Effective Date: 6/13/2025

This Consumer Health Data Privacy Policy (“Health Data Privacy Policy”) applies to Frisbee’s collection of consumer personal information defined as “Consumer Health Data” (described below) under certain U.S. state consumer privacy laws, including the Connecticut Data Privacy Act, Nevada’s Consumer Health Data Privacy Law, and the Washington My Health My Data Act, each as amended (collectively, and as applicable, “Consumer Health Privacy Laws”). This Health Data Privacy Policy supplements Frisbee’s Privacy Policy available at https://www.frisbeerewards.com/privacy-policy (“Privacy Policy”) and any capitalized but not defined terms in this Health Data Privacy Policy will have the definitions set forth in the Privacy Policy or Consumer Health Privacy Laws. ‍‍

Collection of Consumer Health Data

“Consumer Health Data” is personal information that is linked or reasonably linkable to a consumer and that identifies, or that Frisbee uses to identify, a consumer's past, present, or future physical or mental health status. Consumer Health Data does not include information that is publicly available, de-identified, or aggregated. The Consumer Health Data we collect may differ depending on how you interact with us. For example, you may choose to upload a receipt from a health related purchase in our Frisbee app or a loyalty linked account may include a health related purchase.

Categories of Consumer Health Data We Collect

Frisbee only collects Consumer Health Data as needed to provide you with the products and services that you have requested or with your consent. We may collect the following Consumer Health Data:

• [NV, WA] Use or purchase of prescribed medication;
• [NV, WA] Diagnoses or diagnostic testing, treatment, or medication;
• [CT, NV, WA] Reproductive or sexual health information;
• [NV, WA] Precise location information that could reasonably indicate, or that Frisbee uses to indicate, a consumer's attempt to acquire or receive health services or supplies;
• [WA] Data that identifies a consumer seeking health care services; or
• [NV, WA] Any information that a regulated entity or a small business, or their respective processor, processes to associate or identify a consumer with the data described above that is derived or extrapolated from nonhealth information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning).

Categories of Sources of Consumer Health Data

As described in the Categories of Personal Data section of Frisbee Privacy Policy, we may collect Personal Information, including Consumer Health Data, directly from you (when you use our products and services).

Our Purposes for Collecting and Using Consumer Health Data

We may collect, use, disclose, or otherwise process your Consumer Health Data as reasonably necessary for various purposes as described in the Our Commercial and Business Purposes for Collecting Personal Information and Other Permitted Purposes for Processing Personal Information but primarily to provide you with products and services as you have requested or authorized.

How We Disclose Your Consumer Health Data

As further described in our Privacy Policy, we may disclose your Consumer Health Data to certain third parties and our affiliates, which may include:

• Vendors. We may disclose your Consumer Health Data to service providers, analytics partners, business partners, and vendors to provide and improve our Services to you.‍
• Other Parties. We may disclose your Consumer Health Data to other parties that you explicitly gave us consent to do so.‍
• Affiliates. Specifically, our affiliates, including: Attain, Klover, and Merryfield.

Consumer Health Data Rights

If you are a Connecticut, Nevada, or Washington resident, you may have rights with respect to your Consumer Health Data as described below. Your rights may be subject to certain conditions and exceptions under Consumer Health Privacy Laws.

• Access and Portability: You have the right to request confirmation of whether or not we are processing your Consumer Health Data and to access your Consumer Health Data and request a copy of your Consumer Health Data in a machine-readable format, to the extent technically feasible. If you are a Nevada or Washington resident, you may also request a list of all third parties and affiliates to whom we have disclosed or sold you Consumer Health Data and their contact information.‍
• Correction: You have the right to correct inaccuracies in your Consumer Health Data, to the extent such correction is appropriate in consideration of the nature of such data and our purposes of processing your Consumer Health Data.‍
• Deletion: You have the right to request that we delete the Consumer Health Data that we have collected about you.‍
• Opt-Out of Sale, Targeted Advertising, and Profiling: You have the right to opt-out of sale and/or processing of your Consumer Health Data for targeted advertising and profiling purposes.‍
• Withdraw Consent: You have the right to withdraw consent from us collecting and disclosing your Consumer Health Data.‍
• Nondiscrimination: You have the right not to be discriminated against for exercising your rights as described above.‍
• Appeal: If we refuse to take action on your request within a reasonable period of time after receiving your request in accordance with applicable law, you may appeal our decision. If we deny your appeal, you have the right to contact your state's Attorney General (CT, NV, and WA).

To exercise your rights, you must submit a request to us with verifiable information ("Valid Request"). We may not respond to requests that are not submitted properly or that we cannot verify.

You may submit a Valid Request by using the following methods:

• Complete the online form found here.
• Email us at support@frisbeerewards.com.

If you have any questions about this section or whether any of the following rights apply to you, please contact us at support@frisbeerewards.com.

‍