Consumer Health Privacy Notice

Effective Date: September 23, 2026

This Consumer Health Privacy Notice is My Opus, Inc.’s (“OPUS,” “we,” “us,” or “our”) consumer health data privacy policy under Washington’s My Health My Data Act and Nevada’s consumer health data law. It supplements our Privacy Policy.

Consumer health data is information that identifies or can reasonably be linked to you and relates to your physical or mental health. It can include information you provide and information inferred or derived from it.

1. What we collect and why

What OPUS collects depends on what you choose to share and which features you use.

Information you provide

This may include health-related information in onboarding, assessments, profile or personalization inputs, reflections, lessons, quests, OPUS Chat, a product-access review, support messages, or privacy requests.

Depending on what you share, this information may reveal a condition, symptom, diagnosis, treatment, medication, disability, reproductive or sexual health information, gender-affirming care information, substance use, emotional distress, self-harm, immediate safety, abuse, violence, or another physical or mental health experience.

We use this information to provide the feature, response, personalization, support, privacy-request handling, safety routing, or product-access review you request; to secure and operate OPUS; and to comply with law.

Information OPUS derives

OPUS may create or receive:

• mathematical memory representations or embeddings from onboarding-related user memory;
• limited automated safety-routing or meaning-confirmation signals;
• a basic, category-free chat-access state and content-free review metadata;
• temporary routing or event-linkage information; and
• limited review outcomes or administrative records created by authorized OPUS personnel.

We use this information for memory retrieval and personalization, to show fixed safety or meaning-confirmation screens, to maintain chat-access state, and to administer a product-access review. Automated routing is not a diagnosis or clinical assessment.

Product-access review

If chat is paused, you may request a review with or without sharing the conversation. If you share it, OPUS receives the triggering message and the recent exchange identified in the review interface, up to 21 total messages. Without it, no transcript is collected for the review. The review decides only whether chat access will be restored.

Related account and technical information

Account identifiers, contact details, timestamps, security information, and request metadata may become consumer health data when linked to health-related information. We use them to authenticate you, protect OPUS, operate the requested feature, and administer requests or reviews.

2. Sources and processing

We may collect consumer health data from:

• you, when you use OPUS or contact us;
• OPUS systems, when they derive representations, routing signals, access-control information, or related data from what you provide;
• service providers, when they return an AI response, embedding, or other result from data processed for OPUS; and
• authorized OPUS personnel, when they record a limited review, support, or privacy-request outcome.

Depending on the feature, OPUS may receive, analyze, transform, transmit, store, retrieve, review, or delete consumer health data. During an open chat, OPUS processes a recent portion of the conversation to respond; it is not ordinarily saved as account chat history or reused in later chats.

Service providers process data only for the purposes described here and as needed to provide services to OPUS. They include AI response and classification providers; an embedding provider used only for onboarding-derived user memory; cloud, database, authentication, storage, hosting, and backup providers; email and workspace providers for messages you choose to send; and a product-analytics provider configured to exclude raw chat, safety, review, and privacy-request content on designated no-capture surfaces. A conversation is stored for human product-access review only if you choose review with the conversation.

Our current providers and their roles appear in the Subprocessor List.

3. Sharing and sales

OPUS does not sell consumer health data. We do not share it with third parties or affiliates for their own purposes. Service providers process information only as needed to run the features described above.

Washington disclosures

Washington generally excludes disclosures to processors acting on our behalf for the disclosed purpose from its definition of “sharing.”

• Categories of consumer health data shared: None.
• Categories of third parties receiving consumer health data: None.
• Specific affiliates receiving consumer health data: None.

Nevada disclosures

Nevada’s definition of “sharing” includes disclosures to processors. The categories shared may include the user-provided, derived, review, account, and technical information described in Section 1, only as needed for the purposes in Sections 1 and 2.

• Categories of entities receiving consumer health data: AI, cloud infrastructure, database, authentication, storage, hosting, backup, email, workspace, and product-analytics processors described in Section 2.
• Categories of third parties receiving consumer health data: None.
• Categories of affiliates receiving consumer health data: None.

OPUS does not permit a third party to collect consumer health data about you over time and across different websites or online services when you use OPUS.

4. Your choices

Where permission is required, OPUS will ask before the collection or sharing begins. The request will explain the data involved, why and how it will be used, the categories of recipients when applicable, and how to withdraw. Collection permission will not be bundled into general Terms, and any legally required sharing permission will be separate.

You may decline to provide consumer health data, but a feature that needs it may not work. You may withdraw permission for future collection or sharing by emailing privacy@opuswithin.com with the subject Consumer Health Data Request. If you withdraw permission for processing needed to provide OPUS Chat, Chat will remain unavailable until you choose to enable it again.

We won’t discriminate against you for exercising these rights.

5. Your rights

Depending on the law that applies, you may ask OPUS to:

• confirm whether we collect, share, or sell consumer health data concerning you;
• give you access to or let you review that data;
• provide the legally required list of third parties and affiliates with whom it was shared or sold and, when Washington law applies, a current way to contact each listed recipient;
• review or request a correction to information you believe is inaccurate;
• withdraw consent and stop future collection, sharing, or sale; or
• delete consumer health data concerning you.

6. Requests, timing, and appeals

Email privacy@opuswithin.com with the subject Consumer Health Data Request and briefly describe what you would like us to do. You do not need to create a new OPUS account. We may use your existing account or ask for information reasonably necessary to authenticate you and protect your data; we will not ask you to repeat unnecessary health details.

Responses are free as required by law. A reasonable fee or refusal may apply only when the law allows it for a request that is manifestly unfounded, excessive, or repetitive.

Washington timing

We will act without undue delay and within 45 days after receiving your request. Authentication does not extend that deadline. If reasonably necessary, we may extend once by 45 days and will explain the extension within the first 45 days.

For deletion, we will delete covered data from our records and notify applicable affiliates, processors, contractors, and other recipients as required by law. Deletion from archived or backup systems may be delayed only as permitted by law and for no more than six months after authentication.

Nevada timing

We will respond without undue delay and within 45 days after authenticating your request. If reasonably necessary because of the complexity or number of requests, we may extend once by up to 45 days and will explain the extension within the initial period.

For an authenticated deletion request, OPUS will delete covered consumer health data from its records and network and notify applicable affiliates, processors, contractors, and other recipients within 30 days. Those recipients generally have 30 days after notice to delete the covered data. Deletion from archived or backup systems may be delayed only as permitted by law and for no more than two years after authentication.

Appeals

If we refuse a request, you may appeal by replying to our decision or emailing privacy@opuswithin.com with the subject Consumer Health Data Appeal. We will respond in writing within 45 days after receiving the appeal, explain our decision, and provide the appropriate state Attorney General contact method if we deny the appeal.

7. Retention

Ordinary chat is not ordinarily stored as account chat history or reused in later chats. A conversation you choose to submit for product-access review is removed from the active review system when you withdraw it, seven days after a completed review, or 45 days after the request if no review is completed, whichever comes first.

Deleted information may remain temporarily in restricted backup, recovery, security, or legally required provider records and is not restored to ordinary active use. When a valid deletion request is governed by Washington or Nevada law, covered consumer health data in backups is handled within the applicable state maximum described above.

8. Changes to this notice

If we make a material change, we will post the updated notice and provide additional notice through OPUS, by email, or another clear method where required.

Before collecting, using, or sharing an additional category of consumer health data, using it for an additional purpose, or sharing it with an additional third party or affiliate where permission is required, we will provide the required disclosure and obtain affirmative consent before the new processing begins.

9. Contact

For questions, requests, or appeals:

My Opus, Inc. Attention: Privacy 6975 Union Park Avenue, Suite 600 Cottonwood Heights, UT 84047 United States Email: privacy@opuswithin.com