Minimal Inc

Consumer Health Data Privacy Policy

Effective: October 25, 2026

1. INTRODUCTION

This Consumer Health Data Privacy Policy (this “Policy”) explains how Minimal, Inc. (“Minimal,” “we,” “us,” or “our”) collects, uses, shares, and protects consumer health data in connection with the website at https://joinminimal.com, its related mobile application, and the products and services we make available (together, the “Services”). It also explains the rights you have with respect to that data and how to exercise them.

Medical care is provided through the Services by independent, affiliated medical groups, including Synergy Health and Pippen Health, and their licensed providers (together, the “Medical Groups”). Minimal, Inc. provides technology and administrative services; the Medical Groups and their providers provide medical care.

This Policy applies to consumer health data as defined by the Washington My Health My Data Act (RCW 19.373), Nevada Senate Bill 370 (Chapter 603A of the Nevada Revised Statutes), and the consumer health data provisions of the Connecticut Data Privacy Act, and to residents of those states and consumers whose consumer health data is collected or processed in those states. It supplements our Privacy Policy (https://joinminimal.com/privacy-policy). If this Policy conflicts with our Privacy Policy with respect to consumer health data, this Policy controls.

2. WHAT IS CONSUMER HEALTH DATA

“Consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. It can include information that identifies you as seeking or receiving health care services, and information derived or inferred from non-health data. Because the Services relate to weight management, the fact that you visited, signed up for, or purchased a service from us may itself be consumer health data.

3. CATEGORIES OF CONSUMER HEALTH DATA WE COLLECT

Depending on how you use the Services, we may collect the following categories of consumer health data:

Intake and questionnaire responses, including answers about your health goals, symptoms, eating habits, and lifestyle.
Body measurements and metrics, such as height, weight, body mass index (BMI), and weight-loss goals and progress.
Medical history, including health conditions, diagnoses, surgeries, family history, allergies, and pregnancy or breastfeeding status.
Medications, including current and past medications, prescriptions issued through the Services, dosages, and side effects you report.
Health care services sought or received, including consultations, treatment plans, refill requests, and communications with providers and care staff.
Images, videos, or documents you share for medical or identity-verification purposes.
Prescription, pharmacy, and laboratory information received from third parties involved in your care.
Purchase information that reveals that you sought or purchased a weight-loss or other health service or medication, such as your order, plan, or subscription.
Inferences about your health status derived from any of the information above or from your use of the Services.
Precise location information, only if you grant permission on your device, to the extent it could reasonably indicate an attempt to acquire or receive health services.

4. SOURCES OF CONSUMER HEALTH DATA

We collect consumer health data from the following sources:

Directly from you, such as when you create an account, complete an intake questionnaire, place an order, upload images or documents, or communicate with us or with providers.
From the Medical Groups and their providers, who generate and share information in the course of providing your care.
From pharmacies and laboratories involved in your care or the fulfillment of your medication.
Automatically, through your device and your use of the Services, including through cookies, pixels, software development kits, and similar technologies as described in our Privacy Policy.
From service providers that help us operate the Services, such as identity-verification and payment providers.
From inferences we derive from the information above.

5. PURPOSES FOR WHICH WE COLLECT AND USE CONSUMER HEALTH DATA

We collect and use consumer health data for the following purposes:

To provide the Services you request, including to enable consultations with the Medical Groups and their providers, facilitate prescriptions, and fulfill and ship orders.
To create and administer your account and verify your identity and eligibility.
To process payments, subscriptions, and refunds.
To communicate with you about your care, orders, account, and the Services, and to provide customer support.
To maintain the safety, security, and integrity of the Services and to detect and prevent fraud.
To analyze, maintain, and improve the Services, using de-identified or aggregated data where reasonably possible.
To comply with legal and regulatory obligations, respond to legal process, and establish, exercise, or defend legal claims.
For other purposes described to you at the time of collection or at your direction.

We do not use intake answers, medical history, medications, or health conditions for advertising.

6. COLLECTION NECESSARY TO PROVIDE CARE AND YOUR CHOICES

When you submit an intake questionnaire or otherwise request care through the Services, you agree to our collection of the consumer health data you provide, and its sharing with the Medical Groups, pharmacies, laboratories, and service providers, as necessary to provide the product or service you have requested, including evaluation, treatment, prescriptions, and fulfillment. Without this information, we and the Medical Groups may be unable to provide some or all of the Services.

For other uses, including analytics, measurement, and advertising, Minimal and its partners may use cookies, pixels, SDKs, and similar technologies, including on checkout and purchase pages. You can opt out of the sale or sharing of your personal information and of targeted advertising through the “Your Privacy Choices” link on our website or by sending a request to [email protected]. We honor Global Privacy Control (GPC) signals as an opt-out for the browser or device that sends them, and you can also use your browser and cookie controls. You may withdraw or limit our uses of your consumer health data at any time by contacting us as described in Section 12. Doing so does not affect processing that occurred before your request.

7. CATEGORIES OF CONSUMER HEALTH DATA WE SHARE AND WITH WHOM

We generally share consumer health data as necessary to provide the Services you request and as otherwise described in this Policy. The categories of consumer health data we share, and the categories of recipients, are:

Affiliated Medical Groups and their providers: all categories described in Section 3 that are relevant to your care, so that they can evaluate you, provide care, and issue prescriptions.
Pharmacies: your identity and contact details, prescription and medication information, relevant medical history and allergies, and shipping information, to fill and deliver your prescriptions.
Laboratories: information needed to order and process tests, where testing is part of your care.
Payment processors, including Stripe: order and payment information, which may reveal that you purchased a health service or product, to process payments and prevent fraud.
Service providers acting on our behalf, such as hosting and cloud storage, customer support, communications, identity verification, and shipping providers, which may process the categories described in Section 3 only to provide services to us and subject to contractual confidentiality and data protection obligations.
Analytics and advertising partners: as described in our Privacy Policy, we use analytics and advertising technologies that may receive an event indicating that a purchase occurred, together with the purchase value, currency, an order or event identifier, and standard technical information such as IP address, browser and device information, and cookie or advertising identifiers. We design these events to exclude health information such as questionnaire responses, and we limit the information included. To the extent that this information is consumer health data under applicable law, sharing it with analytics and advertising partners is subject to your opt-out choices described in Section 6.
Government authorities, courts, and other parties, where required by law or legal process, or to protect the rights, safety, and property of our users, Minimal, the Medical Groups, and others.
A buyer or successor in connection with a merger, acquisition, financing, or sale of assets, where permitted by law.
Other third parties, at your direction.

We do not share text message opt-in data or consent with third parties other than service providers that help us deliver text messages.

8. NO SALE OF CONSUMER HEALTH DATA

We do not sell consumer health data. We will not sell consumer health data without first obtaining a valid, signed authorization from you as required by law.

9. GEOFENCING

We do not use geofencing to target individuals at health care facilities.

10. DATA SECURITY AND ACCESS RESTRICTIONS

We maintain reasonable administrative, technical, and physical safeguards designed to protect consumer health data, appropriate to the volume and nature of the data, such as access controls and, where appropriate, encryption. We take reasonable steps to restrict access to consumer health data to employees, service providers, and contractors who need that access to provide the Services you request or for the other purposes described in this Policy.

11. YOUR RIGHTS

Subject to applicable law, you have the following rights with respect to your consumer health data:

Right to access: to confirm whether we collect, share, or sell your consumer health data, and to access that data, including a list of the third parties and affiliates with which we have shared or sold your consumer health data and, where required by law, contact information or another mechanism you may use to contact them.
Right to withdraw or limit: to withdraw or limit our collection and sharing of your consumer health data, including to opt out of sharing for advertising.
Right to delete: to have your consumer health data deleted, including from our archives and backup systems, and to have us notify our processors and the third parties and affiliates with which we have shared it of your deletion request. Information we are required to retain by law, including medical records maintained by the Medical Groups, may be retained for the period the law requires. Data in archived or backup systems will be deleted within a reasonable period, as required by law.
Right to non-discrimination: we will not discriminate against you for exercising any of these rights.

Connecticut residents may also exercise the rights described in Section 12 of our Privacy Policy with respect to consumer health data.

12. HOW TO EXERCISE YOUR RIGHTS

To exercise your rights, contact us by email at [email protected] or by phone at (415) 683-2484. Please identify your request (for example, “Consumer Health Data Access Request,” “Consumer Health Data Deletion Request,” or “Withdrawal or Opt-Out Request”) and the state in which you reside.

We will verify your request by matching information you provide with information in our records, using commercially reasonable methods. If we cannot verify your identity, we may ask you for additional information. You may use an authorized agent to submit a request on your behalf; the agent must provide your signed permission or a valid power of attorney, and we may ask you to verify your identity directly.

We will respond to your request within forty-five (45) days of receipt. Where reasonably necessary, taking into account the complexity and number of requests, we may extend this period once by an additional forty-five (45) days, in which case we will notify you of the extension and the reason for it within the initial 45-day period. We will respond to requests free of charge, up to twice in any twelve (12) month period, unless requests are manifestly unfounded, excessive, or repetitive.

13. APPEALS

If we decline to take action on your request, we will explain why. You may appeal our decision within a reasonable time by emailing [email protected] with the subject line “Consumer Health Data Appeal” or by calling (415) 683-2484. We will respond to your appeal within forty-five (45) days of receipt, inform you in writing of any action taken or not taken, and explain the reasons for our decision.

If your appeal is denied, you may contact the Attorney General of your state. Washington residents may submit a complaint to the Washington State Office of the Attorney General at https://www.atg.wa.gov/file-complaint or by calling 1-800-551-4636. Nevada residents may contact the Nevada Office of the Attorney General at https://ag.nv.gov/Complaints/File_Complaint/. Connecticut residents may contact the Connecticut Office of the Attorney General at https://portal.ct.gov/AG/Common/Complaint-Form-Landing-page.

14. NEVADA RESIDENTS

If you are a Nevada resident, or your consumer health data is collected in Nevada, this Policy constitutes our consumer health data privacy policy under Nevada Senate Bill 370. In addition to the rights described above, you may request a list of the third parties with which we have shared your consumer health data. We collect, use, and share consumer health data as necessary to provide a product or service you request and as otherwise described in this Policy, subject to your opt-out choices, and we do not sell consumer health data without your written authorization. We do not use geofencing to target individuals at health care facilities.

15. CONNECTICUT RESIDENTS

If you are a Connecticut resident, consumer health data is “sensitive data” under the Connecticut Data Privacy Act. We process consumer health data as necessary to provide the Services you request and as otherwise permitted by law, subject to your opt-out choices, we do not sell consumer health data, and we take reasonable steps to restrict access to consumer health data through contractual confidentiality obligations. We do not use geofencing to target individuals at health care facilities.

16. CHANGES TO THIS POLICY

We may update this Policy from time to time. We will post the updated Policy on the Services and update the “Last updated” date above. If we make material changes, we will provide any additional notice or choices that applicable law requires.

17. CONTACT US

If you have questions about this Policy or our handling of consumer health data, contact us:

Email: [email protected]

Mail: Minimal, Inc., Attn: Privacy Officer, 2081 Norfork Rd., Northfield, IL 60093

Phone: (415) 683-2484

If you need this Policy in an alternative format, contact us. We will respond promptly.