Washington Consumer Health Data Privacy Policy

1. Categories of Consumer Health Data Collected and Purposes of Collection

Opus may collect the following categories of consumer health data, depending on what you choose to provide and the features you use:

• Health-related information you provide. This includes information you choose to include in onboarding or assessment responses, profile or personalization inputs, reflections, chat, support communications, privacy requests, or other free-form content that identifies or may reveal your physical or mental health status, symptoms, diagnoses, treatment or medication, reproductive or sexual health, gender-affirming care, substance use, immediate safety, abuse or violence, or other health-related experiences. Opus uses this information as reasonably necessary to provide the feature, response, personalization, support, privacy-request handling, or other service you requested.
• Derived health-related representations and routing information. This may include mathematical memory representations or embeddings derived from onboarding-related user memory that contains consumer health data, and limited safety-routing, access-control, or review-status information derived from information you provide. Opus uses these representations and signals for memory retrieval and personalization, to determine whether a fixed safety or meaning-confirmation screen should appear, to determine and maintain chat-access state, and to administer a product-access review when requested.
• Product-access review information. If you request a review without the conversation, Opus uses the minimized account, access-control, and administrative information available for that review and does not collect a transcript for the review. If you affirmatively choose review with the conversation, Opus collects the recent conversation identified in the review interface and uses it for the requested product-access review and related administration.

2. Categories of Sources

Opus may collect consumer health data from the following categories of sources:

• You, when you provide information through Opus or communicate with us.
• Opus automated systems, when they generate derived memory representations, safety-routing information, access-control information, or other derived data from information you provide.
• Processors acting on Opus's behalf, when they return embeddings or other generated or derived information from data Opus provides to them for the requested service.
• Authorized Opus personnel, when they record the limited outcome or administrative information necessary for a requested product-access review or consumer-health-data request.

3. Categories of Consumer Health Data Shared; Third Parties and Affiliates

Categories of consumer health data Opus shares, as "share" is defined by the Washington My Health My Data Act: None in the ordinary operation of the Services.

Categories of third parties and specific affiliates with whom Opus shares consumer health data: None in the ordinary operation of the Services.

4. Exercising Your Washington Consumer Health Data Rights

If the Washington My Health My Data Act applies to you, you may request to:

• confirm whether Opus is collecting, sharing, or selling consumer health data concerning you and access that data;
• receive the list required by Washington law of third parties and affiliates with whom your consumer health data has been shared or sold;
• withdraw consent to future collection or sharing where the processing is based on your consent; and
• delete consumer health data concerning you.

Submit a request by emailing privacy@opuswithin.com with the subject line Consumer Health Data Request. You do not need to create a new Opus account to make a request. Opus may use an existing account or request information reasonably necessary to authenticate you and the request.

Opus will act on a request without undue delay and, in all cases, within 45 days after receipt of the request. Opus will promptly take steps to authenticate the request; authentication does not extend the 45-day period. When reasonably necessary, Opus may extend the response period once by an additional 45 days and will notify you of the extension and the reason within the initial 45-day period.

For a deletion request, Opus will delete covered consumer health data and notify applicable affiliates, processors, contractors, and other recipients as required by Washington law. Deletion of covered data in archived or backup systems may be delayed as permitted by Washington law, but not for more than six months after authentication of the deletion request.

If Opus refuses to act on a request, you may appeal by replying to the decision or emailing privacy@opuswithin.com with the subject line Consumer Health Data Appeal. Opus will respond in writing within 45 days after receipt of the appeal. If the appeal is denied, Opus will provide a method through which you may contact the Washington State Attorney General to submit a complaint.