California Privacy Statement

Effective Date: May 1, 2024

Daffodil Health (“Daffodil”, “we”, and “us”) is providing this California Privacy Statement to comply with the California Consumer Privacy Act of 2018 (“CCPA”), as amended and supplemented by the California Privacy Rights Act of 2020 (“CPRA”) and other applicable California statutes and any terms used below that are defined in a statute shall have the statutory meaning. This California Privacy Statement supplements the information contained in our Privacy Policy published on our website at and applies only if personal information you submit to us is within the scope of the CCPA, CPRA or other applicable California statute, which may be the case where we receive personal information from you, a Payer and/or Providers, in the State of California, USA. In the event of any conflict between this California Privacy Statement (if applicable) and our Privacy Policy, this California Privacy Statement shall prevail with regard to the subject matter hereof.

Categories of personal information collected

The section of our Privacy Policy entitled “INFORMATION WE COLLECT AND HOW WE USE IT” gives details about the personal information we collect/receive. The personal information that we have collected/received from you, a Payer and/or Providers, in the twelve (12) months prior to the effective date of this California Privacy Statement fall into the following categories established by the CCPA and CPRA:

• Personal identifiers such as name, postal address, phone numbers, unique personal identifier (i.e., social security number, date of birth, passport and driver’s license number), online identifier, Internet Protocol (IP) address, email address, and account name.
• Commercial information such as records for services rendered, and information on interactions with our distributors, channel partners or offerings. • Internet or other network activity information such as information regarding your interactions with our services, websites or other services.
• Inferences drawn from any of the above information categories, including information about preferences, characteristics, behavior, and attitudes that we collect via our websites or other services in order to personalize content.

Personal Information under CCPA and CPRA does not include:

• Publicly available information lawfully made available from government records.
• Deidentified or aggregated consumer information.
• Information excluded from the CCPA and CPRA’s scope, like:
  • health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
  • personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

If certain types of information are exempt from CCPA and CPRA, and therefore this statement, other Daffodil Privacy Policies may apply.

We generally do not collect additional categories of personal information or use the personal information we collected for significantly different or meaningfully unrelated purposes without providing you notice.

Sources of personal information

We obtain the types of personal information listed above from the following categories of sources:

• Directly from you, a Payer and/or Providers. For example, from information that you, a Payer and/or Providers, provide to us related to the services from us or in connection with fulfilling any of Daffodil’s services to you, a Payer and/or Providers.
• Directly and indirectly from activity on our websites, mobile applications and/or other services. For example, from submissions through our website or information collected automatically from use of our websites or mobile applications.
• From publicly available sources.
• From our third-party vendors or service providers, including payment processors.
• From third-party website analytics tools and cookies, web tags and other technologies that collect information about visitor traffic on our website and mobile applications.

Purposes for collecting personal information

We may use or disclose the personal information we collect for the purposes identified in the section of our Privacy Policy entitled “INFORMATION WE COLLECT AND HOW WE USE IT” which include one or more of the following:

• Maintaining our business relationship and/or providing ongoing support, where you, a Payer and/or Providers are a user of our services or otherwise engage with us for business purposes,
• Informing you about our services, and responding to your comments or requests for information,
• Enforcing any contracts that we enter into with you, a Payer and/or Providers or defending claims arising from such contracts,
• Operating, maintaining, improving, administering and providing our services, including customizing, personalizing and optimizing services and customer experience,
• Safety and security purposes, including where necessary to protect the rights, property or safety of us or other users or customers,
• Where we are obligated, or permitted, to do so by applicable law, regulation or legal process, including disclosure to customs or other governmental authorities, or • As described to you when collecting your personal information.

Categories of personal information shared or sold

We may share or disclose the personal information that we collect for the purposes identified in the section of our Privacy Policy entitled “INFORMATION WE COLLECT AND HOW WE USE IT.” We do not sell any personal information of our customers. The personal information that we have disclosed about you, a Payer or Providers for business purposes in the twelve (12) months prior to the effective date of this California Privacy Statement fall into the following categories established by the CCPA and CPRA:

• Personal identifiers;
• Financial information;
• Commercial information;
• Internet or other network activity;
• Audio or similar information;
• Inferences drawn from any of the above information categories.

The above categories of information have been disclosed to the following categories of third parties:

• Service providers performing services for us or assisting us to provide a requested product or service to you, including shipping companies; • Analytics Providers that help us generate performance metrics regarding our products, services, sites or apps;
• Our affiliates and related companies;
• Payment processors;
• Third parties authorized by you including Payers and/or Providers.

Rights under the CCPA and CPRA

The CCPA and CPRA grants California residents the following rights:

Right to Know and Data Portability

You can request information about how we have collected, used, shared, sold, disclosed and otherwise processed your personal information during the past twelve (12) months, including the right to request the specific pieces of personal information that we possess.

Right of Deletion

You can request that we delete any of the personal information that we have collected from you. We may deny your deletion request pursuant to certain exceptions in the CCPA and CPRA, and the response we provide will explain any reason for denying your request.

Right of Non-Discrimination

You have the right to not receive discriminatory treatment by us for exercising any of your CCPA and CPRA rights.

Right to Opt-Out of Sale

We do not sell your personal information as provided in the CCPA and CPRA. When we render services, we will share your personal information with Payers and/or Providers which you have chosen to provide medical services to you and/or family member, or third parties and they may contact you regarding use your personal information. By receiving our services or otherwise authorizing disclosure of your information, you are opting in to such use. You can contact us using the contact points below to change your privacy preferences or to control future use and disclosure of your personal information. We do not knowingly sell the personal information of minors under sixteen (16) years of age without obtaining proper opt-in consent.

Right to Correct Inaccurate Personal Information

You can request that we correct any inaccurate personal information that we have collected from you. We may require adequate documentation to verify such inaccuracy.

Right to Limit Use and Disclosure of Sensitive Personal Information

You can request that we do not use or disclose certain sensitive personal information about you, outside of the necessary use of such information to perform the expected services.

Exercising Your Privacy Rights

To exercise your rights, please submit a verifiable consumer request to us by either: • Sending us an email at support@daffodilhealth.com, referencing “CCPA/CPRA” in the subject line, or • Writing us at Daffodil Health, ATTN: Chief Privacy Officer, 354 Rennie Ave, San Jose, CA 95127

We reserve the right to confirm your California residency to process your requests. In accordance with the CCPA and CPRA, we will need to confirm your identity to process your requests and we may require you to login to your account with us, provide information associated with your account or transactions with us, or require you to provide government identification, signed declarations and other proof of identity. You may designate an authorized agent to make a request on your behalf as provided under California law and we reserve the right to request proof of such authorization. You may also make a verifiable consumer request on behalf of your minor child. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm that the personal information relates to you, or if you do not provide us with sufficient detail to allow us to understand and respond to your request. Our response will explain any reasons we cannot comply with a request, if applicable.

Changes to our privacy statement

We reserve the right to amend this California Privacy Statement from time to time as provided in our Privacy Policy.