Myta Wellness — Privacy Policy

Four Pillar Wellness Labs LLC ("Four Pillar Wellness Labs," "we," "us," or "our") operates the Myta Wellness mobile application (the "App"). This Privacy Policy explains what information we collect, how we use and share it, how we protect it, and the choices and rights you have. It applies to the App and to the related website at https://www.fourpillarwellnesslabs.com (together, the "Services").

Because the App handles information about your body — including biometric data and menstrual-cycle information — we also publish a separate Consumer Health Data Privacy Notice that applies to that data and is incorporated into this Policy by reference.

Myta Wellness is a personal wellness product. It is not a medical service and does not provide medical advice, diagnosis, or treatment. Please read the in-App Medical & Wellness Disclaimer and our Terms of Service alongside this Policy.

By creating an account or using the Services, you acknowledge that you have read and understood this Privacy Policy. Where we rely on your consent — including for health and wellness data — we ask for it through an affirmative opt-in, as described below.

1. Who we are and how to contact us

Four Pillar Wellness Labs LLC is the controller responsible for your personal information.

• Company: Four Pillar Wellness Labs LLC, a Tennessee limited liability company
• Mailing address: 116 Agnes Rd, Suite 200, Knoxville, TN 37919, USA
• Privacy Officer / contact: privacy@fourpillarwellnesslabs.com

We have designated a Privacy Officer responsible for our data-protection compliance, reachable at the email above. If you have any question about this Policy or wish to exercise your privacy rights, contact us there.

2. A note about sensitive health information

Myta Wellness is designed for adults (18 and older) and works with information about your body, including biometric data from your Oura Ring and menstrual-cycle and related reproductive information that you choose to enter manually.

This information is treated as sensitive personal information and, under certain U.S. laws, as "consumer health data." We:

• collect it only after your affirmative, opt-in consent, and only to provide the features you ask for;
• do not sell it and do not use it for third-party advertising;
• do not share it except with the limited service providers in Section 7, and only after separate consent where the law requires it; and
• delete it when you disconnect a data source or close your account (Section 8).

Our handling of this data is described in detail in our Consumer Health Data Privacy Notice. You can withdraw your consent at any time by disconnecting a connected service or deleting your account.

3. Information we collect

We practice data minimization: we collect only the information reasonably necessary to provide the Services and retain it only as long as necessary.

a. Information you provide directly

• Account information: your name, email address, and authentication details. If you use Sign in with Apple, we receive the name and email (or Apple "private relay" email) you choose to share.
• Profile, goals, and survey responses: wellness priorities, goals, preferences, and answers to onboarding and recurring surveys.
• Menstrual-cycle and reproductive information: cycle dates, phase, and related details that you manually enter. (The Oura API does not provide cycle data; this comes only from you.)
• Journal entries and reflections: any notes or reflections you log in the App.
• Communications: information you provide when you contact us for support or feedback.

b. Health and wellness data from connected services

With your explicit authorization through a secure OAuth connection, we access data from the Oura Ring API (v2), which may include:

• Sleep: sleep score, sleep stages (deep, REM, light, awake), latency, total duration, efficiency, bedtime and wake patterns, disturbances, and restfulness;
• Readiness and recovery: readiness score, resting heart rate, heart-rate variability (HRV) and HRV balance, body-temperature deviation from baseline, and recovery index;
• Activity: activity score, active and total calories, steps, distance, active time, MET minutes, and auto-detected workout summaries (type, duration, intensity, heart rate); and
• Other metrics Oura makes available through the API that are relevant to the features above, such as stress and cardiovascular indicators.

If we add other integrations in the future (for example, Apple Health or other wearables), we will access that data only with your separate authorization.

c. Calendar data (planned feature — not currently available)

Calendar integration with Google Calendar and Microsoft Outlook is a planned future feature and is not active in the current version of the App. The App does not access your calendar today. If and when we launch this feature, it will be optional, we will request your authorization at that time, and we will update this Policy to describe it before it goes live.

d. Information collected automatically

• Device and technical data: device model, operating system, app version, language, time zone, and similar diagnostic data.
• Usage data: features used and in-app activity, used to operate and improve the App.
• Push notification token: if you enable notifications, a device token used to deliver reminders.

We do not use third-party advertising trackers, we do not track you across other companies' apps or websites, and we do not use precise geolocation or geofencing (including around any health, reproductive, or mental-health facility).

4. Consent and your choices

• Opt-in for health data. We collect Oura data and your manually entered cycle data only after you give affirmative, opt-in consent by connecting Oura or entering the data. We do not use pre-checked boxes or bundled consent.
• Separate consent for sharing. Where a law requires separate consent before we share consumer health data (for example, to process it through our AI provider), we ask for that consent separately.
• Connections: you choose whether to connect Oura, and you can disconnect at any time in the App's settings or in your Oura account.
• Notifications: you can turn push notifications on or off in the App or your device settings.
• Withdraw consent: you can withdraw consent at any time by disconnecting the relevant source or deleting your account. Withdrawing consent does not affect processing already carried out.

5. How we use your information

We use your information to:

• create and manage your account and authenticate you;
• connect and sync data from Oura and any other services you authorize;
• generate your personalized daily and periodic wellness recommendations across movement, nutrition, sleep, and lifestyle;
• display trends, insights, and reflections over time;
• send reminders and service notifications you have enabled;
• provide customer support and respond to your requests;
• maintain, secure, debug, and improve the Services; and
• comply with law and enforce our Terms of Service.

We process sensitive and consumer health data only to provide the features you request and the related purposes above, based on your consent. We do not use it to infer characteristics about you for any other purpose.

6. Automated processing and artificial intelligence

To turn your data into recommendations, the App uses automated processing, including a third-party large-language-model service (OpenAI, via its API). When generating your plan, we send the health and wellness inputs needed for that purpose to the AI service, which returns recommendations to us.

• We seek to limit directly identifying information (such as your name or email) in these requests.
• According to OpenAI's API data-usage policies, data submitted through the API is not used to train its models.
• These recommendations are informational wellness suggestions, not decisions that produce legal or similarly significant effects about you (such as eligibility for healthcare, credit, housing, or employment).

Your rights regarding automated processing. You may ask us about the automated processing used to generate your recommendations and the main factors involved, request human review, and submit your observations. Contact privacy@fourpillarwellnesslabs.com.

7. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as follows:

• Service providers (sub-processors) who process data on our behalf under contract and confidentiality obligations:
  • Supabase — cloud database, authentication, and backend hosting;
  • OpenAI — AI processing to generate recommendations (Section 6);
  • Apple — Sign in with Apple, app distribution, and subscription billing;
  • Expo — app delivery, updates, and push-notification infrastructure.
• Data sources you connect — such as Oura, through the connection you authorize.
• Legal and safety — when required by law, to respond to lawful requests, or to protect the rights, safety, and security of our users, the public, or Four Pillar Wellness Labs.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We have no corporate affiliates with whom we share consumer health data. Oura data restrictions. Consistent with the Oura API Agreement, we will not sell, license, lease, or otherwise disclose your Oura data to advertisers, data brokers, or other third parties, even with your consent, and we use it only to provide the Services to you. Oura collects certain usage data about our use of the Oura API in connection with the App.

8. Data retention and deletion

We keep your personal information only as long as reasonably necessary for the purposes described in this Policy, then delete or de-identify it, except where we must retain limited records to comply with law, resolve disputes, or enforce our agreements.

Backups are purged on a routine deletion schedule after the periods above.

• Delete your account in the App. The App lets you initiate deletion of your account and associated personal data directly within the App. When you delete your account, we delete your personal and health-related data from our active systems and remove it from backups on our routine schedule.
• Disconnect Oura or a calendar. When you disconnect a data source, we stop accessing new data and delete the data we obtained from that source from our active systems, subject to the same backup schedule.

You may also email privacy@fourpillarwellnesslabs.com to request deletion or to confirm that deletion has occurred.

9. How we protect your information and notify you of breaches

• All transmission between the App and our servers is encrypted using TLS 1.2 or higher.
• OAuth tokens and personal data are encrypted at rest and stored on access-controlled servers.
• Access is limited to personnel who need it to operate and support the Services.
• We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the data.

No method of transmission or storage is completely secure. If a breach of unsecured health-related information occurs, we will notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery, and — where applicable — notify the U.S. Federal Trade Commission and the media (for breaches affecting 500 or more residents of a single state) consistent with the FTC Health Breach Notification Rule. Our breach notice will include the information the Rule requires — a description of what happened, the types of information involved, steps you can take, our response, and how to contact us. We will also notify Canadian users and the Quebec Commission d'accès à l'information where required by law.

10. Your privacy rights

Depending on where you live, you may have some or all of the following rights regarding your personal information: to access it, correct it, delete it, obtain a portable copy, withdraw consent, opt out of certain processing, and to not be discriminated against for exercising your rights.

How to exercise. Email privacy@fourpillarwellnesslabs.com or use the in-App controls. We will verify your request (typically by confirming control of your account email) and respond within the time required by applicable law. You may use an authorized agent where the law permits, and you may appeal a decision by replying to our response.

California (CCPA/CPRA)

You have the rights listed above, plus rights specific to sensitive personal information (SPI) — which includes your health and menstrual-cycle data. We use SPI only to provide the Services you request and do not use it to infer characteristics about you. Because our use falls within the purposes permitted by CPRA (see California Civil Code § 1798.121(a)), we are not required to offer a "Limit the Use of My Sensitive Personal Information" link; even so, you may contact us to ask questions or object. We do not sell or share (for cross-context behavioral advertising) personal information or SPI. Retention is described in Section 8. Our recommendation engine is not used to make decisions that produce legal or similarly significant effects, so California's automated-decision-making (ADMT) opt-out for "significant decisions" does not currently apply; we will update this Policy if that changes.

Other U.S. states

If you are a resident of another U.S. state with a comprehensive privacy law (e.g., Virginia, Colorado, Connecticut, Texas, Oregon), you have the rights above, and we obtain your opt-in consent before processing sensitive data, as those laws require.

Consumer health data (Washington, Nevada, Connecticut)

Information about your body, biometrics, and reproductive or menstrual health is "consumer health data" under the laws of Washington (My Health My Data Act), Nevada, and Connecticut, even though it is not covered by HIPAA. For this data you have the right to confirm collection, access it, withdraw consent, and request deletion. We collect and process it only with your opt-in consent, obtain separate consent before sharing where required, and never sell it. Washington residents may have a private right of action under the My Health My Data Act. Full details are in our Consumer Health Data Privacy Notice.

Canada (PIPEDA and Quebec Law 25)

We handle your personal information in accordance with PIPEDA and applicable provincial laws, including Quebec's Law 25. You may request access to and correction of your information and may withdraw consent (subject to legal or contractual limits). Our Privacy Officer (privacy@fourpillarwellnesslabs.com) is responsible for our compliance. We process and store information in the United States; before transferring personal information outside Quebec we assess the protections in place. Where we use automated processing to generate recommendations, you may be informed of the main factors and request that a person review the result. Quebec residents also have the right to data portability under Law 25 (in effect since September 22, 2024): you may receive the computerized personal information you provided to us in a structured, commonly used technological format and, where technically feasible, have it communicated to another organization you designate. To exercise this right, contact privacy@fourpillarwellnesslabs.com. You may also contact the Office of the Privacy Commissioner of Canada or the Quebec Commission d'accès à l'information.

11. Children's privacy

Myta Wellness is intended only for adults 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete it. If you believe a minor has provided us information, contact privacy@fourpillarwellnesslabs.com.

12. Third-party services

The Services let you connect third-party services (such as Oura and your calendar) and may link to third-party sites. Those third parties have their own privacy policies, and we are not responsible for their practices. We encourage you to review the privacy policy of any service you connect, including Oura's.

13. International users and cross-border transfers

We operate the Services from the United States. If you access the Services from Canada or elsewhere, your information will be processed in the United States, where data-protection laws may differ from those in your jurisdiction, and we apply safeguards as described in Section 10. At launch, the Services are offered in the United States and Canada.

14. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date above reflects the most recent changes. If we make material changes, we will notify you in the App or by email before they take effect. Your continued use of the Services after an update means you accept the revised Policy.

15. Contact us

Four Pillar Wellness Labs LLC — Attn: Privacy Officer 116 Agnes Rd, Suite 200, Knoxville, TN 37919, USA Email: privacy@fourpillarwellnesslabs.com Web: https://www.fourpillarwellnesslabs.com

Appendix — categories of personal information (summary)

This Privacy Policy is provided for general informational purposes and does not constitute legal advice. Four Pillar Wellness Labs LLC should have it reviewed by qualified counsel before publication.