METSAW PRIVACY POLICY

Depending on how you use Metsaw, we may collect:

Account and Contact Information

• Name
• Email address
• Phone number
• Account credentials
• Customer support information

Health and Wellness Information

• Glucose data
• Wearable-device data
• Smart resistance or vest data
• Activity information
• Food or meal information
• Fasting-window information
• Health and wellness goals
• Information you voluntarily provide to Metsaw

Connected Device Information

When you authorize a supported device or service connection, Metsaw may receive information made available through that connection, including glucose readings, timestamps, wearable measurements, device status, and related information.

Metsaw will access connected-device information only through authorized methods and subject to permissions granted by the customer and applicable device provider.

Website and Technical Information

We may collect standard technical information such as:

• IP address
• Browser type
• Device type
• Operating system
• Website activity
• Security and diagnostic logs
• Cookies or similar technologies

Transaction Information

If you purchase Metsaw products or services, payment processors and other service providers may process billing, payment, shipping, and transaction information.

Metsaw may use information to:

• Create and operate customer accounts
• Connect authorized sensors, wearables, and services
• Receive and display authorized glucose and wearable information
• Calculate Metsaw metrics and visualizations
• Generate personalized behavioral guidance and Nudges
• Help customers understand patterns in their own data
• Provide customer support
• Fulfill products and services
• Maintain security and prevent misuse
• Troubleshoot and improve Metsaw
• Measure aggregate product performance and outcomes
• Comply with applicable legal obligations

Metsaw follows a data-minimization approach and intends to collect only information reasonably necessary to provide and improve its services.

Metsaw will obtain appropriate customer authorization before accessing supported glucose, wearable, or other connected-device information.

Before connecting supported services, customers will be provided information regarding:

• What information Metsaw may receive
• How that information is used
• How the connection supports Metsaw functionality
• Relevant third-party providers involved
• How authorization may be withdrawn where technically available

Customers remain responsible for maintaining their accounts with third-party device providers and complying with those providers’ applicable terms.

Customers may withdraw authorization or disconnect supported integrations where technically available.

When a connection is revoked:

• Metsaw will stop future collection through that connection where technically possible
• Previously collected information will be handled under Metsaw’s retention and deletion practices
• Certain Metsaw features may stop working because they depend on connected-device information

Disconnecting a device does not automatically erase previously collected information.

Customers may contact privacy@metsaw.com regarding connection, revocation, or deletion questions.

Metsaw may use artificial intelligence systems to help analyze information and provide personalized behavioral guidance.

Examples may include:

• Identifying relevant patterns in authorized customer data
• Generating personalized behavioral choices or Nudges
• Explaining Metsaw metrics
• Supporting customer conversations
• Improving the usability and reliability of Metsaw

Metsaw intends to provide AI systems only the information reasonably necessary to perform Metsaw functions.

Metsaw does not use its AI systems to independently diagnose disease, prescribe medication, or replace the judgment of a qualified healthcare professional.

Third-party AI or technology providers may process information on Metsaw’s behalf as service providers. Metsaw reviews material vendors before production use and seeks to limit their use of customer information to purposes necessary to provide Metsaw services.

Metsaw may share information with service providers that perform functions on our behalf, including:

• Cloud hosting
• Database infrastructure
• Artificial intelligence processing
• Customer authentication
• Device integrations
• Payment processing
• Shipping and fulfillment
• Customer support
• Security and diagnostics
• Analytics necessary to operate and improve Metsaw

These providers may process information only as reasonably necessary to perform their services for Metsaw, subject to their agreements and applicable law.

Metsaw may also disclose information:

• When required by law
• To respond to valid legal process
• To protect Metsaw, customers, or others from fraud, security threats, or harm
• In connection with a merger, acquisition, financing, reorganization, or sale of all or part of the business, subject to appropriate protections

Metsaw does not intend to sell identifiable customer health information to advertisers or data brokers.

Metsaw does not treat customer glucose or wearable data as an advertising product.

Identifiable glucose or wearable information will not knowingly be provided to third parties for their independent advertising purposes.

Metsaw uses reasonable administrative, technical, and organizational measures appropriate to the sensitivity of the information it processes.

These measures may include:

• Authentication controls
• Restricted access
• Encryption in transit where supported
• Appropriate cloud-service safeguards
• Vendor review
• Security monitoring
• Incident-response procedures

No system can guarantee absolute security, but Metsaw works to reduce unnecessary collection, access, exposure, and retention of sensitive information.

Metsaw follows a data-minimization approach and generally retains identifiable customer information only as long as reasonably necessary to provide its services and satisfy legitimate operational, contractual, security, accounting, or legal needs.

Our current retention guidelines include:

• Account/profile information: while the account is active and generally up to 90 days after account closure
• Raw glucose data: while the service is active and generally up to 90 days after account closure
• Raw wearable or vest data: while the service is active and generally up to 90 days after account closure
• Derived Metsaw metrics, including Tilt-related information: while active and generally up to 12 months after account closure
• Nudge history and customer selections: while active and generally up to 12 months after account closure
• Consent, authorization, and revocation records: generally up to 3 years after the customer relationship ends
• Customer support records: generally up to 12 months after resolution
• Security and access logs: generally up to 90 days unless needed for investigation
• Privacy or security incident records: generally up to 3 years
• Marketing leads: until consent is withdrawn or generally after 12 months of inactivity
• Billing, tax, and transaction records: generally up to 7 years where reasonably necessary for accounting, tax, contractual, or legal purposes

Retention periods may be extended when reasonably necessary for legal obligations, litigation, security investigations, fraud prevention, tax requirements, contractual obligations, or active disputes.

Metsaw may retain information that has been genuinely de-identified or aggregated so that it can no longer reasonably be linked to an identifiable individual.

Metsaw may use such information for:

• Product improvement
• System performance analysis
• Aggregate outcome measurement
• Analytics
• Research and development

Metsaw will not intentionally attempt to re-identify information that it maintains as de-identified information.

Depending on applicable law and your relationship with Metsaw, you may have rights involving:

• Access to personal information
• Correction of inaccurate information
• Deletion of eligible information
• Withdrawal of consent or authorization
• Information about how your data is used
• Privacy complaints or questions

To submit a privacy request, contact:

privacy@metsaw.com

Metsaw may need to verify your identity before completing certain requests.

Some information may need to be retained when required for legal, accounting, security, contractual, fraud-prevention, or dispute-resolution purposes.

Metsaw is intended for adults.

Metsaw does not knowingly collect personal health information from children under 18 through its metabolic-health services.

If we learn that information was collected from a child inappropriately, we will take reasonable steps to address the situation.

Metsaw may connect to services operated by third parties.

Those third parties maintain their own privacy practices and terms. Metsaw is not responsible for the independent privacy practices of third-party services.

Customers should review the privacy policies and terms of connected-device providers and other services they choose to use.

Metsaw maintains a process for investigating suspected unauthorized access, disclosure, alteration, loss, or misuse of customer information.

When appropriate, Metsaw will:

• Investigate the event
• Contain identified risks
• Assess affected information
• Correct identified vulnerabilities
• Document the response
• Provide notifications when legally required

Metsaw may update this Privacy Policy as its products, services, technology, integrations, or legal obligations evolve.

Material changes will be reflected by updating the “Last Updated” date and, when appropriate, providing additional notice.

Questions, privacy requests, consent questions, deletion requests, or concerns may be directed to: