Sanislink Consumer Health Data Privacy Policy

Sanislink Consumer Health Data Privacy Policy Effective date: July 27, 2026 Last updated: July 27, 2026 1. Introduction Sanislink Inc. (“Sanislink,” “we,” “us,” or “our”) provides Sanislink smart-ring products, applications, connected services, account features, and general wellness functionality. This Consumer Health Data Privacy Policy (“Health Data Policy”) explains how Sanislink collects, uses, stores, discloses, shares, and otherwise processes consumer health data through Sanislink products and Services. This Health Data Policy supplements the Sanislink Privacy Policy. If this Health Data Policy conflicts with the Sanislink Privacy Policy regarding information covered by this Health Data Policy, this Health Data Policy controls for that information. Sanislink products and connected services are intended only for general wellness, lifestyle, and informational purposes. They are not medical devices or healthcare services and are not intended to diagnose, treat, cure, or prevent any disease or medical condition, or to provide emergency monitoring. 2. Scope This Health Data Policy applies to consumer health data processed through official Sanislink products, applications, connected services, and authorized backend systems that link to or reference this policy. For purposes of this policy, “consumer health data” means personal information that is linked or reasonably linkable to an individual and that identifies, relates to, describes, reflects, or may reasonably indicate the individual’s past, present, or future physical or mental health status, bodily functions, vital signs, measurements, general wellness patterns, or related inferences, where covered by applicable law. Consumer health data does not include information that has been lawfully deidentified or aggregated so that it cannot reasonably be linked to an identified or identifiable individual, provided that Sanislink maintains the information in deidentified form and does not attempt to reidentify it. 3. Categories of Consumer Health Data We Collect Depending on the Sanislink product, application feature, device, account configuration, permissions, and Services used, Sanislink-authorized systems may collect or process the following categories of consumer health data: 3.1 Activity and Movement Information • step counts; • activity duration; • movement patterns; • activity intensity; • inactivity or sedentary periods; • workout-related information; • activity trends; and • related general wellness summaries or insights. 3.2 Cardiovascular and Physiological Measurements • heart-rate measurements; • resting heart-rate information; • heart-rate trends; • heart-rate variability or HRV; • blood-oxygen or SpO2 measurements; • skin-temperature measurements; • physiological trends; and • related general wellness summaries or insights. 3.3 Sleep-Related Information • sleep duration; • estimated sleep stages; • sleep timing; • sleep consistency; • sleep-related trends; • nighttime movement; • sleep-quality indicators; and • related general wellness summaries or insights. 3.4 Recovery, Stress, and Habit Information • recovery-related estimates; • stress-related estimates; • readiness or similar general wellness indicators; • habit-related information; • behavioral or routine trends; • dashboard information; • trend information; and • general wellness insights generated from supported measurements. 3.5 Physical and Profile Information Where provided by the user or required to provide requested features, Sanislink may process: • age or age range; • sex or gender information where voluntarily provided; • height; • weight; • ring size; • dominant hand or wearing preference; • activity preferences; • sleep preferences; and • other profile information used to configure general wellness features. 3.6 Device, App, and Service Information Associated with Consumer Health Data We may process information that is linked to or used with consumer health data, including: • device serial number or other device identifier; • device-pairing status; • device-assignment status; • activation and registration status; • firmware version; • battery status; • connectivity status; • app-operation events; • device diagnostic information; • account identifier; • subscription or service-access status; • service-period start and end dates; • support and troubleshooting records; and • related account, product, or service metadata. 3.7 Verified Wear-Hour Records For certain operational, service, eligibility, or ecosystem functions, Sanislink may retain minimized verified wear-hour buckets or related ledger records. Verified wear-hour records are operational summaries. They do not themselves contain raw heart-rate, HRV, SpO2, skin-temperature, motion, or sleep telemetry. Because verified wear-hour records may be linked to an account or device and may reflect device-wearing behavior, Sanislink treats them as protected information under this Health Data Policy where applicable law classifies them as consumer health data. 3.8 Health-Related Inferences Sanislink may generate general wellness trends, scores, summaries, or inferences from supported measurements and account information. These outputs are intended only for general wellness, lifestyle, and informational purposes. They are not medical diagnoses, clinical conclusions, treatment recommendations, or emergency alerts. 4. Categories of Consumer Health Data We Do Not Intend to Collect Sanislink does not intend to collect or use the following information through its ordinary smart-ring and connected-service operations unless a future feature is separately disclosed and any legally required consent is obtained: • medical diagnoses; • treatment records; • prescription or medication records; • health-insurance records; • genetic sequence data; • reproductive or sexual health records; • gender-affirming care records; • medical-procedure records; • government-issued identification for health-data processing; • precise location information that identifies visits to health care facilities; or • biometric identifier templates used to identify or authenticate a person. Sanislink does not intend to use heart-rate, SpO2, HRV, skin-temperature, sleep, activity, or other general wellness measurements to identify or authenticate an individual. 5. Sources of Consumer Health Data Sanislink may collect consumer health data from the following categories of sources: 5.1 Directly from You We may collect information that you enter, submit, confirm, upload, or otherwise provide through: • the Sanislink application; • account setup; • profile settings; • product registration; • support communications; • device setup; • questionnaires or preferences; and • other requested features. 5.2 From Sanislink Smart-Ring Sensors and Devices We may receive measurements, device events, and related information generated by or transmitted from a Sanislink smart ring or another Sanislink-authorized connected device. 5.3 From the Sanislink Application and Authorized Backend Systems We may generate or process: • device-pairing and activation records; • app-operation events; • dashboards; • trends; • wellness summaries; • verified wear-hour records; • service-status records; • diagnostic records; and • information necessary to provide requested connected features. 5.4 From Devices, Operating Systems, or Services You Choose to Connect Where Sanislink offers an optional integration and you enable it, we may receive information from a device operating system, platform, application, or service that you choose to connect. Before introducing or enabling a materially new integration that collects or shares additional categories of consumer health data, Sanislink will update this policy and obtain any consent required by applicable law. 5.5 From Authorized Processors Sanislink may receive consumer health data or related technical information from authorized service providers that process such information on Sanislink’s behalf and according to Sanislink’s instructions. 6. Purposes for Collecting and Using Consumer Health Data Sanislink may collect and use consumer health data for the following purposes: 6.1 Providing Requested Product and App Functionality • connecting and pairing a Sanislink smart ring; • activating and registering a device; • receiving supported sensor measurements; • displaying dashboards, summaries, measurements, and trends; • calculating general wellness indicators; • providing activity, sleep, recovery, stress, and habit-related features; • maintaining account and service functionality; • enabling data exports requested by the user; and • providing other connected features requested by the user. 6.2 Device and Service Operations • verifying device status; • maintaining device assignments; • managing firmware and connectivity; • maintaining verified wear-hour records; • administering annual service status; • troubleshooting technical issues; • maintaining service continuity; and • supporting product operation. 6.3 Customer Support • responding to questions; • investigating device or app issues; • reviewing user-provided screenshots, logs, or measurements; • diagnosing connectivity or firmware problems; • resolving account or device-assignment issues; and • providing requested support. 6.4 Security, Fraud Prevention, and Abuse Prevention • authenticating users and devices; • preventing unauthorized account or device access; • detecting misuse, fraud, or manipulation; • maintaining system integrity; • investigating security incidents; and • protecting users, Sanislink, and service providers. 6.5 Product and Service Improvement Sanislink may use consumer health data where permitted by law and limited to what is reasonably necessary to: • identify errors; • assess feature performance; • improve algorithms and user experience; • improve device reliability; • improve app and backend functionality; and • develop general wellness features. Where required by law, Sanislink will obtain affirmative consent before using consumer health data for a materially different improvement, research, analytics, or development purpose. Whenever reasonably practical, Sanislink aims to use aggregated, deidentified, or minimized information for product and service improvement. 6.6 Legal and Compliance Purposes Sanislink may process consumer health data where reasonably necessary to: • comply with applicable law; • respond to valid legal process; • establish, exercise, or defend legal claims; • investigate violations of applicable terms or policies; • respond to privacy requests; and • meet security-incident or breach-notification obligations. 7. Consent and Requested Services Sanislink collects and uses consumer health data: • to the extent reasonably necessary to provide a product or service that the consumer has requested; or • with the consumer’s affirmative consent where consent is required by applicable law. Where separate consent is legally required for sharing, Sanislink will request consent that is separate and distinct from consent to collect consumer health data. A consent request may identify: • the categories of consumer health data involved; • the purposes of collection or sharing; • the categories of recipients; • how the information will be used; and • how consent may be withdrawn. Sanislink will not rely on acceptance of general Terms of Service alone as consent where applicable law requires a separate, specific, affirmative opt-in. 8. Categories of Consumer Health Data We Share Sanislink may share or permit processing of the following categories of consumer health data only as reasonably necessary to provide requested Services, operate authorized systems, maintain security, provide support, or comply with law: • activity and movement information; • cardiovascular and physiological measurements; • sleep-related information; • recovery, stress, and habit information; • profile information used to configure general wellness features; • health-related trends, summaries, and inferences; • device and app information associated with consumer health data; • verified wear-hour records; • support information containing consumer health data; and • security or diagnostic information associated with consumer health data. Sanislink does not intend to share all categories with every processor. Each processor is intended to receive only the information reasonably necessary for its authorized function. 9. Categories of Recipients Sanislink may disclose consumer health data to the following categories of recipients: 9.1 Cloud, Database, and Application-Infrastructure Processors These processors may host, store, secure, retrieve, transmit, or process consumer health data on Sanislink’s behalf to provide requested app and connected-service functionality. 9.2 Technical Support, Security, and System-Monitoring Providers These providers may process limited consumer health data or related diagnostic information when reasonably necessary to investigate a support request, maintain security, or resolve a technical issue. 9.3 Professional Advisers Sanislink may disclose limited consumer health data to legal counsel, auditors, cybersecurity specialists, insurers, or other professional advisers where reasonably necessary and subject to confidentiality or professional obligations. 9.4 Government Authorities and Legal Recipients Sanislink may disclose consumer health data where required by applicable law, valid legal process, court order, or a lawful request from a government authority, or where reasonably necessary to establish, exercise, or defend legal rights. 9.5 Corporate-Transaction Recipients Consumer health data may be transferred as part of a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction, subject to applicable law and the recipient’s obligations to protect the data. 9.6 At Your Direction Sanislink may disclose consumer health data to a person or service when you request, direct, authorize, or affirmatively consent to the disclosure. 10. Specific Affiliates and Service Providers As of the Last Updated date: • Sanislink does not currently share consumer health data with any corporate affiliate. • Supabase, Inc. may process consumer health data on Sanislink’s behalf for authorized database, authentication, backend, storage, and application-infrastructure functions. Sanislink may use additional processors in the future only after evaluating the processing, updating this policy where required, and obtaining any legally required consent before collecting, using, or sharing additional categories of consumer health data or using consumer health data for additional purposes. Sanislink does not intend to disclose raw consumer health data to Shopify, Shopify Network Intelligence, payment providers, advertising networks, marketing partners, Make, Slack, manufacturers, fulfillment providers, shipping carriers, or customs providers. Limited account, order, service-status, device-assignment, internal operational, or support information that does not contain raw consumer health measurements may be processed through separate authorized business systems as described in the Sanislink Privacy Policy. 11. No Sale of Consumer Health Data Sanislink does not sell consumer health data. Sanislink does not exchange consumer health data for monetary or other valuable consideration. Sanislink will not sell consumer health data unless it first obtains a separate valid authorization that satisfies all applicable legal requirements. A general consent, acceptance of Terms of Service, or consent to collect consumer health data will not be treated as authorization to sell consumer health data. 12. Advertising and Cross-Context Behavioral Advertising Sanislink does not intentionally use consumer health data for cross-context behavioral advertising, targeted advertising, advertising profiles, or audience creation. Sanislink does not intentionally provide raw consumer health measurements, wellness trends, health-related inferences, or verified wear-hour records to Shopify Network Intelligence, advertising networks, marketing partners, or data brokers. Website and ecommerce information that does not constitute consumer health data may be processed separately as described in the Sanislink Privacy Policy and through the privacy choices available on the official Sanislink online store. 13. Third-Party Collection Across Websites or Online Services Sanislink does not knowingly permit a third party to collect consumer health data over time and across unrelated websites or online services for targeted advertising or independent commercial profiling. Authorized processors may process consumer health data within Sanislink Services only as necessary to provide requested functionality and according to contractual or legal obligations. 14. Geofencing Sanislink does not use geofencing technology around health care facilities to: • identify or track consumers seeking health care services; • collect consumer health data; • send health-related messages or advertisements; or • infer that a consumer is seeking health care services. Sanislink does not intend to use precise location information to identify visits to health care facilities or to target consumers based on such visits. 15. Data Minimization and Purpose Limitation Sanislink aims to collect and process consumer health data that is reasonably necessary and proportionate for the disclosed purposes. Sanislink will not collect, use, or share an additional category of consumer health data not disclosed in this policy without first updating this policy and obtaining affirmative consent where required. Sanislink will not use consumer health data for an additional purpose not disclosed in this policy without first updating this policy and obtaining affirmative consent where required. Temporary raw payloads, working copies, prompts, diagnostic records, or intermediate processing data may be deleted, minimized, or deidentified after use where technically and operationally appropriate. 16. Consumer Health Data Rights Depending on where you reside and applicable law, you may have the following rights: 16.1 Right to Confirm and Access You may request confirmation of whether Sanislink is collecting, sharing, or selling consumer health data concerning you. You may request access to consumer health data maintained about you. Where required by applicable law, you may also request a list of third parties or affiliates with which Sanislink has shared or sold your consumer health data and available contact information for those recipients. 16.2 Right to Withdraw Consent You may withdraw consent from future collection or sharing of consumer health data where processing is based on consent. Withdrawal does not affect processing lawfully completed before the withdrawal. Withdrawing consent may prevent Sanislink from providing some or all connected features that require the applicable consumer health data. 16.3 Right to Delete You may request deletion of consumer health data concerning you. Subject to applicable law, Sanislink will delete covered consumer health data from active systems and notify applicable processors, contractors, and other recipients of the deletion request. Where consumer health data is stored in archived or backup systems, deletion may be delayed until those systems are restored or overwritten, subject to applicable legal deadlines. Where Washington law applies, this delay will not exceed six months after authentication of the deletion request. Sanislink may retain information where retention is permitted or required by applicable law, including limited records necessary for security, fraud prevention, legal compliance, dispute resolution, or documenting a privacy request. 16.4 Right to Correct Where provided by applicable law, you may request correction of inaccurate consumer health data. Certain sensor-generated measurements may not be technically editable. In those cases, Sanislink may provide another available remedy, such as deletion, annotation, recalculation, or account correction, where appropriate. 16.5 Right to Portability Where provided by applicable law and technically feasible, you may request a portable copy of certain consumer health data. 16.6 Right to Appeal If Sanislink refuses or is unable to fulfill a consumer health data request, you may appeal the decision by contacting compliance@sanislink.com and stating that your message is a “Consumer Health Data Privacy Appeal.” Sanislink will review the appeal and respond within the period required by applicable law. 16.7 Right to Non-Discrimination Sanislink will not unlawfully discriminate against you for exercising an applicable consumer health data right. 17. How to Exercise Your Rights Submit a consumer health data request by emailing: compliance@sanislink.com You may also contact: support@sanislink.com Use the subject line: Consumer Health Data Privacy Request Please include: • your full name; • the email address associated with your Sanislink account; • the right you wish to exercise; • the relevant device or account information, where known; and • enough information for Sanislink to identify the relevant records. Do not send passwords, verification codes, complete payment-card numbers, government identification, or unnecessary health information by ordinary email. Sanislink may request additional information reasonably necessary to authenticate your identity and protect consumer health data from unauthorized disclosure or deletion. You are not required to create a new Sanislink account to submit a request. Sanislink may ask you to use an existing account where appropriate and permitted by law. Where permitted by law, an authorized agent may submit a request on your behalf. Sanislink may require evidence that the agent is authorized and may ask you to verify your identity or confirm the request directly. Sanislink will provide responses free of charge to the extent required by applicable law. Manifestly unfounded, excessive, or repetitive requests may be handled as permitted by law. 18. Withdrawal of Consent and Service Effects You may withdraw applicable consent by contacting compliance@sanislink.com or through an available in-app privacy control. If you withdraw consent to collect consumer health data required for a requested connected feature, Sanislink may be unable to continue providing that feature. Withdrawal may affect: • sensor-data synchronization; • dashboards; • trends; • general wellness insights; • sleep, activity, recovery, or stress-related features; • verified wear-hour calculations; • device-linked history; or • other connected functionality. Sanislink will explain material service effects where reasonably possible. 19. Data Retention Sanislink retains consumer health data only for as long as reasonably necessary to: • provide requested Services; • maintain device and account functionality; • provide dashboards, trends, and wellness features; • provide support; • maintain security; • detect fraud or misuse; • respond to privacy requests; • comply with legal obligations; and • establish, exercise, or defend legal claims. Retention periods vary depending on: • the category of consumer health data; • the requested feature; • account and service status; • device status; • user preferences; • legal requirements; • security needs; • support activity; and • pending disputes or investigations. When consumer health data is no longer reasonably necessary, Sanislink will delete, deidentify, or restrict it as appropriate, subject to applicable law and technical limitations. 20. Deidentified and Aggregated Data Sanislink may create deidentified or aggregated information from consumer health data for security, analytics, performance assessment, product improvement, or business planning. When Sanislink treats information as deidentified data, Sanislink will take reasonable measures designed to prevent the information from being linked to an identified or identifiable consumer and will not attempt to reidentify it except where permitted by law to test the effectiveness of deidentification safeguards. Sanislink will require recipients of deidentified data to maintain it in deidentified form where required by applicable law. 21. Security Sanislink uses reasonable administrative, technical, and organizational safeguards designed to protect consumer health data. Safeguards may include: • access controls; • authentication; • role-based permissions; • encryption where appropriate; • secure cloud and database services; • system monitoring; • credential management; • data minimization; • logging and incident-response procedures; • processor agreements; and • restrictions on internal access. No transmission, storage, device, application, or security system is completely secure. Sanislink cannot guarantee absolute security. Users should protect account credentials and should not share passwords, verification codes, API keys, or other access credentials. 22. Security Incidents and Breach Notification Sanislink maintains procedures designed to identify, investigate, contain, and respond to security incidents involving consumer health data. Where required by applicable law, Sanislink will provide notice to affected individuals, government authorities, regulators, or other recipients following a qualifying breach or unauthorized disclosure. 23. International Processing Sanislink and authorized processors may store or process consumer health data in the United States and other countries where authorized infrastructure providers operate. Those countries may have privacy laws that differ from the laws of your country or region. Where required by applicable law, Sanislink or the applicable processor will use recognized safeguards for international transfers. Sanislink does not intend to provide raw consumer health data to manufacturing, fulfillment, shipping, customs, or China-based supply-chain personnel. 24. Children’s Consumer Health Data Sanislink Services are not directed to children under 13 years of age. Sanislink does not knowingly collect consumer health data online from a child under 13 without legally required parental or guardian authorization. Additional age, consent, or authorization requirements may apply depending on the consumer’s location and the information involved. If you believe that a child has provided consumer health data without legally required authorization, contact compliance@sanislink.com. 25. Material Changes to This Health Data Policy Sanislink may update this Health Data Policy to reflect changes in products, features, data practices, processors, legal requirements, or operations. Sanislink will publish the updated policy and revise the “Last updated” date. Where required by applicable law, Sanislink will provide additional notice of a material change. Sanislink will not begin collecting, using, or sharing an additional category of consumer health data, or use consumer health data for an additional purpose, without first providing any disclosure and obtaining any consent required by applicable law. 26. Mandatory Rights Nothing in this Health Data Policy excludes, restricts, or modifies any consumer right or remedy that cannot legally be excluded, restricted, or modified. Where this Health Data Policy conflicts with a mandatory applicable legal requirement, the mandatory legal requirement will apply. 27. Contact Sanislink Inc. Official Online Store: shop.sanislink.com Consumer Health Data, Privacy, and Compliance Requests: compliance@sanislink.com General Support: support@sanislink.com