Consumer Health Data Privacy Policy

(Washington and Nevada Residents Only)

Last Updated: March 31, 2026

Introduction

This Consumer Health Data (“CHD”) Privacy Policy (“CHD Privacy Policy”) supplements the information contained in WR Specialists, LLC’s (“WRS,” or “we,” “us,” or “our”) Privacy Notice and U.S. State Privacy Supplement and describes what consumer health data (as defined below) we collect, how we use it as well as who we disclose it to and why, and the choices you may have regarding your consumer health data.

This CHD Privacy Policy applies only to (i) individual consumers who are residents of the State of Washington or Nevada, and (ii) individuals whose consumer health data is collected in any of these states. Accordingly, this CHD Privacy Policy is provided in accordance with the Washington My Health My Data Act (“MHMDA”) and Nevada Senate Bill No. 370 (“Nevada Consumer Health Data Privacy Law”) (collectively, the “Applicable CHD Laws”). In the event of a conflict between any other policy, statement, or notice provided by WRS and this CHD Privacy Policy, this CHD Privacy Policy will control with respect to consumer health data collected under Applicable CHD Laws.

The term “consumer health data,” as used in this CHD Privacy Policy, has the following meaning with respect to residents of the State of Washington and Nevada:

• For Washington residents, “consumer health data” means personal information that (i) is linked or reasonably linkable to a consumer that identifies the consumer’s past, present, or future physical or mental health status (including information about medical conditions as well as non-medical information that identifies a consumer’s physical or mental health status), and (ii) WRS determines the purpose and means of collecting, processing, sharing, or selling (as applicable).
• For Nevada residents, “consumer health data” means personally identifiable information that (i) is linked or reasonably capable of being linked to a consumer, (ii) is used to identify the past, present or future health status of the consumer, and (iii) WRS determines the purpose and means of collecting, processing, sharing, or selling (as applicable).

However, the following categories of information are not consumer health data and are not covered by this Policy to the extent applicable under the Applicable CHD Laws:

• Protected Health Information, as defined by the HIPAA;
• Health care information collected, used, or disclosed in accordance with Washington Revised Code § 70.02 (“Medical Records – Health Care Information Access and Disclosure”);
• Publicly available information;
• Deidentified data; or
• Information otherwise excluded from the scope of Applicable CHD Laws.

Please note that data practices concerning Protected Health Information collected by independent medical practitioners (“Medical Group”), an independent medical group with a network of United States-based health care providers (each, a “Provider”) and its affiliates are described in the terms and privacy disclosures specific to those services, namely, the Provider’s Notice of Privacy Practices.

This CHD Privacy Policy applies to the consumer health data we collect when you: (i) access, use, or otherwise interact with our devices, equipment, technologies, solutions, and features in connection with Cold Compression Therapy (“CCT”) and, if applicable, Remote Therapy Monitoring (“RTM”) Services offered through WRS (collectively, the “Services”); and (ii) submit information to us, such as on the “Contact Us” page of our website (https://www.wrs.group/wrs/), through the Services, or in email or other electronic communications between you and us (whether by telephone or through other means).

Please read this CHD Privacy Policy carefully to understand our policies and practices regarding your consumer health data and how we will treat it. If you do not agree with our policies and practices, you should not use the sites, products, applications, platforms, or other services linking to this CHD Privacy Policy. Other privacy policies may apply to your personal data that is not consumer health data and if you are not a resident of Washington or Nevada. To view our Privacy Notice describing how we treat other personal data, please visit https://www.wrs.group/privacy-policy/. In addition, if you are a resident of Connecticut, Nebraska, or Texas, please review our U.S. State Privacy Supplement for additional disclosures and rights relating to your personal data that we maintain.

Consumer Health Data We May Collect About You

We may collect the following categories of consumer health data with your consent or to the extent necessary to provide a product or service that you requested. We only collect the categories of consumer health data described in this CHD Privacy Policy.

• Information about any of the following:
  • Individual health conditions, treatment, diseases, or diagnoses, such as details of a medical condition and/or disability, prescription information, and diagnostic codes received from your health care provider;
  • Diagnostic testing, treatment, or medication, such as your prescribed CCT program, cold and/or compression therapy usage, and participation in RTM (if applicable);
  • Bodily functions, vital signs, symptoms, or measurements of physical or mental health status, such as patient-reported responses to short survey questions, including pain levels reported before and after therapy sessions, optional comments you choose to provide regarding your therapy experience through a mobile application or device, as well as therapy session duration and usage data collected through Telematics-enabled devices (including when the therapy device is turned off, confirmation that cold and/or compression therapy was used, the date and time associated with the transmission of telemetry data, and the power consumption of the smart plug based on timed intervals) (if you participate in RTM). For more details, please refer to the Information We Collect Through Automatic Data Collection Technologies section in our Privacy Notice.
• Data identifying a consumer seeking health care services. Health care services means any service provided to a person to assess, measure, improve, or learn about a person’s mental or physical health, including: (i) individual health conditions, status, diseases, or diagnoses; and (ii) diagnostic testing, treatment, or medication. WRS may collect data that identifies you as a consumer seeking health care services through information provided by your treating physician or health care provider who prescribed CCT as part of your treatment, an ordering physician, or another workforce member at your prescriber’s office, including your name, diagnostic code, Social Security number (if combined with consumer health data), and workers’ compensation claim number (if applicable).
• Any information processed to associate or identify a consumer with consumer health data that is derived, extrapolated, or inferred from non-health information (e.g., the device ID of the smart plug used by consumers who participate in RTM enables WRS to understand the power consumption of that smart plug and associate that plug with the consumer’s treatment).

Sources from Which We Collect Consumer Health Data

As described further in our Privacy Notice, we collect personal data (which may include consumer health data) from the following sources:

• Directly from you when you provide it to us, including when you use or interact with our Services or communicate with us, such as when you provide medical information (which may include prescription information or details of a medical condition and/or disability), responses to short survey questions (including pain levels before and after therapy sessions if you are an RTM participant), and optional comments regarding your therapy experience through a mobile application or device (if you are an RTM participant).
• Automatically as you access, navigate through, or otherwise use our Services. If you participate in RTM, we use a connected device and a mobile application to collect certain therapy-related information during your use of the CCT device via Telematics, including the duration of therapy sessions, when the therapy device is turned off, confirmation that cold and/or compression therapy was used, the date and time associated with the transmission of telemetry data, and the power consumption of the smart plug based on timed intervals. We may also collect information about your mobile device and internet connection, such as your IP address, operating system (e.g., iOS or Android), and the make and model number of your mobile device, as well as the device ID of the smart plug connected to your CCT device.
• From third parties, such as your treating physician or health care provider who prescribed CCT as part of your treatment, an ordering physician, or another workforce member at your prescriber’s office, who may provide us with your name, Social Security number, diagnostic code, and other medical information. If you are a workers’ compensation patient, your carrier may require us to provide your Social Security number to identify you in their system.

Purposes for Collecting and Using Consumer Health Data

We only collect and use consumer health data for the purposes described in this CHD Privacy Policy and our Privacy Notice. Primarily, we collect and use consumer health data as reasonably necessary to provide you with the products or Services you have requested or authorized. We may also collect and use consumer health data for the following purposes (most – if not all of which – are reasonably necessary for us to communicate with you and/or provide you with the products and Services you have requested or authorized):

• Provide Services. To provide our CCT and, if applicable, RTM, Services to you, including supporting monitoring of your prescribed therapy, providing therapy usage reports to your treating health care provider, assisting with therapy adherence and patient support services, and personalizing the Services provided.
• Payment. To obtain payment for our CCT and RTM Services, including billing and payment activities related to your workers’ compensation claim (if applicable).
• Program Administration. To improve our therapy programs, system performance, patient support Services, and overall program administration.
• Research and Development. We may de-identify your information such that it does not identify you and potentially aggregate it with other de-identified information for analytics, research, quality improvement, program development and other similar business purposes.
• Customer Service. To provide you with support and responding to your inquiries (including investigating and addressing concerns and monitoring/improving responses).
• Legal and Business Operations. To exercise or defend legal claims; to respond to legally binding requests from law enforcement, regulatory authorities or other third parties; to comply with our legal, regulatory and contractual obligations; to carry out our obligations and enforce our rights arising from any contracts entered into between you and us.
• With your Consent. We may use your consumer health data for any other purpose with your consent.

We will not process consumer health data for purposes that are neither reasonably necessary nor compatible with the purposes for which the consumer health data is processed as described in our Privacy Notice without your consent.

Sharing of Consumer Health Data

We do not sell your consumer health data to others. We only disclose consumer health data as directed by you, for the purpose of providing the products and/or Services you request from WRS, or as explained in this section.

We may disclose any categories of the consumer health data described above for the purposes described in the How We May Disclose Your Information section of our Privacy Notice. In particular, we may disclose consumer health data with your consent or as reasonably necessary to provide a product or Service that you have requested or authorized.

As necessary for the purposes described above, we may disclose any of the categories of consumer health data that we collect to (i) your treating physician or health care provider to provide you our Services and for treatment purposes; and (ii) service providers and other third parties we use to support our business or assist us in providing our Services, including (a) workers’ compensation payers, claims administrators, and third-party administrators responsible for managing your claim or other billing and payment purposes, and (b) technology and data processing services, such as billing clearinghouses.

We may also disclose consumer health data as permitted by applicable law, including:

• with your consent;
• to a third party acquiring our assets if WRS sells its business or otherwise is part of a merger, acquisition, bankruptcy, or other transaction involving a third-party taking control of our assets or business;
• to law enforcement or other government agencies when we believe doing so is necessary to comply with applicable law, respond to valid legal process, report conduct or activities that we believe may violate applicable law, or as otherwise required or permitted by applicable law; and
• to investigate, report, or take legal action to protect our rights, property, and safety and the rights, property, and safety of others.

Your Privacy Rights

If you are covered by MHMDA or the Nevada Consumer Health Data Privacy Law, then you may have certain rights with respect to consumer health data under the law that applies to you (subject to certain limitations), including:

• The right to confirm whether we are collecting, sharing, or selling your consumer health data;
• The right to access your consumer health data that we have collected or control, including: (i) a list of all third parties and affiliates with whom we have shared or sold your consumer health data; and (ii) the email addresses or other online method to contact those third parties and affiliates;
• The right to delete your consumer health data;
• The right to withdraw consent for the collection or sharing of your consumer health data (if you provided such consent), subject to certain exceptions (e.g., if our collection and/or sharing of your consumer health data is necessary to provide a product or Service you have requested or authorized); and
• The right to appeal our decisions on requests to exercise any of these rights.

You can request to exercise such rights by contacting us at privacy@wrspecialists.com (with the subject line “Health Privacy Rights Request”). You may submit a rights request, free of charge, up to two times per year. We will respond to your rights request within 45 days, though in certain cases we may inform you that we will need up to another 45 days to act on your request.

If your request to exercise a right is denied, you may appeal that decision by contacting us at privacy@wrspecialists.com. If your appeal is unsuccessful, and you are covered by MHMDA, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

Contact Us

If you have any questions regarding this Consumer Health Data Privacy Policy, please contact us at: