California Privacy Notice

Effective Date: 2025-07-03

Version: v1.0.0

Business: Beijing Lieyi Health Management Co., Ltd. (北京猎一健康管理有限公司) — 北京猎一健康管理有限公司

Privacy Contact: privacy@rebirthealth.com

1. About This Notice

This California Privacy Notice supplements the Privacy Policy and applies to California residents. It is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA").

If you are a California resident, this Notice describes the personal information we collect about you, how we use and disclose it, and the rights you have. Where this Notice and the general Privacy Policy differ for California residents, this Notice controls for you.

2. Health Information

Rebirthealth necessarily processes health-related information that you choose to provide. Under California law, health information is sensitive personal information. We use it only to provide the platform's core service and for the related purposes described below — not for advertising or profiling.

3. Categories of Personal Information We Collect

In the past 12 months, we may have collected the following categories of personal information about California residents:

| Category | Examples | Collected? |

|---|---|---|

| Identifiers | Name, email, account ID, IP address | Yes |

| Account credentials | Password and login data | Yes |

| Commercial information | Transactions, fees paid | Yes |

| Internet / network activity | Usage data, pages viewed | Yes |

| Geolocation data | Approximate location from IP | Yes (approximate) |

| Sensitive personal information | Health information you submit; account login credentials | Yes |

| Professional information | Self-reported background (Advisors) | Yes, for Advisors |

| Inferences | Limited, for matching cases to advisors | |

We do not intentionally collect biometric information, and we do not collect government identifiers unless you choose to provide them for a specific purpose.

4. Sources of Personal Information

Directly from you (registration, case submissions, communications);
Automatically through your use of the platform (usage and device data);
From service providers (for example, payment-status information from a payment processor).

5. Purposes of Use

We use personal information to: operate the platform's core function; process payments; provide support; secure the platform and prevent fraud; comply with law; keep records; and communicate with you. Full detail is in the Privacy Policy.

6. Disclosure of Personal Information

In the past 12 months, we may have disclosed personal information for business purposes to:

Advisors — case information (de-identified where the service is designed to de-identify it), so they can decide whether to respond;
Service providers — hosting, payment processing, communications, analytics, acting under contract on our instructions;
Legal recipients — where required by law or to protect rights and safety.

7. No Sale; No Sharing for Cross-Context Behavioral Advertising

We do not sell personal information for money or other valuable consideration, and we do not "share" personal information for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. Because we do not sell or share, there is no need to opt out of sale or sharing; if this ever changes, we will update this Notice and provide an opt-out mechanism.

8. Use of Sensitive Personal Information

We use sensitive personal information (including health information you submit, and your login credentials) only for purposes permitted under the CCPA/CPRA — namely, to provide the service you have requested and for related operational, security, and legal purposes. We do not use it to infer characteristics about you for advertising.

9. Your California Rights

As a California resident, you have the right to:

Know / Access — request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients;
Delete — request deletion of personal information we have collected, subject to legal exceptions;
Correct — request correction of inaccurate personal information;
Opt out of sale/sharing — we do not sell or share, so no action is needed;
Limit use of sensitive personal information — we already limit our use of sensitive personal information to permitted purposes;
Non-discrimination — we will not discriminate against you for exercising your rights.

10. How to Exercise Your Rights

Submit a request by emailing privacy@rebirthealth.com with the subject "California Privacy Request," stating which right you wish to exercise.

Verification. To protect your information, we will take reasonable steps to verify your identity before responding. We may ask you to confirm information associated with your account.
Authorized agents. You may use an authorized agent to make a request. We may require proof of the agent's authorization and verification of your identity.
Timing. We will confirm receipt within 10 business days and respond within 45 calendar days, extendable by a further 45 days where permitted, with notice.
Cost. Requests are free unless excessive or unfounded, as permitted by law.

11. Retention

We retain each category of personal information for as long as needed for the purposes described in the Privacy Policy, and afterward as required by law. Some information is subject to mandatory retention periods and cannot be deleted earlier even on request.

12. Minors

The platform is for adults. We do not knowingly collect personal information from anyone under 18, and we do not sell or share the personal information of minors.

13. Changes

We may update this Notice. We will revise the Effective Date.

14. Contact

Beijing Lieyi Health Management Co., Ltd. (北京猎一健康管理有限公司)

北京市昌平区北七家枫树家园5区4号楼03

Email: privacy@rebirthealth.com

⚙️ NOTES — NOT PART OF THE PUBLISHED DOCUMENT

To be removed before publication.

Placeholders used: `2025-07-03`, `v1.0.0`, `Beijing Lieyi Health Management Co., Ltd. (北京猎一健康管理有限公司)`, `枫树家园5区4号楼03`, `privacy@rebirthealth.com`, `Privacy Policy`.

Items to review:

1. Consistency. This Notice and Section B of the Privacy Policy must say the same things. If one changes, change both.

2. "Sale"/"Share" determination. The claim that the platform does not "sell" or "share" must be verified against actual data flows — in particular, whether any analytics or advertising tools constitute "sharing" under the CPRA. If any do, this Notice must change and an opt-out must be provided.

3. Verification & agent procedures must be operationally implemented, not just stated.

4. Confirm whether the business meets CCPA/CPRA applicability thresholds; if it does, also confirm obligations such as the annual privacy-rights metrics disclosure where applicable.

This document is a DRAFT and is not a substitute for review by qualified legal counsel.