Last updated: August 24, 2026

This Consumer Health Data Privacy Policy applies only to consumer health data that Vana Labs, Inc., doing business as VANA ("VANA," "we," "us," or "our"), controls through a separately identified Direct VANA health feature under applicable U.S. state consumer health-data laws. A Direct VANA health feature can include a direct VANA chat experience delivered through a messaging service such as iMessage or a health data-source connection when VANA makes that feature available. This policy supplements the Privacy Policy.

This policy does not apply to Connected Agents. Connected Agents are general protocol and routine tools used through third-party agent platforms. They are not designed to process protected health information or clinical records, and health information stored through a Direct VANA health feature is not available through them.

"Consumer health data" means personal information that identifies or can reasonably be linked to a person and that identifies the person's past, present, or future physical or mental health status where applicable law uses that or a similar definition.

1. Consumer health data we collect

Depending on what you provide and connect through a Direct VANA health feature, we can collect:

• health and wellness goals, habits, routines, and Protocol activity;
• exercise, movement, recovery, sleep, heart-rate, body-measurement, nutrition, and similar metrics;
• symptoms, conditions, injuries, allergies, disability, pregnancy, reproductive, or mental-health information;
• medications, supplements, treatments, and device information;
• laboratory results, clinician notes, medical records, or other clinical information that you choose to provide;
• information that identifies a request for, use of, or response to a health or wellness feature;
• identifiers, profile information, location-derived activity, and other information used to associate these categories with you; and
• inferences about health or wellness that VANA creates from the information above.

Direct VANA health features are consumer health and wellness information services, not medical services. VANA provides them directly to consumers. VANA is not a healthcare provider, health plan, or healthcare clearinghouse and does not provide these features on behalf of a healthcare organization unless VANA expressly states otherwise in a separate agreement. HIPAA may not apply to health information that you provide directly to VANA or direct another service to provide to VANA. Other privacy and consumer health-data laws may still protect the information.

2. Sources

We can collect consumer health data:

• directly from you through a Direct VANA Experience;
• from a data source, wearable, application, device, or service that you connect within a Direct VANA health feature;