Consumer Health Data Privacy Policy

Section 1 of the Headspace Privacy Policy describes that we collect health information about you depending on how you engage with our Platform. This health information can fall under the following specific categories of consumer health data:

• individual health conditions, treatment, diseases, or diagnosis;
• social, psychological, behavioral, and medical interventions;
• health-related surgeries or procedures;
• use or purchase of prescribed medication;
• bodily functions, vital signs, symptoms, or measurements of health information;
• diagnoses or diagnostic testing, treatment, or medication;
• gender-affirming care information;
• reproductive or sexual health information;
• biometric data;
• data that identifies you seeking health care services; or
• any inferences of the above categories of health data derived or extrapolated from non-health information.

We may collect consumer health data in the following ways:

• directly from you such as when you fill out an assessment in our mobile app;
• your mobile device and web browser when accessing our Websites and Products such as when you view content that could indicate your health condition;
• your parent or guardian if you are under 18 and required your parent or guardian’s permission;
• your other third-party apps or other third-party services with which you have integrated or linked your Headspace account; and
• your other health or wellness providers.

We may use your consumer health data in the following ways:

• to provide to you our Platform;
• to communicate with you regarding our Platform including updates, new features, promotions, or changes;
• to provide you support when responding to your questions, concerns, complaints, or other requests;
• to process your payments for your subscription or other purchases;
• to fulfill our obligations under any agreements that we may have with you;
• to maintain and improve the quality of our Platform, including analytics for product development;
• to protect ourselves, you, and others such as by taking actions to prevent, detect, or respond to fraud, security incidents, harassment, or other malicious or illegal activity;
• to create and maintain a trusted, secure, and reliable online environment;
• to comply with our compliance and other legal obligations;
• to establish or exercise our legal rights or defense against legal claims; and
• with your consent where requested and received.

We may share your consumer health data with third parties to achieve the purposes and uses listed above when reasonably necessary to complete a transaction or provide to you our Platform. The categories of third parties we share your consumer health data with are:

• Service providers. We have third parties that provide services on our behalf that make up parts of our Platform. For example, we use third parties to host the infrastructure for our Products that includes storing your consumer health data.
• Your integrations. You may choose to connect your Headspace account through supported integrations with third parties and we will share your consumer health data in order to provide that functionality if you so choose.
• Other users. If you engage with other Platform users or other individuals, we may share your consumer health data as directed by you such as when you use our community features to post on a comment board.
• Business partners. In limited cases, we may share consumer health data with other businesses with which we have a joint promotional relationship, bundled subscription offer, or other service offering that is jointly operated.
• Payment processors. When you purchase something from us, we may share your consumer health data as necessary for that transaction such as your credit card provider.
• Affiliates. We have affiliated companies and subsidiaries with which we share data to enable our Platform and related business operations. For example, if you engage with Headspace Care, we will share data with our Care Providers including Ginger.io of California Medical P.C. Our other affiliates are Headspace, Inc., Ginger.io, Inc., and Headspace Meditation Limited.
• Government agencies. When we receive a lawful request from a government agency, including law enforcement, we may disclose your consumer health data if necessary to comply with that request.
• Business transfer. If Headspace, including any of our subsidiaries, brands, or affiliates, is involved in a merger, acquisition, asset sale, or other corporate combination, your consumer health data may be transferred to the acquiring or surviving entity.
• Other third parties. We may share your consumer health data with other third parties with your consent or, if necessary, we may share your consumer health data in certain circumstances to protect our rights, our customers, or your safety.

As provided for in section 5 of the Headspace Privacy Policy, you may make requests about your personal information. Applicable privacy laws provide you certain specific rights with respect to your consumer health data law subject to exceptions.

Nevada and Washington residents have the following rights in relation to their consumer health data, subject to certain exceptions:

• The right to know what categories of consumer health data we collect, share, or sell. You also have the right to obtain a list of all third parties and affiliates with whom we have shared or sold your Consumer Health Data, and an active email address or other mechanism that you may use to contact these third parties. If you are a Washington resident or otherwise subject to Washington law, you also have the right to access your Consumer Health Data that we collect, share, or sell.
• The right to have us, as well as our affiliates, service providers, and contractors, delete the consumer health data we have about you.
• The right to withdraw consent related to your consumer health data where we rely upon consent to collect, use, or share your consumer health data.
• The right not to receive discriminatory treatment for the exercise of the privacy rights described above.

Connecticut residents have the following rights in relation to your Consumer Health Data, subject to certain exceptions:

• The right to know what consumer health data we collect, use, disclose, and/or sell or share as those terms are defined under applicable law. You may ask us to provide you a portable copy of this information up to two times in a rolling twelve-month period.
• The right to have us, as well as our affiliates, service providers, and contractors, delete the consumer health data we have about you.
• The right to opt-out of targeted advertising, the sale of your consumer health data, and profiling decisions that could produce legal or similarly significant effects concerning the consumer.
• The right to have us correct inaccurate consumer health data.
• The right not to receive discriminatory treatment for the exercise of the privacy rights described above.
• Rights concerning sensitive personal data. We cannot process your consumer health data, or use your consumer health data for certain purposes without your affirmative consent.

You may exercise your rights by contacting [email protected] with your request. As further stated in the Headspace Privacy Policy, your request may be denied where an exception applies, including but not limited to, where we are legally required to maintain your consumer health data or if we are unable to authenticate the request using commercially reasonable efforts.

We will respond to your request within forty-five (45) days after receipt and we reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days. As described below, in some jurisdictions, an authorized agent may submit a request to exercise your rights on your behalf.

How to appeal decisions about your rights.

• Connecticut. If you are a Connecticut resident and your request is denied, you may appeal our decision and we will provide the steps to appeal as part of responding to your request. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may submit a complaint with the Connecticut Attorney general at https://www.dir.ct.gov/ag/complaint/.
• Nevada. If you are a Nevada resident and your request is denied, you may appeal our decision and we will provide the steps to appeal as part of responding to your request. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If your appeal is not successful, you may submit a complaint with the Nevada Attorney General at https://ag.nv.gov/Complaints/File_Complaint/.
• Washington. If you are a Washington resident or located in Washington and your request is denied, you may appeal our decision and we will provide the steps to appeal as part of responding to your request. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If your appeal is not successful, you may submit a complaint with the Washington State Attorney General at https://www.atg.wa.gov/file-complaint.