Privacy & Data Rights

1. Scope of This Policy

This Consumer Health Data Privacy Policy (the “Policy”) describes Enel Health Inc.’s (“Enel Health”) collection, use, sharing, and disclosure of Consumer Health Data, as required by the Washington My Health My Data Act (RCW 19.373 et seq.) and other applicable state consumer-health-data laws, including the Nevada Consumer Health Data Privacy Law (Nev. Rev. Stat. ch. 603A) and the Connecticut Data Privacy Act, as amended (Conn. Gen. Stat. § 42-515 et seq.).

This Policy applies to Consumer Health Data of any individual who is a resident of Washington, Nevada, or Connecticut, or whose Consumer Health Data is collected in any of those states. The rights and procedures described in this Policy are extended to all residents of any U.S. state, regardless of whether the applicable state law requires Enel Health to do so.

This Policy applies to both Enel Health user roles: RWE Contributors (who log self-reported wellness data and may contribute to the Real-World Evidence Program) and Curators (who provide self-identified demographic information and interests to receive Matched Insights drawn from the de-identified profiles of RWE Contributors with similar profiles). Self-identified demographic attributes (gender, age, race, and ethnicity) and stated interests, when combined to operate the Matching Algorithm or to generate health-related inferences, are Consumer Health Data under this Policy.

2. Definition of Consumer Health Data

“Consumer Health Data” means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status, including:

• individual health conditions, treatment, diseases, or diagnoses;
• social, psychological, behavioral, or medical interventions;
• health-related surgeries or procedures;
• use or purchase of prescribed medication;
• bodily functions, vital signs, symptoms, or measurements (including weight, mood, energy, sleep, hunger, cravings, focus, stress, and self-reported symptoms);
• diagnoses or diagnostic testing, treatment, or medication;
• gender-affirming care information;
• reproductive or sexual-health information;
• biometric data;
• genetic data;
• precise location information that could reasonably indicate a consumer’s attempt to acquire or receive health services or supplies;
• data that identifies a consumer seeking health-care services; and
• any information described above that is derived or extrapolated from non-health information.

3. Categories of Consumer Health Data Collected and Sources

3.1 Categories of Consumer Health Data Enel Health Collects

From RWE Contributors, Enel Health collects the following categories of Consumer Health Data:

• self-reported wellness observations (mood, energy, sleep quality, hunger, cravings, focus, stress, weight, symptoms, free-text notes);
• protocol-adherence information (selected protocol, start date, end date, deviations);
• eligibility and contraindication screening responses (including responses about pregnancy, eating disorders, diabetes, cardiac conditions, and medications);
• messages, prompts, and chat history with Enel Health AI agents that contain health-related content;
• user-uploaded documents or images containing health information;
• community posts that contain health-related content;
• data from connected wearables, fitness, nutrition, or sleep applications you authorize;
• with separate authorization, data from laboratories, diagnostic providers, pharmacies, or electronic health records;
• inferences derived from the foregoing that identify physical or mental health status;
• account information when used together with health-related information.

From Curators, Enel Health collects the following additional categories of Consumer Health Data:

• self-identified demographic information (which may include gender, age, race, and ethnicity), to the extent the Curator chooses to provide it;
• stated wellness interests (which may identify or reasonably infer the Curator’s interest in particular conditions, symptoms, protocols, or therapeutic categories);
• interactions with Matched Insights (which protocols, products, or comparison cohorts the Curator views, saves, or follows);
• inferences derived from the foregoing that may identify physical or mental health status or health-related preferences;
• account information when used together with the foregoing.

3.2 Categories of Sources From Which Consumer Health Data Is Collected

Enel Health collects Consumer Health Data from the following categories of sources:

• directly from the consumer through the Enel Health website, mobile application, account portal, AI-agent conversations, daily check-in tools, community features, and contact forms;
• from devices, applications, or platforms that the consumer connects to Enel Health (such as wearables and fitness or nutrition apps);
• with separate authorization, from third-party healthcare-related sources the consumer designates (such as laboratories, diagnostic providers, pharmacies, or electronic health record systems);
• Enel Health service providers acting on Enel Health’s behalf; and
• Enel Health systems that generate derived or inferred Consumer Health Data based on the consumer’s use of the service.

4. Purposes for Collecting and Using Consumer Health Data

Enel Health collects and uses Consumer Health Data for the following purposes:

• to provide the Enel Health website, mobile application, account portal, daily check-in tools, AI agents, community features, and related services that the consumer has requested;
• to evaluate eligibility for and administer the Founding Member Program and the Real-World Evidence (RWE) Program;
• to operate the Matching Algorithm for Curators by comparing a Curator’s self-identified profile and interests to the de-identified profiles of RWE Contributors with similar profiles, and to present Matched Insights to the Curator. Matched Insights are presented in de-identified, aggregated, or statistical form. RWE Contributors are not identified to Curators. The Matching Algorithm is further described in the Algorithmic Matching & Automated Decision-Making Disclosure;
• to screen the consumer for contraindications to specific wellness protocols and to deliver safety information;
• to personalize the consumer’s experience;
• to generate wellness summaries, trend analyses, and informational reports;
• with the consumer’s separate affirmative authorization, to operate AI Features (including chat, summarization, and recommendation) using identifiable Consumer Health Data;
• to detect, prevent, and respond to fraud, abuse, security incidents, and unauthorized access;
• to comply with legal, regulatory, contractual, and audit obligations, including the FTC Health Breach Notification Rule and applicable state breach-notification laws;
• to generate de-identified, pseudonymized, or aggregated datasets for internal research, quality improvement, scientific publication, and (with separate authorization) the RWE Program;
• to communicate with the consumer about the consumer’s account, security, privacy, billing, legal notices, and material service changes; and
• with the consumer’s separate affirmative consent, for any other purpose disclosed at the time consent is obtained.

5. Categories of Consumer Health Data Shared and Recipients

5.1 Categories of Consumer Health Data Shared

Enel Health may share the following categories of Consumer Health Data with the categories of recipients listed in Section 5.2 below, in each case only as necessary to accomplish a purpose stated in Section 4 and subject to written contractual restrictions:

• self-reported wellness observations and check-in data;
• protocol-adherence information;
• AI-agent chat history and prompt content (limited to the model provider strictly necessary to deliver the response);
• uploaded documents or images containing health information (only with recipients the consumer designates);
• integration data from connected devices or applications;
• self-identified demographic information and stated interests submitted by Curators (used internally to operate the Matching Algorithm; not shared externally in identifiable form);
• inferences derived from the foregoing;
• de-identified or aggregated forms of the foregoing, including Matched Insights presented to Curators.

Matched Insights presented to a Curator describe the de-identified, aggregated, or statistical experience of RWE Contributors with similar profiles. RWE Contributors are not identified to Curators. The Matching Algorithm operates within Enel Health’s systems and Enel Health’s processor environments; it does not transmit Consumer Health Data to third-party advertising or marketing systems.

5.2 Categories of Third Parties and Specific Affiliates Receiving Consumer Health Data

Enel Health shares Consumer Health Data only with the following categories of recipients:

• Cloud-hosting and infrastructure providers (currently: the company’s primary cloud hosting provider, listed at https://enelhealth.com/subprocessors);
• Database and storage providers;
• Security and fraud-prevention providers;
• Customer-support tooling providers;
• Communication providers (transactional email, SMS for service notifications only);
• AI model providers (limited to the model provider used to deliver responses, contractually prohibited from training on Enel Health customer data and required to delete prompts and outputs from provider systems);
• Analytics providers (limited to non-Consumer-Health-Data analytics; no Consumer Health Data is sent to third-party advertising or marketing analytics);
• Payment processors (when payment information is collected for paid services);
• Auditors, accountants, and external counsel under confidentiality obligations;
• Healthcare, wellness, or coaching providers the consumer expressly designates;
• Research collaborators and institutions under written agreements that prohibit re-identification and re-disclosure (only with separate authorization for identifiable data);
• Successors in connection with a corporate transaction (merger, acquisition, financing, restructuring, or sale of assets), with advance notice to the consumer where required by law;
• Specific affiliates of Enel Health Inc.: as of the date of this Policy, Enel Health Inc. has no affiliates; if affiliates are added in the future, they will be listed at https://enelhealth.com/affiliates and this Policy will be updated;
• Law enforcement, regulators, courts, and other governmental bodies, only when required by valid legal process or to protect rights, safety, or security.

Enel Health does not sell Consumer Health Data. Enel Health does not share Consumer Health Data with third parties for cross-context behavioral advertising, third-party targeted advertising, or for any purpose other than those listed above and in Section 4.

6. How to Exercise Your Consumer Health Data Rights

Subject to identity verification and the limited exceptions described in this Section 6, residents of Washington, Nevada, Connecticut, and any other U.S. state have the following rights with respect to their Consumer Health Data:

6.1 Right to Know and Access

You have the right to confirm whether Enel Health is collecting, sharing, or selling your Consumer Health Data and to access such Consumer Health Data. This includes the right to receive a list of all third parties and affiliates with whom Enel Health has shared or sold your Consumer Health Data, and an active email address or other online mechanism to contact those third parties or affiliates.

6.2 Right to Withdraw Consent

You have the right to withdraw consent for the collection and sharing of your Consumer Health Data, except where continued processing is strictly necessary to provide a product or service you have requested. Withdrawal of consent is effective prospectively; it does not affect the lawfulness of processing carried out before withdrawal.

6.3 Right to Delete

You have the right to request deletion of your Consumer Health Data. Upon receiving a verifiable deletion request, Enel Health will delete your Consumer Health Data from its records, instruct its processors and contractors to delete your Consumer Health Data, and notify all affiliates and third parties to whom Enel Health has sold or shared your Consumer Health Data of the deletion request.

Enel Health may retain Consumer Health Data after a deletion request only where necessary to: (a) comply with a legal obligation; (b) detect security incidents, protect against malicious or fraudulent activity, or prosecute persons responsible for such activity; (c) defend against legal claims; (d) maintain a routine backup in accordance with documented retention practices, until the backup is overwritten or expires; or (e) other limited exceptions expressly permitted by applicable law.

6.4 Right to Non-Discrimination

Enel Health will not discriminate against you for exercising any right under this Policy.

6.5 How to Submit a Request

To exercise any of the rights described in this Section 6, contact Enel Health at:

• Email: info@enelhealth.com (subject line: “Consumer Health Data Request”)
• Online form: https://enelhealth.com/privacy-requests
• Mail: Enel Health Inc., Privacy Office, 5639 La Jolla Blvd, La Jolla, CA 92037

Enel Health will verify your identity before fulfilling a request. Enel Health will respond within forty-five (45) calendar days of receipt of a verifiable request, with one additional forty-five (45) day extension where reasonably necessary and with notice to you.

6.6 Authorized Agents

You may use an authorized agent to submit a request, subject to verification of the agent’s authority and your identity.

6.7 Right to Appeal

If Enel Health denies your request in whole or in part, you may appeal by contacting info@enelhealth.com and stating that you are appealing. Enel Health will respond to your appeal within sixty (60) calendar days. If your appeal is denied, you may contact the Washington Attorney General at https://www.atg.wa.gov/file-complaint, the Nevada Attorney General at https://ag.nv.gov/, the Connecticut Attorney General at https://portal.ct.gov/ag, or the attorney general of your state.

7. Sale of Consumer Health Data

Enel Health does not sell Consumer Health Data. If Enel Health were to sell Consumer Health Data in the future, Enel Health would obtain a separate valid authorization from the consumer that meets the requirements of the applicable state law (including the signature, timing, and content requirements of the Washington My Health My Data Act, RCW 19.373.030).

8. Updates to This Policy

Enel Health may update this Policy. Material changes to the categories of Consumer Health Data collected, the purposes for which Consumer Health Data is collected and used, or the categories of recipients receiving Consumer Health Data, will not be applied to Consumer Health Data already collected without the consumer’s affirmative consent. The “Last updated” date above shows when this Policy was most recently revised.

9. Contact

Enel Health Inc.
Privacy Office
5639 La Jolla Blvd
La Jolla, CA 92037
info@enelhealth.com
https://enelhealth.com

This Website Privacy & Cookie Notice (this “Notice”) explains how Enel Health Inc. (“Enel Health,” “we,” “us,” or “our”) collects, uses, discloses, and protects information when you visit https://enelhealth.com (the “Website”), browse marketing pages, submit a contact form, sign up for a newsletter, register interest, interact with our content, or communicate with us outside of deeper participation in Enel Health services.

This Notice is separate from, and does not replace:

• the Enel Health RWE Contributor Privacy Notice, which applies to RWE Contributor accounts, health-related information, daily check-ins, AI-agent interactions, uploaded documents, the RWE Program, and related Enel Health services;
• the Enel Health Curator Privacy Notice, which applies to Curators who provide self-identified demographic information and interests to receive Matched Insights;
• the Enel Health Consumer Health Data Privacy Policy, which is a standalone notice required by the Washington My Health My Data Act and analogous state laws and addresses Consumer Health Data;
• the Enel Health Algorithmic Matching & Automated Decision-Making Disclosure, which describes the Matching Algorithm; and
• the Enel Health State Privacy Rights Notice, which describes state-specific consumer privacy rights.

1. Information Enel Health Collects Through the Website

When you visit or interact with the Website, Enel Health may collect:

• contact information, such as name, email address, phone number, organization, and role;
• registration or waitlist information;
• messages, form submissions, and support inquiries;
• newsletter and marketing preferences;
• event registration or webinar information;
• IP address, browser type, device type, operating system, referring pages, pages viewed, and session activity;
• cookie and tracking information (see Section 3);
• approximate location derived from IP address;
• analytics and performance data;
• advertising interaction data where applicable; and
• information you voluntarily provide.

Do not submit health information through the Website. Please do not submit sensitive health information, medical information, genetic information, lab records, or another person’s private information through general Website contact forms unless the form specifically asks for it and explains how it will be used. Health information collected outside the account portal is not subject to the same controls as RWE Contributor data and may be more difficult to delete or restrict.

2. How Enel Health Uses Website Information

Enel Health uses Website information to:

• operate, maintain, secure, and improve the Website;
• respond to inquiries;
• manage waitlists, applications, and registrations;
• send newsletters, updates, or marketing communications where permitted;
• provide information about Enel Health products, services, and programs;
• understand Website traffic and user behavior;
• improve Website content, design, and performance;
• detect fraud, spam, abuse, or security issues;
• comply with legal obligations;
• enforce the Terms of Use;
• measure marketing campaign performance; and
• carry out other purposes with your consent.

3. Cookies and Similar Technologies

The Website may use cookies, pixels, tags, scripts, local storage, and similar technologies (collectively, “Cookies”) to operate the Website, remember preferences, understand traffic, improve performance, and measure marketing activity. Cookie categories include:

3.1 Strictly Necessary Cookies

Required for Website functionality, security, navigation, forms, authentication, fraud prevention, load balancing, and basic site operation. These cannot be disabled without breaking the Website.

3.2 Analytics Cookies

Help Enel Health understand how visitors use the Website, which pages are viewed, how users arrive at the Website, how visitors interact with content, and how the site performs. Analytics Cookies are non-essential and require your consent in jurisdictions that require consent for non-essential cookies.

3.3 Preference Cookies

Remember choices such as region, language, display preferences, form settings, or other user-selected options.

3.4 Marketing or Advertising Cookies

May help Enel Health measure campaigns, understand referral sources, deliver relevant marketing, or evaluate advertising effectiveness where permitted by law. Marketing Cookies are non-essential and require your consent.

No Consumer Health Data in Cookies. Enel Health configures its analytics and advertising tools so that Consumer Health Data from logged-in account areas is not transmitted to third-party analytics or advertising providers. Enel Health does not use Consumer Health Data for cross-context behavioral advertising or third-party targeted advertising.

4. Managing Cookies

Where legally required, Enel Health provides a cookie banner or preference center that allows you to accept or reject non-essential cookie categories before placement. You may also manage cookies through your browser settings or device settings. Disabling some cookies may affect Website functionality.

5. Global Privacy Control and Universal Opt-Out Mechanisms

Enel Health honors the Global Privacy Control (“GPC”) signal and other legally recognized opt-out preference signals as a valid request to opt out of the sale and sharing of personal information, and (to the extent applicable to the Website) of cross-context behavioral advertising. Enel Health treats a GPC signal as a request from a verified consumer where applicable state law (including, without limitation, the California Consumer Privacy Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Texas Data Privacy and Security Act, the New Jersey Data Privacy Act, the Oregon Consumer Privacy Act, the New Hampshire Privacy Act, the Delaware Personal Data Privacy Act, the Maryland Online Data Privacy Act, the Minnesota Consumer Data Privacy Act, the Montana Consumer Data Privacy Act, the Nebraska Data Privacy Act, the Indiana Consumer Data Protection Act, the Kentucky Consumer Data Protection Act, and the Rhode Island Data Transparency and Privacy Protection Act) gives effect to such signals.

6. Email and Marketing Communications

If you sign up for updates, join a waitlist, register for an event, download content, or submit a form, Enel Health may send you service-related or marketing communications. You may opt out of marketing emails by using the unsubscribe link in the email or contacting info@enelhealth.com. Even if you opt out of marketing communications, Enel Health may still send non-marketing messages about your account, transactions, security, legal notices, or services you request.

Enel Health complies with the federal CAN-SPAM Act, 15 U.S.C. § 7701 et seq. SMS marketing, if any, is sent only with the consumer’s prior express written consent in compliance with the Telephone Consumer Protection Act, 47 U.S.C. § 227, and FCC implementing rules.

7. How Enel Health Shares Website Information

Enel Health may share Website information with:

• Website hosting providers;
• Analytics providers;
• Email and communication platforms;
• Customer relationship management tools;
• Security and fraud-prevention providers;
• Payment processors, if applicable;
• Marketing service providers;
• Professional advisors (auditors, accountants, external counsel) under confidentiality obligations;
• Legal, compliance, or safety recipients when required by law or to protect rights and safety; and
• Successors in connection with a merger, acquisition, financing, restructuring, or sale of assets, with notice where required by law.

Service providers are bound by written agreements that restrict use to authorized purposes.

8. No Sale of Health Data Through the Website

Enel Health does not sell Consumer Health Data and does not use Consumer Health Data for cross-context behavioral advertising or third-party targeted advertising. General Website analytics and advertising tools are configured not to receive Consumer Health Data.

9. Data Retention

Enel Health retains Website information for as long as reasonably necessary to operate the Website, respond to inquiries, maintain business records, provide requested communications, manage waitlists and registrations, analyze Website performance, comply with law, resolve disputes, enforce agreements, maintain security, and support legitimate business purposes. Retention periods vary by category:

• Inquiry and contact-form submissions: 24 months from last interaction;
• Newsletter subscriptions: until unsubscribe plus 12 months for audit purposes;
• Waitlist or registration data: 24 months from receipt or until program closure;
• Web analytics: 14 months in identified form, then aggregated;
• Server logs: 90 days for routine logs; 24 months for security and incident logs.

10. Security

Enel Health uses reasonable administrative, technical, and organizational safeguards designed to protect Website information. However, no Website, network, transmission, storage system, or security measure is completely secure. Enel Health cannot guarantee that unauthorized access, loss, misuse, or breach will never occur.

11. Your Privacy Choices

Depending on your location and applicable law, you may have rights to:

• access your personal information;
• correct inaccurate information;
• delete certain personal information;
• opt out of marketing communications;
• opt out of certain cookies or tracking;
• opt out of sale, sharing, or targeted advertising where applicable;
• limit certain uses of sensitive personal information where applicable;
• request portability where applicable; and
• appeal certain privacy decisions where required.

State-specific rights, response timeframes, and appeal procedures are described in detail in the Enel Health State Privacy Rights Notice. To make a privacy request, contact info@enelhealth.com or visit https://enelhealth.com/privacy-requests. Enel Health may need to verify your identity before responding.

12. Third-Party Links

The Website may link to third-party websites, articles, social media pages, research sources, partner sites, marketplaces, or external services. Enel Health does not control third-party websites and is not responsible for their privacy practices, security, content, or terms.

13. Social Media and Public Interactions

If you interact with Enel Health through social media platforms, public comment areas, events, webinars, or community spaces, your interaction may be visible to others and may be governed by the privacy practices of the relevant platform or service. Do not post sensitive health information or private information in public areas.

14. Forms and Waitlists

If you submit a Website form, waitlist request, early-access request, Founding Member request, or contact inquiry, Enel Health may use the information you provide to review your request, communicate with you, evaluate eligibility, provide updates, improve services, and maintain business records. Submitting a form does not guarantee acceptance into any program, access to any service, or approval as a Founding Member or RWE Contributor.

15. International Visitors

Enel Health is based in the United States, with primary operations in California. If you visit the Website from another jurisdiction, your information may be processed in the United States or other jurisdictions where Enel Health or its service providers operate. Where required, Enel Health uses appropriate safeguards for international data transfers, including contractual protections and standard contractual clauses.

16. Children

The Website is not intended for, and Enel Health does not knowingly collect personal information through the Website from, anyone under eighteen (18). If you believe a child has provided personal information through the Website, contact info@enelhealth.com.

17. Changes to This Notice

Enel Health may update this Notice from time to time. Updates may reflect changes in the Website, cookies, analytics tools, marketing practices, legal requirements, security practices, or business operations. The “Last updated” date above shows when this Notice was most recently revised. Unless otherwise stated, updates become effective when posted or when notice is provided.

18. Contact

Enel Health Inc.
Privacy Office
5639 La Jolla Blvd
La Jolla, CA 92037
info@enelhealth.com
https://enelhealth.com

Introduction

This State Privacy Rights Notice (this “Notice”) supplements the Enel Health RWE Contributor Privacy Notice, the Curator Privacy Notice, the Consumer Health Data Privacy Policy, the Algorithmic Matching & Automated Decision-Making Disclosure, and the Website Privacy & Cookie Notice. It describes specific consumer privacy rights available to residents of certain U.S. states. Where state law provides greater rights than those described in our other notices, this Notice and the applicable state law control for residents of that state.

To exercise any of the rights described in this Notice, contact Enel Health at:

• Email: info@enelhealth.com (subject line: “Privacy Rights Request — [State]”)
• Online form: https://enelhealth.com/privacy-requests
• Mail: Enel Health Inc., Privacy Office, 5639 La Jolla Blvd, La Jolla, CA 92037

Enel Health will verify your identity before fulfilling a request and will respond within the timeframes specified by applicable state law (generally 45 calendar days, with a possible 45-day extension). If your request is denied, you have the right to appeal as described in this Notice and applicable state law.

California

If you are a California resident, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act and subsequent amendments (collectively, the “CCPA”), gives you the following rights:

Right to Know: You may request that Enel Health disclose the categories and specific pieces of personal information it has collected about you, the categories of sources, the business or commercial purpose for collecting, selling, or sharing personal information, and the categories of third parties to whom Enel Health discloses personal information.

Right to Delete: You may request that Enel Health delete personal information it has collected from you, subject to legal exceptions.

Right to Correct: You may request that Enel Health correct inaccurate personal information.

Right to Opt Out of Sale or Sharing: Enel Health does not sell or share personal information for cross-context behavioral advertising. You may still submit an opt-out request; Enel Health will confirm that no sale or sharing is occurring.

Right to Limit Use of Sensitive Personal Information: You may direct Enel Health to limit its use of your sensitive personal information (which includes information about health, sex life, sexual orientation, racial or ethnic origin, religious or philosophical beliefs, union membership, biometric information processed to identify a consumer, genetic data, precise geolocation, account credentials, contents of mail/email/text messages, and neural data) to purposes necessary to perform the services and other narrow categories permitted by the CCPA. Note that if you have provided race or ethnicity to Enel Health for use in the Matching Algorithm, that use is considered necessary to perform the matching service you have requested; exercising the Right to Limit Use of Sensitive Personal Information will stop further use of that information beyond what is strictly necessary to operate the Matching Algorithm and will, on your request, remove that information entirely from your Curator profile.

Right to Non-Discrimination: Enel Health will not discriminate against you for exercising your CCPA rights.

Right to Opt Out of Automated Decision-Making Technology (“ADMT”): Where Enel Health uses automated decision-making technology to make significant decisions about you, you have the right to opt out and the right to access information about the technology, in accordance with the CCPA regulations effective January 1, 2026. Enel Health’s Matching Algorithm and AI-driven personalization features are described in the Algorithmic Matching & Automated Decision-Making Disclosure, which serves as the pre-use notice required under those regulations. To opt out of ADMT use, contact info@enelhealth.com or use the dedicated form at https://enelhealth.com/privacy-requests.

Shine the Light. Under California Civil Code § 1798.83, California residents may request information about disclosures of personal information to third parties for those third parties’ direct-marketing purposes. Enel Health does not disclose personal information to third parties for their direct-marketing purposes.

AB-45 (Health and Location Data). Effective January 1, 2026, California AB-45 strengthens privacy protections for health information and prohibits geofencing within precise geolocation of family-planning centers for advertising, identification, tracking, data collection, or notification purposes. AB-45 provides a limited private right of action for violations. Enel Health complies with AB-45.

Global Privacy Control. Enel Health treats GPC signals as valid opt-out requests for sale and sharing of personal information.

Appeal. If Enel Health denies your CCPA request, you may appeal by contacting info@enelhealth.com. You may also file a complaint with the California Privacy Protection Agency at https://cppa.ca.gov or the California Attorney General at https://oag.ca.gov.

Colorado

If you are a Colorado resident, the Colorado Privacy Act (“CPA”) gives you the rights to access, correct, delete, and obtain a portable copy of your personal data, to opt out of the processing of personal data for purposes of targeted advertising, sale, or profiling in furtherance of decisions producing legal or similarly significant effects, and to appeal denials of your requests. Processing of sensitive data (including health and mental-health information) requires opt-in consent. Enel Health honors universal opt-out mechanisms recognized under the CPA, including the Global Privacy Control. Submit requests to info@enelhealth.com. If Enel Health denies your request, you may appeal by replying to the denial; if your appeal is denied, you may submit a complaint to the Colorado Attorney General at https://coag.gov.

Connecticut

If you are a Connecticut resident, the Connecticut Data Privacy Act (“CTDPA”) gives you the rights to access, correct, delete, and obtain a portable copy of your personal data, to opt out of targeted advertising, sale, and profiling in furtherance of decisions producing legal or similarly significant effects, and to appeal denials. Processing of sensitive data (including consumer health data and data revealing physical or mental-health status) requires affirmative opt-in consent. Effective January 1, 2026, Enel Health honors recognized universal opt-out mechanisms in Connecticut, including the Global Privacy Control. Enel Health processes consumer health data under the standalone Consumer Health Data Privacy Policy. Submit requests to info@enelhealth.com. Appeals: reply to the denial; complaints may be filed with the Connecticut Attorney General at https://portal.ct.gov/ag.

Delaware

If you are a Delaware resident, the Delaware Personal Data Privacy Act gives you the rights to access, correct, delete, obtain a portable copy of your personal data, opt out of targeted advertising, sale, and profiling, and appeal denials. Sensitive data processing requires opt-in consent. Enel Health honors recognized universal opt-out mechanisms. Submit requests to info@enelhealth.com. Complaints may be filed with the Delaware Attorney General at https://attorneygeneral.delaware.gov.

Florida

If you are a Florida resident, the Florida Digital Bill of Rights (“FDBR”) gives certain consumers rights to access, correct, delete, obtain a portable copy of their personal data, opt out of sale and targeted advertising, and appeal denials. The FDBR applies only to controllers meeting specified thresholds. Enel Health responds to verifiable Florida resident requests submitted to info@enelhealth.com regardless of whether Enel Health is a controller subject to the FDBR. Complaints may be filed with the Florida Department of Legal Affairs at https://www.myfloridalegal.com.

Indiana

Effective January 1, 2026, the Indiana Consumer Data Protection Act gives Indiana residents the rights to access, correct, delete, obtain a portable copy of their personal data, opt out of targeted advertising, sale, and profiling, and appeal denials. Sensitive data processing requires opt-in consent. Submit requests to info@enelhealth.com. Complaints may be filed with the Indiana Attorney General at https://www.in.gov/attorneygeneral.

Iowa

If you are an Iowa resident, the Iowa Consumer Data Protection Act gives you the rights to access, delete, obtain a portable copy of your personal data, opt out of sale, and to be informed of sensitive-data processing. Submit requests to info@enelhealth.com. Complaints may be filed with the Iowa Attorney General at https://www.iowaattorneygeneral.gov.

Kentucky

Effective January 1, 2026, the Kentucky Consumer Data Protection Act gives Kentucky residents the rights to access, correct, delete, obtain a portable copy of their personal data, opt out of targeted advertising, sale, and profiling, and appeal denials. Sensitive data processing requires opt-in consent. Submit requests to info@enelhealth.com. Complaints may be filed with the Kentucky Attorney General at https://ag.ky.gov.

Maryland

If you are a Maryland resident, the Maryland Online Data Privacy Act gives you the rights to access, correct, delete, obtain a portable copy of your personal data, opt out of targeted advertising, sale, and profiling, and appeal denials. Maryland prohibits the sale of sensitive data and the collection or processing of sensitive data unless strictly necessary. Enel Health does not sell Consumer Health Data. Enel Health honors recognized universal opt-out mechanisms. Submit requests to info@enelhealth.com. Complaints may be filed with the Maryland Attorney General at https://www.marylandattorneygeneral.gov.

Minnesota

If you are a Minnesota resident, the Minnesota Consumer Data Privacy Act gives you the rights to access, correct, delete, obtain a portable copy of your personal data, opt out of targeted advertising, sale, and certain profiling, opt out of profiling that produces legal or similarly significant effects, and appeal denials. Sensitive data processing requires opt-in consent. Enel Health honors recognized universal opt-out mechanisms. Submit requests to info@enelhealth.com. Complaints may be filed with the Minnesota Attorney General at https://www.ag.state.mn.us.

Montana

If you are a Montana resident, the Montana Consumer Data Privacy Act gives you the rights to access, correct, delete, obtain a portable copy of your personal data, opt out of targeted advertising, sale, and profiling, and appeal denials. Sensitive data processing requires opt-in consent. Enel Health honors recognized universal opt-out mechanisms. Submit requests to info@enelhealth.com. Complaints may be filed with the Montana Department of Justice at https://dojmt.gov.

Nebraska

If you are a Nebraska resident, the Nebraska Data Privacy Act gives you the rights to access, correct, delete, obtain a portable copy of your personal data, opt out of targeted advertising, sale, and profiling, and appeal denials. Sensitive data processing requires opt-in consent. Submit requests to info@enelhealth.com. Complaints may be filed with the Nebraska Attorney General at https://ago.nebraska.gov.

Nevada

If you are a Nevada resident, Nevada SB 370 (codified at Nev. Rev. Stat. ch. 603A) and Nevada’s general privacy statute give you the rights to confirm the collection of your consumer health data, access your consumer health data, request deletion, request a list of recipients of your consumer health data, and withdraw consent. Sensitive consumer-health-data processing requires opt-in consent. Enel Health processes consumer health data under the standalone Consumer Health Data Privacy Policy. Submit requests to info@enelhealth.com. Nevada SB 370 is enforced exclusively by the Nevada Attorney General; complaints may be filed at https://ag.nv.gov.

New Hampshire

If you are a New Hampshire resident, the New Hampshire Privacy Act gives you the rights to access, correct, delete, obtain a portable copy of your personal data, opt out of targeted advertising, sale, and profiling, and appeal denials. Sensitive data processing requires opt-in consent. Enel Health honors recognized universal opt-out mechanisms. Submit requests to info@enelhealth.com. Complaints may be filed with the New Hampshire Attorney General at https://www.doj.nh.gov.

New Jersey

If you are a New Jersey resident, the New Jersey Data Privacy Act gives you the rights to access, correct, delete, obtain a portable copy of your personal data, opt out of targeted advertising, sale, and profiling in furtherance of decisions producing legal or similarly significant effects, and appeal denials. Sensitive data processing requires opt-in consent. Enel Health honors recognized universal opt-out mechanisms. Submit requests to info@enelhealth.com. Complaints may be filed with the New Jersey Division of Consumer Affairs at https://www.njconsumeraffairs.gov.

Oregon

If you are an Oregon resident, the Oregon Consumer Privacy Act gives you the rights to access, correct, delete, obtain a portable copy of your personal data, request a list of specific third parties to which your personal data has been disclosed, opt out of targeted advertising, sale, and profiling, and appeal denials. Sensitive data processing requires opt-in consent. Effective January 1, 2026, Enel Health honors recognized universal opt-out mechanisms in Oregon. Submit requests to info@enelhealth.com. Complaints may be filed with the Oregon Attorney General at https://www.doj.state.or.us.

Rhode Island

Effective January 1, 2026, the Rhode Island Data Transparency and Privacy Protection Act gives Rhode Island residents the rights to access, correct, delete, obtain a portable copy of their personal data, opt out of targeted advertising, sale, and profiling, and appeal denials. Sensitive data processing requires opt-in consent. Submit requests to info@enelhealth.com. Complaints may be filed with the Rhode Island Attorney General at https://riag.ri.gov.

Tennessee

If you are a Tennessee resident, the Tennessee Information Protection Act gives you the rights to access, correct, delete, obtain a portable copy of your personal data, opt out of targeted advertising, sale, and profiling, and appeal denials. Sensitive data processing requires opt-in consent. Submit requests to info@enelhealth.com. Complaints may be filed with the Tennessee Attorney General at https://www.tn.gov/attorneygeneral.

Texas

If you are a Texas resident, the Texas Data Privacy and Security Act (“TDPSA”) gives you the rights to access, correct, delete, obtain a portable copy of your personal data, opt out of targeted advertising, sale, and profiling in furtherance of decisions producing legal or similarly significant effects, and appeal denials. Sensitive data processing requires opt-in consent. Enel Health honors recognized universal opt-out mechanisms. The TDPSA applies broadly without revenue or volume thresholds for many businesses that target Texas residents. Submit requests to info@enelhealth.com. Complaints may be filed with the Texas Attorney General at https://www.texasattorneygeneral.gov.

Utah

If you are a Utah resident, the Utah Consumer Privacy Act gives you the rights to access, delete, obtain a portable copy of your personal data, and opt out of targeted advertising and sale. Sensitive data processing requires that consumers be presented with clear notice and an opportunity to opt out. Submit requests to info@enelhealth.com. Complaints may be filed with the Utah Division of Consumer Protection at https://consumerprotection.utah.gov.

Virginia

If you are a Virginia resident, the Virginia Consumer Data Protection Act (“VCDPA”) gives you the rights to access, correct, delete, obtain a portable copy of your personal data, opt out of targeted advertising, sale, and profiling in furtherance of decisions producing legal or similarly significant effects, and appeal denials. Sensitive data processing requires opt-in consent. Submit requests to info@enelhealth.com. If Enel Health denies your appeal, you may submit a complaint to the Virginia Attorney General at https://www.oag.state.va.us.

Washington

If you are a Washington resident, or if your consumer health data is collected in Washington, the Washington My Health My Data Act (RCW 19.373 et seq.) gives you significant rights, including the right to confirm whether Enel Health is collecting, sharing, or selling your consumer health data, the right to access your consumer health data, the right to a list of all third parties and affiliates with whom Enel Health has shared or sold your consumer health data, the right to withdraw consent for collection or sharing, the right to deletion (which Enel Health will propagate to its processors and to all third parties to whom Enel Health has sold or shared your data), and the right to non-discrimination.

Enel Health processes consumer health data under the standalone Consumer Health Data Privacy Policy. Enel Health does not sell consumer health data. The Washington Attorney General enforces the My Health My Data Act, and the Act also provides a private right of action under Washington’s Consumer Protection Act, RCW 19.86. Complaints may be filed at https://www.atg.wa.gov.

Other U.S. States

Residents of states not specifically listed above may have rights under federal law (including the FTC Act and the FTC Health Breach Notification Rule) and other applicable state laws. Enel Health responds to verifiable privacy requests from any U.S. consumer submitted to info@enelhealth.com on a basis no less protective than the most protective applicable state law.

Authorized Agents

Where state law permits, you may use an authorized agent to submit privacy requests on your behalf. Enel Health requires written proof of the agent’s authority (such as a notarized power of attorney) and may also require direct confirmation from you that the request is authorized.

Updates to This Notice

Enel Health updates this Notice as new state privacy laws take effect and as existing laws are amended. The “Last updated” date above shows when this Notice was most recently revised.

Contact

Enel Health Inc.
Privacy Office
5639 La Jolla Blvd
La Jolla, CA 92037
info@enelhealth.com
https://enelhealth.com