Consumer Health Data Privacy Policy

ANTHA INC. – CONSUMER HEALTH DATA PRIVACY POLICY

Effective Date: August 15, 2026

Note: This privacy policy applies to our collection, use, and disclosure of “Consumer Health Data” received or created due to your access to and use of certain items provided by us, “Antha Inc.” (referred to here as “Antha,” “we,” “us,” or “our”). These items consist of our website at antha.health (the “Site”), our mobile application (if applicable), and the following services we provide to you: hormone replacement therapy products and related services (collectively, the “Services”). This policy applies to any personal information that we collect that may meet the definition of “Consumer Health Data” that is subject to state consumer health privacy laws, including the Washington State My Health My Data Act (“MHMDA”), the Nevada Health Data Privacy Act (“NHDPA”), and similar laws in Connecticut and other applicable states. Please note that Antha may be deemed a “business associate” of a healthcare provider and may be subject to certain provisions of HIPAA with respect to “protected health information” as defined under HIPAA. Any medical or health information that you provide that is subject to specific protections under applicable state laws will be used and disclosed only in accordance with such applicable laws.

Consumer Health Data We Collect

Because Consumer Health Data is defined very broadly under applicable state laws, many of the categories of information described in the “What information is collected by the Services and how is it used?” section of our general Privacy Policy (available at antha.health/privacy) could be considered “Consumer Health Data.” The categories of Consumer Health Data we collect include:

Health Information, including information you provide through the patient portal, medical questionnaires, and communications with healthcare providers. This may include clinical information (such as height and weight, current health conditions, symptom history, and other medical data related to hormone replacement therapy) and non-clinical lifestyle information (such as eating habits and exercise activity);
Government-issued identification (such as driver’s license or passport information) collected for identity verification purposes, as well as photographs or other content you upload to the Services;
Health-seeking information, including queries and interactions concerning hormone replacement therapy, wellness, or other health-related topics;
Telehealth consultation information provided to facilitate prescribing services; and
Inferences derived from the above.

Sources of Consumer Health Data

We collect Consumer Health Data from the sources described in our general Privacy Policy, including directly from you when you use the Site and/or submit information to us through the Site, from your devices and browsers, and from authentication providers.

Why We Collect and Use Consumer Health Data

We collect and use Consumer Health Data as reasonably necessary to provide the Services to you. The specific purposes for which we use your information are described in the “What information is collected by the Services and how is it used?” section of our general Privacy Policy. We only use Health Information as it relates to providing the Services. We do not collect, use, or share Consumer Health Data for purposes beyond those disclosed in this policy and our general Privacy Policy without first obtaining your consent.

We may use Consumer Health Data for other purposes for which we give you choices and/or obtain your consent as required by law. See the How to Exercise Your Rights section below for more details on the controls and choices you may have.

Our Sharing of Consumer Health Data

We share Consumer Health Data with the categories of third parties described in the “Do third parties see and/or have access to information obtained by the Services?” section of our general Privacy Policy. With respect to Consumer Health Data specifically, we share such data with:

Third-Party Health Care Providers who provide telehealth consultations and prescribing services (these are independent entities with their own privacy practices);
Third-Party Pharmacies that fulfill prescriptions (these are independent entities with their own privacy practices);
Service Providers who host and support the Site on Antha's behalf and do not have any right to independently use any personal information that we share with them. This includes companies we have hired to provide customer service support or assist in protecting and securing our systems and services;
Payment Processors who perform payment processing on our behalf. We will not store or collect your payment card details. Information that you provide to our third-party payment processors is governed by their privacy policies. These payment processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council;
Authentication and Technology Partners (such as Apple and Google for single sign-on);
Affiliates where we may enable access to personal information across our subsidiaries, affiliates, and related companies, for example, where we share common data systems or where access helps us to provide our Services and operate our business;
Parties to Corporate Transactions where we may disclose personal information as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets;
Government Agencies and Legal Compliance where we will access, disclose, and preserve personal information when we believe that doing so is necessary to: (a) comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies; (b) protect our customers and others, for example to prevent spam or attempts to commit fraud, or to help prevent the loss of life or serious injury of anyone; (c) operate and maintain the security of our Services, including to prevent or stop an attack on our computer systems or networks; or (d) protect the rights or property of ourselves or others, including enforcing our agreements, terms, and policies; and
Other Third Parties as otherwise described in our general Privacy Policy.

Sale of Consumer Health Data

Antha does not sell Consumer Health Data, as “sell” is defined under the Washington State My Health My Data Act and similar state consumer health privacy laws. We do not exchange Consumer Health Data for monetary or other valuable consideration. If our practices change in the future, we will update this policy and obtain any required consent before selling Consumer Health Data.

How to Exercise Your Rights

If you are a resident of Washington, Nevada, Connecticut, or another state with consumer health data-specific laws, you may have rights to access, delete, or withdraw consent relating to your Consumer Health Data. For information on how to exercise your rights, please see the “Your Personal Information Rights” section of our general Privacy Policy, or contact us at support@antha.health.

Other State Privacy Laws

In addition to the consumer health data-specific laws described above, several states have enacted comprehensive privacy laws that classify health-related information as “sensitive personal information” subject to heightened protections. For information about your rights under these laws, please see the “State-Specific Privacy Rights” section of our general Privacy Policy.

We also monitor legislative and regulatory developments in all U.S. states regarding consumer health data and sensitive personal information. As additional states enact laws that impose specific requirements for consumer health data, we will update this policy and our practices as necessary to comply with such laws. We encourage you to check this policy periodically for updates.

If your request to exercise a right is denied, you may appeal that decision by contacting us using the information provided at the end of this Privacy Policy. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the applicable regulatory authority. In Washington, that official is the Washington State Attorney General at www.atg.wa.gov/file-complaint. In Nevada, that official is the Nevada State Attorney General at https://ag.nv.gov/complaints/file_complaint/. In Connecticut, that official is the Connecticut Attorney General at https://portal.ct.gov/AG/Common/Complaint-Form-Landing-page.