U.S. Consumer Health Data Privacy Notice

1. Consumer health data covered by this Notice

Consumer health data generally means personal information that is linked or reasonably linkable to a person and identifies, relates to, or is used to identify that person's past, present or future physical or mental health status, as defined by applicable law. Depending on how it is used and linked, Still Sky consumer health data may include:

• Wellness goals or content preferences you select, such as relaxation, sleep, focus, mindfulness or stress-related preferences.
• Searches, selections, favourites, listening or playback history, progress, streaks, minutes and other interactions with meditation, mindfulness or nature-sound content, where linked or reasonably linkable to you and treated by law as identifying or relating to health status.
• Account, device, network or diagnostic identifiers, such as an account or user ID, IP address, device or app information, or crash and performance data, only when linked or reasonably linkable to the wellness preferences, content activity or inferences described above and therefore treated as consumer health data under applicable law.
• Information you voluntarily include in customer-support requests, feedback or other communications, if it reveals or relates to a covered physical or mental health status.
• Content recommendations, categories or other inferences generated from the information above, if they identify or relate to a covered physical or mental health status.

At launch, Still Sky does not ask for or intentionally collect medical diagnoses, treatment or medical records, Apple Health or HealthKit data, genetic or biometric data, precise geolocation, or reproductive or sexual-health information. We do not use Still Sky activity to create a clinical or medical profile. De-identified information is not treated as consumer health data where applicable law excludes it.

2. Sources of consumer health data

We collect consumer health data directly from you when you choose a wellness preference, interact with covered content, contact customer support or provide feedback containing covered information. We may also collect it automatically from your use of the Service when the App or our systems record the activity described above, including linked identifiers or diagnostic information. We do not buy consumer health data from data brokers and do not obtain it from social-media platforms at launch.

3. Why and how we collect and use consumer health data

We collect and use consumer health data only for the purposes disclosed below:

• Provide the meditation, mindfulness and nature-sound features you request.
• Save and sync preferences, favourites, history, progress, streaks or minutes when those features are available.
• Personalise the Service and recommend relevant content or categories.
• Operate, secure, troubleshoot and support the Service, including diagnosing errors or responding to your requests.
• Comply with law, prevent fraud or misuse, resolve disputes, and establish, exercise or defend legal claims.
• Create de-identified or aggregated insights to understand overall content popularity, improve the Service and inform general content or marketing decisions without targeting a person based on identifiable listening history.

Processing may be automated where the App saves activity, syncs an account, generates a content recommendation or creates an aggregate. Access by people or service providers is limited to what is reasonably necessary for authorised operational, support, security, legal or request-handling purposes.

4. Consent and limits on new processing

Where applicable law permits it, we collect or use consumer health data to the extent necessary to provide a product or service you requested. Where consent is required, we obtain affirmative consent before the covered collection or use. Where applicable law requires separate consent to share consumer health data, that sharing consent will be separate and distinct from collection consent. This Notice is a disclosure and is not, by itself, a consent request.

We will not collect, use or share an additional category of consumer health data, add a materially new purpose, or add a recipient that requires consent without first updating the relevant disclosure and obtaining affirmative consent where applicable law requires it.

5. Sharing of consumer health data

To the extent reasonably necessary for the purposes above, the consumer health data categories described in Section 1 may be processed or disclosed to:

• Processors that provide database or cloud infrastructure, media delivery, analytics limited to our instructions, diagnostics, performance, customer support, fraud prevention or security. These providers may process the data only to perform authorised services or meet legal and security duties.
• Professional advisers, courts, regulators or public authorities when required or authorised by law, or reasonably necessary to protect rights, safety and security or handle legal claims.
• A buyer, successor or new operator in a merger, financing, reorganisation, sale or transfer, subject to the obligations that apply to the data.
• Another person when you direct the disclosure or give a valid consent that applicable law requires.

Specific affiliates with whom we share consumer health data: none at launch.

Still Sky does not sell consumer health data. We do not share it with data brokers or advertising networks, use it for cross-app or cross-site behavioural advertising, or upload identifiable listening history to create custom or lookalike audiences. We do not permit a third party to collect consumer health data over time and across unaffiliated websites or online services when you use Still Sky for targeted advertising or advertising measurement.

6. De-identification, retention and security

When we rely on an applicable law's exclusion for de-identified data, we take reasonable measures designed to prevent the data from being linked to a person, maintain and process it only in de-identified form, do not attempt to re-identify it, and contractually require any recipient to satisfy the applicable de-identification requirements. We use aggregated insights only in a form that does not reasonably identify or link back to a person.

We retain consumer health data only as long as reasonably needed for the purposes in this Notice, taking account of the sensitivity of the data, account duration, security needs and legal obligations. We use reasonable administrative, technical and organisational safeguards appropriate to the nature of the data. No system is completely secure.

When a valid deletion request applies, we delete covered data and notify relevant processors or other recipients as required by applicable law. Data in protected archives or backups may be deleted on the schedule permitted by the applicable law. If a legal exception or permitted delay applies, we will handle and explain the request as required.

7. Your U.S. consumer health data rights

Subject to the law that applies and its exceptions, you may have the right to:

• Confirm whether we collect, use, share or sell consumer health data about you, and access or receive a copy of covered data.
• Receive a list of third parties and affiliates with whom covered data has been shared or sold, together with available contact information where required.
• Withdraw consent or ask us to cease a covered collection or sharing where the applicable law provides that right.
• Delete covered data, including through processors or other recipients where required.
• Correct inaccurate data or obtain covered data in a portable, readily usable format where applicable law provides those rights.
• Opt out of a sale, targeted advertising or qualifying profiling where applicable. Still Sky does not currently engage in those activities with consumer health data.
• Exercise a right without unlawful discrimination.

How to submit a request

Email [email protected] with the subject line "U.S. Consumer Health Data Request" and describe the request. If you have an account, write from its associated email address when possible. You do not need to create a new account to submit a request. We may ask for information reasonably necessary to authenticate your identity and the request. We will respond within the period required by the law that applies, and may charge a permitted fee or decline a manifestly unfounded, excessive or repetitive request where the law allows.

Appeals

If we deny a request and applicable law gives you a right to appeal, email [email protected] with the subject line "U.S. Consumer Health Data Appeal" and explain why you believe the decision should be reconsidered. We will respond within the period required by law. If an appeal is denied, we will provide information for contacting the relevant state attorney general where required.

8. Changes to this Notice

We may update this Notice when our practices or the law changes, and we will revise the date above. We will notify consumers of a material change through a prominent notice on our website or in the App, by email to the address associated with an account, or by another method required by applicable law. Where applicable law requires affirmative consent for a new category, purpose or recipient, we will seek that consent before beginning the new processing.

9. Contact

Operator: Anurag Tripathi, sole proprietor trading as Still Sky

Email: [email protected]

Please do not send passwords, payment-card details, medical records or other information we do not need to identify and respond to your request.