Consumer Health Data Privacy Policy

Effective Date: September 29, 2026

ViewFi Health, Inc. (“ViewFi Health,” “ViewFi,” “we,” “us,” or “our”) values your privacy. This Consumer Health Data Privacy Policy supplements ViewFi’s general Privacy Policy and applies to personal information defined as “consumer health data” under Washington’s My Health My Data Act and Nevada’s consumer health data privacy law. It explains the consumer health data we collect, the sources from which we collect, how we may collect, use, disclose, share, or otherwise process consumer health data, how we protect it, and the rights and choices that may be available to you.

Scope

This policy applies to consumer health data that we collect from or about Washington and Nevada consumers, and individuals whose consumer health data is collected or processed in Washington or Nevada, as applicable, in connection with the ViewFi Platform, including the Site, Mobile Applications, patient portal, telehealth functionality, at-home diagnostic exams, and related Services that link to this policy.

For purposes of this policy, “consumer” means a Washington or Nevada resident, or an individual whose consumer health data is collected or processed in Washington or Nevada, as applicable. “Consumer health data” has the meaning given under Washington or Nevada law, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status.

This policy does not apply to protected health information that ViewFi processes as a business associate or service provider on behalf of a HIPAA-covered health care provider, health plan, covered entity, or business associate customer. In that role, we follow the customer’s instructions and the applicable business associate agreement. Where ViewFi handles protected health information on behalf of a participating provider, that information is governed by HIPAA, the provider’s Notice of Privacy Practices, and ViewFi’s contractual obligations to that provider.

This policy does not apply to personal information that we collect and process about our workforce members, job applicants, contractors, or other individuals in an employment or similar professional capacity. It also does not apply to information that is deidentified or aggregated so that it is not linked or reasonably linkable to a consumer.

Our Collection of Consumer Health Data

ViewFi collects consumer health data in connection with its virtual musculoskeletal care platform. We do not intentionally collect broader consumer health data unrelated to orthopedic and sports medicine care, telehealth visits, at-home diagnostic exams, care plan management, patient support, service administration, security, or related product functionality.

Examples of consumer health data we may collect include:

• Health, injury, symptom, pain, mobility, treatment, medication, care plan, care team, and related information you provide through the platform or that is made available through the Service;
• Telehealth documentation support. This feature is disabled by default. If enabled for an appointment and subject to any required consents, we may use automated technologies, including artificial intelligence, to record and transcribe the visit audio to prepare a summary of the clinically relevant content discussed for use by your care team as a reference. The summary is separate from, and does not replace or alter, the clinical documentation authored and signed by the treating healthcare provider. The audio recording and verbatim transcript are deleted once the summary is generated and are not retained;
• Video and images captured during at-home self-guided physical exams and video visits through your device camera;
• Insurance and coverage information, emergency contact information, occupation, sex, and gender identity;
• Appointment scheduling, care plan, and treatment history information;
• Information provided by or linked to your health care provider, orthopedic surgeon, sports medicine physician, care team, or other provider you connect to your account, including referral information, clinical notes, and provider-submitted materials;
• Intake and screener responses, at-home exam results, messages, appointment history, notes, and related engagement information;
• Information that identifies you as seeking or obtaining health care services, musculoskeletal care, telehealth consultations, or information about a treatment plan or condition.

We may also create deidentified or aggregated information that is not linked or linkable to a consumer. This policy does not apply to information that is deidentified in accordance with applicable law.

The Categories of Sources From Which We Collect Consumer Health Data

We may collect consumer health data from the following categories of sources:

• You directly, including when your account is provisioned and you use the ViewFi Platform, provide intake or screener responses, participate in telehealth visits, complete at-home exams, send messages, submit feedback, or otherwise interact with ViewFi;
• Your parent or legal guardian, where you are a minor patient (ages 12–17), including where they provide information on your behalf, consent to the Service on your behalf, or exercise rights on your behalf, where permitted by law;
• Health care providers, orthopedic surgeons, sports medicine physicians, care teams, clinics, physician groups, hospitals, or other providers that refer you to ViewFi or that use ViewFi to support your care;
• The ViewFi Platform automatically, including device information, usage data, and information collected through diagnostic, analytics, interaction-monitoring, and similar operational technologies to support quality assurance, debugging, security, performance monitoring, and service improvement; and
• Hosting providers, infrastructure providers, analytics providers, communications providers, customer support providers, security providers, and other service providers that support the Service.

How We Use Consumer Health Data

We may use consumer health data for the following purposes:

ViewFi does not currently offer patient-facing artificial intelligence. Telehealth documentation support is disabled by default and may be enabled for an appointment only subject to any required consents.

• Conduct telehealth visits and, when telehealth documentation support is enabled for an appointment and subject to any required consents, use automated technologies, including artificial intelligence, to record and transcribe visit audio and generate a summary of clinically relevant content for use by the care team as a reference. The summary is separate from, and does not replace or alter, the clinical documentation authored and signed by the treating healthcare provider;
• Support healthcare providers by preparing draft clinical documentation for review, editing, and signature by the responsible clinician and by assisting with intake review, examination selection, care-plan development, text refinement, document summaries, and source-referenced chronologies. These technologies are assistive, do not make independent clinical decisions, and do not replace the judgment of the treating healthcare provider;
• Support operations by triaging a shared support inbox. We do not apply artificial intelligence to analytics, usage, or product-improvement data;
• Facilitate at-home self-guided physical exams and processing associated video and images for diagnostic assessment;
• Connect you with orthopedic and sports medicine physicians and facilitating provider consultations;
• Enable Health Guides to provide patient support, answer questions, and assist with scheduling and care coordination;
• Allow your linked care team to view care-related information that is available through the Service and relevant to your treatment;
• Manage accounts, authentication (including one-time access codes and partner single sign-on), access controls, provider links, audit records, parental or guardian permissions where applicable, and service administration;
• Conduct quality assurance, security, debugging, fraud prevention, compliance, analytics, product development, and operational improvement related to the Service;
• Comply with legal, regulatory, contractual, audit, dispute-resolution, safety, and security obligations; and
• Other purposes disclosed to you at the time of collection or for which you, or where applicable your parent or legal guardian, provide consent.

Third Parties and Affiliates With Whom We Share Consumer Health Data

We may share the categories of consumer health data subject to this policy described in “Our Collection of Consumer Health Data,” including identifiers, information indicating that a consumer is seeking or receiving healthcare services, telehealth and at-home examination information, appointment and care-coordination information, and communications, with the following categories of third parties and affiliates:

• Health care providers, orthopedic surgeons, sports medicine physicians, care teams, clinics, and other providers you are linked to or that participate in your care through ViewFi, including ViewFi’s affiliated medical practices;
• Service providers that help us provide, operate, secure, support, and improve the Service, including:
  • Diagnostic, analytics, interaction-monitoring, and similar operational technology providers that support quality assurance, debugging, security, performance monitoring, and service improvement;
  • Artificial-intelligence and cloud model-hosting providers that support permitted clinical and operational functions, subject to access controls, generation logging, and applicable contractual safeguards. ViewFi and its artificial-intelligence service providers do not use personal information or patient data to train, fine-tune, or improve artificial-intelligence or machine-learning models;
  • Application performance, telemetry, and crash monitoring providers for service reliability, error tracking, and operational support;
  • Payment processing providers that process and tokenize payment information so that ViewFi does not receive full card numbers;
  • Identity and authentication providers for secure sign-in, access management, and account protection;
  • Address-search and other operational functionality providers;
• Professional advisers, auditors, consultants, insurers, legal counsel, compliance advisers, and other business operations providers;
• Regulators, courts, law enforcement, government authorities, or other parties where disclosure is required or permitted by law;
• Successors, purchasers, investors, or counterparties in connection with an actual or proposed merger, acquisition, financing, reorganization, sale, or transfer of all or part of our business or assets; and
• Other parties where you direct us to share information or provide consent.

We limit the consumer health data we disclose to what is reasonably necessary for the purposes described in this policy or as otherwise permitted or required by law.

Advertising and marketing technologies may be used on ViewFi’s Site but are not used in the patient Mobile Applications or patient portal. ViewFi does not use patient information for third-party advertising or retargeting and does not send marketing communications to patients. Site analytics are addressed in the general Privacy Policy, including information about controlling certain cookies and similar technologies through browser or device settings.

Collection and Sharing of Consumer Health Data

We collect and share consumer health data only as permitted by applicable Washington or Nevada law, including where necessary to provide a product or service that you request; where you, your parent or legal guardian, or your authorized representative provide information through the Service; where a participating provider refers you or facilitates your care through ViewFi; where we have obtained consent; or as otherwise authorized by applicable law. You may withdraw consent for future collection or sharing of consumer health data, but withdrawal will not affect processing that occurred before we received and processed your withdrawal request.

We do not sell consumer health data. Although ViewFi may receive fees for providing the Service, those fees are for the Service itself and not for the disclosure, transfer, or sale of consumer health data.

Location Information and Geofencing

ViewFi does not collect precise GPS location information. We may derive approximate location information from your IP address at the city or region level for purposes such as compliance, fraud prevention, and service availability. We do not use geofencing around facilities that provide in-person health care services.

How to Exercise Your Rights With Respect to Your Consumer Health Data

Depending on where you live and how you use the Service, you may have the following rights with respect to your consumer health data:

• Request confirmation of whether we collect, share, or sell your consumer health data;
• Request access to your consumer health data;
• Request a list of third parties and affiliates with whom we have shared or sold your consumer health data, including contact information where required;
• Withdraw consent for the collection or sharing of your consumer health data; and
• Request deletion of your consumer health data subject to this policy, subject to legal exceptions.

How to Submit a Request

To exercise rights with respect to consumer health data, please contact us at support@viewfi.com or call us at (404) 474-3762. We may take reasonable steps to verify the identity of the consumer and the authority of the person submitting the request.

If you are a third party submitting a request on behalf of another person as an authorized agent, you must provide proof of your authority, such as a signed declaration, power of attorney, or other documentation demonstrating that you are authorized to act on the consumer’s behalf. ViewFi may verify both the consumer’s identity and the authorized agent’s authority before responding to the request.

Where the Service is made available to a minor patient (ages 12–17), a parent or legal guardian may provide consent, access or manage the minor’s account or data, and submit consumer health data rights requests on behalf of the minor, in each case where permitted by law and subject to ViewFi’s verification procedures.

Where ViewFi provides the Service through a participating healthcare provider, physician group, hospital, or other healthcare organization, we may rely on that provider or organization to identify the patient, determine applicable parent, guardian, or proxy-access permissions, and communicate any authorizations, consents, or access rights applicable to the patient’s account or data.

We will respond to verified requests within the timeframe required by applicable law. If we deny your request, you may appeal by contacting us at support@viewfi.com and stating that you are appealing a consumer health data rights decision. If your appeal is unsuccessful, you may contact the Washington Attorney General or another applicable regulator, depending on the law that applies to your request.

We will not discriminate against you for exercising any of the consumer health data rights described in this policy.

Data Security

We maintain administrative, technical, and organizational safeguards designed to protect consumer health data against unauthorized access, use, disclosure, alteration, and destruction. ViewFi is HIPAA compliant and SOC 2 Type 2 certified. We restrict access to consumer health data to personnel who have a need to know. We choose technology partners based on their security and privacy practices. In case of a security incident involving consumer health data, we will respond in accordance with applicable data protection and breach notification laws.

Data Retention

We retain consumer health data for as long as reasonably necessary to provide, maintain, support, secure, and improve the Service; administer accounts, care plans, treatment history, provider relationships, audit records, and customer relationships; and comply with legal, contractual, audit, record-retention, safety, and regulatory obligations.

Medical records are retained in accordance with HIPAA and applicable state medical records retention laws. Non-medical operational data, including usage data and information collected through diagnostic, analytics, interaction-monitoring, and similar operational technologies, is retained only as long as needed for the purposes for which it was collected and is then deleted or de-identified.

Audio recordings and verbatim transcripts used to generate telehealth documentation-support summaries are deleted once the summary is generated and are not retained. The resulting summary is retained as a care-team reference only for as long as reasonably necessary to support care and related operational purposes, subject to applicable legal, security, audit, and backup requirements. The summary is separate from, and does not replace or alter, the clinical documentation authored and signed by the treating healthcare provider.

We delete, deidentify, or anonymize consumer health data when it is no longer needed for these purposes, subject to applicable legal, security, backup, and operational retention requirements.

Supplement for Nevada Consumers

This supplement applies to Nevada consumers for purposes of providing additional disclosures required by Nevada’s consumer health data privacy law. Terms used in this supplement that are defined under Nevada’s consumer health data privacy law have the meanings given to them under that law.

Purposes and manner of processing. We collect, use, process, and share consumer health data for the purposes and in the manners described in this Consumer Health Data Privacy Policy, including to provide the Service, support virtual musculoskeletal care, facilitate telehealth visits and at-home diagnostic exams, communicate with users, parents or legal guardians, and linked providers, maintain security, comply with legal obligations, and improve the Service.

Review and revision of consumer health data. If you would like to review or revise your consumer health data, you may submit a request using the methods listed in this policy. We will respond to your request in accordance with applicable law and, where Nevada law applies, no later than 45 days after receiving your request, unless an extension is permitted by law.

Changes to this supplement. We will notify you before making any material changes to our privacy practices with respect to consumer health data by posting an updated notice with an updated effective date or by providing other notice required by applicable law.

Third-party collection of consumer health data. Third parties may collect information directly from you when you interact with their websites, applications, or services. Their practices are governed by their own privacy notices. ViewFi does not authorize third parties to collect consumer health data through the patient Mobile Applications or patient portal for third-party advertising or retargeting.

Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, technologies, services, or legal requirements. If we make material changes, we will provide notice as required by law. The version posted on our website or made available through the Service will indicate the effective date.

Contact Us

If you have questions about this policy or wish to exercise your consumer health data rights, please contact ViewFi Health at support@viewfi.com or call us at (404) 474-3762.