Consumer Health Data Privacy Policy

Last Revised: October 13, 2026

This Consumer Health Data Privacy Policy supplements the ZOZOFIT and ZOZOFIT Pro Privacy Policies. We at ZOZO Apparel USA, Inc. (“ZOZO”, “we”, “us”, “our”, or “the Company”) value your privacy and are committed to maintaining the confidentiality and security of your information across all of our products and services.

This Consumer Health Data Privacy Policy governs consumer health data collected through both our direct-to-consumer features (including the ZOZOFIT mobile app and GLP-1 Journal) and our business-to-business platform (“ZOZOFIT Pro”). The ZOZOFIT mobile app, GLP-1 Journal, and ZOZOFIT Pro are collectively referred to as the “Services.”

This policy specifically applies to personal information defined as “Consumer Health Data” under applicable state health privacy statutes, including Washington’s My Health My Data Act (“MHMDA”), Nevada’s Consumer Health Data Privacy Law (SB 370), and health-data provisions under the Connecticut Data Privacy Act (“CTDPA”).

SCOPE AND HIPAA INTERACTION

Except as set forth below regarding HIPAA and CMIA (defined below), this policy governs all Consumer Health Data collected through the ZOZOFIT app, GLP-1 Journal features, and ZOZOFIT Pro account-linking with third-party business partners (“ZOZOFIT Pro Partners”).

HIPAA-Covered Healthcare Providers: When you link your account with a ZOZOFIT Pro Partner that is a healthcare provider or clinical facility acting as a “Covered Entity” under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), ZOZO acts as a “Business Associate.” In these specific clinical contexts, the processing of your Protected Health Information (“PHI”) is governed by HIPAA and the Business Associate Agreement (“BAA”) between ZOZO and your healthcare provider, rather than state consumer health privacy laws.

California Healthcare Providers: Where ZOZO provides ZOZOFIT Pro services to California healthcare providers, ZOZO operates as a “Contractor” under the California Confidentiality of Medical Information Act (“CMIA”) (Cal. Civ. Code § 56.06) and processes medical information strictly pursuant to CMIA authorization and statutory confidentiality requirements. 

CATEGORIES OF CONSUMER HEALTH DATA WE COLLECT

Depending on how you interact with our platform, whether through standard 3D body scanning, GLP-1 Journal tracking, or account-linking via ZOZOFIT Pro, ZOZO collects information that identifies or could reasonably be linked to your past, present, or future physical health status. We may collect the following categories of information that may be considered Consumer Health Data:

• Demographic Data: We collect demographic data, which may include, but not be limited to, your name, email address, address, and organizational role to establish your personal user profile. The collection of this demographic data is primarily used to create your user account, which you can use to securely receive the Services.
  
• Biometric and Body Composition Data: 3D body scan mesh data, body fat percentage, fat mass, lean mass, body weight, body measurement circumferences, and automated body composition trend calculations. We collect this information to provide you with the Services.
  
• Prescription and Medication Tracking Data: Self-reported prescription medication details, including specific drug names, dosages, administration frequency, and injection site locations. We collect this information to provide you with the GLP-1 Journal features.
  
• Physical Symptom and Wellness Logs: Self-reported physical symptoms and side effects, mood ratings, daily nutritional macros, water intake, alcohol consumption, and exercise logs. We collect this information to provide you with the GLP-1 Journal features.
  
• Facility Affiliations: Identifiers connecting your user account to ZOZOFIT Pro Partners, including invitation acceptance logs, account connection timestamps, and authorization status. We collect this information to provide you with the ZOZOFIT Pro features.
  
• Support Data: If you contact us for support or to lodge a complaint, we may collect technical or other information from you through log files and other technologies. Such information will be used for the purposes of troubleshooting, customer support, software updates, and improvement of the Platform and related Services.
  
• Technology Data: Information may be automatically collected via cookies, web beacons, and log files as you navigate the Services. This may include your IP address (or proxy server), device and application identification numbers, location, browser type, Internet service provider and/or mobile carrier, the pages and files you viewed, your searches, your operating system, system configuration information, and date/time stamps associated with your usage. This information is used to analyze overall trends, help us provide and improve our Services, and ensure the proper functioning and security of the Services.
  

SOURCES OF CONSUMER HEALTH DATA

We collect Consumer Health Data from the following categories of sources:

• Directly from you: When you register your user account and input information to receive our Services.
  
• Automatically from your Device: Via automated tracking technologies as you interact with our Services, webpages, or emails. Additionally, via visual and depth sensor data generated by your mobile device’s camera.
  
• ZOZOFIT Pro Partners: Account invitation requests and organizational linkage confirmations transmitted when a ZOZOFIT Pro Partner connects to your user account.
  
• Third-Party Authentication Partners: Single sign-on authentication details provided if you choose to register or log into the Services using third-party credential providers (such as Apple or Google). 
  

WHY WE COLLECT AND USE CONSUMER HEALTH DATA

We process your Consumer Health Data as necessary to provide the Services requested by you or pursuant to your explicit affirmative consent, specifically for the following purposes:

• To provide our Services;
  
• To fulfill our contractual obligations to you;
  
• To communicate with you about and manage your user account;
  
• To properly store and track your data within our system;
  
• To respond to lawful requests from public and government authorities, and to comply with applicable state/federal law, including cooperation with judicial proceedings and court orders;
  
• To protect our rights, privacy, safety, or property, and/or that of you or others by providing proper notices, pursuing available legal remedies, and acting to limit our damages;
  
• To handle technical support and other requests from you;
  
• To enforce and ensure your compliance with the terms of any other applicable services agreement we have with you;
  
• To manage and improve our operations and the Services, including the development of additional functionality;
  
• To manage payment processing;
  
• To evaluate the quality of service you receive, identify usage trends, and improve your user experience;
  
• To keep our Services safe and secure;
  
• To send you information about changes to our terms, conditions, and policies; and
  
• To allow us to pursue available remedies or limit the damages that we may sustain.
  

SHARING OF CONSUMER HEALTH DATA

ZOZO does not sell your Consumer Health Data. We do not share or disclose your Consumer Health Data to third-party advertising networks, data brokers, or retargeting marketing services. We may share any of the categories of Consumer Health Data collected when necessary to deliver our Services or to satisfy legal mandates. 

THIRD PARTIES AND AFFILIATES WITH WHOM WE SHARE CONSUMER HEALTH DATA

We share Consumer Health Data with the following categories of third parties: 

• Business Partners and Vendors: We share Consumer Health Data with a limited number of partners, service providers, and other persons/entities who help run our business (“Business Partners”). Specifically, we may employ third-party companies and individuals to facilitate our Services, provide Services on our behalf, perform Service-related functions, or assist us in analyzing how our Services are used. Our Business Partners are contractually bound to protect your Consumer Health Data and to use it only for the limited purpose(s) for which it is shared. Business Partners’ use of Consumer Health Data may include, but is not limited to, the provision of services such as data hosting, IT services, customer services, and payment processing. 
  
• Our Advisors: We may share your Consumer Health Data with third parties that provide advisory services to ZOZO, including, but not limited to, our lawyers, auditors, accountants, and banks (collectively, “Advisors”). Consumer Health Data will only be shared with Advisors if ZOZO has a legitimate business interest in the sharing of such data. 
  
• Authorized ZOZOFIT Pro Partners: If you choose to accept an invitation from a ZOZOFIT Pro Partner using ZOZOFIT Pro, we will share your Consumer Health Data with that organization based on your explicit, unbundled opt-in consent.
  
• Third Parties Upon Your Direction or Consent: You may direct ZOZO to share your Consumer Health Data with third parties. Upon your request and consent, we may share such Consumer Health Data with those third parties that you identify. 
  
• Third Parties Pursuant to Business Transfers: In the event of a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of ZOZO’s corporate entity, assets, or stock (including in connection with any bankruptcy or similar proceedings), we may share your Consumer Health Data with a third party. 
  
• Government and Law Enforcement Authorities: If reasonable and necessary, to comply with legal processes, judicial orders, or enforceable government requests, or to investigate violations of applicable terms of use, we may share your Consumer Health Data with Government and Law Enforcement Authorities.  
  

YOUR STATE PRIVACY RIGHTS

Under Washington, Nevada, and Connecticut laws, residents have specific statutory rights regarding their Consumer Health Data:

• Right to Confirm and Access: You have the right to confirm whether we are collecting, processing, or sharing your Consumer Health Data and to obtain a copy of your data in a readily usable format.
  
• Right to a List of Recipients: You have the right to request a list of all third parties and specific affiliates with whom your Consumer Health Data has been shared, disclosed, or sold.
  
• Right to Delete: You have the right to request the complete deletion of your Consumer Health Data from our databases and to have our business partners do the same.
  
• Right to Withdraw Consent: You have the right to withdraw your consent for the ongoing collection or sharing of your Consumer Health Data at any time (including unlinking your account from a ZOZOFIT Pro Partner). Revoking consent will not affect the lawfulness of processing conducted prior to your withdrawal.
  
• Right to Appeal: If we decline to act on any of your data rights requests, you have the right to formally appeal our decision.
  

In compliance with Washington, Nevada, and Connecticut health privacy laws, ZOZO does not implement geofences around healthcare facilities, hospitals, mental health centers, clinics, or medical offices to identify consumers, track movements, collect health data, or deliver targeted health notifications. 

HOW TO EXERCISE YOUR RIGHTS

To exercise your right to access, delete, request recipient lists, withdraw consent, or appeal a decision, please contact our Privacy Officer at support@zozofit.com. 

Appeals: If your request is denied, you may submit a formal appeal within forty-five (45) days by replying directly to the denial notification. If your appeal is denied, we will provide you with a direct link to submit a complaint to your state Attorney General.

Written correspondence may be mailed to:

ZOZO Apparel USA, Inc.
Attn: Legal and Privacy Department
2450 Colorado Ave
Suite 100E
Santa Monica, CA 90404