Effective date: July 14, 2026

This Consumer Health Data Privacy Notice (this “Notice”) supplements the HMR Privacy Policy and applies to “consumer health data” that HMR Program, Inc. (“HMR,” “we,” “us,” or “our”) collects from (a) Washington residents and individuals whose consumer health data is collected in Washington, as required by the Washington My Health My Data Act, and (b) Nevada residents, as required by Nevada Senate Bill 370 (NRS 603A.500 et seq.). If this Notice conflicts with the HMR Privacy Policy with respect to consumer health data, this Notice controls.

“Consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. In the context of our weight-management products and services, this can include information about your weight, health goals, and dietary program participation.

Consumer Health Data We Collect and Why

Depending on how you interact with our websites, products, and services, we collect the following categories of consumer health data for the purposes described:

•       Health and wellness information you provide — such as your weight, weight-management goals, quiz responses, dietary preferences and restrictions, and information you share when participating in HMR coaching. We use this information to provide the products, services, and coaching you request, to personalize your program, and to provide customer support.

•       Program participation and purchase information — such as your enrollment in an HMR plan and purchases of HMR structured-diet foods, which could be used to infer information about your health. We use this information to fulfill orders, manage your account and subscription, and provide the services you request.

•       Communications — information about your health that you include in messages to our support or coaching teams. We use this information to respond to you and provide the services you request. If you participate in group coaching sessions or classes, information you choose to share during a session will be heard or seen by the coach and other participants. We do not record coaching sessions.

•       Inferences — inferences drawn from the information above to provide and personalize our weight-management products and services.

We collect consumer health data only (i) with your consent, or (ii) to the extent necessary to provide a product or service you have requested from us.

Sources of Consumer Health Data

•       Directly from you, when you create an account, complete a quiz, enroll in a plan, make a purchase, participate in coaching, or communicate with us.

•       Automatically, from your use of our websites and app, to the limited extent such usage information constitutes consumer health data.

•       From our service providers, when they collect or process this information on our behalf (each bound by contract to process it only on our documented instructions).

Consumer Health Data We Share; Categories of Recipients

We do not sell your consumer health data, and we will not sell it without first obtaining your separate, signed authorization as required by law. We do not share your consumer health data with third parties for their own marketing or advertising purposes, and we do not include consumer health data in advertising audience files. We disclose consumer health data only as follows:

•       Service providers and processors — companies that perform services on our behalf under contract (e.g., IT and website hosting, payment processing, order fulfillment and shipping, customer support, cloud storage, and analytics), which may process each of the categories listed above solely on our behalf.

•       Affiliates — We do not share consumer health data with affiliates.

•       With your consent or at your direction. — for example, if you ask us to refer you to a third-party provider, such as our partner offering GLP-1 medication programs, we will disclose your contact information and relevant consumer health data to that provider at your direction and with any consent required by applicable law. That provider is independent of HMR and will process your information under its own privacy notice.

•       For legal reasons — to comply with applicable law or valid legal process, or to protect our rights and the rights of others, as permitted by law.

Your Rights

If you are a Washington or Nevada resident (or your consumer health data was collected in Washington), you have the right to:

•       Access your consumer health data, including a list of all third parties and affiliates with whom we have shared or to whom we have sold it, and an email address or other online mechanism to contact those third parties.

•       Withdraw consent you previously provided to the collection or sharing of your consumer health data.

•       Delete your consumer health data. If you make a verified deletion request, we will delete it from our records, including archived and backup systems as required by law, and will notify our processors and any third parties with whom we shared it to do the same.

To exercise these rights, email privacy@hmrprogram.com or use the request form at https://www.hmrprogram.com/pages/data-sharing-opt-out. We may need to verify your identity before acting on your request, and you may use an authorized agent as permitted by law. We will respond within the time required by applicable law (generally 45 days, with one 45-day extension where reasonably necessary). We will not discriminate against you for exercising your rights.

Appeals

If we decline to act on your request, you may appeal by replying to our response or emailing privacy@hmrprogram.com with the subject line “Consumer Health Data Appeal.” We will respond to your appeal within the time required by applicable law. If your appeal is unsuccessful, you may contact the Washington State Attorney General at www.atg.wa.gov/file-complaint or the Nevada Attorney General at ag.nv.gov, as applicable.

Changes to This Notice

We may update this Notice from time to time. We will post the revised Notice on this page and update the effective date above. If we make material changes to how we collect or share consumer health data, we will obtain any consent required by applicable law before the new practice applies to previously collected consumer health data.

Contact Us

Should you have any questions about our privacy practices or this Consumer Health Data Privacy Notice, or if you would like to exercise any of the rights available to you, please call or email us at privacy@hmrprogram.com or contact us at 3209 West Smith Valley Road, Suite 207, Greenwood, IN, 46142, US.