Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy describes how Tech With Nikola Ltd, doing business as Nalura ("we," "us," or "our") collects, uses, shares, and protects "consumer health data" as defined by applicable U.S. state laws. It also outlines your privacy rights regarding this data in connection with our services (the "Services").

This policy supplements our main Privacy Policy.

Health Data We Collect

We collect the following types of consumer health data:

• Health conditions and medical history: information about your health background, chronic symptoms, diagnoses, treatments, and prescribed medications
• Behavioral and lifestyle interventions: exercise routines, fitness goals, dietary habits, sleep patterns, stress management activities, and other health-related behaviors
• Physical measurements and vital signs: weight, height, vital signs, and other physiological measurements
• Diagnostic information: panel screening results, blood test data, and other diagnostic assessments you share
• Derived health insights: personalized health targets, risk assessments, and habit change recommendations generated from your inputs

Where We Get Your Health Data

We collect health data from:

Directly From You

When you use our Services, complete forms or surveys, upload test results or health assessments, or communicate with our support team.

Third-Party Health Platforms

When you explicitly authorize us to access data from platforms like Apple Health, Oura, Whoop, and similar services. We will not use this data for advertising or sell it to advertising platforms, data brokers, or information resellers. We use your health data solely to deliver our Services and provide personalized health recommendations.

Why We Collect and Use Health Data

We collect and use your health data for:

• Service delivery: Provide personalized health insights and recommendations based on your health metrics, manage your account, and process transactions
• Research and development: Improve our Services through analysis of aggregated, de-identified, or anonymized data
• Legal compliance and protection: Meet legal requirements, protect rights and safety, audit internal processes, enforce our terms, and prevent fraud and harmful activities

How We Share Your Health Data

We may share the health data categories described above with:

Service Providers

• AI platforms: OpenAI, Anthropic, and Google for generating personalized insights
• Cloud infrastructure: AWS and similar providers for secure data storage
• Analytics providers: to analyze service usage and improve user experience

Legal Authorities

Law enforcement or government agencies when required by law or to protect legitimate interests.

Business Transfer Recipients

Potential acquirers or partners in mergers, acquisitions, or similar business transactions. We will make reasonable efforts to notify you if this occurs.

Other Parties

Third parties at your direction or with your explicit authorization.

Your Health Data Rights

Depending on your location and how you interact with our Services, you may have the right to:

• Confirm whether we collect, share, or sell your health data
• Access your health data
• Delete your health data
• Withdraw consent for our collection or sharing of your health data

Please note that in some cases, we may be unable to fulfill your request if doing so would impair others' rights, prevent us from providing requested services, or conflict with our legal obligations. We'll notify you if we cannot fulfill your request and explain why.

How to Submit a Request

To exercise any of these rights, email us at: help@nalura.ai

We will not discriminate against you for exercising your privacy rights.

How to Appeal

If we deny your request, you may appeal by emailing help@nalura.ai. We'll respond within 45 days with an explanation of our decision. If your appeal is denied, you may file a complaint with the appropriate regulatory authorities.

Policy Changes

We may update this Consumer Health Data Privacy Policy at any time. When we do, we'll update the date at the top and post the revised version on our website. For significant changes, we'll provide additional notice as required by law. Your continued use of the Services after changes take effect indicates your acceptance of the updated policy.