Privacy Policy

ALLOY PRIVACY POLICY

Last Updated: September 18, 2026.

Alloy Health, Inc. (“Alloy,” “we,” “our,” and/or “us”) values the privacy of individuals who use our website and related services (collectively, our “Services”). This privacy policy (the “Privacy Policy”) explains how we collect, use, and disclose information from users of our Services (“Users”). By using our Services, you agree to the collection, use, disclosure, and procedures this Privacy Policy describes. Beyond the Privacy Policy, your use of our Services is also subject to our Terms of Use.

Alloy is not a medical group or a health care provider. Alloy operates as a technology platform that enables its users to obtain a telemedicine consultation provided by independent medical practitioners including, but not limited to, M&D Integrations Inc. and MDI Medical Group PC (collectively, “MDI Health”), an independent medical group with a network of United States based health care providers (each, a “Health Care Provider”). MDI Health is responsible for providing you with a privacy notice describing its collection and use of your health information.

Please also review our U.S. State Privacy Notice (for residents of California, Colorado, Connecticut, Maryland, New Jersey, or Virginia, which are the states with comprehensive state privacy laws that apply to us at this time) and our Consumer Health Privacy Notice (for residents of Washington and Nevada) for more information about the types of personal information we collect and disclose, as well as how to exercise your rights under these states’ laws.

Information We Collect

We may collect a variety of information from or about you or your devices from various sources, as described below.

A. Information You Provide to Us.

Registration and Account Information. When you sign up for an account, we ask you for your first name, email, state of residence, information about Services of interest, and a password. We will also ask you for certain medical intake information, described below.

Medical Intake Forms and Identity Verification. If you choose to complete a medical intake form in order to meet with a Health Care Provider to obtain a prescription, we will collect information about the prescription or service you are seeking as well as information that you provide through the form, such as your symptoms, your and your family’s health and medical history, and your birth date, height, and weight. We may also collect your government-issued ID (a driver’s license, passport, state ID, or permanent resident card) so that the Health Care Provider can verify your identity before prescribing any medication.

Communications. If you contact us directly, such as when you contact our Customer Support, we may receive additional information about you, such as your name, email address, phone number, the contents of a message or attachments that you may send to us, and other information you choose to provide. When you communicate with us, third party vendors receive and store these communications on our behalf. When we send you emails, we may use embedded pixels or other technologies to track information about your receipt and interaction with our emails, such as whether and when you open them and how you interact with them.

Payment Information. If you make a payment on our Services, your payment-related information, such as credit card or other financial information, is collected by our third-party payment processor on our behalf.

B. Information We Collect When You Use Our Services.

Location Information. When you use our Services, we receive your location information. For example we infer your location information by using your IP address.

Device Information. We receive information about the device and software you use to access our Services, including IP address, device type, device identifiers, web browser type and version, and operating system version.

User Portal. If you log in to our user portal and message your Health Care Provider for consultation, a third-party vendor, on the Health Care Provider’s behalf, collects information you provide through the messages, such as your symptoms and your health and medical history, and your doctor’s responses. When we provide customer support to Health Care Providers, they may provide us access to your messages.

Usage Information. We automatically receive information about your interactions with our Services, like the pages or other content you view, the searches you conduct, purchases you make, any content you post, and the dates and times of your visits.

Information from Cookies and Other Tracking Technologies. We and our third-party partners collect information about your activities on our Services using cookies, pixel tags, or other tracking technologies. Our third-party partners, such as analytics, advertising, and security partners, may also use these technologies to collect information about your online activities over time and across different services.

C. Information We Receive from Other Sources.

Information from Health Care Providers and Pharmacy Partners. We receive information about the prescriptions that your Health Care Provider has prescribed you and the shipping status of your prescriptions from pharmacy partners. As described above, when we provide customer support to Health Care Providers, they may provide us access to messages you exchanged with them through our user portal.

How We Use the Information We Collect

We use the information we collect:

• To provide, maintain, improve, and enhance our Services;
• To personalize your experience on our Services such as by providing tailored content and recommendations;
• To understand and analyze how you use our Services and develop new products, services, features, and functionality;
• To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, respond to comments and questions, and otherwise provide customer support;
• For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable or otherwise of interest to you;
• To generate anonymized or aggregate data containing only de-identified, non-personal information that we may use and disclose for any lawful purposes such as to conduct analytics and publish reports;
• To send you text messages (No SMS opt-in information will be shared with third parties for marketing purposes);
• To facilitate transactions and payments;
• To find and prevent fraud and abuse, and respond to trust and safety issues that may arise;
• For compliance purposes, including enforcing our Terms of Use or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and
• For other purposes for which we provide specific notice at the time the information is collected.

How We Disclose the Information We Collect

Affiliates. We may disclose any information we receive to our current or future affiliates for any of the purposes described in this Privacy Policy.

Vendors and Service Providers. We may disclose any information we receive to vendors and service providers retained in connection with the provision of our Services.

Your Healthcare Providers. If you schedule a consultation with a Health Care Provider, we share your information, including information you provide through our intake form and other information collected from your use of our Website, with that Health Care Provider.

Pharmacy Partners. If you obtain a prescription from a Health Care Provider, we communicate that prescription and order information, including shipping address, to a Pharmacy partner to fulfill the prescription.

Your Family. We share your information with family members (e.g., immediate family or friends) that you designate to receive your information.

Social Networks and Other Online Services. Our Services allow you to, upon your direction, post information to social networking services, such as X and Facebook. You understand and agree that the use of your information by any social networking websites will be governed by the privacy policies of these third-party platforms and your settings on that platform. We encourage you to review their privacy policies.

Analytics Partners. We use analytics services such as Google Analytics to collect and process certain analytics data. You can learn more about Google’s practices by visiting https://www.google.com/policies/privacy/partners/.

Advertising Partners. We work with third-party advertising partners to collect and process your information in order to show you ads that we think may interest you. Some of our advertising partners are members of the Digital Advertising Alliance (https://optout.aboutads.info) and serve ads through cookie-based technologies. Please visit their opt-out pages to learn about how you may opt out of receiving certain web-based personalized ads from member companies. These opt-outs will apply only to our third-party advertising partners that are members of these organizations. These opt-outs will not apply when our partners serve ads through non-cookie based technologies.

As Required By Law and Similar Disclosures. We may access, preserve, and disclose your information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your information may occur if you post any objectionable content on or through the Services.

Merger, Sale, or Other Asset Transfers. We may transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets. The use of your information following any of these events will be governed by the provisions of this Privacy Policy in effect at the time the applicable information was collected.

Consent. We may also disclose your information with your permission.

Your Choices

Marketing Communications. You can unsubscribe from our promotional emails via the link provided in the emails or by visiting the Account Preferences section of our Services. Even if you opt out of receiving promotional email messages from us, you will continue to receive administrative messages from us. You can opt out from our promotional SMS messages by replying “STOP” to our message. If you wish to opt out of all text messages from us, you can text the word “STOPALL” to the number from which you are receiving the messages.

Third Parties

Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.

Security

We make reasonable efforts to protect your information by using physical and electronic safeguards designed to improve the security of the information we maintain. However, because no electronic transmission or storage of information can be entirely secure, we can make no guarantees as to the security or privacy of your information.

Children’s Privacy

We do not knowingly collect, maintain, or use personal information from children under 18 years of age, and no part of our Service(s) is directed to children. If you learn that a child has provided us with personal information in violation of this Privacy Policy, then you may alert us at support@myalloy.com.

International Visitors

Our Services are hosted in the United States and intended for visitors located within the United States. If you choose to use the Services from the European Union or other regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your personal information outside of those regions to the U.S. for storage and processing. We may also transfer your data from the U.S. to other countries or regions in connection with storage and processing of data, fulfilling your requests, and operating the Services. By providing any information, including personal information, on or to the Services, you consent to such transfer, storage, and processing.

Update Your Information

You can update your account information or close your account through your subscription settings.

Changes to this Privacy Policy

We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or disclose personal information previously collected from you through the Services, we will notify you through the Services, by email, or other communication.

Contact Information

If you have any questions, comments, or concerns about our processing activities, please email us at support@myalloy.com. You may also contact us by writing to:

Alloy Health, Inc.

99 Wall Street #2031

New York, NY 10005

---

Alloy U.S. State Privacy Notice Addendum

This U.S. State Privacy Notice Addendum (this “Notice”) supplements the information and disclosures contained in our Privacy Policy. It applies to the residents of the following U.S. states: California, Colorado, Connecticut, Maryland, New Jersey, and Virginia (the “Covered States”). This Notice explains how we collect and process Personal Information as a “business” or “controller” and how you can exercise your rights under these states’ comprehensive privacy laws (the “U.S. State Privacy Laws”).

Personal Information means information that the U.S. State Privacy Laws define as “Personal Information” or “Personal Data.” Generally speaking, this means any information that is linked or reasonably linkable to an identified or identifiable natural person. Personal Information does not include information that is deidentified or aggregated, or otherwise excluded from the scope of the U.S. State Privacy Laws, such as publicly available information.

1. Sources of Personal Information We Collect

We collect Personal Information from you when you provide it to us or automatically through our services. We may also obtain information about you from other sources, such as health care providers and pharmacies.

2. Categories of Personal Information We Collect, Process, and Disclose

The information we collect, use, and disclose about you will vary depending on how you interact with Alloy’s Services. Over the past 12 months, we may have collected, used, and disclosed each of the categories of Personal Information about you, as described below.

• Identifiers, including name, address, online identifiers, internet protocol address, email address, phone number, passport number, driver’s license number or other government-issued ID number, or other similar identifiers
• Categories of information listed in the California Customer Records statute (Cal. Civ. Code Section 1798.80(e)), including name, physical characteristics or description, address, phone number, passport number, driver’s license or state identification card number, payment card number, or medical information
• Characteristics of Protected Classifications under California or Federal Law, including age (over 40), mental or physical disability, sex, sexual orientation, gender, gender identity or expression, medical condition
• Commercial Information, including records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies
• Internet or Other Electronic Network Activity Information, including browsing history, search history, and information regarding a consumer’s interaction with an internet website
• General (Non-Precise) Geolocation Data
• Sensitive Personal Information, including driver’s license number or other government-issued ID number, account log-in information, health information, and information concerning an individual’s sex life

3. Our Purposes for Processing Personal Information

We use the information we collect:

Purpose	Categories of Personal Information Used for This Purpose
To provide, maintain, improve, and enhance our Services;	Identifiers, Categories of information listed in the California Customer Records statute, Characteristics of Protected Classifications, Commercial Information, Internet or Other Electronic Network Activity Information, Geolocation Information, Sensitive Personal Information
To personalize your experience on our Services such as by providing tailored content and recommendations;	Identifiers, Categories of information listed in the California Customer Records statute, Characteristics of Protected Classifications under California or Federal Law, Sensitive Personal Information
To understand and analyze how you use our Services and develop new products, services, features, and functionality;	Identifiers, Categories of information listed in the California Customer Records statute, Commercial Information, Internet or Other Electronic Network Activity Information, Geolocation Information, Sensitive Personal Information
To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, and otherwise provide customer support;	Identifiers, Categories of information listed in the California Customer Records statute, Sensitive Personal Information
For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable or otherwise of interest to you;	Identifiers, Commercial Information, Internet or Other Electronic Network Activity Information, Geolocation Information, Sensitive Personal Information
To facilitate transactions and payments;	Identifiers, Categories of information listed in the California Customer Records statute, Sensitive Personal Information
To find and prevent fraud and abuse, and respond to trust and safety issues that may arise;	Identifiers, Categories of information listed in the California Customer Records statute, Internet or Other Electronic Network Activity Information, Geolocation Information
For compliance purposes, including enforcing our TOS or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency	Identifiers, Categories of information listed in the California Customer Records statute, Characteristics of Protected Classifications, Commercial Information, Internet or Other Electronic Network Activity Information, Geolocation Information, Sensitive Personal Information

4. Categories of Third Parties to Which We Disclose Your Information

We may disclose your information to third parties, including the following categories of third parties:

• Service providers and vendors
• Healthcare providers
• Pharmacy partners
• Your family (if you designate them to receive your information)
• Analytics partners
• Advertising partners
• Law enforcement or other third parties in connection with legal requests, to comply with applicable law or to prevent harm
• Third parties in mergers and other corporate transactions
• Corporate affiliates

In the past 12 months, we have disclosed all categories of personal information set forth in Section 2 to service providers or contractors.

We disclose Identifiers, Commercial Information, and Internet or Other Electronic Network Activity Information to Advertising Partners, and we have engaged in these disclosures over the past 12 months. Under the U.S. State Privacy Laws, some of these data disclosures may broadly be considered a “sale” of Personal Information, processing of Personal Information for targeted advertising, and “sharing” of Personal Information for cross-context behavioral advertising.

We do not use or disclose Sensitive Personal Information as defined in the CCPA for purposes other than those set forth in that law.

We do not knowingly “sell” or “share” Personal Information about consumers under the age of 16 for cross-context behavioral advertising. We do not knowingly collect, use, or sell Personal Information for the purpose of training large language models. We do not knowingly process Personal Information about consumers under the age of 13.

5. Retention

We will retain Personal Information for a time period required or allowed by applicable regulations or laws and as needed to fulfill business purposes outlined in Section 3, including providing you products and services, complying with our legal obligations, resolving disputes, and enforcing our agreements, or for other purposes described in this U.S. State Privacy Notice Addendum. Our retention of information is based on many factors such as your relationship with Alloy, the nature of the information, compliance with our legal obligations, and defending or resolving actual or anticipated legal claims.

6. Your U.S. State Privacy Rights

Some states provide consumers certain rights regarding their Personal Information. Depending on where you live and subject to certain exceptions, you may exercise the following rights:

• The right to confirm whether we process your personal information and to know the categories of personal information we have collected or disclosed about you, as well as the sources of such personal information, the purposes, and the categories of third parties to whom such personal information is disclosed.
• The right to access, correct, or delete the specific pieces of Personal Information we have collected about you.
• The right to opt out of the “sale” of your Personal Information, the “sharing” of your Personal information for cross-context behavioral advertising, and the processing of your Personal Information for targeted advertising.
• The right to limit our collection, use or disclosure of your sensitive Personal Information, where permitted by law.
• The right to be free from discriminatory treatment for the exercise of your privacy rights.
• The right to appeal any decision with regard to your privacy request.
• The right to opt-out of profiling in furtherance of producing legal or significant decisions concerning a consumer. We do not engage in such profiling.
• If your Personal Information is profiled in furtherance of decisions that produce legal or similarly significant effects concerning you, you have the right to question the result of the profiling, to be informed of the reason that the profiling resulted in the decision, and, if feasible, to be informed of the actions you might have taken to secure a different decision and the actions that you might take to secure a different decision in the future. You also have the right to review your Personal Information used in the profiling, and if applicable, have the data corrected and the profiling decision reevaluated based upon the corrected data. We do not engage in such profiling.

7. Exercising Your U.S. State Privacy Rights

Submitting Requests. You can submit access, correction, deletion, and appeal requests by accessing our online form. You can exercise your right to opt out of the processing of your Personal Information for targeted advertising, the “sharing” of your Personal Information for cross-context behavioral advertising, or the “sale” or your Personal Information by first clicking on the “Manage Cookie Preferences” link at the bottom of this page, then clicking the slider beside “Do Not Sell or Share My Personal Information” at the bottom the menu, then clicking “Save.” If you visit our website using a web browser with the Global Privacy Control (“GPC”) signal enabled, we will treat the GPC signal as a request to opt out of targeted advertising, “sharing,” and “sales.”

Verification. Requests for access to, deletion, or correction of Personal Information are subject to our ability to verify your identity. We verify your identity by requiring you to provide the email address associated with your Alloy Health account when you submit a request, providing requested information only to that email address, and, where appropriate, by requesting additional personal information associated with your account.

Authorizing an Agent. If you are acting as an authorized agent to make a request to know, delete, or correct on behalf of a California resident, please send an email to support@myalloy.com and attach a written authorization signed by the resident. We may still require the California resident to directly verify their identity and confirm that they have provided you permission to submit the request.

8. Contact Information

If you have any questions, comments, or concerns about this notice, please email us at support@myalloy.com.

Last Reviewed and Updated: [DATE — see note]

---

Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy supplements the Alloy Privacy Policy and applies only to personal data defined as “Consumer Health Data” that is subject to the Washington State My Health My Data Act (MHMDA) and the Nevada Health Data Privacy Act (NHDPA) (“U.S. State Health Privacy Laws”).

Who is Alloy?

Alloy’s purpose driven mission is to provide a holistic solution to help women age healthfully. Alloy helps women age healthfully by providing access to health care professionals, education, and a community of women navigating through life’s natural processes. We are Alloy.

Alloy is not a medical group or a health care provider. Alloy provides its users with the ability to obtain a telemedicine consultation provided by independent medical practitioners including, but not limited to, MDI Health Technologies Ltd. (“MDI Health”), an independent medical group with a network of United States based health care providers (each, a “Provider”). MDI Health (or your own medical provider if you do not use a MDI Health Provider) is responsible for providing you with a Notice of Privacy Practices describing its collection and use of your health information, not Alloy.

Categories of Consumer Health Data We Collect

Depending on the context of your interactions with Alloy and the products and services you use, we may collect the following categories of Consumer Health Data:

Categories of Consumer Health Data

Examples

Individual health conditions, treatment, diseases, or diagnosis. Diagnoses or diagnostic testing, treatment, or medication. Use or purchase of medication, including prescribed medication Bodily functions, vital signs, symptoms, or measurements. Data that identifies a consumer seeking health care services. Reproductive or sexual health information

We may receive information about the prescriptions that the Provider has provided to you to help deliver the medication to your home address. If you choose to complete a medical intake form in order to meet with a Provider, we may collect information such as your symptoms, height, and weight, to connect you with a Provider. We may collect information that may indicate that you are seeking to receive health care services to improve or learn about your health, such as your registration for our services. If you log in to our user portal and message your doctor for consultation, we may access those communications to provide customer support.

We may share each of the categories of Consumer Health Data described above with your consent, or to the extent necessary to provide a product or service that you have requested.

Sources of Consumer Health Data

We collect Consumer Health Data from the following categories of sources: directly from you, and from medical providers.

Purposes for Collection and Use of Consumer Health Information

We collect and use Consumer Health Data to provide you with the products or Services you have requested, for other purposes permitted under U.S. State Health Privacy Laws, or with your consent. These uses may include:

• Providing, maintaining, improving, and enhancing our products and services to you;
• Personalizing our services and products tailored for your medical needs;
• Understanding and analyzing how you use our Services and develop new products, services, features, and functionality;
• Communicating with you, providing you with updates and other information relating to our services, providing information that you request, and otherwise providing customer support;
• Marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable or otherwise of interest to you;
• Facilitating the connection of third-party services, such as matching you with a Provider;
• Finding and preventing fraud and abuse, and responding to trust and safety issues that may arise;
• For compliance purposes, including enforcing our Terms of Use or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency;
• Anonymizing and aggregating information for analytics and reporting;
• Administering surveys and questionnaires;
• Sending you text messages; and
• Facilitating transactions and payments.

Our Sharing of Consumer Health Data

With your consent, or to the extent necessary to provide you with the products or Services you have requested or for other purposes permitted under U.S. State Health Privacy Laws, we share Consumer Health Data with the following categories of third parties (excluding those who constitute “processors” who only process consumer health data on our behalf for limited purposes pursuant to our instructions) and affiliates:

• Your healthcare providers or family. With your consent, we may share your information, including information collected from your use of our Services, with your health care providers and/or family members (e.g., immediate family or friends) that you designate to receive your information.
• Vendors. We may share your Consumer Health Data with our affiliates, vendors, service providers, and business partners, including our analytics, marketing, and advertising providers. We may also share your Consumer Health Data with professional advisors, such as auditors, law firms, and accounting firms.
• Third parties in mergers and other corporate transactions. We may share your information with advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our business or assets.
• Corporate affiliates. We may share your information with our corporate affiliates.
• Government agencies. We may share your information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. The sharing of your information may occur, for example, if you post any objectionable content on or through the Services.

Consumer Rights

If you are a Washington or Nevada resident or an individual whose information is otherwise covered by U.S. State Health Privacy Laws, you may exercise the following rights, subject to certain exceptions:

• The right to confirm whether we have collected, shared, or sold Consumer Health Data concerning you
• The right to access such data
• The right to obtain list of all categories of third parties and affiliates with whom we have shared or sold such data and an active email address or other online mechanism that the consumer may use to contact these third parties
• The right to request deletion of the Consumer Health Data concerning you
• The right to request that we cease collecting, sharing, or selling such data
• The right to appeal any decision with regard to your privacy request

You can submit a privacy request above by submitting your request by using our online form. Such requests are subject to our ability to reasonably verify your identity.

If you submit an appeal and it is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint or the Nevada State Attorney General at https://ag.nv.gov/Contact/.

Contact Information

If you have any questions, comments, or concerns about our processing activities, please email us at support@myalloy.com

Last updated: September 18, 2026.