CALIFORNIA PRIVACY NOTICE

This California Privacy Notice applies solely to individuals who reside in the State of California (“consumers” or “you”). It supplements the information contained in Evolve Your Bod’s general Privacy Policy and describes our practices in accordance with the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), and other applicable California privacy laws.

Any terms defined in the CCPA or CPRA have the same meaning when used in this Notice.

1. Scope and HIPAA Carve-Out

This Notice applies to “Personal Information” collected by Evolve Your Bod (AA Health Solutions, LLC) in its role as a business under California law.

Important: Medical information and Protected Health Information (“PHI”) that are governed by the Health Insurance Portability and Accountability Act (“HIPAA”) are not subject to the CCPA/CPRA. Such information is handled in accordance with our Notice of Privacy Practices (available at evolveyourbod.com/notice-of-privacy-practices) and our PHI / Data-Sharing Authorization, not this California Privacy Notice.

This Notice primarily applies to:

– Website visitor data and browsing activity.

– Account registration and profile information.

– Marketing, advertising, and analytics data.

– Payment and transaction data (to the extent not governed by HIPAA).

– Customer support communications.

– Non-medical operational data.

– Insurance eligibility and billing information for In-Person Visit, Hybrid, and Mobile IV services (to the extent not governed by HIPAA).

– Health-related intake information that does not qualify as PHI under HIPAA.

2. Categories of Personal Information We Collect

Under California law, “Personal Information” means information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked to a particular consumer or household.

Evolve Your Bod has collected the following categories of Personal Information:

3. Sources of Personal Information

We collect Personal Information from the following sources:

– Directly from you: When you create an account, complete forms, submit intake questionnaires, contact customer support, or otherwise interact with our platform.

– From your interactions with our website: Through cookies, analytics tools, and tracking technologies that record browsing activity and device information.

– From healthcare providers and partner clinics: Information shared by affiliated Medical Groups, partner clinics, satellite site staff, pharmacies, and laboratories in connection with your care (to the extent such information is not governed by HIPAA).

– From insurance carriers: Insurance eligibility and billing information received during verification, claims processing, and benefits coordination for IPV, Hybrid, and Mobile IV services.

– From third-party service providers: Information from payment processors, analytics providers, marketing partners, identity verification services, and referral sources.

4. Purposes for Collecting and Using Personal Information

We collect and use Personal Information for the following business and commercial purposes:

– Providing access to the Evolve platform across all care models (Telehealth, In-Person Visits, Hybrid Consult + IV, and Mobile IV).

– Account creation, management, and authentication.

– Payment processing, subscription billing, and refund management.

– Insurance eligibility verification, claims coordination, and billing for IPV, Hybrid, and Mobile IV services (performed by the rendering provider, partner clinic, or Evolve acting as billing agent under a Management Services Agreement).

– Customer service, support, and complaint resolution.

– Website analytics, performance monitoring, and user experience improvement.

– Fraud prevention, security monitoring, and abuse detection.

– Marketing communications and promotional offers (where permitted by law and subject to your opt-out preferences).

– Legal compliance, regulatory obligations, and dispute resolution.

– Coordinating care logistics, including scheduling, intake processing, and appointment management across all care models.

We do not use Personal Information for materially different, unrelated, or incompatible purposes without providing you with notice.

5. Disclosure of Personal Information

We may disclose Personal Information to the following categories of third parties for the business purposes described in Section 4:

– Affiliated Medical Groups and licensed healthcare providers — for care coordination across all care models.

– Partner clinics and satellite facilitating sites — for scheduling, intake, and in-person/hybrid encounter coordination.

– On-site clinical staff and mobile IV field nurses — for encounter facilitation and IV therapy administration.

– Licensed pharmacies (including compounding pharmacies) — for prescription fulfillment.

– Laboratories and diagnostic facilities — for lab testing and diagnostics.

– Insurance carriers and payers — for eligibility verification, claims submission, and benefits coordination (IPV, Hybrid, Mobile IV).

– Payment processors — for secure transaction processing.

– Technology and hosting service providers — for platform operations, data storage, and telehealth infrastructure.

– CRM and patient engagement platforms — for communication and care coordination workflows.

– Analytics and marketing vendors — for website analytics and advertising effectiveness measurement.

– Legal and regulatory authorities — when required by law, court order, or regulatory process.

Sale of Personal Information

Evolve Your Bod does not sell Personal Information for monetary compensation.

Sharing of Personal Information

Certain website tracking technologies (such as cookies, pixels, and similar tools used for analytics and advertising) may qualify as “sharing” under the CPRA when used for cross-context behavioral advertising. If applicable, California residents may opt out of this sharing as described in Section 7 below.

6. Data Retention

We retain Personal Information only as long as reasonably necessary to fulfill the purposes for which it was collected. Retention periods vary by data type:

– Account and billing information: Retained for the duration of your active account and for a reasonable period thereafter (typically 7 years) to comply with tax, accounting, and legal obligations.

– Website analytics and technical data: Retained in accordance with our analytics platform’s settings, typically no longer than 26 months.

– Marketing and preference data: Retained until you opt out, request deletion, or the data is no longer needed for marketing purposes.

– Insurance and billing records: Retained for the period required by applicable healthcare billing regulations and payer requirements.

– Customer support communications: Retained for a reasonable period to resolve issues and improve service quality.

Health records governed by HIPAA are retained in accordance with applicable medical record retention laws (not this CCPA Notice). In Texas, medical records must generally be retained for a minimum of seven years from the date of last treatment.

When Personal Information is no longer needed, we securely delete or de-identify it in accordance with our data retention and destruction policies.

7. Your California Privacy Rights

If you are a California resident, you have the following rights under the CCPA/CPRA:

1. Right to Know

You may request disclosure of the categories of Personal Information collected, the specific pieces of Personal Information we hold about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom we share your information. You may make this request up to two times in a 12-month period.

1. Right to Delete

You may request deletion of Personal Information we have collected about you. We will comply unless an exception applies (for example, if the information is needed to complete a transaction, detect security incidents, comply with a legal obligation, or exercise a legal right).

1. Right to Correct

You may request correction of inaccurate Personal Information maintained about you. We will use commercially reasonable efforts to correct the information.

1. Right to Opt-Out of Sale or Sharing

Evolve Your Bod does not sell Personal Information for monetary compensation. If certain website tracking technologies qualify as “sharing” under the CPRA for cross-context behavioral advertising purposes, you may opt out by:

– Clicking the “Do Not Sell or Share My Personal Information” link in the footer of our website.

– Emailing your request to info@evolveyourbod.com with the subject line “California Opt-Out Request.”

– Calling 866-301-3141 and requesting to opt out.

– Enabling a browser-based opt-out preference signal (such as the Global Privacy Control or GPC). We honor GPC signals as valid opt-out requests under the CPRA.

1. Right to Limit Use of Sensitive Personal Information

You may request that we limit the use and disclosure of Sensitive Personal Information to what is necessary to provide the services you have requested. Evolve Your Bod already limits its use of Sensitive Personal Information to permitted business purposes and does not use it to infer characteristics about you beyond what is necessary to provide services.

1. Right to Non-Discrimination

We will not discriminate against you for exercising any of your California privacy rights. This means we will not deny you services, charge you different prices, provide a different level of service quality, or suggest that you will receive different treatment for exercising your rights.

8. How to Submit a Privacy Request

To exercise your California privacy rights, you may submit a request through any of the following methods:

Email: info@evolveyourbod.com (Subject: California Privacy Request)

Phone: 866-301-3141

Online: Submit a request through the “Do Not Sell or Share My Personal Information” link in the website footer, or by contacting us through the Contact Us page at evolveyourbod.com/contact-us.

We will acknowledge your request within 10 business days and provide a substantive response within 45 calendar days. If we need additional time (up to an additional 45 days), we will notify you of the extension and the reason for it.

You may also designate an authorized agent to submit a request on your behalf. If you use an authorized agent, we may require that you provide the agent with written permission, that the agent verify their identity, and that you directly confirm with us that you authorized the agent to act on your behalf.

9. Verification Process

To protect your privacy and security, we must verify your identity before fulfilling a privacy request. Verification requirements vary depending on the type and sensitivity of the request:

– For requests to know categories of information: We will verify your identity to a reasonable degree of certainty by matching at least two data points you provide with information we already maintain.

– For requests to know specific pieces of information: We will verify your identity to a reasonably high degree of certainty by matching at least three data points and obtaining a signed declaration under penalty of perjury that you are the consumer whose information is being requested.

– For requests to delete: Verification to a reasonable degree of certainty (two data points), or a reasonably high degree of certainty (three data points) depending on the sensitivity of the information.

If we cannot verify your identity, we will explain why and provide information about what you can do to complete the verification process.

10. Children Under 16

Evolve Your Bod’s services are intended for individuals 18 years of age or older. We do not knowingly collect, sell, or share Personal Information of consumers under 16 years of age. If we become aware that we have collected Personal Information from a consumer under 16, we will take steps to delete that information promptly.

11. Financial Incentive Programs

Evolve Your Bod may offer financial incentive programs, such as multi-month discount pricing, subscription benefits, or loyalty programs, that involve the collection or retention of Personal Information. If we offer such programs, the terms will be presented to you at the time of enrollment. You may opt out of any financial incentive program at any time.

We estimate the value of Personal Information collected in connection with financial incentive programs based on the expense related to collecting and retaining that information and the revenue associated with the program. We do not assign a monetary value to Personal Information outside of these specific program contexts.

12. Relationship to Other Privacy Documents

This California Privacy Notice is part of a suite of privacy documents maintained by Evolve Your Bod:

Privacy Policy (evolveyourbod.com/privacy-policy) — Governs the collection and use of all personal information by Evolve as a technology platform.

Notice of Privacy Practices (evolveyourbod.com/notice-of-privacy-practices) — Governs how PHI is used and disclosed under HIPAA. PHI is exempt from the CCPA/CPRA.

PHI / Data-Sharing Authorization — Your signed consent for Evolve to share health information with entities involved in your care and a copy is available at evolveyourbod.com/phi-authorization/

HIPAA Compliance Page (evolveyourbod.com/hipaa-compliance) — Explains how Evolve protects health information and the safeguards in place.

Where HIPAA applies to your health information, the Notice of Privacy Practices governs and the CCPA does not apply. Where HIPAA does not apply, this California Privacy Notice and the Privacy Policy govern. In all cases, the most protective standard applies.

13. Updates to This Notice

We may update this California Privacy Notice periodically to reflect changes in our practices, applicable law, or regulatory guidance. The effective date at the top of this Notice reflects the latest revision. Material changes will be posted on our website and, where required, communicated to affected consumers.

14. Contact Information

If you have questions about this California Privacy Notice or your privacy rights, please contact:

Evolve Your Bod — Privacy Office

AA Health Solutions, LLC

5521 Bellaire Drive South, Suite 200

Fort Worth, TX 76109

Email: info@evolveyourbod.com (Subject: California Privacy)

Phone: 866-301-3141