the outcome in writing. If we deny the appeal, we will tell you how to complain to your state Attorney General.

10. Users Under 18

The App is available to users aged 13 and over. We do not sell or share the consumer health data of any user under 18, and we do not use it for targeted advertising or profiling. A parent or legal guardian may exercise any of the rights in this Notice on behalf of their child by contacting us at privacy@theshiftsapp.com.

11. Changes to This Notice

If we make a material change to how we handle consumer health data, we will post the updated Notice here, change the date at the top, and ask for your consent again before the change applies to you.

12. Contact Us

SHIFTS APP LLC

1 E Erie St, Suite 525-2136

Chicago, IL 60611

privacy@theshiftsapp.com