Consumer Health Data Privacy Policy

This is a standalone policy specific to consumer health data, separate from our general Privacy Policy. We apply the protections in this policy to all visitors nationwide, regardless of where you live, because several states — including Washington (My Health My Data Act, RCW 19.373), Nevada (SB 370), and Connecticut (CTDPA) — now regulate consumer health data specifically, and other states classify health information as "sensitive data" under their general privacy laws. Washington's law is the most protective of these and includes a private right of action, so this policy is written to meet that standard for everyone we collect data from.

1. Scope of This Policy

This policy describes how Contrast Cube Inc. ("Contrast Cube," "we," "us," or "our") collects, uses, shares, and protects consumer health data — information that identifies your past, present, or future physical or mental health status, such as information about an injury, surgery, chronic pain condition, or related treatment. This policy applies to all visitors and customers, regardless of state of residence.

This policy applies only to consumer health data. Our general Privacy Policy separately describes how we handle other personal information (such as your name and email address) that does not fall into this category.

2. Categories of Consumer Health Data We Collect

Depending on how you interact with us, we may collect the following categories of consumer health data:

• Reservation form responses. If you complete the "Reserve Now" form on contrastcube.com and select "Post-injury/surgery recovery" or "Chronic pain management" as your primary intended use, that selection is consumer health data.
• Survey responses. If you complete one of our linked surveys (hosted on Typeform), your answers about musculoskeletal injury history, past treatment, and use of heat or cold therapy are consumer health data.
• Voluntary open-ended responses. Free-text answers you provide (for example, in response to "What makes you want a Contrast Cube?") may incidentally contain health information if you choose to include it.

We do not collect precise geolocation data, biometric data, or any consumer health data through tracking pixels, SDKs, or similar technologies.

3. Sources of Consumer Health Data

We collect consumer health data directly from you, through forms you voluntarily complete on contrastcube.com or on linked third-party survey platforms. We do not purchase or receive consumer health data about you from any other source.

4. Why We Collect and How We Use Consumer Health Data

We use consumer health data only to:

• Understand demand for Contrast Cube and how prospective customers intend to use the product;
• Inform product design and engineering decisions;
• Prepare aggregated, de-identified summaries (for example, "X% of respondents cited injury recovery as a primary use") for internal planning, investor communications, and business development; and
• Respond to you directly if you contact us about your survey or reservation submission.

We do not use consumer health data to make individualized advertising decisions about you, and we do not use it for any purpose beyond what is described above without asking for your separate consent first.

5. How We Share Consumer Health Data

We do not sell consumer health data, and we will never sell it without first obtaining your separate, signed authorization as required by law.

We share consumer health data only with the following service providers, who process it on our behalf to operate the forms and surveys described above:

• The Rocket Science Group, LLC (Mailchimp) — receives and stores reservation form responses, organized by email address, so we can maintain our reservation list.
• Typeform S.L. — receives and stores survey responses submitted through our linked surveys.

Our website itself is hosted by Hostinger, which serves the web pages you view on contrastcube.com. Hostinger does not receive or store your form or survey responses — those are transmitted directly to Mailchimp or Typeform, respectively.

We do not share consumer health data with any other third party, and we do not permit any service provider to use your consumer health data for their own independent purposes.

We do not use geofencing (location-based targeting) around any healthcare facility to identify, track, or send messages to consumers, and we will not do so in the future.

6. Data Retention

We retain consumer health data for as long as reasonably necessary to fulfill the purposes described in Section 4, or until you request deletion, whichever comes first. If your data is stored in a backup or archival system at the time you request deletion, we may take up to six months to complete deletion from those systems, consistent with applicable law.

7. Your Rights

You have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data;
• Access the specific pieces of consumer health data we have collected about you;
• Withdraw your consent to our collection or use of your consumer health data at any time (this will not affect the lawfulness of anything we did before you withdrew consent); and
• Request deletion of your consumer health data.

We will not discriminate against you (for example, by denying you a reservation) for exercising any of these rights.

8. How to Exercise Your Rights

To make a request, email zachary@contrastcube.com with the subject line "Consumer Health Data Request" and let us know what you're asking for. We may need to verify your identity (for example, by confirming the email address associated with your submission) before completing your request.

We will respond within 45 days of receiving your request. If we need more time due to the complexity or number of requests we've received, we may extend this once by an additional 45 days, and we will tell you within the initial 45-day period if we do so, along with the reason.

Appeals. If we decline to act on your request, you may appeal by emailing the same address above with the subject line "Appeal — Consumer Health Data Request" within a reasonable time after receiving our decision. We will respond to your appeal in writing within 45 days, explaining our decision. If we deny your appeal, we will also tell you that you may submit a complaint to the Attorney General's office in your state of residence.

9. Consent and Optional Fields

Fields on our forms and surveys that could reveal consumer health data are optional. Before we collect a response to any such field, we will ask for your informed, opt-in consent through a separate, clearly labeled checkbox — distinct from any other consent or agreement on the page. You are never required to answer these fields to complete a reservation or, where applicable, a survey, and declining does not affect your ability to submit the rest of the form.

10. Data Minimization

We only ask for the consumer health data described in Section 2, and only where it serves the purposes described in Section 4. We do not collect health data we don't have a defined use for.

11. If a Breach Occurs

In the event of a breach involving your consumer health data, we will notify you and any applicable regulators as required by law, including the FTC's Health Breach Notification Rule and applicable state breach notification laws. Notification will describe what happened, what information was involved, and the steps we're taking in response.

12. Changes to This Policy

If we make material changes to this policy, we will update the "Last Updated" date above and, where required by law, take additional steps to notify you.

13. Contact Us

Contrast Cube, Inc.
512 S. Madison Ave, La Grange, IL 60525
zachary@contrastcube.com