Consumer Health Data Privacy Policy

Effective date: October 6, 2026

This Consumer Health Data Privacy Policy explains how Yaluma LLC ("GoodQuits," "we," "us") collects, uses, shares and protects consumer health data through the GoodQuits app and goodquits.com. It is written to meet Washington's My Health My Data Act, Nevada's consumer health data privacy law and similar state laws, and it applies to everyone who uses GoodQuits. It adds to our Privacy Policy, which covers all other information.

1. Consumer health data we collect

"Consumer health data" is personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status. At GoodQuits, this may include:

• the habits you are working to quit (such as smoking, vaping, drinking, cannabis, gambling or other habits), how often you engage in them, and how much you spend;
• your quit history, quit date, how ready you feel, your reasons and your triggers;
• whether you experience physical symptoms when you stop drinking;
• your mood, check-ins, urge logs, slips and usage logs;
• your coach conversations and the notes the coach saves to remember you;
• your pattern report, which is built from your logs;
• photos, videos and other things you add, to the extent they reveal health information.

2. Why we collect and use it

We collect and use consumer health data only to:

• provide the coaching you ask for, including your plan, dashboard, streak, reminders, urge support, pattern report and AI coach;
• keep the Service secure and prevent fraud and abuse;
• comply with the law.

We do not use it for advertising, we do not sell it, and we do not use it to train AI models.

3. Where it comes from

It comes directly from you (your answers, logs, messages and uploads) and from how you use the app (for example, when you check in). Answers you give in the sign-up quiz stay on your device until you create an account and give the consents described in Section 5.

4. Who we share it with

We share consumer health data only with these service providers, which process it on our behalf under contracts that limit their use of it:

• Supabase stores your account and data and runs our backend. Privacy contact: supabase.com/privacy
• Cloudflare privately stores your photos and videos. Privacy contact: cloudflare.com/privacypolicy
• Our third-party AI model provider runs the AI model that writes coach replies. Your messages and relevant context are sent to it with each reply.

Each page above explains how to contact that company about privacy. Our other providers (RevenueCat, Resend, Apple and Google) receive account or payment information, such as your email or subscription status, but not the health information you enter in the app.

We may also disclose consumer health data if the law requires it, at your direction, or as part of a merger, acquisition or sale of assets, in which case this Policy continues to apply. The app does not include advertising, attribution or third-party analytics tools.

5. Your consent

Before we collect your consumer health data, we ask for two separate consents when you create your account, each with its own box that starts unchecked:

• Collection: consent to collect and use your consumer health data to provide your coaching.
• Sharing: consent to share it with the service providers listed in Section 4 so they can run the Service for us.

GoodQuits cannot work without both, so both are needed to create an account. You can withdraw your consent at any time by deleting your account in the app (Settings > Delete my account) or by emailing support@goodquits.com. When you withdraw consent, we stop collecting and sharing your consumer health data and delete it as described in Section 7.

6. Your rights

You have the right to:

• confirm whether we collect, share or sell your consumer health data, and access it, including a list of the third parties and affiliates we share it with and how to contact them;
• delete your consumer health data;
• withdraw your consent;
• appeal if we deny your request.

To make a request, email support@goodquits.com, or delete your account directly in the app. We will verify your identity (usually by confirming your account email) and respond within 45 days. If we need more time, we will tell you, and we may take up to 45 more days where the law allows. If we deny your request, you may appeal by replying to our decision. If you are not satisfied with the result of your appeal, you may contact the Washington State Attorney General (atg.wa.gov) or the attorney general of your state. We will not discriminate against you for exercising your rights.

7. Deletion

When you delete your account in the app, your account and all of its data are permanently removed from our database, and your photos and videos are deleted from storage, immediately. Nothing is kept in a hidden or "deactivated" state.

If you ask us to delete your data by email, we will do the same within 45 days of receiving your request, and we will confirm when it's done.

Copies in our providers' backups are overwritten on their normal schedule within 90 days. Backups are used only to recover from outages, and if one is ever restored, we will delete your data again. Our AI model provider keeps coach messages only for a limited time for trust, safety and abuse prevention, and then deletes them under its commercial terms.

8. How we protect it

Only the people and service providers who need consumer health data to run the Service can access it. We protect it with encryption in transit, access controls that separate each person's data, private storage for media, and time-limited access links.

9. Contact us

Yaluma LLC
418 Broadway Ste N, Albany, NY 12207
support@goodquits.com