Consumer Health Data Privacy Policy

Effective date: March 11, 2025

This Consumer Health Data Privacy Policy (“Health Privacy Policy”) applies to Lemme’s collection of “Consumer Health Data” (described below) of consumers that reside in in certain states such as Connecticut, Washington, or Nevada (“you”) in accordance with the Connecticut Data Privacy Act, Nevada’s Consumer Health Data Privacy Law, and the Washington My Health My Data Act, each as applicable the “Consumer Health Data Privacy Laws”). This Health Policy supplements the Lemme’s Privacy Policy and any capitalized but not defined terms in this Health Privacy Policy will have the definitions set forth in the Lemme’s Privacy Policy or the applicable Consumer Health Data Privacy Law.

Collection of Consumer Health Data
“Consumer Health Data” generally includes personal information that is linked or reasonably linkable to you and that identifies, or that Lemme may use to identify the your past, present, or future physical or mental health status. Consumer Health Data does not include information that is publicly available, de-identified, or aggregated. 

Categories of Consumer Health Data We Collect
The Consumer Health Data we collect may include information about a health or wellness condition that you provide to us, in a questionnaire or survey. 

Our Purposes for Collecting and Using Consumer Health Data
We may collect, use, disclose, or otherwise process your Consumer Health Data as reasonably necessary to provide you with products or services relevant to your Consumer Health Data. For more information, please see the “Our Commercial and Business Purposes for Collecting Personal Data” and “Other Permitted Purposes for Processing Personal Data” sections of our Privacy Policy.    

We do not engage in geofencing around our stores that provides in-person health care services in Washington to either: (1) identify or track you when seeking health care services; (2) collect your Consumer Health Data; or (3) send notifications, messages, or advertisements to you related to your Consumer Health Data or health care services.

We may create aggregated, de-identified or anonymized data Consumer Health Data we collect, including by removing information that makes the data personally identifiable to you. We may use such aggregated, de-identified or anonymized data and disclose it with third parties for our lawful business purposes, including to analyze, build and improve the Services and promote our business, provided that we will not disclose such data in a manner that could identify you.  

We do not “sell” your Consumer Health Data as defined under Health Data Privacy Laws.

How We Disclose Your Consumer Health Data
We may disclose your Consumer Health Data as reasonably necessary to Third Parties and Affiliates, which may include: 
• Vendors. We may disclose your Consumer Health Data to service providers, contractors, analytics partners, business partners, and vendors to provide and improve our Services to you. 
• Other Parties. We may disclose your Consumer Health Data to other parties that your explicitly gave us consent to do so.

We may also disclose your Consumer Health Data in the following ways:
• We may disclose your Consumer Health Data to government, including law enforcement, or other parties to meet certain legal requirements and enforcing legal terms including: fulfilling our legal obligations under applicable law, regulation, court order or other legal process, such as preventing, detecting and investigating security incidents and potentially illegal or prohibited activities; protecting the rights, property or safety of you Lemme or another party; enforcing any agreements with you; responding to claims that any posting or other content violates third-party rights; and resolving disputes.
• All of your Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part). 

Consumer Health Data Rights
If we have collected your Consumer Health Data, you may have rights set forth in this section depending on the applicable Consumer Health Data Privacy Law, which also may be subject to certain requirements and exceptions.

• Access and Portability: You have the right to request confirmation of or access to the Consumer Health Data that we process about you. If you’re a Washington and Nevada resident, you have the right to request a list of all third parties and affiliates with whom we have disclosed or sold your Consumer Health Data and their contact information, if applicable. If you are a Connecticut resident, you have right to request a copy of your Consumer Health Data in a machine-readable format, to the extent technically feasible.

• Correction: If you are a Connecticut resident, you have the right to correct inaccuracies in your Consumer Health Data, to the extent such correction is appropriate in consideration of the nature of such data and our purposes of processing your Consumer Health Data.

• Deletion: You have the right to request that we delete the Consumer Health Data that we have collected about you. 

• Withdraw Consent: You have the right to withdraw consent from us collecting and disclosing your Consumer Health Data. Due to the nature of our Services, this may require a deletion of your Personal Data or account with us. 

• Opt-Out of Sale, Targeted Advertising, and Profiling: If you are a Connecticut resident, you have the right to opt-out of sale and/or processing of your Consumer Health Data for targeted advertising and profiling purposes. However, we do not conduct such activities.

• Nondiscrimination: We will not discriminate against for exercising your rights as described above.

 • Appeal: If we refuse to take action on your request within a reasonable period of time after receiving your request in accordance, you may appeal our decision. If we deny your appeal, you have the right to contact the Attorney General of your state of residence (NV, WA, CT). 

To exercise your rights, you must send us a request that (1) provides sufficient information to allow us to verify that you are the person about whom we have collected Personal Data and your relationship with us (such as your Contact Data or Lemme Account Data), and (2) describes your request in sufficient detail to allow us to understand, evaluate and respond to it. Each request that meets both of these criteria will be considered a “Valid Request.” We may not respond to requests that do not meet these criteria.

You may submit a Valid Request by using the following methods:

If you have any questions about this section or whether any of the following rights apply to you, please contact us at privacy@lemmelive.com. We will not discriminate against you for exercising your rights under applicable law.