Atticus Consumer Health Data Notice

This Atticus Law, P.C. Consumer Health Data Privacy Policy (“CHD Policy”) supplements the Atticus Law, P.C. (“we,” “us,” “our”) Privacy Policy (“Privacy Policy”) and applies to information defined as “consumer health data” (“CHD”) by the Washington state My Health My Data Act (“MHMDA”) and Nevada’s Consumer Health Data Privacy Law (“Nevada CHD Law”) (collectively, “CHD Laws”). Undefined capitalized terms shall have the meanings set forth in the Privacy Policy.

1. Categories of CHD Collected

As described further in our Privacy Policy, and depending on applicable law and your interactions with us, we may collect the following categories of CHD, as broadly defined in the CHD Laws. We collect information about the following based on your interactions with us:

• Individual health conditions, treatment, diseases, or diagnoses (e.g., information about injuries, symptoms, and medications).
• Social, psychological, behavioral, and medical interventions (e.g., mental health treatment).
• Health-related surgeries or procedures.
• Use or purchase of prescribed medication.
• Bodily functions, vital signs, symptoms, or measurements of health information.
• Diagnoses or diagnostic testing, treatment, or medication.
• Data that identifies you as seeking health care services (e.g., information that indicates your plans to undertake certain health treatments or procedures).
• Other information that may be used to infer, derive, or extrapolate data related to the above or other health information.

If you choose to provide us with other CHD, for example, when engaging with us via text or email, we will handle it in accordance with this CHD Policy.

2. Sources of CHD

As described further in our Privacy Policy, we collect information that may include CHD directly from you (e.g., through a webform, calls, or texts) or from other sources such as worker’s compensation and veterans’ benefits providers.

3. Purposes for Collection of CHD

We describe the purposes for collection and use of CHD in the “How We Use Your Information” section of our Privacy Policy. As further described there and subject to applicable law, we may collect and use CHD as directed by you or with your consent, or (1) to provide and maintain the Services, including to communicate with you; (2) for security and audits; and (3) for legal purposes.

4. How and Why We Disclose CHD

We may disclose each of the categories of CHD described above for the following purposes:

• To provide and manage the Services;
• For security and audits;
• To enable our vendors to provide us with services that allow us to operate our Services, such as data storage, billing, and customer service;
• With your consent;
• To protect us and others, including to enforce our Terms of Use, Privacy Policy, or other contracts with you, and for fraud prevention;
• To comply with our legal obligations; and
• In connection with any negotiation or completed acquisition, merger, or purchase involving our business assets.

In addition, if we think that a firm in our network can represent you, we may disclose your CHD to that firm so they can determine if they can represent you.

As described in our Privacy Policy, we reserve the right to create aggregate/de-identified data from the information we collect through the Services and our disclosure of such aggregate/de-identified data is in our discretion.

As further described in our Privacy Policy, and subject to applicable law (and subject to your consent in certain situations), we may disclose CHD to the following categories of third parties:

• Our affiliate: Atticus Labs, Inc.
• Vendors and service providers;
• Entities for legal purposes (e.g., to governmental entities in response to legal process, to protect or exercise our legal rights);
• As necessary for business transfers; and
• At your direction or with your consent.

5. How To Exercise Your Rights Under CHD Laws

Depending on your jurisdiction and subject to exceptions, the CHD Laws extend certain rights regarding CHD, which may include the right to request to (1) confirm whether we are collecting, sharing or selling your CHD; (2) access your CHD; (3) delete your CHD; (4) correct your CHD; and (5) withdraw your consent to the collection or sharing of your CHD.

You can seek to exercise these rights by emailing us at privacy@atticus.com. Depending on the nature of your request, we may request further information if appropriate to authenticate your identity.

If we deny your request in whole or in part, you may appeal that decision by emailing us at privacy@atticus.com. If you are a resident of Washington and your appeal is denied, you can contact the Washington State Attorney General at https://atg.wa.gov/file-complaint. If you are a resident of Nevada and your appeal is denied, you can contact the Nevada Attorney General at https://ag.nv.gov/Complaints/File_Complaint.

6. Contact Us; Updates to this CHD Policy

You can contact us about this CHD Policy by emailing us at privacy@atticus.com.

This CHD Policy is effective as of the date of the “Last Updated” date above. We may u pdate this CHD Policy from time to time, so we encourage you to review it periodically. By continuing to use our Services after an update to this CHD Policy, you agree that we will handle your CHD in accordance with the updated CHD Policy. We will update the “Last Updated” date above if we make an update to this CHD Policy, and otherwise notify you if required by applicable law.