Welcome to Rousia! You are reading this Rousia Privacy Policy ("Privacy Policy") because you (“you,” “your,” “user”) are using a Rousia website, mobile app, or digital experience, all of which are part of Rousia's Platform (collectively, "Services"). This Privacy Policy explains how your personal information is collected, used, shared, and protected by Rousia. It also describes your rights and choices concerning your personal information and how you can contact us about our privacy practices.

Please note that we enter into agreements with healthcare professionals that govern our use of Protected Health Information and specific information about you that we receive from or on behalf of healthcare professionals. This Privacy Policy supplements those agreements; however, the agreements will control to the extent this Privacy Policy is in conflict. Please visit our Rousia Notice of Privacy Practices for Telehealth and Remote Health Services at https://www.rousia.com/privacy-practices-services if you are a Rousia patient seeking further information about the use and disclosure of your Protected Health Information.

For more information on our technology platform policies, please visit our Terms of Service https://www.rousia.com/terms-of-service.

This Privacy Policy contains two sections: (1) generally applicable privacy policies; and (2) addenda for California residents.

1. Who is responsible for collecting your information?

2. What information do we collect, when, and from what sources?

3. Children

4. Why and how we use your information

5. Sharing your information

6. Cookies and pixel tags

7. Your rights and choices

8. Links to third-party websites, social media, and app stores

9. Information security

10. Retention

11. Changes to our Privacy Policy

12. International data transfers

13. How to contact us

Rousia (referred to as "our," "we," or "us" in this Privacy Policy).

We may collect personal and de-identified information when you use our Services. "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, to you as an individual or identifiable household.

We may collect personal information (1) that you provide, (2) through automated methods, and (3) from other sources. You are not obligated to provide personal information. However, in certain circumstances, you may experience a delay in Services, or we may be unable to provide you with our Services without your personal information. Please note that personal information does not include information made lawfully available to the general public.

"De-identified Information" is the information we collect that is not associated with personal information about you and which, on its own, does not individually identify you. We may create de-identified information records from personal information by excluding information (such as your name) that would otherwise make such data personally identifiable to you.

We may use de-identified information at our discretion and for any purpose.

Information you provide to us. We collect the information you provide directly to us. For example, we collect information when you create an account, participate in any interactive features of the Services (i.e., surveys, quizzes), request customer support, or otherwise communicate with us. The types of information we may collect from you include:

• contact information, including your name, email address, billing and shipping address, and telephone number;
• date of birth;
• driver's license number or non-driver identification card number;
• physical characteristics or description, including weight, height, and body measurements;
• demographic information such as gender and age;
• biometric information such as behavioral, and biological characteristics or activity patterns used to extract a template or other identifier or identifying information, such as fingerprints, faceprints;
• login credentials in combination with a password or security or security question and answer;
• images, photos, or videos;
• transaction information, including payment method and card information such as account number, credit or debit card number, in combination with any required security code, access code, password, or other information that would permit access to a financial account;
• health and fitness data;
• other information you choose to provide us when you interact with us (including through social media); and
• inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, abilities, and aptitudes.

In addition to the information above, if you are a Rousia employee or health coach, during registration, you may be asked to provide information regarding your professional qualifications and information related to your professional practice.

Information we collect through automated methods. When you access or use our Services, we automatically collect information about you from your computer system or mobile device. This information may include:

• internet protocol (I.P.) address;
• computer or mobile device operating system and browser type;
• device and component serial numbers;
• type of mobile device and its settings;
• unique device identifier (UDID) or mobile equipment identifier (MEID) of your mobile device;
• referring web page or application;
• geolocation;
• online activity on other websites, applications, or social media;
• access times; and
• pages viewed.

Information we collect from other sources. We may obtain information from other sources (i.e., payment processors, your public social media posts, or other publicly accessible sources) and use it as discussed in this Privacy Policy, including to provide the Services to and otherwise communicate with you.

Persons under the age of 13 are strictly prohibited from using our Services. We do not knowingly collect information from children under the age of 13. Our Services are intended for users eighteen (18) and older. Notwithstanding the foregoing, we do not knowingly collect information from minors between thirteen (13) and eighteen (18), even if a parent or legal guardian would be willing to provide consent. If you believe a user under the age of 18 may have provided us with personal information violating this Privacy Policy, please contact us at compliance@rousia.com and include a description of the specific posted information (including information that will allow us to confirm it was created and posted by the minor user).

We use the information we collect for the following purposes:

• to provide Services or products to you and for the performance of our contract with you (including payment processing, customer support, and order fulfillment and shipping updates);
• to identify you and your identity;
• to identify your account when communicating with our servers and update and enhance customer records;
• to respond to your comments, questions, and requests;
• ensuring business policies are adhered to (i.e., Terms of Service);
• operational reasons such as improving efficiency, training and quality control, and personalizing and improving products and services for your overall user experience;
• to identify, prevent, and detect fraud and other crimes, claims, and other liabilities against you and Rousia;
• ensuring the confidentiality of commercially sensitive information;
• to comply with our legal and regulatory obligations;
• to generate individually non-identifiable statistics and usage activities in support of improving our products and services;
• ensuring safe work practices, staff administration, and assessments;
• for rewards programs, and marketing our services and those of selected third parties to existing and former customers, third parties who have previously expressed an interest in our Services, and third parties with whom we have had no previous dealings; and
• to establish, exercise, or defend a legal claim.

We do not sell your personal information. We only share your personal information as described in this Privacy Policy or as otherwise communicated to you at the time of collection. We routinely share your personal information with:

• service providers we use to help deliver our services and products to you, such as payment processors, information technology service providers, health coaches, warehouses, and delivery companies;
• other third parties we use to help us run our business, such as marketing agencies or website hosts;
• third parties approved by you, including social media sites you choose to link your account to or third-party payment providers;
• our insurers and brokers;
• our banks;
• other third parties to the extent necessary to (1) comply with a government request, a court order, or applicable law; (2) prevent illegal uses of our Services or violations of our Terms of Service and policies; (iii) defend ourselves against third-party claims and, (iv) assist in fraud prevention or investigation (i.e., counterfeiting);
• professional advisors, such as accountants, legal advisers, and auditors; and
• potential buyers of some or all of our business, or during a restructuring.

Please note that we only allow our service providers to handle your personal information if we are satisfied with the measures they take to protect your personal information. We also impose contractual obligations on service providers to ensure they can only use your personal information to provide services to us and you.

Community and other public forums. Rousia may provide community areas, such as chat rooms, online discussion boards, and other public forums on the Services where users can share information about their similar interests or concerns. All community areas are open to the public and should not be considered private.

Any information you share in our community areas will be made available to other users and may be used by others in ways we cannot control or predict. You should think carefully before posting any personal information or additional information you do not intend to keep private.

Rousia and our service providers may use various technologies to collect information, including cookies and pixel tags (also known as web beacons or clear gifs). "Cookies" are small data files on an internet user's web browser, device, or hardware to remember and/or obtain information about the user, such as how many times they have visited a website. "Pixel Tags" are tiny graphics with a unique identifier, similar in function to cookies, and are used to track the online movements of users. We use cookies and pixel tags to improve our Services and your experience, see which areas and features of our Services are popular, count visits, understand usage, and campaign effectiveness.

We may allow third parties to advertise on our Services. Third-party ad servers or ad networks use technologies like cookies, JavaScript, or Web Beacons to measure the effectiveness of their advertising campaigns and/or to personalize the advertising content you see on websites you visit. These third parties have their own privacy policies, and Rousia has no access to or control over their cookies.

You can reject or disable cookies or manage your cookie preferences by following the directions in your browser settings on each browser and device you use. Each browser is different, so visit the browser's "Help" menu to learn more about managing your cookies. Please note that if you disable all cookies, you may not be able to use all features available on our Services, or the Services may not function properly.

Under applicable law, and subject to the conditions and the extent set out in applicable law, you may have the right to:

• update, correct, supplement, anonymize, block, or delete your personal information that is inaccurate, incomplete, outdated, unnecessary, excessive, or processed in non-compliance with applicable requirements;
• request restriction of the collection, processing, or use of your personal information;
• request data portability;
• check whether we have collected personal information about you;
• check what type of your personal information we have collected and request access to or copies of such information;
• under certain circumstances, revoke the consent previously granted to process your personal information or object to the processing of personal information for legitimate reasons; or
• to lodge a complaint with the appropriate authority.

Promotional communications and push notifications. We may use your personal information to send you updates (by email or app notifications/alerts) about our services and/or products, including exclusive offers, rewards, promotions, or new products or services. We have a legitimate interest in processing your personal information for promotional purposes (see above Why and how we use your information). We will ask for this consent separately and clearly. You have the right to opt-out of receiving promotional communications at any time by:

• contacting us at compliance@rousia.com; or
• using the "unsubscribe" link in emails.

We may ask you to confirm or update your marketing preferences if you instruct us to provide products and/or services in the future or if there are changes in the law, regulation, or the structure of our business.

Text Messages

We may also use your personal information to send you order fulfillment and shipping updates via text message. We have a legitimate interest in processing your personal information for order and shipment status (see above Why and how we use your information). We will ask for this consent separately and clearly. You have the right to opt-out of receiving text messages at any time by:

• replying “STOP” from your mobile device; or
• contacting us at compliance@rousia.com.

Native applications on mobile devices. Some features of our app may require access to certain native applications on your mobile device to facilitate your use of certain features of our Services, such as the camera and photo storage applications (e.g., to take and upload photos). If you decide to use these features, we will ask you for your consent prior to accessing the applications and collecting information. Note that you can revoke your consent at any time by changing the settings on your device.

Notice concerning Do Not Track. We do not monitor, recognize, or honor any opt-out or do not track mechanisms, including general web browser "Do Not Track" settings and signals.

Our Services may contain links to other websites, apps, tools, widgets, and plug-ins (collectively, "third-party links"). Rousia does not control these third-party links. We encourage our users to be aware when they leave our website and read each third-party link's privacy policies that collect personally identifiable information. We do not endorse, screen, or approve third-party links and are not responsible for such third-party links' privacy practices or content. Visiting these third-party links is at your own risk.

Your app store (i.e., Apple App Store or Google Play) may collect certain information in connection with your use of the app, such as personal information, payment information, geolocational information, and other usage-based data. We have no control over the collection of such information by a third-party app store, and any such collection or use will be subject to that third party's applicable privacy policies.

We implement and maintain organizational, technical, and administrative security measures to protect your personal information from loss, misuse, unauthorized access, disclosure, alteration, or destruction. These measures aim to provide ongoing integrity and confidentiality of your personal information. Your information is only accessible to personnel who need access to perform their duties. Please understand, however, that no security system is impenetrable. We cannot guarantee the security of our databases, website, mobile app or computer systems, or the databases of the third parties with which we may share such personal information. Further, we guarantee that the personal information you supply will not be intercepted while transmitted over the Internet or any other public network.

We will keep your personal information while you have an account with us or while we provide you with products and/or services. After that, we will keep your personal information for as long as is necessary unless otherwise required or permitted by law, or de-identify it.

We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of the Privacy Policy. In some cases, we may provide you with additional notice, such as adding a statement to our homepage or sending you an electronic notification. We encourage you to review the Privacy Policy whenever you access our Services or interact with us to stay informed about our information practices and how you can help protect your privacy.

Our Services are operated in the United States and intended for users located in the United States. If you are located outside of the United States, by visiting our Services and providing us with data, you acknowledge and agree that your personal information may be processed for the purposes identified in this Privacy Policy. In addition, such data may be stored on servers outside your resident jurisdiction and in jurisdictions with less stringent privacy practices than yours. By providing us with your data, you consent to the transfer of such data. If you do not want your information transferred to or processed or maintained outside the country or jurisdiction where you are located, you should not use the Services.

We welcome questions, comments, and concerns about our Privacy Policy and privacy practices. If you wish to provide feedback or if you have questions or concerns, or wish to exercise your rights related to your personal information, please email us at compliance@rousia.com, "PRIVACY POLICY" in the subject line, or mail us at the following address:

If you contact us with a privacy complaint, it will be assessed to resolve the issue promptly and effectively.

CALIFORNIA RESIDENTS

Additional Notice for California Consumers

This privacy notice applies solely to visitors, users, and others who reside in the State of California and supplements the information contained in our Privacy Policy.

"Personal Information" is defined in California as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device. Below is a list of categories of personal information we may collect or may have collected from California residents within the last 12 months.

Note that the categories and examples provided in the list are identified in the California Consumer Privacy Act (CCPA). We may not have collected all the personal information in each category. However, the list reflects our good-faith belief that some of the data in the following categories may be and may have been collected.

This personal information is required to provide you with products and/or services. If you do not provide the personal information we request, it may delay or prevent us from providing products and/or services to you.

Under the CCPA, personal information does not include:

• publicly available information;
• lawfully obtained, truthful information that is a matter of public concern;
• de-identified consumer information;
• aggregate consumer information; or
• information excluded from the CCPA's scope, such as:
• health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; or
• personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

We will retain each category of personal information collected for as long as necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required by law. Specific retention periods for each category are determined based on legal obligations, operational needs, and consumer expectations.

We collect most personal information:

• Directly from you - for example, the forms you complete on our Services, preferences you express or provide through our Services, or your purchases on our Services.
• Indirectly from you - for example, from observing your activity on our Services.
• Automatically from you - for example, through cookies we or our service providers set on your device as you navigate through our Services.
• From service providers - for example, third-party vendors to monitor and analyze the use of our Services, third-party vendors for payment processing, or other third-party vendors that we use to provide the Services to you.

We may use or disclose personal information we collect for "business purposes" or "commercial purposes" (as defined under the CCPA), which may include the following examples:

• to operate our Services and provide you with our Services;
• to support you and respond to your inquiries, including investigating and addressing your concerns and monitoring and improving our Services;
• to fulfill or meet the reason you provided the information; for example, if you provide your personal information to purchase a product or service, we will use that information to process your payment and facilitate delivery;
• to respond to law enforcement requests and as required by applicable law, court order, or governmental regulations;
• as described to you when collecting your personal information or as otherwise outlined in the CCPA;
• for internal administrative and auditing purposes; or
• to detect security incidents and protect against malicious, deceptive, fraudulent, or illegal activity, including, when necessary, to prosecute those responsible for such actions.

Please note that the examples provided above are illustrative and not intended to be exhaustive. Please refer to the Why and how we use your information section above for more details.

If we decide to collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes, we will update this Privacy Policy.

As is common practice among businesses that operate Internet websites and mobile apps, within the past 12 months, we may have shared certain identifiers such as email addresses and pseudonymized identifiers, information about the use of our websites and apps, and inferences drawn about you to our social media, advertising, and analytics partners. Under certain state laws, this may be considered to be a sale of personal information for consideration. We do not disclose the personal information of individuals we know to be under 16 to other businesses or third parties for consideration.

We require all third parties to whom we disclose personal information to adhere to the same privacy standards that we uphold, ensuring your data is protected and used only for specified purposes.

We have disclosed personal information in all or substantially all of the categories identified in this Additional Notice for California Consumers to the following categories of third parties:

• service providers;
• payment processors;
• our affiliates;
• our business partners;
• third-party vendors to whom you or your agents authorize us to disclose your personal information in connection with the products or services we provide to you; and
• as otherwise provided in the Sharing Your Information section above.

If you are a California resident, you have the rights listed below. We will honor requests received to the extent required by applicable law and within the time provided by law.

• the categories of personal information we have collected about you;
• the categories of sources from which the personal information is collected;
• our business or commercial purpose for collecting or selling personal information;
• the categories of third parties with whom we share personal information if any; and
• the specific pieces of personal information we have collected about you.

In connection with any personal information we may disclose to a third party for a business purpose, you have the right to know:

• the categories of personal information we disclosed about you for business purposes.

Please note that we are not required to:

• retain any personal information about you that was collected for a single, one-time transaction if, in the ordinary course of business, that information about you is not retained;
• reidentify or otherwise link any data that, in the ordinary course of business, is not maintained in a manner that would be considered personal information; or
• provide the personal information to you more than twice in a 12-month period.

The Right to Delete: Subject to certain exceptions set out below, on receipt of a verifiable request from you, we will:

• delete your personal information from our records; and
• direct any service providers to delete your personal information from their records.

Please note that we may not delete your personal information if it is necessary to:

• complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted under federal law, provide a good or service requested by you or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us;
• detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity;
• debug to identify and repair errors that impair existing intended functionality;
• exercise free speech, ensure the right of another consumer to exercise their right of free speech, or exercise another right provided for by law;
• comply with the California Electronic Communications Privacy Act;
• engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent;
• enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us;
• comply with an existing legal obligation; or
• otherwise use your personal information internally, in a lawful manner that is compatible with the context in which you provided the information.

The Right to Correct Inaccurate Information: California residents have the right to request the correction of inaccurate personal information that we maintain about them. You can submit a correction request by contacting us at compliance@rousia.com.

The Right to Limit the Use of Sensitive Personal Information: You have the right to request restrictions on the use of your sensitive personal information. This includes information revealing racial or ethnic origin, precise geolocation, and biometric data. To exercise this right, please contact us at us at compliance@rousia.com.

The Right to Opt-Out: You have the right to opt out of the disclosure of your personal information.

The Right Not to Be Discriminated Against: You have the right not to be discriminated against by us because you exercised your rights under the CCPA; this means we cannot, among other things:

• deny goods or services to you;
• charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
• provide a different level or quality of goods or services to you; or
• suggest that you receive a different price or rate for goods or services or a different level or quality of goods or services.

Please note that we may charge a different price or rate or provide a different level or quality of goods and/or services to you if that difference is reasonably related to the value provided to our business by your personal information.

If you are a California resident, you have the rights listed below. We will honor requests received to the extent required by applicable law and within the time provided by law.If you are a California resident, to exercise any of your rights under the CCPA, you can contact us by visiting this page on our website: https://www.rousia.com/privacy-policy.

Only you, or a person registered with the California Secretary of State you authorize to act on your behalf, may make a verifiable request related to your personal information.

Your request to us must:

• provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and
• describe your request in sufficient detail, allowing us to understand, evaluate, and respond appropriately.

We cannot respond to your request or provide you with the required information if we cannot:

• verify your identity or authority to make the request; and
• confirm that the personal information relates to you.

We will disclose and deliver the required information free of charge within 45 days of receiving your verifiable request. The time to provide the required information may be extended by an additional 45 days when reasonably necessary and with prior notice.

Any disclosures we provide will only cover the 12-month period preceding the verifiable request's receipt.

For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not monitor, recognize, or honor any opt-out or do not track mechanisms, including general web browser "Do Not Track" settings and/or signals.

However, some third-party websites do keep track of your browsing activities. If you are visiting such websites, you can set your preferences in your web browser to inform websites that you do not want to be tracked. You can enable or disable D.N.T. by visiting your web browser's preferences or settings page.

Persons under the age of 13 are strictly prohibited from using our Services. We do not knowingly collect information from children under the age of 13. Our Services are intended for users eighteen (18) and older. Notwithstanding the foregoing, we do not knowingly collect information from minors between thirteen (13) and eighteen (18), even if a parent or legal guardian would be willing to provide consent. If you believe a user under the age of 18 may have provided us with personal information violating this Privacy Policy, please contact us at compliance@rousia.com and include a description of the specific posted information (including information that will allow us to confirm it was created and posted by the minor user).

We urge parents and guardians to monitor and supervise their children's online activities regularly. If you have any questions about our children's privacy practices, please contact us at:

Email: compliance@rousia.com

Under California Civil Code Section 1798 (California's Shine the Light law), California residents with an established business relationship with us can request information once a year about sharing their personal data with third parties for the third parties' direct marketing purposes.

If you'd like to request more information under the California Shine the Light law, and if you are a California resident, you can contact us using the contact information provided below.

California Business and Professions Code section 22581 allows California residents under the age of 18 who are registered users of online sites, services, or applications to request and obtain the removal of content or information they have publicly posted.

To request the removal of such data, and if you are a California resident, you can contact us using the contact information provided above and include the email address associated with your account.

Be aware that your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.

Our Services may contain links to other websites, apps, tools, widgets, and plug-ins (collectively, "third-party links"). Rousia does not control these third-party links. We encourage our users to be aware when they leave our Services and to read the privacy policies of each third-party link that collects personally identifiable information. We do not endorse, screen, or approve and are not responsible for the privacy practices or content of such other third-party links. Visiting these third-party links is at your own risk.

Your app store (i.e., iTunes or Google Play) may collect certain information in connection with your use of the app, such as personal information, payment information, geolocational information, and other usage-based data. We have no control over the collection of such information by a third-party app store, and any such collection or use will be subject to that third party's applicable privacy policies.

We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of the Privacy Policy. In some cases, we may provide you with additional notice, such as adding a statement to our homepage or sending you an electronic notification. We encourage you to review the Privacy Policy whenever you access our Services or interact with us to stay informed about our information practices and how you can help protect your privacy.

We welcome questions, comments, and concerns about our Privacy Policy and privacy practices. If you wish to provide feedback or if you have questions or concerns, or wish to exercise your rights related to your personal data, please email us at compliance@rousia.com, "PRIVACY POLICY" in the subject line, or mail us at the following address: