ResonantVibe LLC — Consumer Health Data Privacy Policy

This policy supplements our Privacy Policy and applies to "consumer health data" as defined by the Washington My Health My Data Act and Nevada SB 370, for consumers those laws protect. Where this policy conflicts with our general Privacy Policy, this policy controls for consumer health data.

1. What Consumer Health Data We Collect

When you use a VAVE System's Biofeedback module, we collect Biofeedback Data: brain activity (EEG) and heart rate, captured through the integrated biofeedback sensor (the InteraXon Muse S Athena headband), and — if and when voice analysis is offered and you enable voice biofeedback — voice-derived acoustic features captured through a microphone, together with similar physiological measurements any future sensor we support may capture.

We also collect:

• health-profile and screening responses you provide through the General Medical Disclaimer, Waiver & Health Acknowledgment and its condition-screening flows (for example, implants, pregnancy, seizure history, medications);
• session logs — which sessions you ran, when, which modalities were enabled, and the settings used;
• wellness insights derived from your measurements, including the processed session summaries ("deltas") described in our Privacy Policy; and
• health information you choose to enter, such as mood tags, notes, or journal entries.

If you receive a session as a guest or operator-run participant without a VAVE account, we collect through the pre-session confirmation flow on your own phone: the health attestations of the General Medical Disclaimer and condition screening (which are consumer health data), together with your name as you type it to sign the General Medical Disclaimer, your date of birth and a contact channel you choose (an email address or a mobile number for SMS). This information is collected and used for safety and incident-record purposes only, is retained for twenty-four (24) months from the session date and then deleted (an incident moves that person's record to our separate incident file), and is never used for marketing — we will not send marketing messages to that contact channel unless you separately give express consent. You hold the same rights under Section 5 as an account holder, exercisable without a VAVE account by email to privacy@resonantvibe.com or by phone at +1 (303) 222 0963. If you ask us to delete this information, we delete your contact channel, your name and your date of birth within thirty (30) days of your request; the health attestations stay for the twenty-four (24) months as the safety record, without your name and with only a yes that you passed the adults-only check in place of your date of birth, and are then deleted. If the person running your session confirms the safety steps for you instead (Terms of Use §15), we collect no consumer health data about you.

2. Why We Collect It

Solely to: operate the biofeedback, screening, and session features you request (including recording a condition you report and letting you proceed only after your recorded acknowledgment: physician clearance confirmed, or risks accepted); display your real-time and historical readings; generate the personalized wellness insights you enable; troubleshoot and secure the Services; and comply with law. We collect consumer health data with your consent or as necessary to provide services you have requested.

3. How We Get Your Consent

Before your first biofeedback session on a VAVE System, we ask for your affirmative, opt-in consent to collect and process Biofeedback Data. Your acceptance of the General Medical Disclaimer is recorded separately, with the form version and timestamp, before your account is activated for sessions, or, if you are a guest, before your first session. You may withdraw your biofeedback consent at any time in Settings or by emailing privacy@resonantvibe.com; the System's non-biofeedback functions continue to work.

4. Sharing

We do not sell consumer health data, and we will not sell it without the separate signed authorization the law requires — which we do not currently seek from anyone. We share consumer health data only with:

• service providers processing it on our documented instructions — currently Amazon Web Services (AWS), which hosts and stores all physiological data: the session database holding session metadata and derived summaries ("deltas") and Amazon S3 object storage for raw biometric recordings where the Raw Biometrics Storage module is enabled, in each case operated under our agreement with AWS. Supabase provides identity, authentication, and entitlements only, and Cloudflare provides content delivery for session audio and program content and marketing-site edge services only — no Biofeedback Data is stored on or transits either service, and no API traffic carrying Biofeedback Data is proxied through Cloudflare's network. Our Privacy Policy §15 is the roster of our sub-processors;
• a Covered Customer's authorized Hub account, where you receive VAVE sessions through a wellness center, clinic, or practitioner and have been informed of that sharing (see Privacy Policy §8.1); and
• authorities, where legally required.

We do not share consumer health data with advertising networks, data brokers, or social media platforms, and we do not use it for targeted advertising.

5. Your Rights

You may:

• confirm whether we collect, share, or sell your consumer health data;
• access it, including a list of all third parties and affiliates with whom we have shared it and an active contact address for each;
• withdraw consent; and
• have it deleted, including from backups on our standard backup-expiration cycle (purged within 90 days) and by notice to our processors.

Exercise any right at privacy@resonantvibe.com, by phone at +1 (303) 222 0963, or in-app under Settings → Privacy. We will respond within the time required by your state's law.

When you ask us to delete your data, we delete your name and the personal data we hold about you, including your consumer health data. We keep a record that each session took place (the time, the composition, the duration and the VAVE System) without anything that identifies you and without any consumer health data, as in a Private Mode session (Privacy Policy §6): under the account of the person who ran the session, or, for sessions you ran on your own VAVE System, in that System's history. A guest's health attestations are kept as Section 1 says.

6. Appeals

If we deny a request, you may appeal by replying to our decision. If your appeal is denied, you may contact the Washington Attorney General (atg.wa.gov) or the Nevada Attorney General (ag.nv.gov).

7. Security and Retention

Consumer health data is encrypted in transit and at rest. Biofeedback Data is uploaded from the System tagged only with a pseudonymized session identifier; your identity, consent, and payment records are held on separate Backend infrastructure and linked only within access-controlled systems, restricted to personnel who need access to operate the Services. Consumer health data is retained only as long as needed for the purposes above or as Section 13 of our Privacy Policy specifies, whichever is shorter — by default, raw sensor readings are deleted as soon as your session delta is computed, and deltas are retained for up to twenty-four (24) months from your last interaction with the Services (or per your active Extended Data Retention or Raw Biometrics Storage subscription, as described in the Privacy Policy §3.3 and §13). We keep deltas for up to twenty-four (24) months to show you your own session history and to run the features you chose, and we delete them sooner if you delete your account or withdraw your consent.

8. Changes and Contact

We will post changes to this policy on this page and update the Last Updated date; you will be notified of material changes as described in our Privacy Policy §27.

ResonantVibe LLC, 42 W Byers Pl., Denver, Colorado 80223 — privacy@resonantvibe.com

ResonantVibe LLC. Consumer Health Data Privacy Policy, CHD-1.11.