Calm Consumer Health Data Privacy Policy

This Consumer Health Privacy Policy explains how Calm.com, Inc. and our subsidiaries and affiliates (“Calm”, “we”, “our”, or “us”) collect, use, and disclose certain health information about you when you access or use our Calm Sleep website(s) and mobile application (collectively, the “Services”), and when you contact our customer service team or otherwise interact with us. This Consumer Health Privacy Policy is a supplement to the Calm Privacy Policy and applies to personal information and other data that may fall within the definition of “consumer health data” under applicable United States state laws, including Nevada’s Consumer Health Data Privacy Act and Washington’s My Health My Data Act (“Consumer Health Data”). We encourage you to review the Calm Privacy Policy to learn more about our privacy practices and our commitments to you. Capitalized terms used below have the same definitions as in the Calm Privacy Policy or in the applicable laws, unless otherwise noted.

We may change this Consumer Health Privacy Policy from time to time. If we make changes, we will revise the date at the top of the policy and, in some cases, we may provide you with additional notice.

This Consumer Health Privacy Policy does not apply to third-party websites or producats. Please separately review their privacy policies to understand how your personal information is used and stored by those third parties.

Collection of Consumer Health Data

We may collect certain Consumer Health Data about you depending on how you engage with our Services. This health information may fall under the following specific categories of Consumer Health Data:

• Bodily functions, vital signs, symptoms, or measurements. With your permission, we may receive data from your mobile device’s health app (like Apple HealthKit or Google Health Connect) or wearable, such as hours of sleep, heart rate, wrist temperature, and blood oxygen.

Sources of Consumer Health Data

We may collect Consumer Health Data in the following ways:

• from third-party apps (like Apple HealthKit) or other third-party products (like a connected fitness device) with which you have chosen to integrate or link your Calm Sleep account.

Use of Consumer Health Data

We may use your Consumer Health Data in the following ways:

• to provide our Services to you, including by personalizing your Calm Sleep experience and sending you reports on your sleep and recommended actions;
• to provide you support when responding to your questions, concerns, complaints, or other requests;
• to create anonymous or aggregated data sets;
• to protect ourselves, you, and others such as by taking actions to prevent, detect, or respond to fraud, security incidents, harassment, or other malicious or illegal activity;
• to comply with our compliance, third party contractual agreements, and other legal obligations;
• to establish or exercise our legal rights or defense against legal claims; and
• otherwise with your consent where requested and received.

Disclosures of Consumer Health Data

We may disclose your Consumer Health Data to achieve the purposes and uses listed above. The categories of recipients to whom we disclose your Consumer Health Data with are:

• Service providers: We disclose Consumer Health Data to service providers and vendors (also known as “processors” under the Consumer Health Data Laws) that need access to such data to perform services on our behalf, such as to provide cloud storage, manage user accounts, and power our Services.
• Business transfer: We may disclose Consumer Health Data in connection with any merger, sale of company assets, financing or acquisition of all or a portion of our business by another company.
• Other: We may disclose Consumer Health Data for legal reasons or as necessary to protect Calm or others.

Privacy Rights

As provided for in the Privacy Rights section of the Calm Privacy Policy, you may make requests about your personal information. Applicable privacy laws provide you certain specific rights with respect to your Consumer Health Data law subject to exceptions. Specifically:

• The right to know what categories of Consumer Health Data we collect, share, or sell. You also have the right to obtain a list of all third parties and affiliates with whom we have shared or sold your Consumer Health Data, and an active email address or other mechanism that you may use to contact these third parties. If you are a Washington resident or otherwise subject to Washington law, you also have the right to access your Consumer Health Data that we collect, share, or sell.
• The right to have us, as well as our affiliates, service providers, and contractors, delete the Consumer Health Data we have about you.
• The right to withdraw consent related to your Consumer Health Data where we rely upon consent to collect, use, or share your Consumer Health Data.
• The right not to receive discriminatory treatment for the exercise of the privacy rights described above.

You may exercise your rights by contacting support@calm.com with your request. As further stated in the Calm Privacy Policy, your request may be denied where an exception applies, including but not limited to, where we are legally required to maintain your Consumer Health Data or if we are unable to authenticate the request using commercially reasonable efforts.

We will respond to your request to exercise your right(s) within forty-five (45) days after receipt, and we reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days. An authorized agent may submit a request to exercise the opt-out right on your behalf.

How to appeal decisions about your rights.

• Nevada: If you are a Nevada resident and your request is denied, you may appeal our decision and we will provide the steps to appeal as part of responding to your request. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If your appeal is not successful, you may submit a complaint with the Nevada Attorney General at https://ag.nv.gov/Complaints/CSU_Complaints___FAQ/.
• Washington: If you are a Washington resident or located in Washington and your request is denied, you may appeal our decision and we will provide the steps to appeal as part of responding to your request. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If your appeal is not successful, you may submit a complaint with the Washington State Attorney General at https://www.atg.wa.gov/file-complaint.