Consumer Health Privacy Policy

Last Updated: June 18, 2025

This Consumer Health Privacy Policy provides information regarding how Nayya Health, Inc. (“Nayya,” “we,” “our,” or “us”) processes “consumer health data” and analogous terms as defined by applicable consumer health privacy laws. In the event of a conflict between Nayya’s Privacy Policy and this Consumer Health Privacy Policy, this Consumer Health Privacy Policy will control with respect to the processing of consumer health data subject to such laws.

Consumer health data we collect

We may collect consumer health data in connection with certain of our products and services, such as when you visit our website, use our claims appeal platform, or contact us regarding our services (collectively, the “Services”). The type of consumer health data depends on the Service and your interactions with us. Examples of consumer health data that we collect may include:

information about your health-related conditions, symptoms, status, diagnoses, testing, treatments, or medications, including your use and purchase of such medication;

information about social, psychological, behavioral, and medical interventions;

information about your health-related surgeries or procedures;

information about your insurance and payment for health care services;

biometric data, such as photographs;

gender-affirming care information;

reproductive or sexual health information;

precise location information that could reasonably indicate your attempt to acquire or receive health servicesor supplies, such as proximity to a medical office or hospital;

information that could identify you seeking health care services, such as visits to our website or use of our Services; and

other information that may be used to infer or derive data related to the above or other health information.

How we use consumer health data

We primarily collect and use consumer health data as necessary to provide you with products or services that you request or for other purposes for which we obtain your consent as required by applicable law. This may include the following:

communicating with you and providing support, such as to address your inquiries, sending reminders, and other communications you send us;

creating claims appeal letters, if you use our claims appeal platform, for you to send to your insurance carrier;

operating, evaluating, and improving our business, such as to perform accounting, auditing, record keeping, and other internal functions, conducting research, developing new products and services, analyzingand improving our Services, and personalizing your experience;

complying with law, such as to comply with legal obligations and process and contractual obligations, as well as our policies and terms and conditions; and

any other lawful purpose for which we obtain your consent.

We may also collect and use consumer health data as necessary to protect the rights and safety of us, you, or others, such as to:

prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any activity that is illegal under applicable state law or federal law;

preserve the integrity or security of our systems; and

investigate, report, or prosecute those responsible for any such action that is illegal under applicable state or federal law.

We may deidentify consumer health data so that it cannot reasonably be reidentified by us or by another person, and we may use this deidentified data for any reason permitted by applicable law. If we deidentify information that was originally based on consumer health data, we maintain and use that information in deidentified form and will not attempt to reidentify the data, except as otherwise permitted under applicable law.

Sources of consumer health data

We collect consumer health data:

directly from you;

automatically as you and your devices interact with our online Services;

at your request, if you enable certain integrations with third parties;

from our affiliates, business partners, customers (primarily business entities), or service providers; and

from authorized third-party sources, such as consumer reporting agencies, your employer, your insurer, government agencies or regulators, and social media platforms.

The specific sources of consumer health data depend on the Service and your interaction with us.

How we share consumer health data

We may share each of the categories of consumer health data described in this Consumer Health Privacy Policy as necessary to provide you with the Services, to enable support, with your consent, or for certain security-related purposes, as described above. We may also share consumer health data:

to comply with law or cooperate with lawful requests: We may share your consumer health data with law enforcement agencies, courts, other government authorities or other third parties where we believe necessary to comply with a legal or regulatory obligation. We may share consumer health as we deem reasonably necessary to support lawful investigations or otherwise to protect our rights or the rights of you orany other party.

in the context of a business transfer: We may share your consumer health data with potential transaction partners, service providers, advisors, and other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell or transfer all or a portion of our assets or business.

Third parties and affiliates with which we share consumer health data

As necessary for the purposes described above, we may share consumer health data with the following categories of third parties and affiliates:

Our agents, service providers, vendors, suppliers, and other business partners;

parties to a business transfer;

third parties such as government agencies and law enforcement in response to valid legal process or other third parties as necessary to protect us, our affiliates, you, or others; and

other third parties as necessary to provide the services or products you requested or with your consent, such as your insurer.

How to exercise your rights

Under applicable consumer health privacy laws, subject to certain exceptions, you may have the right to access or delete consumer health data about you, or receive a list of third parties and affiliates with whom your consumer healthdata was shared. You also may have the right, subject to certain exceptions, to withdraw consent relating to the use and sharing of your consumer health data. To exercise these rights, you may contact us at privacynotices@nayya.com. We will use information you provide in your request to verify your identity, and we may request additional information if necessary to complete the verification process.

If your request to exercise a right is denied, you may appeal that decision by contacting us as described below. If your appeal is unsuccessful, you can lodge a complaint with the respective state Attorney General.

If you have questions about this Consumer Health Data Policy or would like to make a complaint to Nayya, you can contact us at privacynotices@nayya.com.

Supplement to Consumer Health Privacy Policy for Connecticut and Nevada consumers

This supplement applies only with respect to Connecticut and Nevada consumers and provides additional disclosuresrequired by these consumer health privacy laws.

Requesting Changes to Consumer Health Data. You may request a change to your inaccurate consumer health data by contacting us at privacynotices@nayya.com. We will use information you provide in your request to verify your identity, and we may request additional information if necessary to complete the verification process. If your request to change your consumer health data is denied, you may appeal that decision in accordance with applicable law by contacting us as described above.

Third Party Collection of Consumer Health Data. Third parties collect consumer health data over time and across different websites or online services when you visit public portions of our website.

Changes to this Consumer Health Privacy Policy. We may modify or update this Consumer Health Privacy Policy from time to time. We encourage you to visit this Consumer Health Privacy Policy regularly to learn about any changes to the way we collect, use, or share your consumer health data. If we make a material change to this Consumer Health Privacy Policy, we will take reasonable steps to notify you as required by applicable law.