Consumer Health Data Privacy Notice

Effective Date: October 2026

This Consumer Health Data Privacy Notice (“Notice”) explains how Path CCM, Inc. d/b/a Rula Health (“Rula,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes Consumer Health Data in connection with certain Rula digital services and features, including https://www.rula.com/, Rula’s artificial intelligence-driven tool and related mobile application, AI-enabled, survey, safety, recommendation, engagement, and other digital features (collectively, the “Consumer Features”).

For purposes of this Notice, “Consumer Health Data” means personal information that is linked or reasonably linkable to an individual and that identifies or relates to the individual’s past, present, or future physical or mental health status, to the extent such information is subject to applicable state consumer health privacy laws.

This Notice applies to Consumer Health Data subject to applicable state consumer health privacy laws. It does not apply to protected health information or other information maintained as part of Rula’s provider-care or medical-record workflows to the extent such information is governed by the Health Insurance Portability and Accountability Act (“HIPAA”) or otherwise exempt from applicable consumer health privacy laws. Such information is handled in accordance with Rula’s applicable health information privacy practices.

This Notice supplements our Privacy Policy. To the extent this Notice conflicts with our Privacy Policy with respect to Consumer Health Data covered by this Notice, this Notice will control.

We may update this Notice from time to time. We will post updates and provide additional notice or obtain consent where required by applicable law.

1. Collection of Consumer Health Data

We collect Consumer Health Data as reasonably necessary to provide, operate, maintain, secure, and support the Consumer Features and for the purposes described in this Notice. Depending on how you interact with Rula and the Consumer Features, Consumer Health Data we collect may include:

• information about health conditions, symptoms, diseases, disabilities, diagnoses, diagnostic testing, treatment, medications, surgeries, procedures, or other health care you receive or seek;

• information about social, psychological, behavioral, or medical interventions and social determinants of health;

• health, wellness, lifestyle, mood, behavioral, or emotional information relating to your physical or mental health;

• reproductive or sexual health information and gender-affirming care information;

• information that identifies or relates to you seeking, receiving, or expressing interest in health care services;

• content and information you provide through the Consumer Features, including AI conversations and prompts, questions, responses, pre-session topics, survey responses, reflections, exercises, resource interactions, feedback, preferences, unsubmitted or abandoned drafts, and other information you choose to provide;

• health-related information generated through your use of the Consumer Features, including summaries, suggested topics, recommendations, scores, classifications, signals, alerts, safety-related information, and other health-related outputs;

• device, network, technical, location, usage, and engagement information that identifies or relates to your use of health care services, including device identifiers, IP addresses, IP-derived location, application activity, notification interactions, telemetry, mobile session replay, local device cache/storage, feature-flag/experimentation data, crash/diagnostic reports, and browser/device signals, and other operational metadata; and

• health-related inferences, including information about your health, health status, conditions, treatment, care needs, interests, or activities that we derive, infer, or extrapolate from other information, including through algorithms, artificial intelligence, machine learning, or other automated processing.

2. Sources of Collection

We may collect Consumer Health Data:

• directly from you, including when you interact with the Consumer Features, provide information or content, complete surveys or exercises, communicate with Rula, or otherwise use Rula’s services;

• automatically from your device and your use of Rula’s digital services, including through application, browser, network, analytics, security, diagnostic, notification, and similar technologies;

• from information generated or derived through the Consumer Features, including through AI, algorithms, recommendation systems, analytics, safety systems, or other automated processing;

• from Rula systems and services, including information associated with your Rula account and prior interactions with Rula, where appropriate to provide the Consumer Features and permitted by applicable law;

• from service providers that support the Consumer Features, where they process or provide information on Rula’s behalf; and

• from your Rula provider or care team, other health or wellness providers, or third-party applications or services that you choose to connect to Rula, where permitted by applicable law.

3. Purposes and Use of Your Consumer Health Data

We process Consumer Health Data through manual and automated means, which may include collecting, receiving, storing, organizing, analyzing, deriving or inferring information from, using, transmitting, disclosing, and deleting Consumer Health Data as appropriate for the purposes described below.

Depending on how you interact with the Consumer Features, we may collect and use Consumer Health Data to:

• provide, operate, and personalize the Consumer Features, including AI-enabled conversations, summaries, pre-session and between-session features, surveys, exercises, therapeutic resources, saved content, recommendations, and other features or functionality you request;

• generate health-related content, recommendations, and other outputs, including summaries, suggested topics, resources, exercises, scores, classifications, or other personalized content;

• support health and safety functions, including analyzing interactions for potential safety concerns, generating or evaluating safety-related classifications, scores, signals, or alerts, and reviewing, escalating, or responding to potential safety concerns;

• support and coordinate Rula services, including facilitating the health care services you request and interactions with a Rula care team member where applicable;

• communicate with you, including providing service-related messages, reminders, notifications, updates, security alerts, and information about the Consumer Features;

• operate, maintain, troubleshoot, and secure the Consumer Features, including diagnosing technical issues, maintaining service functionality, monitoring and evaluating performance, preventing fraud or misuse, protecting Rula and its users, and responding to support requests;

• understand, evaluate, and improve the Consumer Features, including through analytics, application telemetry, engagement information, quality assurance, safety review, testing, auditing, monitoring, and evaluation;

• create de-identified or aggregated information for analytics, evaluation, testing, research, product improvement, AI evaluation or development, or other lawful purposes, where permitted by applicable law;

• comply with applicable law, legal process, regulatory obligations, or governmental requests and establish, exercise, or defend our legal rights; and

• process Consumer Health Data for other purposes for which you provide consent, where required by applicable law.

• generate recommendations and facilitate Rula services, including suggested pre-session or carry-forward topics and therapeutic-resource recommendations.

We do not use identifiable Consumer Health Data to train or fine-tune our AI models. We may use synthetic, aggregated, or de-identified information for model training or fine-tuning where permitted by applicable law. 

4. Sharing of Consumer Health Data

We may disclose Consumer Health Data as reasonably necessary to provide and support the Consumer Features and services you request, for the other purposes described in this Notice, or as permitted or required by applicable law.

Depending on the applicable purpose and recipient, we may share:

• health, wellness, behavioral, and other Consumer Health Data that you provide through the Consumer Features;

• health-related information generated through the Consumer Features, including summaries, recommendations, scores, classifications, safety-related information, and other outputs or inferences;

• device, network, location, usage, engagement, notification, analytics, telemetry, diagnostic, and other technical information associated with your use of health care services; and

• session, conversation, processing, and other operational metadata associated with the Consumer Features.

We may disclose Consumer Health Data to:

• Service providers and processors that perform services on our behalf, including providers of cloud hosting and storage, AI processing and infrastructure, security, analytics and telemetry, survey functionality, communications and notifications, customer support, safety operations, quality assurance, and other technology services. As part of these services, third parties may collect Consumer Health Data over time and across different Rula websites or online services when you use any Internet website or online service provided by Rula;

• Healthcare providers and care teams, where you choose to share information with your provider or the applicable feature is designed to make information available to your provider, or where otherwise appropriate to provide services you request. Information maintained in Rula’s provider-care or medical-record workflows may be governed by HIPAA or other health-information privacy requirements rather than this Notice;

• Legal, regulatory, and governmental authorities, where disclosure is required or permitted by applicable law or reasonably necessary to establish, exercise, or defend legal rights;

• Parties to a business transaction, such as a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, subject to applicable law; and

• Other parties with your consent or at your direction.

5. Your Privacy Rights

Depending on where you live and subject to applicable law, you may have rights regarding your Consumer Health Data, including:

• Access and information. You may request confirmation of whether we collect, share, or sell Consumer Health Data concerning you and request access to Consumer Health Data we maintain about you.

• Information about recipients. You may request information about third parties and affiliates with whom we have shared or sold Consumer Health Data concerning you, where required by law.

• Deletion. You may request deletion of Consumer Health Data concerning you. Where required by law, we will also communicate your deletion request to applicable affiliates, processors, service providers, contractors, or other third parties.

• Review or correction. You may request to review or correct inaccurate Consumer Health Data, where provided by applicable law.

• Withdraw consent or stop certain processing. Where our collection or sharing of Consumer Health Data is based on consent, you may withdraw that consent and request that we cease future collection or sharing to the extent provided by applicable law.

• Other applicable privacy rights. Depending on applicable law, you may also have rights to opt out of certain processing and to exercise your privacy rights without unlawful discrimination or retaliation.

• Appeal. If we decline to act on a request, you may have the right to appeal our decision.

You may submit a privacy rights request using the following methods:

• By email: privacy@rula.com

• By telephone: (323) 205-7088

• Via the online privacy request form, found here.

• Through the Support Center chat feature, which we make available on the website.

Before fulfilling your request, we may take reasonable steps to verify your identity and authenticate your request to protect Consumer Health Data and prevent unauthorized access or deletion. We will not require you to create a new account solely to exercise your privacy rights, although we may require you to use an existing account where permitted by applicable law.

We will respond within the time required by applicable law. If we decline to act on your request, in whole or in part, we will explain the basis for our decision and provide information regarding any applicable appeal or complaint rights.

If you have questions about this Notice or Rula’s privacy practices, please contact us at privacy@rula.com.