Section 1 — Who This Policy Covers

This Consumer Health Data Privacy Policy applies to: (a) Washington State residents; and (b) any natural person whose Consumer Health Data is collected in Washington (“you,” “consumer”), where such Consumer Health Data is collected, processed, or shared by MEMOIZE AI LLC in connection with the MEMOIZE AI Memory-as-a-Service platform (“Services”).

MEMOIZE AI LLC is a limited liability company organized under the laws of the State of Indiana, with its registered agent at c/o Northwest Registered Agent LLC, 5534 Saint Joe Road, Fort Wayne, IN 46835, USA.

Section 2 — What Is Consumer Health Data

Under the Washington My Health My Data Act (RCW 19.373.010), “Consumer Health Data” means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. The following categories of Consumer Health Data are collected or processed by MEMOIZE AI LLC through our Services:

2(a) Individual Health Conditions, Treatments, Diseases, or Diagnoses

Information regarding allergies, dietary restrictions, and wellness preferences that you share or that are inferred from your interactions with MEMOIZE AI-powered shopping assistants. Examples include, but are not limited to: disclosed food allergies, sensitivity to specific ingredients, chronic condition-related product preferences (e.g., gluten-free, diabetic-friendly).

2(b) Use or Purchase of Prescribed Medication

Information regarding medication queries, supplement interests, or prescription-related product searches stored in your AI memory profile. Examples include, but are not limited to: queries about supplement interactions, vitamin or medication preferences disclosed during product recommendation sessions.

2(c) Reproductive or Sexual Health Information

Data related to pregnancy-related product searches, prenatal care product interests, or other reproductive health inferences derived from your shopping history or AI interactions. Examples include, but are not limited to: prenatal vitamin preferences, baby product browsing patterns that may indicate pregnancy status.

2(d) Bodily Functions, Vital Signs, Symptoms, or Measurements

Wellness preferences and symptom-related product searches, including, but not limited to: energy level concerns, sleep-related product queries, immune support interests, and pain-related supplement searches.

2(e) Inferred or Derived Health Data

The Washington My Health My Data Act specifically covers data “derived or extrapolated from non-health information.” MEMOIZE AI LLC’s AI memory engine may infer health-related attributes from non-health data, including, but not limited to: inferring dietary restrictions from purchase patterns; inferring pregnancy from browsing of prenatal products; inferring chronic conditions from supplement purchase history. We treat all such inferences as Consumer Health Data subject to this Policy.

Section 3 — How We Collect Consumer Health Data

Directly from You

When you interact with an AI-powered shopping assistant on a MEMOIZE AI-enabled Shopify store, you may directly share health-related information (e.g., “I’m allergic to peanuts” or “I’m looking for prenatal vitamins”).

From Our Merchant Clients

MEMOIZE AI LLC receives Consumer Health Data from the Shopify merchants whose stores you visit, including purchase history data, browsing data, and product interaction data that the Merchant transmits to MEMOIZE AI LLC via the Shopify API for the purpose of generating personalized recommendations.

Through AI Inference

Our AI memory engine may derive or infer Consumer Health Data from non-health information as described in Section 2(e) above. Such inferred data is treated as Consumer Health Data under this Policy.

Section 4 — Purposes for Which We Collect and Use Consumer Health Data

We collect and use Consumer Health Data solely for the following purposes:

• To provide personalized AI-powered product recommendations on Merchant stores
• To maintain contextual memory of your shopping preferences across sessions on the same Merchant’s store
• To generate relevant responses to your queries through the Merchant’s AI shopping assistant
• To improve the accuracy of product suggestions based on your disclosed health needs and preferences

We do NOT use Consumer Health Data for:

• Targeted advertising or cross-context behavioral advertising
• Sale to data brokers or third parties
• Training or fine-tuning AI models
• Automated eligibility determinations (credit, insurance, employment, housing)
• Any purpose beyond delivery of the Services to the applicable Merchant

Section 5 — Sharing of Consumer Health Data

We share Consumer Health Data only as follows. The categories of Consumer Health Data that may be shared include all categories described in Section 2 above: individual health conditions, treatments, diseases, or diagnoses (Section 2(a)); medication and supplement data (Section 2(b)); reproductive or sexual health information (Section 2(c)); bodily functions, vital signs, symptoms, or measurements (Section 2(d)); and inferred or derived health data (Section 2(e)).

5.1 With the Merchant (Your Store Operator)

The Merchant through whose Shopify store you are interacting receives AI-generated recommendations and insights derived from your memory data. The Merchant is the primary operator and Data Controller for your data.

5.2 With AI Infrastructure Sub-Processors (for Service Delivery Only)

Google Vertex AI Zero Data Retention: MEMOIZE AI LLC engages Google Vertex AI exclusively under enterprise “Zero Data Retention” settings. Prompts sent to Gemini and corresponding responses are not logged, stored, or used by Google for any purpose, including model training, beyond the immediate API request processing window.

All sub-processors are contractually prohibited from using Consumer Health Data for any purpose other than providing services to MEMOIZE AI LLC, and from selling, disclosing, or retaining Consumer Health Data beyond operational necessity.

For information about sub-processor changes, notification procedures, and your right to object, see MEMOIZE AI LLC’s Privacy Policy at memoizeai.com/privacy-policy, Section 5.1, or the sub-processor list at memoizeai.com/legal/sub-processors.

We do NOT: sell Consumer Health Data to any person or entity; share Consumer Health Data with data brokers; disclose Consumer Health Data for targeted advertising; or share Consumer Health Data with employers, insurers, or government agencies (except as required by law).

Section 6 — Geofencing Prohibition

MEMOIZE AI LLC does not use Consumer Health Data to implement, enforce, or facilitate geofencing around healthcare facilities or services. We do not track your physical location, and the Services do not use location data in connection with Consumer Health Data.

Section 7 — Your Rights Under the Washington My Health My Data Act

7.1 Right to Confirm Collection

You have the right to confirm whether MEMOIZE AI LLC is collecting, sharing, or selling your Consumer Health Data, and to access that data.

7.2 Right to Access

You have the right to receive a copy of the Consumer Health Data we hold about you, in a portable and readily usable format, free of charge, once per 12-month period. Upon request, we will also provide a list of all third parties and affiliates with whom we have shared your Consumer Health Data, including an active email address or other online mechanism that you may use to contact each such third party.

7.3 Right to Withdraw Consent

You have the right to withdraw consent to our collection and sharing of Consumer Health Data at any time. Withdrawal of consent will not affect the lawfulness of processing that occurred prior to your withdrawal.

7.4 Right to Deletion

You have the right to request deletion of your Consumer Health Data from our active systems and to require us to instruct our sub-processors to delete your data. Upon a valid deletion request:

• We will delete your Consumer Health Data from active databases within 30 days.
• We will instruct sub-processors (including Google LLC via Vertex AI and Google LLC via Cloud SQL with pgvector) to delete associated data within the same timeframe.
• Residual data in encrypted backup systems will be permanently overwritten within 90 days.
• We will provide written confirmation of deletion upon your request.

7.5 Right to Appeal

If we decline to take action on your rights request, you have the right to appeal our decision. See Section 9 (Appeal Process) below.

Section 8 — How to Exercise Your Rights

To exercise any of the rights described in Section 7, submit a request using one of the following methods:

Verification: To protect your privacy, we will verify your identity before processing your request. We may ask you to confirm your email address associated with the Merchant store, the name of the Merchant store, and the approximate date range of your interactions.

Response Time: We will respond to verified requests within 45 days of receipt. If we require additional time (up to an additional 45 days), we will notify you of the extension within the initial 45-day period. We will not charge a fee to process your rights requests.

Section 9 — Appeal Process

If we decline to take action on your Consumer Health Data rights request, you have the right to appeal that decision. To appeal:

1. Submit your appeal in writing to privacy@memoizeai.com with the subject line “Washington MHMD Appeal” within 30 days of receiving our decision.
2. Include: (a) a copy of our original decision; (b) your original request; and (c) the specific grounds on which you believe our decision was incorrect.
3. We will review your appeal and respond in writing within 45 days of receipt.
4. If your appeal is denied, we will provide the reason(s) for denial and information about how to contact the Washington State Attorney General’s Office:

Section 10 — Two-Tiered Consent

Tier 1 — Consent to Collect Consumer Health Data

Before MEMOIZE AI LLC collects your Consumer Health Data, the Merchant through whose store you are interacting must present you with the following consent notice in a clear, standalone disclosure — NOT bundled with Terms of Service or pre-checked:

Tier 2 — Consent to Share Consumer Health Data (Separate and Distinct)

A separate, independent consent must be obtained before Consumer Health Data is shared with any third party beyond the operational sub-processors necessary to deliver the Services:

Neither consent may be: pre-checked; bundled with acceptance of Terms of Service; required as a condition of using non-health-related features; or obtained through a “deemed consent” or countdown-timer mechanism. Merchants are contractually responsible for implementing both tiers of consent in their store interfaces before enabling Consumer Health Data processing.

Section 11 — Small Business Applicability

The Washington My Health My Data Act does not provide a small business revenue exemption. The Act applies to any entity that conducts business in Washington or targets Washington residents and processes Consumer Health Data, regardless of revenue size or employee count. Accordingly, MEMOIZE AI LLC is subject to the MHMD Act to the extent it processes Consumer Health Data of Washington residents through Merchant stores that serve Washington customers, irrespective of MEMOIZE AI LLC’s revenue or size as an Indiana-based company.

Section 12 — Data Security

Consumer Health Data is protected by the same technical and organizational safeguards described in our general Privacy Policy, including AES-256 encryption at rest, TLS 1.3 encryption in transit, and strict sub-processor contractual controls. Given the sensitivity of Consumer Health Data, access is further restricted on a need-to-know basis and logged for audit purposes.

Section 13 — Changes to This Policy

We will provide at least 30 days’ advance notice of any material changes to this Consumer Health Data Privacy Policy via email to affected Merchants and by posting a notice on this page. The “Last Updated” date at the top reflects the most recent revision.

Section 14 — Contact

🔗 Homepage Link Notice (Required by RCW 19.373.020): The following prominent link must appear on the MEMOIZE AI LLC homepage and on any Merchant-facing data collection interface, linking to memoizeai.com/consumer-health-data-privacy-policy: “Washington State Consumer Health Data Privacy Policy — Your rights under the Washington My Health My Data Act”