Consumer Health Data Privacy Notice

This Consumer Health Data Privacy Notice supplements the Tongo Privacy Policy and describes how Tongo Inc. ("Tongo," "we," "us") handles Consumer Health Data of residents of Washington and Nevada, and of individuals whose Consumer Health Data is collected in those states through the Stella AI concierge and related services (the "Service").

This Notice is not a contract and creates no legal rights or obligations not otherwise provided by law.

1. What is Consumer Health Data

"Consumer Health Data" means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status, as defined under the Washington My Health My Data Act and the Nevada Consumer Health Data Privacy Law.

Consumer Health Data does not include information that is deidentified under those laws.

2. What we collect

We do not request Consumer Health Data. The concierge context means you may choose to share it in order to receive an appropriate recommendation. Examples include:

• Allergies and dietary restrictions — food allergies, intolerances, medically restricted diets
• Mobility and accessibility needs — wheelchair access, step-free routes, hearing or vision accommodations, service animal needs
• Health conditions or symptoms mentioned in the course of a request, for example when asking about a pharmacy or urgent care
• Health-related requests for others in your party, including children
• Inferences that could be derived from the above

Sources. Directly from your conversations with Stella, and in some cases from the hotel's reservation or property management systems where you provided the information to the hotel.

You are not required to share any of this. Stella can make recommendations without it, though they may be less specific to your needs.

3. How we use it

We process Consumer Health Data solely to fulfill the request for which you provided it — for example, to identify restaurants that can accommodate an allergy, or to find an activity that meets an accessibility requirement.

4. What we do not do

We do not:

• Sell your Consumer Health Data;
• Use it, or data derived from it, for advertising, marketing, or cross-context behavioral advertising;
• Share it with third parties for their own advertising or data-mining purposes;
• Use it to train, fine-tune, or improve any artificial intelligence or machine learning model, whether ours or a third party's;
• Use it to build profiles or preference segments beyond fulfilling your immediate request;
• Add it to your guest profile in the hotel's systems;
• Retain it beyond the period stated in Section 6.

5. Who we share it with

• The hotel you are staying at, only as needed to fulfill your specific request — for example, telling the restaurant about an allergy. The hotel's own privacy notice governs its use.
• Service providers who host our infrastructure or operate the Service on our behalf, under confidentiality and security obligations, and only as needed to deliver the Service to you.
• Booking providers, only where necessary to complete a specific request you made.
• As required by law, or to establish, exercise, or defend legal claims.

6. How long we keep it

Consumer Health Data is used during your stay and deleted at the end of your stay. We do not retain it for future visits or add it to a persistent guest profile.

7. Your rights

Under the Washington My Health My Data Act and the Nevada Consumer Health Data Privacy Law you have the right to:

• Confirm and access — learn whether we collect, share, or sell your Consumer Health Data, who we have shared it with, and obtain a copy;
• Withdraw consent — withdraw any consent you previously provided for our collection or sharing;
• Delete — request deletion of your Consumer Health Data, including a request that third parties to whom we disclosed it also delete it.

To exercise these rights, email hello@letstongo.com or write to us at the address below.

We will verify your identity before processing a request, generally by matching information you provide against our records. If we decline a request in whole or in part, we will explain why and inform you of any right to appeal.

8. Changes to this Notice

We may update this Notice from time to time. Material changes will be communicated through appropriate channels and the effective date above will be revised.

9. Contact us

Tongo Inc., Attn: Privacy, 1401 South Lamar Boulevard, Austin, Texas 78704
hello@letstongo.com

Washington residents may also contact the Washington State Attorney General. Nevada residents may contact the Nevada Attorney General.