California Privacy Notice

1. Overview

This California Privacy Notice supplements the information contained in our Privacy Policy and applies solely to residents of the State of California ("consumers" or "you"). This notice is provided in compliance with the California Consumer Privacy Act of 2018 (CCPA) as amended by the California Privacy Rights Act of 2020 (CPRA).

Truventa Medical ("we," "us," or "our") is committed to protecting the privacy of California residents and ensuring transparency in how we collect, use, and share personal information.

2. Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information from California consumers:

• Identifiers: Name, email address, postal address, phone number, date of birth, account credentials
• Personal information under Cal. Civ. Code § 1798.80(e): Name, address, telephone number, medical information, health insurance information
• Protected classification characteristics: Age, sex, gender (collected for medical purposes only)
• Commercial information: Purchase history, subscription details, payment records
• Internet or network activity: Browsing history on our site, search history, interaction with our website
• Geolocation data: Approximate location based on IP address (to verify state eligibility)
• Professional or employment information: Occupation (when relevant to medical intake)
• Sensitive personal information: Health and medical information, including medical history, diagnoses, medications, and lab results
• Inferences: Health profiles and care recommendations derived from collected information

3. How Your Information Is Used

We collect and use personal information for the following business and commercial purposes:

• Providing healthcare services: Facilitating telehealth consultations, processing prescriptions, and managing your care
• Account management: Creating and managing your account, processing payments, and communicating about your subscription
• Compliance: Meeting legal, regulatory, and HIPAA requirements
• Improving services: Analyzing platform usage to improve user experience and service quality
• Communication: Sending appointment reminders, health updates, and service notifications
• Security: Detecting and preventing fraud, unauthorized access, and other security threats
• Marketing: Sending promotional communications (with your consent, where required)

4. Right to Know

As a California resident, you have the right to request that we disclose the following information about our collection and use of your personal information over the past 12 months:

• The categories of personal information we have collected about you
• The categories of sources from which the personal information was collected
• Our business or commercial purpose for collecting or selling the information
• The categories of third parties with whom we share the information
• The specific pieces of personal information we have collected about you

5. Right to Delete

You have the right to request that we delete any personal information we have collected from you, subject to certain exceptions. We may deny your deletion request if retaining the information is necessary for us or our service providers to:

• Complete a transaction or provide a service you requested
• Detect and resolve security incidents or fraudulent activity
• Comply with legal obligations (including medical record retention requirements)
• Exercise free speech or other legal rights
• Engage in public or peer-reviewed research in the public interest

6. Right to Opt-Out of Sale or Sharing

Under the CCPA/CPRA, you have the right to opt out of the "sale" or "sharing" of your personal information. As defined by California law, "sale" includes making personal information available to third parties for monetary or other valuable consideration, and "sharing" includes cross-context behavioral advertising.

Truventa Medical does not sell your personal information for monetary consideration. However, certain data sharing activities — such as the use of analytics and advertising technologies — may be considered "sharing" under the CPRA.

You can opt out of such sharing at any time (see Section 7 below).

7. Do Not Sell or Share My Personal Information

• Emailing us at support@truventamedical.com with the subject line "Do Not Sell or Share"
• Submitting a request through our website

We will process your opt-out request within 15 business days. You do not need to create an account to submit an opt-out request.

We also honor the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we will treat it as a valid opt-out request.

8. Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. Specifically, we will not:

• Deny you services
• Charge you different prices or rates for services
• Provide you a different level or quality of services
• Suggest that you may receive a different price or rate for services, or a different level or quality of services

9. Sensitive Personal Information Handling

We collect and process sensitive personal information, including health and medical information, solely for the following purposes as permitted under the CPRA:

• Providing healthcare services, including telehealth consultations and prescription fulfillment
• Ensuring the quality and safety of medical care
• Complying with HIPAA and other healthcare regulations
• Detecting and preventing fraud

We do not use or disclose sensitive personal information for purposes beyond those permitted by the CPRA. Your health information is additionally protected under HIPAA, which provides further restrictions on the use and disclosure of protected health information (PHI).

You have the right to limit the use and disclosure of your sensitive personal information to only those uses necessary to perform the services you have requested.

10. Retention Periods

We retain personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, including:

• Account information: Retained for the duration of your active account plus 3 years after closure
• Medical records: Retained for a minimum of 7 years from the date of last treatment, or as required by applicable state and federal law (whichever is longer)
• Billing and payment data: Retained for 7 years for tax and accounting compliance
• Website analytics data: Retained for up to 26 months
• Communication records: Retained for 3 years after last interaction

After the applicable retention period, personal information is securely deleted or de-identified.

11. Exercising Your Rights

To exercise any of your California privacy rights, you may submit a verifiable consumer request through the following methods:

Verification Process

To protect your privacy, we must verify your identity before fulfilling your request. We may ask you to provide:

• Your name and email address associated with your account
• Additional identifying information to confirm your identity
• A signed declaration under penalty of perjury (for certain requests)

Authorized Agents

You may designate an authorized agent to make a request on your behalf. The authorized agent must provide written proof of authorization, and we may still require you to verify your identity directly.

Response Timing

We will respond to verifiable consumer requests within 45 days of receipt. If additional time is required, we will notify you of the extension and the reason for the delay (up to an additional 45 days).

12. Contact Us

If you have questions about this California Privacy Notice or wish to exercise your privacy rights, please contact us:

This California Privacy Notice was last updated in April 2026 and may be updated periodically. We will notify you of any material changes by posting the updated notice on our website.