Consumer Health Data Privacy Policy

Eir Services Group, LLC d/b/a Timber Health

Effective Date: October 01, 2026 | Last Updated: October 01, 2026 | Version 1.3

1. Introduction and Scope

1. Eir Services Group, LLC d/b/a Timber Health ("Timber Health," "we," "us," or "our") provides this Consumer Health Data Privacy Policy (this "CHD Policy") to describe how we collect, use, share, and protect consumer health data, and the rights available to you with respect to that data. This CHD Policy applies to consumer health data collected through https://timberhealth.co and the related websites, applications, intake flows, account tools, communications channels, and services that link to it (collectively, the "Services").

2. This CHD Policy is a standalone policy, linked from the footer of every page of our website. It is provided to satisfy state consumer-health-data laws — including the Washington My Health My Data Act, Nevada Senate Bill 370, and the consumer-health-data provisions of the Connecticut Data Privacy Act — and, as a matter of company practice, we apply its core commitments to consumer health data we collect about consumers nationwide. The scope and mechanics of specific statutory rights may vary based on your state of residence and the law that applies to your request.

3. This CHD Policy supplements the Timber Health Privacy Policy, available at https://timberhealth.co, which describes our privacy practices generally. For consumer health data, this CHD Policy controls in the event of any conflict. Information that is protected health information ("PHI") governed by the Health Insurance Portability and Accountability Act ("HIPAA") and maintained by or on behalf of a covered entity, and other information exempted by an applicable consumer-health-data law, is governed by the legal frameworks applicable to that information rather than by these state consumer-health-data laws.

4. Timber Health provides non-clinical technology, care-coordination, administrative, and customer-support services. Independent licensed clinicians in the Arora Health network provide all medical care, and The Pharmacy Hub, a licensed pharmacy located in Miami, Florida, dispenses prescription medications, and independent laboratories perform the laboratory testing that Arora Health clinicians — or, for standalone lab panels, the physicians of the physician group engaged by Junction, our laboratory-services platform — order. Timber Health acts as the business associate of the Arora Health medical practices for the protected health information it handles on their behalf and, for laboratory data, as a subcontractor business associate of Junction. Those parties maintain their own privacy notices for the records they hold.

2. What "Consumer Health Data" Means

5. "Consumer health data" means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. It includes, for example, information about health conditions, symptoms, diagnoses, treatments, diseases, medications, bodily functions, vital signs and measurements, reproductive or sexual health, gender-affirming care, biometric data, use or purchase of prescribed medication, efforts to research or obtain health services or supplies, and information that is derived or inferred from non-health data and used to associate you with health status.

3. Categories of Consumer Health Data We Collect and Why

6. Depending on how you use the Services, we collect the following categories of consumer health data:

(a) intake questionnaire responses, including symptoms, health conditions, diagnoses, medical and surgical history, allergies, medications and supplements, lifestyle information, and treatment preferences;

(b) measurements and clinical values, including height, weight, body-composition information, vital signs, hormone levels, and laboratory orders and results;

(c) information related to the treatment programs you request or receive, including hormone optimization and testosterone replacement therapy, weight management, sexual health, hair health, sleep support, NAD+ therapy, peptide therapy, and standalone laboratory testing (lab panels);

(d) prescription, refill, fulfillment, and shipping information for medications dispensed to you;

(e) photographs, videos, and files you submit for identity verification or treatment support, including biometric identifiers processed for identity verification;

(f) communications with Providers, pharmacies, laboratories, care teams, and customer support that relate to your health;

(g) website and app usage information that identifies your interest in or attempt to obtain health services — for example, health-related page views, searches, and program sign-ups — where that information is linked or reasonably linkable to you; and

(h) inferences drawn from the information above, such as program eligibility or likely health interests.

7. We collect and use consumer health data for the following purposes: to provide and coordinate the Services you request; to route your information to independent Providers for clinical evaluation and to the dispensing pharmacy and laboratories for fulfillment and testing; to verify your identity, age, location, and eligibility; to provide customer support, care coordination, reminders, and account administration; to process payments, subscriptions, cancellations, and refunds; to maintain safety, security, fraud prevention, and legal compliance; and to operate, audit, troubleshoot, and improve the Services. We collect only the consumer health data reasonably necessary for these purposes, and we do not use consumer health data for advertising except as permitted by applicable law and supported by any required consent.

4. Sources of Consumer Health Data

8. We collect consumer health data from: you, when you complete an intake, create an account, communicate with us, or otherwise provide information; your devices, through the technologies described in our Privacy Policy, subject to the consent requirements described below; independent Medical Groups, Providers, pharmacies, and laboratories involved in your care; and service providers acting on our behalf, such as identity-verification, payment, communications, and hosting vendors.

5. How We Share Consumer Health Data; Categories of Third Parties; Affiliates

9. We share consumer health data only as necessary to provide the Services you request, with your consent, or as otherwise permitted by applicable law. The categories of third parties with which we share consumer health data are:

(a) independent Medical Groups and Providers — including the independent licensed clinicians in the Arora Health network — for clinical evaluation, diagnosis, treatment, prescribing decisions, and follow-up care;

(b) licensed pharmacies — including The Pharmacy Hub, the default dispensing pharmacy for the Services, or a pharmacy you choose — for prescription review, dispensing, counseling, and fulfillment;

(d) service providers and processors acting under contract on our behalf and prohibited from using the data for their own purposes — including cloud hosting and security vendors, identity-verification vendors, customer-support and communications platforms, and our designated payment processor, Stripe, Inc. ("Stripe") (which receives transaction information only; we do not transmit your intake or clinical information to the payment processor);

(e) shipping and logistics vendors, for delivery of medications and supplies; and

(f) legal, safety, and compliance recipients — such as regulators, courts, law enforcement, auditors, and professional advisors — where disclosure is required or permitted by law.

(10) Affiliates. We do not share consumer health data with corporate affiliates. Eir Services Group, LLC operates the Services directly. If that changes, we will update this CHD Policy and, where required, obtain your consent before sharing.

(11) Upon request, we will provide you with a list of the third parties and affiliates, if any, with whom we have shared or sold your consumer health data, together with contact information for those parties, as required by applicable law.

6. Your Consent: Separate Consents to Collect and to Share

12. Where applicable law requires consent, we collect consumer health data only after obtaining your affirmative, voluntary consent, and we share consumer health data beyond what is necessary to provide the services you request only after obtaining a separate affirmative consent. Each consent is presented separately, is unchecked by default, is not bundled with any other consent or with the acceptance of other terms, and is not a condition of receiving unrelated services. Declining to consent to collection means we cannot provide services that depend on that data; declining a sharing consent never blocks your care.

13. You may withdraw any consent at any time as described in the "How to Exercise Your Rights" section below. Withdrawal takes effect prospectively after it is received and processed and does not affect processing that occurred before withdrawal or processing that remains permitted or required by law.

14. We do not use non-essential tracking technologies on health-related pages before you have made a consent choice, and we honor recognized universal opt-out preference signals, such as Global Privacy Control, where required by applicable law.

7. No Sale of Consumer Health Data

15. We do not sell consumer health data. We will not sell consumer health data without first obtaining the valid, signed authorization required by applicable law — an authorization that is separate from and in addition to any consent to collect or share — and any such authorization would be valid only for the period permitted by law and revocable at any time.

8. No Geofencing of Health Care Facilities

16. We do not use geofencing around any facility that provides in-person health care services to identify or track consumers, to collect consumer health data, or to send notifications, messages, or advertisements to consumers related to their consumer health data or health services.

9. Your Consumer Health Data Rights

17. Subject to the law that applies to your request, you have the right to:

(a) confirm and access — confirm whether we are collecting, sharing, or selling consumer health data about you and access that data, including a list of all third parties and affiliates with whom we have shared or sold it and an active email address or other online mechanism to contact those third parties;

(b) withdraw consent — withdraw a previously given consent to the collection or sharing of your consumer health data;

(c) delete — request deletion of your consumer health data, including data we have shared with affiliates, processors, contractors, or other third parties, to whom we will forward your deletion request as required by law; and

(d) appeal — appeal our refusal to take action on a request, through the appeal process described below.

18. Deletion and other rights are subject to the exceptions in applicable law. For example, we may retain information where deletion would conflict with legal or regulatory retention obligations (including medical-record and pharmacy-record retention held by Providers or pharmacies), the completion of services you requested, safety, security, fraud prevention, or the establishment or defense of legal claims, and archived or backup systems are purged on the schedule permitted by law.

19. How to Exercise Your Rights; Verification; Timing; Appeals

You may exercise your rights by emailing compliance@timberhealth.co with the subject line "Consumer Health Data Request," through any privacy-request mechanism available in your account, or by writing to us at the address in the "Contact Us" section. We will verify your identity using information associated with your account before acting on a request, and we may ask for additional information reasonably necessary for verification. Where permitted by law, you may use an authorized agent; we may require proof of the agent's authority and verification of your identity.

20. We will respond to authenticated requests within the time required by applicable law — generally within forty-five (45) days of receipt, extendable once by an additional forty-five (45) days where reasonably necessary, in which case we will notify you of the extension and the reason for it. We do not charge a fee for a first request in any twelve-month period; a reasonable fee may apply to repetitive requests where the law allows.

21. If we decline to act on your request, we will explain our reasons and how to appeal. To appeal, reply to our decision or email compliance@timberhealth.co with the subject line "Privacy Appeal" within the period stated in our response. We will decide your appeal within the time required by applicable law (generally forty-five (45) days) and provide a written explanation. If your appeal is denied, you may contact the attorney general of your state — for Washington residents, the Washington State Office of the Attorney General at www.atg.wa.gov — to submit a complaint.

11. Non-Discrimination

We will not discriminate against you for exercising any right described in this CHD Policy, including by denying services, charging different prices, or providing a different level or quality of services, except as permitted by applicable law where a difference is reasonably related to the value of the data or the data is necessary to provide the requested service.

12. Changes to This CHD Policy

We may update this CHD Policy to reflect changes in our practices, the Services, or applicable law. The updated CHD Policy will be posted at https://timberhealth.co with a revised effective date, and, where a change materially affects the processing of consumer health data for which you provided consent, we will obtain any new consent required by law before the change applies to your data.

13. Contact Us

If you have questions about this CHD Policy or wish to exercise a right, contact:

Eir Services Group, LLC d/b/a Timber Health
Attn: Privacy Officer
5900 Balcones Drive, Suite 100, Austin, TX 78731
Email: compliance@timberhealth.co
Phone: +1 (201) 283-8474
Website: https://timberhealth.co