Consumer Health Data Privacy Policy

1. Introduction and Scope

Vision Optimized LLC ("Vision Optimized," "VO," "we," "our," or "us") is a New Jersey company that offers consumer applications that collect consumer health data, including the Health Suite, Vital Rhythms, and Heartbeat applications and any other consumer application we make available that collects consumer health data. This Consumer Health Data Privacy Policy explains how we collect, use, share, and protect consumer health data through those applications and any related websites and services.

"Consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. This includes information such as health conditions, treatment, diagnoses, measurements of bodily or biological functions, vital signs, use or purchase of health-related products, and any information that a company uses to associate a consumer with the categories above.

This is a standalone policy. It is required by the Washington My Health My Data Act and addresses comparable requirements under the Nevada consumer health data law and the Connecticut Data Privacy Act. It exists on its own webpage, separate from our general privacy policy, and governs only consumer health data.

This policy works alongside our general privacy policy. Where our general privacy policy describes our overall data practices, this policy controls with respect to consumer health data. If there is any conflict between the two regarding consumer health data, this policy governs.

Vision Optimized is not a HIPAA-covered entity, and the information we handle through these applications is generally not protected health information under HIPAA. Consumer health data laws apply to this information instead, and this policy describes the protections we provide under those laws.

2. Categories of Consumer Health Data We Collect

Depending on which application you use and the features you turn on, we may collect the following categories of consumer health data:

Health measurements and vital signs that you record or that a connected device shares, such as heart rate, sleep, activity, and similar readings.

Health conditions, symptoms, and wellness information that you enter or that the application infers to deliver a feature.

Information about your use of health-related features, products, or services within the applications.

Health Suite: health information you enter or upload about yourself, including conditions, symptoms, medications, measurements, and the contents of health documents and photographs you choose to store.

Vital Rhythms: wellness information you record about yourself, including daily habits, mood, energy, sleep, and activity, together with any readings shared by a device you connect.

Heartbeat: learning and developmental information you enter or upload, including the contents of educational and therapy documents you choose to store.

COE Smiles: appliance types you select (such as braces, elastics, aligners, expander, facemask, or retainer), your treatment start date and estimated duration, habit logs you record (such as elastic, aligner, and bracket days), saved visit dates and any notes you choose to add, and, where you use the document scan feature, treatment-plan details drawn from documents you upload, such as treatment type, steps, and duration.

We collect this data from the following sources: directly from you when you enter it or set up a feature; automatically from your device or connected devices when you enable a feature that uses them; and, where applicable, from third parties you authorize to share data with us.

3. How and Why We Collect and Use It

We collect and use consumer health data to deliver the features you ask us to provide. For each feature you turn on, we collect only the consumer health data that is necessary to make that feature work, and we use it for that purpose.

Examples of how we use consumer health data to deliver a feature you request include: providing the readings, trends, insights, and reminders that a feature is designed to show you; operating, maintaining, and securing the application and the feature you enabled; and responding to your requests and providing support.

We treat any collection or use of consumer health data that goes beyond what is necessary to deliver the feature you asked for as a separate act that requires your separate opt-in consent, as described in Section 4. We do not use consumer health data for those additional purposes unless you have given that consent.

For example, we analyze consumer health data to understand how our features are used and to improve and develop our products, and we do this only with your separate opt-in consent under Section 4. We may also analyze de-identified or aggregated data, which is not consumer health data, to improve and develop our products, and we keep that data in de-identified form and require recipients to do the same.

4. Consent

We build consent as a series of separate, layered opt-ins. We do not rely on a single blanket agreement to cover every use of consumer health data. Each of the acts below is treated separately, and each has its own consent step.

4.1 Collection necessary to deliver a feature

We do not ask for separate consent to collect the consumer health data that is necessary to deliver a feature you have asked us to provide. Turning on and using that feature is what authorizes the collection needed to make it work.

4.2 Collection beyond the necessary minimum

Before we collect any consumer health data beyond what is necessary to deliver the feature you asked for, we obtain your separate opt-in consent. You choose whether to allow it, and declining does not affect the feature you originally requested.

4.3 Sharing consumer health data

Before we share your consumer health data, we obtain your separate opt-in consent for that sharing. This consent is distinct from any consent to collect, and you can allow collection while declining sharing.

4.4 Sale of consumer health data

Before any sale of your consumer health data, we obtain your distinct, written authorization that is signed by you. This authorization is separate from every other consent described in this policy. Our current practice on sale is described in Section 6.

4.5 Records and withdrawal of consent

We keep a dated record of every consent and authorization you provide. You may withdraw any consent at any time, and withdrawing consent is as easy as giving it. You can withdraw consent through the in-app privacy settings or by contacting us at support@visionoptimized.com. Withdrawal applies going forward and does not affect processing that already took place while your consent was in effect. Each consent and authorization you give extends to a successor entity that assumes control of our assets in a merger, acquisition, bankruptcy, or similar transaction, so long as the successor uses your consumer health data only for the purposes you agreed to and complies with applicable law.

5. How We Share It, Including AI Processing

When we share consumer health data, we share it with the following categories of recipients: service providers and processors that perform functions on our behalf, such as hosting, storage, analytics, and customer support; third-party artificial intelligence providers that process content you submit in order to deliver a feature, such as Anthropic (Claude) accessed through its API; specific affiliates with whom we share consumer health data: none — we do not currently share consumer health data with any affiliate, and if that changes, we will update this policy and obtain any consent required before sharing; a successor entity in a merger, acquisition, bankruptcy, or other transaction in which the successor assumes control of all or part of our assets (any successor receives consumer health data subject to this policy and to the consents you have given, and must comply with applicable consumer health data laws); and government or legal authorities where we are required to disclose by law.

The categories of consumer health data we share are the categories described in Section 2: health measurements and vital signs; health conditions, symptoms, and wellness information; information about your use of health-related features, products, or services; and the app-specific categories listed in Section 2. We share these categories only as described in this policy and, where consent is required, only with your consent.

Some of our applications transmit content you provide to third-party AI models so the model can generate the result a feature is designed to deliver. That transmission is processing of consumer health data. When it goes beyond delivering the feature you asked for, it is also sharing, and we obtain your separate opt-in consent under Section 4 before it occurs.

We treat every third-party AI provider that receives consumer health data as a processor. Washington law requires a contract that limits how a processor may use consumer health data, and we bind our AI providers and other processors to contracts that restrict their use of consumer health data to the purposes we authorize and that prohibit them from using it for their own purposes.

6. Sale of Consumer Health Data

We do not sell consumer health data. We do not exchange consumer health data for money or other valuable consideration. A transfer of consumer health data to a successor entity as an asset in a merger, acquisition, bankruptcy, or other transaction in which the successor assumes control of all or part of our assets is not a sale under Washington law, provided the successor complies with that law, and any such transfer remains subject to this policy and to your consents.

If this ever changes, we will not sell any consumer health data without first obtaining the distinct, written authorization signed by you that is described in Section 4.4, and we will update this policy before doing so.

7. Your Rights

You have the following rights with respect to your consumer health data: confirm whether we collect, share, or sell your consumer health data, and access the specific consumer health data we have collected about you; obtain a list of the third parties and affiliates with whom we have shared your consumer health data, and, where applicable, an active email address or other online contact for those recipients; withdraw any consent you have given to the collection, use, or sharing of your consumer health data; delete your consumer health data (when you ask us to delete it, we delete it from our records and notify our processors, affiliates, and other recipients to delete it from their records as well); and appeal a denial of any request (if we decline a request, we will explain why, and you may appeal).

To exercise any of these rights, contact us at support@visionoptimized.com or use the privacy controls in the application. We will respond within the time required by the applicable state law, which is generally within 45 days of receiving your request, with one extension where allowed. If we deny a request, we will provide instructions for appealing, and we will respond to an appeal within the time the applicable law requires.

You may use an authorized agent to submit a request on your behalf. To do so, have your agent send the request to support@visionoptimized.com along with written permission signed by you authorizing the agent to act for you. We may contact you directly to confirm that you gave permission and to verify your identity before we act on the request. If your agent holds a valid power of attorney for you, written permission is not required.

8. Data Retention and Security

We keep consumer health data only for as long as necessary to deliver the feature you requested, to provide the services you use, and to meet our legal obligations. When consumer health data is no longer needed for those purposes, we delete or de-identify it.

We maintain administrative, technical, and physical safeguards designed to protect consumer health data against unauthorized access, use, disclosure, alteration, and destruction. We limit access to consumer health data to personnel and processors who need it to perform the functions described in this policy, and we require them to protect it.

9. No Geofencing

We do not use a geofence around any health care facility to track consumers, collect consumer health data, or send messages, notifications, or advertisements to consumers based on their proximity to such a facility. This includes the geofencing restrictions under the Washington and Nevada laws, and the Connecticut prohibition on geofences within 1,750 feet of any mental health, reproductive, or sexual health facility.

10. Processors and Service Providers

We use processors and service providers to help us operate the applications. Every processor and service provider that handles consumer health data on our behalf is bound by a contract that limits its use of consumer health data to the purposes we authorize, prohibits it from using consumer health data for its own purposes, and requires it to protect the data and to delete it when we direct. This includes the third-party AI providers described in Section 5.

11. State-Specific Disclosures

11.1 Washington

This policy is our consumer health data privacy policy under the Washington My Health My Data Act. It applies to Washington consumers and to consumer health data collected from them. It describes the categories of consumer health data we collect, the purposes for collection and use, the categories of sources, the categories of consumer health data we share and the categories of recipients, and how you can exercise your rights. We obtain consent before collecting consumer health data beyond what is necessary to deliver a requested product or service, obtain separate consent before sharing, and obtain a signed authorization before any sale.

11.2 Nevada

For Nevada consumers, we handle consumer health data consistent with Nevada's consumer health data law. We do not collect, use, or share consumer health data without the consent required by that law, we do not sell consumer health data without your authorization, and we do not use geofencing around health care facilities as described in Section 9.

11.3 Connecticut

For Connecticut consumers, we handle consumer health data consistent with the consumer health data provisions of the Connecticut Data Privacy Act. We obtain consent before collecting or sharing consumer health data as required by that law, honor your rights to access, delete, correct, and opt out, and do not use a geofence within 1,750 feet of any mental health, reproductive, or sexual health facility.

12. Changes to This Policy

We may update this policy from time to time. When we make a material change, we will post the updated policy on its webpage and revise the "Last Updated" date below. Where a change materially affects consumer health data we already collected, we will obtain your consent before applying the change to that data.

Effective Date: August 31, 2026

Last Updated: August 31, 2026

13. Contact Us

If you have questions about this policy or want to exercise your rights, contact us at:

Vision Optimized LLC
150 Brooks Bend, Princeton, NJ 08540
support@visionoptimized.com