Consumer Health Data Privacy Policy for Becoming Last Updated: October 23, 2026 This policy explains how Zager Consulting LLC handles "consumer health data" as defined by the Washington My Health My Data Act, Nevada law (SB 370) and Connecticut law. It adds to our Privacy Policy. We apply it to all users. 1. HEALTH DATA WE COLLECT Becoming is a self-reflection and habit app, not a health service. Still, some of what you share may count as consumer health data: - What you write to Zya or in reflections about your feelings, stress, mood, sleep, habits (including drinking or other substance use), relationships, or any physical or mental health condition, treatment or medication you choose to mention. - Mood check-ins and mood history. - Goals and practice results related to your wellbeing. - Summaries, patterns and insights the app creates from that content. - A record that the app detected possible signs of a crisis (not the message itself). - Voice clips you record with the mic, which may include health details. They are turned into text and not kept. We do not collect precise location, biometric data or genetic data, and we do not use geofencing. 2. WHY WE COLLECT IT We collect and use consumer health data only to provide the features you ask for: - Writing Zya's replies and remembering context. - Creating goals, practices, reflections and insights for you. - Showing crisis resources when the app detects possible signs of a crisis. - Keeping the service secure and fixing problems. We do this only with your consent, which you give on the AI consent screen, or where it is necessary to provide the service you requested. 3. WHERE IT COMES FROM - You, when you use the app. - Our AI processing of what you share (summaries, patterns and insights). 4. WHO WE SHARE IT WITH We do not sell consumer health data. We share it only with processors that handle it for us under contract: - Google LLC (Firebase, Google Cloud, Vertex AI, Cloud Speech-to-Text): storage, hosting, AI processing and turning voice into text. Contact: https://cloud.google.com/terms/cloud-privacy-notice - OpenAI, L.L.C. (API): AI processing. Contact: https://openai.com/policies/privacy-policy - Resend (Plus Five Five, Inc.): only if your feedback, or a reply you report and your message before it, includes health details, when it is emailed to our team. Contact: https://resend.com/legal/privacy-policy Crash reports sent to Sentry are designed to exclude your content. We have no affiliates that receive consumer health data. If we ever want to share consumer health data with anyone other than a processor, we will ask for your separate consent first. 5. YOUR RIGHTS You have the right to: - Confirm whether we collect, share or sell your consumer health data, and access it. - Get a list of all third parties and affiliates we have shared it with, and how to contact them (see Section 4). - Withdraw your consent. In the app, go to Settings, AI & Your Data, and tap Turn off AI. - Have your consumer health data deleted. In the app, go to Settings, Account, Delete Account, or email us. We delete it from our systems and tell our processors to delete it too. Copies in backups are deleted within six months. 6. HOW TO USE YOUR RIGHTS Email support@becoming.help from the email address on your account, or use the in-app options above. We may need to confirm your identity. We respond within 45 days and will tell you if we need up to 45 more days. Requests are free (up to twice a year for access requests). 7. APPEALS If we decline your request, reply with "Appeal" in the subject line. We will respond in writing within 45 days and explain our decision. If your appeal is denied, you can contact: - Washington Attorney General: https://www.atg.wa.gov/file-complaint - Nevada Attorney General: https://ag.nv.gov/Complaints/File_Complaint/ - Connecticut Attorney General: https://portal.ct.gov/AG/Common/Complaint-Form-Landing-page 8. CONTACT Zager Consulting LLC Iowa, United States support@becoming.help