Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy supplements Wyze’s broader privacy practices and explains how consumer health information may be collected, handled, used, and disclosed in connection with residents of Washington and Nevada. The policy is intended to provide additional transparency concerning information that may qualify as consumer health data under applicable state privacy requirements. Such information can cover a broad range of data associated with an individual’s physical or mental well-being, healthcare-related activities, or circumstances that could reasonably be connected to a person’s health or attempts to obtain health-related services.

The categories of consumer health information handled by Wyze can vary depending on the products, applications, devices, and services a person chooses to use. Certain connected devices may collect measurements and activity information that can be associated with health or fitness. For example, compatible Wyze wearable and wellness products may record information such as height, weight, physical activity, heart rate, body composition measurements, body fat, muscle mass, protein levels, and other related metrics. Depending on how location-enabled products are used, location information may also provide insight into visits to places associated with wellness, exercise, healthcare, or other health-related activities.

Health-related information may also become available through integrations that users voluntarily establish with external applications or services. When a user chooses to connect a third-party platform to a Wyze product or service, the information received through that integration may include data that falls within the applicable definition of consumer health data. The nature and scope of information received through an integration depend on the third-party service, the permissions selected by the user, and the way the connected service operates.

Wyze generally receives or collects consumer health data when users voluntarily provide the information, use products or services that are designed to generate such information, interact with connected applications, or otherwise direct Wyze to obtain the data. Information may also originate from third parties when a user chooses to authorize an integration or otherwise permits information to be shared. These collection practices are intended to support the functionality and services requested by users and to operate connected products effectively.

Consumer health information may be used for a variety of legitimate business and service-related purposes. These purposes can include providing requested products and features, operating connected devices and applications, maintaining account functionality, responding to customer requests, diagnosing technical problems, improving product performance, strengthening security, preventing misuse, and developing new products or services. Information may also be processed when necessary to satisfy legal obligations or protect the rights, property, and security of Wyze, its users, or other individuals.

In certain circumstances, consumer health data may be used to personalize or improve the user experience. Data generated through connected products can help support features that provide users with information about their activities or measurements. It may also contribute to product research, development, testing, and performance analysis. Any processing for purposes requiring consent will be conducted subject to the applicable consent requirements and the choices made by the individual.

Wyze may disclose consumer health data to other parties when there is a valid business, service, legal, or operational reason for doing so. Information may be shared with service providers that perform functions on behalf of Wyze, such as technology operations, data processing, customer support, security, analytics, or other services necessary to maintain the company’s products and infrastructure. Such parties are expected to handle information according to applicable contractual and legal requirements.

Consumer health data may also be disclosed to third parties when a user has specifically authorized the disclosure. For example, a user may choose to connect a product with an external application or service and permit information to be exchanged between the services. The scope of information involved in such an integration depends on the permissions and functionality associated with the connection.

Corporate transactions may also result in the transfer or disclosure of information. In connection with events such as a merger, acquisition, financing, restructuring, sale of assets, or similar business transaction, consumer health data may be transferred or reviewed as reasonably necessary to complete the transaction and operate the resulting business relationship. Any such handling remains subject to applicable legal obligations and privacy requirements.

Wyze may additionally disclose consumer health information when required or permitted by law. This can include responding to valid legal processes, governmental requests, court orders, regulatory requirements, or other lawful demands. Information may also be disclosed when reasonably necessary to investigate security incidents, prevent fraud or unlawful activity, enforce applicable terms, protect individuals from harm, or defend legal rights and interests.

The company seeks to limit disclosures of consumer health data to information that is reasonably necessary for the purpose for which the disclosure occurs. Wyze considers the applicable circumstances and legal requirements when determining whether information may be shared. Processing and disclosure practices are intended to remain consistent with applicable privacy laws and the broader privacy commitments described in the company’s general Privacy Policy.

Residents of Washington and Nevada may have specific rights concerning consumer health information under applicable state laws. Depending on the circumstances, these rights may include requesting access to covered health information, seeking correction of inaccurate information, requesting deletion of certain information, or withdrawing consent for particular processing activities. The availability and scope of a specific right may depend on the applicable law, the nature of the information involved, and any statutory exceptions.

Individuals who wish to exercise an applicable privacy right may use the request procedures described in Wyze’s general Privacy Policy. Requests should contain sufficient information for Wyze to understand the nature of the request and, where required, verify that the request is being made by the appropriate individual. Verification procedures are intended to protect personal information from unauthorized access or improper requests.

If a privacy request involving consumer health data is denied, applicable law may provide an opportunity to appeal the decision. Individuals may use the appeal process made available by Wyze’s privacy team and provide additional information or clarification regarding the request. Where applicable rights remain unresolved after the internal appeal process, an individual may have the ability to submit a complaint to the appropriate state authority, including the Washington State Attorney General where permitted by law.

Consent choices are also an important component of consumer health data privacy. When applicable law requires consent for a particular collection, use, or disclosure, Wyze seeks to obtain that authorization before conducting the relevant activity. Where withdrawal of consent is legally available, users may follow the procedures provided in the company’s privacy materials to communicate their decision. Withdrawal does not necessarily affect processing that occurred before the withdrawal became effective.

Wyze recognizes that consumer health information can be particularly personal and therefore requires careful handling. The company seeks to maintain appropriate administrative, technical, and organizational safeguards designed to protect information against unauthorized access, misuse, alteration, disclosure, or loss. Security measures may evolve as technology, products, threats, and legal requirements change.

Privacy practices may also be reviewed and updated periodically. Changes in technology, new product capabilities, evolving legal requirements, and feedback from users may lead to modifications in how consumer health information is handled. When updates are made to applicable privacy notices, Wyze may revise the relevant materials so that users can better understand current practices and available rights.

The company’s approach is intended to provide users with greater visibility into the ways health-related information may enter its systems and how that information may be processed. By explaining potential collection sources, business purposes, disclosure circumstances, and available privacy rights, Wyze seeks to help individuals make informed decisions about the connected products and services they choose to use.

Wyze remains committed to maintaining responsible privacy practices for consumer health information and to respecting applicable rights in Washington and Nevada. The company continues to evaluate its data practices, security controls, consent processes, and compliance procedures as privacy expectations develop. Users who have questions or require assistance with a consumer health data request may consult the general Privacy Policy for the applicable contact and request information.