Privacy Policy

PRIVACY POLICY Last Updated: July __, 2026 5D Patient Journey, Inc. d/b/a Total Health, including its affiliates (collectively, “Total Health,” “we,” “us,” or “our”), is committed to being transparent about how we handle your information. This Privacy Policy explains how we collect, use, share, and protect your information when you use our website, application, platform, and related products and services (collectively, the “Services”). This Privacy Policy is incorporated into and made part of our Terms of Service. Total Health is not a health care provider and does not provide medical advice. Total Health is not a HIPAA “covered entity” or “business associate,” and the information we hold is generally not “protected health information” under HIPAA once it is in our possession, though it may be protected under certain state laws. This Privacy Policy, together with any additional consents or authorizations you have signed with us, governs our use of your data. Washington, Nevada, and Connecticut residents: our Consumer Health Data Privacy Notice contains additional disclosures and rights that apply to you. 1. INFORMATION WE COLLECT Information you provide directly: account and contact details (name, email, phone, address, date of birth); health and lifestyle information you enter or provide (including medical history, symptoms, family history, medications, diet, activity, and similar); and payment information. Health information from sources you authorize: Where authorized, we collect health information from third-party sources you designate, which may include health care providers, hospitals, clinics, laboratories, pharmacies, health plans and insurers, health information exchanges and networks, wearable and connected devices, and direct-to-consumer testing services (including, where you elect, genetic and biomarker data). Information collected automatically: This includes device and usage data, IP address, identifiers, and cookie and similar tracking data. See Section 8. 2. HOW WE USE YOUR INFORMATION We use your information to: - create and maintain your account and provide the Services; - collect, aggregate, organize, and analyze your health information to generate Reports, scores, insights, and educational content; - develop, train, test, validate, and improve our models, algorithms, and Services, and to develop new products and services, as described below; - communicate with you, including service and transactional messages and, subject to your rights and choices, marketing; - process payments and administer subscriptions; - protect the security and integrity of the Services and prevent fraud; and - comply with legal obligations and establish, exercise, or defend legal claims. How we develop and improve our models. We use de-identified and aggregated data to develop, train, test, validate, and improve our models, algorithms, and Services. We do not use identified consumer health data for model development except where it is strictly necessary to provide or maintain the Services you have requested, or where you have consented and applicable law permits. Sensitive and consumer health data. We collect and use consumer health data only for the purposes described in this Privacy Policy, our Consumer Health Data Privacy Notice, and any additional consents or authorizations signed with us, and, where required by law, only with your separate consent. We do not use your genetic information in a manner prohibited by the Genetic Information Nondiscrimination Act (GINA) or applicable state law. We do not make eligibility, underwriting, employment, or clinical decisions about you, and we do not permit our Reports to be used for such purposes. 3. DE-IDENTIFIED AND AGGREGATED INFORMATION We create de-identified and aggregated information from the data we collect. De-identified information is information that does not identify you and cannot reasonably be used to infer information about, or otherwise be linked to, you. Aggregated information describes a group or category of people in a way that no individual can reasonably be identified. De-identified and aggregated information is not personal information, personal data, or consumer health data under applicable law. We may retain, use, license, sell, and disclose de-identified and aggregated information for any lawful purpose, including to conduct and support research, to collaborate with and provide data and analyses to research partners, life sciences companies, academic institutions, and other third parties, to develop and improve our models and Services, to develop new products, and for business development and marketing purposes. This information is not subject to deletion. We may retain and continue to use de-identified and aggregated information indefinitely, including after you close your account, request deletion, withdraw a consent, or revoke an authorization. Our commitments. We will maintain and use such information only in de-identified or aggregated form. We will not attempt to re-identify you, except as reasonably necessary to test whether our de-identification methods are effective, and we contractually prohibit recipients from attempting to re-identify you or to link the information to any individual. 4. HOW WE SHARE YOUR INFORMATION We share information: - with service providers and processors who perform functions on our behalf (hosting, analytics, payment processing, data aggregation, customer support) under contracts that restrict their use of the data to our purposes; - at your direction, including when you choose to share a Report or other information with your own health care provider; - for research, in de-identified or aggregated form as described in Section 3, and in identified form only where you have given separate consent; - in a corporate transaction such as a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, in which case your information may be transferred to the successor or acquirer, which may use it in accordance with a privacy policy consistent with this one; we will notify you of any material change in how your information is handled and obtain any consent required by law; - for legal reasons, to comply with law, respond to lawful requests (such as a valid subpoena issued by a court with jurisdiction), or protect rights and safety; and - with your consent for any other purpose disclosed at the time of collection. We do not sell your consumer health data or other sensitive data, and we do not share it for cross-context behavioral advertising or targeted advertising. Section 3 (de-identified and aggregated information) describes information that is not consumer health data and is not subject to this statement. 5. YOUR CHOICES AND RIGHTS Depending on where you live, you may have rights to access, correct, delete, or obtain a portable copy of your information; to withdraw or revoke a consent or authorization (as set forth in such documents); to opt out of certain processing, “sales,” “sharing,” and targeted advertising; to limit the use of sensitive personal information; and to appeal a denied request. The specific rights available to you depend on your state of residence; not every state provides every right. To exercise any right, contact us at privacy@trytotalhealth.com. We will not discriminate against you for exercising these rights. If exercising a right limits our ability to process your information (for example, a deletion request), we may no longer be able to provide the Services to you. Consumer health data. If you are a resident of Washington, Nevada, or Connecticut, please see our Consumer Health Data Privacy Notice for additional rights, including the right to withdraw consent to the collection and sharing of your consumer health data and the right to have that data deleted. Marketing. You may opt out of marketing communications using the unsubscribe link or by contacting us. We may still send you service and transactional messages. 6. DATA RETENTION We retain your information for as long as your account is active and as needed to provide the Services, and thereafter for the periods set out in our retention schedule and as needed for legal, compliance, security, audit, and other legitimate business purposes, after which we delete or de-identify it. You may request deletion as described above. As described in Section 3, de-identified and aggregated information is not subject to deletion and may be retained and used indefinitely. 7. DATA SECURITY We maintain administrative, technical, and physical safeguards designed to protect your information. No system is perfectly secure; we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at privacy@trytotalhealth.com. Breach notification. In the event of a breach of security involving your information, we will notify you and applicable regulators as required by law and regulation. 8. COOKIES AND TRACKING We use cookies, pixels, and similar technologies for functionality, analytics, and, where permitted and subject to your choices, advertising. You can manage your preferences through [our cookie manager] and your browser settings. We [do / do not] recognize the Global Privacy Control and other opt-out preference signals. 9. STATE-SPECIFIC DISCLOSURES California The disclosures in this section apply solely to residents of the State of California and provide additional information about how we collect, use, disclose, and otherwise process personal information within the scope of the California Consumer Privacy Act of 2018, as amended, including its implementing regulations (“CCPA”). Unless otherwise expressly stated, all terms in this section have the same meaning as defined in the CCPA. Sensitive Personal Information. Certain information we collect is “sensitive personal information” under the CCPA. This includes personal information collected and analyzed concerning your health, genetic data, and your account credentials. We use and disclose sensitive personal information for the purposes described in Section 2 of this Privacy Policy, including to generate your Reports and, in de-identified or aggregated form, to develop and improve our models and Services. Right to Limit the Use of Sensitive Personal Information. You may direct us to limit our use and disclosure of your sensitive personal information to those purposes permitted under the CCPA. To exercise this right, email privacy@trytotalhealth.com with the subject line “Limit Sensitive PI.” Please note that exercising this right may limit our ability to provide the Services to you. California Privacy Rights. As a California resident, you may be able to exercise the following rights in relation to the personal information about you that we have collected (subject to certain limitations at law): - The Right to Know any or all of the following, upon verification of your identity: the specific pieces of personal information we have collected about you; the categories of personal information we have collected; the categories of sources of that information; the categories of personal information we have disclosed to third parties for a business purpose and the categories of recipients; the categories of personal information we have sold or shared and the categories of third parties to whom it was sold or shared; and the business or commercial purposes for collecting, selling, or sharing the personal information. - The Right to Request Deletion of personal information we have collected from you, subject to certain exceptions. - The Right to Request Correction of inaccurate personal information. - The Right to Opt Out of Sales or Sharing of personal information to third parties now or in the future. - The Right to Limit the Use of Sensitive Personal Information, as described above. - The Right to Non-Discrimination for exercising these rights. However, if the exercise of these rights limits our ability to process personal information, we may no longer be able to provide the Services or engage with you in the same manner. How to Exercise Your California Privacy Rights. To exercise your rights to know, correct, delete, opt out, or limit, email privacy@trytotalhealth.com with the subject line “California Rights Request.” We will need to verify your identity before processing your request. To verify your identity, we will generally require either successful login to your account or the matching of sufficient information you provide to the information we maintain about you in our systems. Although we try to limit the personal information collected in connection with a request, certain requests may require us to obtain additional personal information from you. In certain circumstances, we may decline a request, particularly where we are unable to verify your identity or locate your information in our systems, or as permitted by law. Minors Under Age 16. We do not sell or share the personal information of consumers we know to be less than 16 years of age. “Shine the Light.” California's “Shine the Light” law (Civil Code § 1798.83) permits California residents that have an established business relationship with us to request certain information regarding our disclosure of certain types of personal information to third parties for their direct marketing purposes during the immediately preceding calendar year. To make such a request, email privacy@trytotalhealth.com. Maryland The Maryland Online Data Privacy Act (“MODPA”) imposes additional requirements on our processing of the personal data of Maryland residents. We do not sell your sensitive data, including your consumer health data, genetic data, or biometric data, and we do not do so even with your consent. We collect and process sensitive data only where strictly necessary to provide or maintain the Services you have requested, and we limit our collection of other personal data to what is reasonably necessary and proportionate to provide or maintain the Services. We do not process the personal data of any consumer we know to be under 18 for purposes of targeted advertising or sale. Washington, Nevada, and Connecticut — Consumer Health Data Our Consumer Health Data Privacy Notice, contains the disclosures and rights required by the Washington My Health My Data Act, Nevada SB 370, and the Connecticut Data Privacy Act with respect to consumer health data. Other States with Comprehensive Privacy Laws If you reside in a state that has enacted a comprehensive consumer privacy law, you may have rights to access and obtain a copy of your personal data; to request deletion of personal data provided by or obtained about you; to correct inaccuracies in your personal data; to opt out of targeted advertising; to opt out of the sale of personal data; and to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. The rights available to you vary by state — some states do not provide a right to correct, and some do not provide a right to appeal. Where your state provides a right to appeal a refusal to act on your request, you may appeal by emailing privacy@trytotalhealth.com with the subject line “Privacy Rights Appeal.” To submit a request, email privacy@trytotalhealth.com with the subject line “Privacy Rights Request” and tell us the state in which you reside. Nevada — NRS Chapter 603A Chapter 603A of the Nevada Revised Statutes permits a Nevada resident to opt out of future sales of certain covered information that a website operator has collected or will collect about the resident. We do not sell covered information as defined in Chapter 603A. To submit a request, contact privacy@trytotalhealth.com. 10. CHILDREN The Services are not directed to individuals under 18, and we do not knowingly collect information from them. If you believe a minor has provided information, contact us and we will delete it. 11. CHANGES We may update this Privacy Policy. Material changes will be posted with a new “Last Updated” date and, where required, communicated to you. Where a change materially affects previously collected consumer health data, we will obtain any consent required by law. 12. CONTACT Users may contact us with any questions about this Privacy Policy by email at privacy@trytotalhealth.com. Please note that email communications are not always secure, so please do not include sensitive information in your emails to us.