Nevada Consumer Health Data Privacy Policy

Effective Date: August 25, 2026

This Nevada Consumer Health Data Privacy Policy describes how My Opus, Inc. ("Opus," "we," "us," or "our") handles information that qualifies as consumer health data under Nevada law.

1. Categories of Consumer Health Data We Collect and How We Use It

Depending on what you choose to provide and the features you use, Opus may collect:

• Health-related information you provide, including information you choose to include in onboarding or assessment responses, profile or personalization inputs, reflections, chat, support communications, privacy requests, or other free-form content that identifies or may reveal a health condition, symptom, diagnosis, treatment or medication, reproductive or sexual health information, gender-affirming care information, substance use, immediate safety, abuse or violence, or another aspect of your physical or mental health. Opus uses this information as reasonably necessary to provide the feature, response, personalization, support, privacy-request handling, or other service you requested.
• Derived health-related representations and safety/access information, including mathematical memory representations or embeddings derived from onboarding-related user memory that contains consumer health data, and limited automated safety-routing, access-control, or review-status information derived from information you provide. Opus uses these representations and signals for memory retrieval and personalization, automated safety routing, determining and maintaining chat-access state, and administering a product-access review when requested.
• Product-access review information. If you request review without the conversation, Opus uses minimized account, access-control, and administrative information and does not collect a transcript for that review. If you affirmatively choose review with the conversation, Opus collects the recent conversation identified in the review interface and uses it for the requested product-access review and related administration.

2. Categories of Sources

Opus may collect consumer health data from:

• you, when you provide information through Opus or communicate with us;
• Opus automated systems, when they generate derived memory representations, safety-routing information, access-control information, or related derived data from information you provide;
• processors acting on Opus's behalf, when they return embeddings or other generated or derived information from data Opus provides to them for the requested service; and
• authorized Opus personnel, when they record the limited outcome or administrative information necessary for a requested product-access review or consumer-health-data request.

3. Purposes for Collecting, Using, and Sharing Consumer Health Data

Opus collects, uses, and, where necessary to provide a requested service, communicates consumer health data to processors for the following purposes:

• providing requested AI-powered responses, analyses, and other Opus features;
• generating memory embeddings and operating memory retrieval and personalization;
• operating automated safety routing and displaying fixed safety information;
• determining and maintaining chat-access state;
• conducting a requested non-clinical product-access review;
• receiving, authenticating, routing, and responding to support or privacy communications;
• securing and operating the Services; and
• complying with applicable law.

Opus does not sell consumer health data.

4. Manner in Which Consumer Health Data Is Processed

Depending on the feature you use:

• information submitted through applicable AI-powered features may be transmitted to Anthropic acting as an Opus processor to generate requested AI responses or analyses and to perform applicable automated chat classification;
• onboarding-derived user-memory text may be transmitted to the OpenAI API acting as an Opus processor to generate mathematical embedding vectors used for memory retrieval and personalization; this embedding path is not used to process ordinary Opus chat or chat-safety content;
• account, application, memory, access-control, and review information may be stored or otherwise processed through Opus's cloud infrastructure, database, authentication, and storage providers;
• messages submitted through chat may be evaluated by automated safety-routing systems;
• a recent conversation is stored for product-access review only if you affirmatively choose the review-with-conversation route; no transcript is collected for a review-without-conversation request;
• transactional email processors may process the information necessary to send account and service communications; safety-event notifications are designed not to contain raw conversation content; and
• communications you separately send to an Opus support, privacy, or chat-access email address are processed through the applicable communications provider.

Current processors are identified in the Opus Subprocessor List.

5. Categories of Consumer Health Data We Share

Nevada law defines "share" broadly enough to include certain communications of consumer health data to processors acting on Opus's behalf. Depending on the feature used, the categories of consumer health data Opus may share include:

• health-related content necessary for Anthropic to provide a requested AI response, analysis, or applicable automated chat classification;
• onboarding-derived health-related user-memory text necessary for OpenAI to generate embedding vectors for memory retrieval and personalization;
• derived embeddings and other health-related account or application data processed through cloud database, storage, authentication, access-control, and backup systems;
• limited safety-routing, chat-access, and product-access-review information processed through those systems;
• a recent conversation you affirmatively submit for product-access review; and
• health-related information you voluntarily include in support, privacy, or chat-access communications.

Categories of third parties and affiliates with whom Opus currently shares consumer health data: None in the ordinary operation of the Services. Nevada's definition of "third party" excludes processors acting on behalf of a regulated entity.

6. Submitting a Consumer Health Data Request

If Nevada's consumer-health-data law applies to you, you may request that Opus:

• confirm whether Opus is collecting, sharing, or selling consumer health data relating to you;
• provide a list of third parties with whom Opus has shared your consumer health data or to whom it has sold such data;
• cease collecting, sharing, or selling consumer health data relating to you; or
• delete consumer health data concerning you.

Submit a request by emailing privacy@opuswithin.com with the subject line Consumer Health Data Request. Opus may request information reasonably necessary to authenticate your identity and the request.

Opus will respond without undue delay and no later than 45 days after authenticating the request. When reasonably necessary based on the complexity and number of requests, Opus may extend that period once by up to 45 additional days and will notify you of the extension and the reason within the initial 45-day period.

For an authenticated deletion request, Opus will delete covered consumer health data from its records and network and notify applicable affiliates, processors, contractors, and other recipients as required by Nevada law within the applicable statutory periods. Nevada law permits deletion of covered data stored or archived on backup systems to be delayed, where necessary to restore the archived or backup system, for no more than two years after the request is authenticated.

7. Reviewing and Requesting Changes to Consumer Health Data

You may ask to review consumer health data maintained about you or request a change to information you believe is inaccurate by emailing privacy@opuswithin.com with the subject line Consumer Health Data Request and identifying the information you want reviewed or changed. Opus may request information reasonably necessary to authenticate the request.

8. Appeals

If Opus refuses to act on a consumer-health-data request, you may appeal by replying to the decision or emailing privacy@opuswithin.com with the subject line Consumer Health Data Appeal.

Opus will respond to the appeal in writing no later than 45 days after receiving the appeal, explaining any action taken or not taken and the reasons for the decision. If the appeal is denied, Opus will provide contact information for the Nevada Office of the Attorney General.

9. Material Changes to This Policy

If Opus makes a material change to this policy affecting consumer health data we collect, use, or share, Opus will post the updated policy and provide additional notice through the Services, by email, or by another clear and appropriate method where required.

Before collecting, using, or sharing an additional category of consumer health data, sharing consumer health data with an additional third party or affiliate, or using consumer health data for an additional purpose where Nevada law requires consent, Opus will provide the required disclosure and obtain affirmative, voluntary consent before that processing occurs.

10. Third-Party Collection Across Websites or Online Services

Opus does not permit a third party to collect consumer health data about you over time and across different unrelated Internet websites or online services when you use Opus.

11. Contact

For questions or requests concerning this policy:

My Opus, Inc. Attention: Privacy Email: privacy@opuswithin.com