Health Data Privacy Policy

This Health Data Privacy Policy supplements Y factor's general Privacy Policy (available at yfactor.app/en/privacy-policy) and provides additional information about how we collect, use, and share consumer health data. It applies to users in California, Washington, and Nevada, and is provided in accordance with:

• California's Confidentiality of Medical Information Act (CMIA), as amended by AB 254

• Washington's My Health My Data Act (MHMDA) — RCW 19.373

• Nevada's Consumer Health Data Privacy Law — SB 370

Terms used in this policy that are defined in Y factor's Privacy Policy or Terms of Service have the same meaning here. Where this policy and Y factor's Privacy Policy cover the same subject, this policy controls with respect to health data for users in California, Washington, and Nevada.

1. What Is Consumer Health Data

Consumer health data is personal information that relates to your reproductive health, family planning intentions, physical attributes, lifestyle, and other information that identifies or can be used to infer something about your health or reproductive status. On Y factor, this includes the information you provide when creating your profile and the information shared with other users through the platform.

As described in Section 3.2 of Y factor's Privacy Policy, this includes User Content such as:

• Basic information: your user type (donor or recipient), location, and date of birth

• Family type: your family structure (solo mother, same-sex couple, heterosexual couple, or other) and relationship status. This reveals information about your family planning intentions and relationship structure.

• Physical information: photos, physical appearance group, height, weight, eye color, and hair color

• Personal information: profile description, lifestyle habits including tobacco use, alcohol intake, activity level

• Donation preferences: commitment level, preferred donation method (via clinic, home insemination, or intercourse), donation type (free or willing to pay), and family type

• Biological children information: number of your own children, confirmed Y factor pregnancies, other past pregnancies, and previous bank donor status

• Your match information: chats, shared arrangement details (including commitment, method, compensation, future siblings, written agreement, health testing, calls, meetings, ovulation details, donation schedule and logistics, updates during pregnancy, and updates after birth)

2. How We Collect Health Data

As described in Section 3 of Y factor's Privacy Policy, the Company collects health data directly from you when you:

• Create and update your User account and profile through the App

• Interact with the Service, including when you like, match, or communicate with other Users through the App

The Company collects health data that you provide voluntarily. You are not required to provide all information, but certain information is necessary to use the Service as described in Y factor's Privacy Policy.

3. How We Use Health Data

As described in Section 4 of Y factor's Privacy Policy, the Company uses health data to:

• Provide and improve the Services, including creating your profile and facilitating connections between you and other Users

• Verify User identities and maintain account security

• Communicate with Users, including customer support and account updates

• Prevent fraud and ensure compliance with legal obligations

Not all of the information listed in Section 1 is health data in the clinical sense, and Y factor does not treat it that way. Some fields, such as lifestyle habits, profile photos, and your written description, are listed here because applicable state law defines consumer health data broadly to include information that identifies or can be used to infer something about a person's reproductive health or family planning intentions, even when that information is collected for a different purpose.

Y factor does not use lifestyle information, profile photos, or free-text profile descriptions to draw inferences about your health status. These fields are collected solely to help you build a profile and connect with other users. They are listed here because the laws of California, Washington, and Nevada require us to be transparent about all categories of information that could fall within their definitions, and we would like all of our users to be aware of these disclosures.

The fields that are directly related to reproductive health, your user type, family type, donation preferences, biological children information, and location, are the core of what these laws are designed to protect, and Y factor treats them with the highest level of care.

Y factor may use aggregated, non-identifiable statistics derived from user data for general reporting and marketing purposes, such as describing general trends in how users use the platform. These statistics do not identify any individual user. Users who wish to be excluded in such statistics may opt out through their account settings at any time. Users who opt out will not have their data included in any aggregated statistics used for marketing purposes.

Y factor does not use identifiable health data for advertising or marketing purposes. As stated in Section 4 of Y factor's Privacy Policy, Y factor never shares identifiable User data with third parties for marketing purposes.

4. How We Share Health Data

As described in Section 7 of Y factor's Privacy Policy, the Company may share your health data with the following:

a. Other Y factor Users

Your health data is shared with other Y factor users in stages that correspond to how interactions progress on the platform.

Visible to all registered Y factor users while browsing

The following information is visible to any registered Y factor user who views your profile in search or browse results, from the moment your profile is active:

• Your nickname and age

• Your location (city only - your full address and coordinates are never displayed)

• Your user type (donor or recipient)

• Your family type (solo mother by choice, same-sex couple, heterosexual couple, or other)

• Your physical appearance groups (up to 3 groups selected from: Northern European, Eastern European, Mediterranean, African, South Asian, Central Asian, East Asian, Southeast Asian, Pacific Islander, Native American)

• Your height and weight

• Your profile and child photos

• Your eye color and hair color

• Your donation preferences: commitment level, donation method (via clinic, Do-It-Yourself home insemination, or intercourse), and donation type (free or with compensation)

• Your occupation, education, relationship status, tobacco use, alcohol intake, and activity level

• Your biological children information: number of own children, confirmed Y factor pregnancies, other past pregnancies, and previous bank donor status

• Your written “About” introduction and stated values

Y factor does not gate any profile fields behind a like or a match. If you activate your profile, the information listed above is visible to all registered users on the platform.

Visible only to your matches

Once you and another user have mutually liked each other, direct messaging through the platform becomes available together with your shared match space.

• Your chat conversations

• Your match information

• Your shared arrangement details: commitment, method, compensation, future siblings, written agreement, health testing, calls, meetings, ovulation details, donation schedule and logistics, updates during pregnancy, and updates after birth

Your chat messages are private and visible only to you and the person you are matched with. The shared match space feature is also private to matched users only, where you can keep record of arrangement details.

b. Third Parties

We may share each of the categories of health data described above with the following categories of third parties:

1. Processors. As listed in Section 7 of Y factor's Privacy Policy, vendors and data processors who help the Company operate the platform may access your health data to provide services to the Company. For example, companies that host our servers or provide customer support may need access to health data to provide those functions. Service providers may only use your health data to operate the platform on Y factor's behalf. They may not use it for their own purposes.

2. Parties to a Corporate Transaction. The Company may disclose your health data in connection with or following a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of Y factor's business or assets.

3. Legal Authorities: As described in Section 7 of Y factor's Privacy Policy, the Company may share your health data with legal authorities if required by law.

5. Your Rights

In addition to the rights described in Section 9 of Y factor's Privacy Policy, users in California, Washington, and Nevada have the following rights with respect to their consumer health data:

a. Right to Access

You may request to know what health data the Company holds about you and receive a copy of it. As described in Section 9(a) of Y factor's Privacy Policy, you can access your personal data through the 'Export my data' function in the App.

b. Right to Correct

You may request that the Company corrects inaccurate health data. As described in Section 9(b) of Y factor's Privacy Policy, you can rectify inaccurate data through the edit functions in Settings and Profile in the App.

c. Right to Delete

You may request that the Company deletes your health data. As described in Section 9(d) of Y factor's Privacy Policy, you can request erasure of your data through the 'Delete account' function in the App, or by contacting support@yfactor.app.

d. Right to Withdraw Consent

You may withdraw your authorization for the Company to collect or share your health data at any time through your account settings by deleting your profile or by contacting support@yfactor.app. You can also delete any of your optional reproductive health data at any time. As described in Section 1.5 of Y factor's Terms of Service, you may withdraw your consent to data processing at any time, without affecting the lawfulness of data processing occurring before such withdrawal. Withdrawing consent does not automatically delete your account or data already collected.

e. Right to Restrict

As described in Section 9(f) of Y factor's Privacy Policy, you may restrict processing of your data by pausing your profile or hiding it from search results using the 'Pause profile' function in Settings.

f. How to Submit a Rights Request

To exercise any of the rights described above, contact the Company at:

Y factor ApS

support@yfactor.app

hello@yfactor.app

Suomisvej 4, 1927 Frederiksberg C, Denmark

As described in Section 9 of Y factor's Privacy Policy, the Company will respond to verifiable requests within 45 days. The Company may extend this period by an additional 45 days if reasonably necessary and will notify you of any extension.

g. Right to Appeal

If the Company denies a rights request, you may appeal by contacting support@yfactor.app. If your appeal is unsuccessful:

• Washington residents may contact the Washington State Attorney General at atg.wa.gov/file-complaint

• Nevada residents may contact the Nevada Attorney General at ag.nv.gov/Complaints

• California residents may contact the California Attorney General's Office as described in Section 12 of Y factor's Privacy Policy.

6. Data Retention

As described in Section 6 of Y factor's Privacy Policy, the Company retains personal data only for as long as necessary to provide the Services and comply with legal obligations. Health data is retained in accordance with Y factor's general data retention practices. When your account is deleted, your health data is deleted as described in Y factor's Privacy Policy.

7. International Data Transfers

As described in Section 8 of Y factor's Privacy Policy, some of the Company's service providers operate outside the EEA. When the Company transfers health data internationally, it implements appropriate safeguards such as Standard Contractual Clauses (SCCs) or relies on adequacy decisions. Y factor's primary servers are located in Frankfurt, Germany (AWS eu-central-1).

8. Updates to This Policy

Y factor may update this Health Data Privacy Policy from time to time. If we make material changes, we will notify you through the App or by email, consistent with how Y factor handles updates to its Privacy Policy as described in Section 13 of Y factor's Privacy Policy. The updated policy will be posted at yfactor.app/en/health-data-privacy-policy with an updated effective date.

9. Contact

For questions about this policy or to exercise your rights, contact the Company at:

Email: support@yfactor.app

Address: Y factor ApS (CVR: 44690934), Suomisvej 4, 1927 Frederiksberg C, Denmark

As described in Section 14 of Y factor's Privacy Policy, the Company's Data Protection Officer can also be contacted at the above address for data protection inquiries.