Calm Consumer Health Data Privacy Policy

Last Updated August 15, 2025

• This health-data policy covers Calm Sleep Legal Rights & Agreement Rules

This Consumer Health Privacy Policy explains how Calm.com, Inc. and our subsidiaries and affiliates (“Calm”, “we”, “our”, or “us”) collect, use, and disclose certain health information about you when you access or use our Calm Sleep website(s) and mobile application (collectively, the “Services”), and when you contact our customer service team or otherwise interact with us. This Consumer Health Privacy Policy is a supplement to the Calm Privacy Policy and applies to personal information and other data that may fall within the definition of “consumer health data” under applicable United States state laws, including Nevada’s Consumer Health Data Privacy Act and Washington’s My Health My Data Act (“Consumer Health Data”). We encourage you to review the Calm Privacy Policy to learn more about our privacy practices and our commitments to you. Capitalized terms used below have the same definitions as in the Calm Privacy Policy or in the applicable laws, unless otherwise noted.

• This health-data policy covers Calm Sleep Legal Rights & Agreement Rules
• Send health-data rights requests to support@calm.com Legal Rights & Agreement Rules

We may change this Consumer Health Privacy Policy from time to time. If we make changes, we will revise the date at the top of the policy and, in some cases, we may provide you with additional notice.

• Calm may change this policy Legal Rights & Agreement Rules

This Consumer Health Privacy Policy does not apply to third-party websites or producats. Please separately review their privacy policies to understand how your personal information is used and stored by those third parties.

• Third-party products have separate privacy policies Legal Rights & Agreement Rules
• Send health-data rights requests to support@calm.com Legal Rights & Agreement Rules

Collection of Consumer Health Data

We may collect certain Consumer Health Data about you depending on how you engage with our Services. This health information may fall under the following specific categories of Consumer Health Data:

• Permission enables health-app and wearable data collection Data Access & Collection

• Bodily functions, vital signs, symptoms, or measurements. With your permission, we may receive data from your mobile device’s health app (like Apple HealthKit or Google Health Connect) or wearable, such as hours of sleep, heart rate, wrist temperature, and blood oxygen.
• • Permission enables health-app and wearable data collection Data Access & Collection

Sources of Consumer Health Data

We may collect Consumer Health Data in the following ways:

• Permission enables health-app and wearable data collection Data Access & Collection

• from third-party apps (like Apple HealthKit) or other third-party products (like a connected fitness device) with which you have chosen to integrate or link your Calm Sleep account.
• • Permission enables health-app and wearable data collection Data Access & Collection

Use of Consumer Health Data

We may use your Consumer Health Data in the following ways:

• Health data may personalize sleep services and reports Use & Processing
• Health data may be used to answer support requests Use & Processing
• Health data may be used to create anonymous or aggregated datasets Use & Processing
• Health data may be used to address fraud and harmful activity Security & Safeguards
• Health data may be used for contractual and legal compliance Legal Rights & Agreement Rules
• Health data may be used to exercise or defend legal rights Legal Rights & Agreement Rules
• Other health-data uses may occur with requested and received consent Use & Processing

• to provide our Services to you, including by personalizing your Calm Sleep experience and sending you reports on your sleep and recommended actions;
• • Health data may personalize sleep services and reports Use & Processing
• to provide you support when responding to your questions, concerns, complaints, or other requests;
• • Health data may be used to answer support requests Use & Processing
• to create anonymous or aggregated data sets;
• • Health data may be used to create anonymous or aggregated datasets Use & Processing
• to protect ourselves, you, and others such as by taking actions to prevent, detect, or respond to fraud, security incidents, harassment, or other malicious or illegal activity;
• • Health data may be used to address fraud and harmful activity Security & Safeguards
• to comply with our compliance, third party contractual agreements, and other legal obligations;
• • Health data may be used for contractual and legal compliance Legal Rights & Agreement Rules
• to establish or exercise our legal rights or defense against legal claims; and
• • Health data may be used to exercise or defend legal rights Legal Rights & Agreement Rules
• otherwise with your consent where requested and received.
• • Other health-data uses may occur with requested and received consent Use & Processing

Disclosures of Consumer Health Data

We may disclose your Consumer Health Data to achieve the purposes and uses listed above. The categories of recipients to whom we disclose your Consumer Health Data with are:

• Service providers receive health data needed to work for Calm Sharing & Disclosure
• Health data may be disclosed during business transactions Sharing & Disclosure
• Health data may be disclosed for legal or protective reasons Sharing & Disclosure

• Service providers: We disclose Consumer Health Data to service providers and vendors (also known as “processors” under the Consumer Health Data Laws) that need access to such data to perform services on our behalf, such as to provide cloud storage, manage user accounts, and power our Services.
• • Service providers receive health data needed to work for Calm Sharing & Disclosure
• Business transfer: We may disclose Consumer Health Data in connection with any merger, sale of company assets, financing or acquisition of all or a portion of our business by another company.
• • Health data may be disclosed during business transactions Sharing & Disclosure
• Other: We may disclose Consumer Health Data for legal reasons or as necessary to protect Calm or others.
• • Health data may be disclosed for legal or protective reasons Sharing & Disclosure

Privacy Rights

As provided for in the Privacy Rights section of the Calm Privacy Policy, you may make requests about your personal information. Applicable privacy laws provide you certain specific rights with respect to your Consumer Health Data law subject to exceptions. Specifically:

• You can request health-data categories and recipient contact details Sharing & Disclosure
• Washington law provides an additional health-data access right Data Access & Collection
• You can request deletion by Calm and its service chain Retention & Deletion
• You can withdraw consent where Calm relies on it Use & Processing
• Send health-data rights requests to support@calm.com Legal Rights & Agreement Rules

• The right to know what categories of Consumer Health Data we collect, share, or sell. You also have the right to obtain a list of all third parties and affiliates with whom we have shared or sold your Consumer Health Data, and an active email address or other mechanism that you may use to contact these third parties. If you are a Washington resident or otherwise subject to Washington law, you also have the right to access your Consumer Health Data that we collect, share, or sell.
• • You can request health-data categories and recipient contact details Sharing & Disclosure
  • Washington law provides an additional health-data access right Data Access & Collection
• The right to have us, as well as our affiliates, service providers, and contractors, delete the Consumer Health Data we have about you.
• • You can request deletion by Calm and its service chain Retention & Deletion
• The right to withdraw consent related to your Consumer Health Data where we rely upon consent to collect, use, or share your Consumer Health Data.
• • You can withdraw consent where Calm relies on it Use & Processing
• The right not to receive discriminatory treatment for the exercise of the privacy rights described above.
• • Exercising these privacy rights should not lead to discrimination Legal Rights & Agreement Rules

You may exercise your rights by contacting support@calm.com with your request. As further stated in the Calm Privacy Policy, your request may be denied where an exception applies, including but not limited to, where we are legally required to maintain your Consumer Health Data or if we are unable to authenticate the request using commercially reasonable efforts.

• You can request health-data categories and recipient contact details Sharing & Disclosure
• Washington law provides an additional health-data access right Data Access & Collection
• You can request deletion by Calm and its service chain Retention & Deletion
• You can withdraw consent where Calm relies on it Use & Processing
• Send health-data rights requests to support@calm.com Legal Rights & Agreement Rules

We will respond to your request to exercise your right(s) within forty-five (45) days after receipt, and we reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days. An authorized agent may submit a request to exercise the opt-out right on your behalf.

• Requests get a response within 45 days, with a conditional extension Legal Rights & Agreement Rules
• An authorized agent may submit an opt-out request for you Legal Rights & Agreement Rules

How to appeal decisions about your rights.

• Nevada residents may appeal a denied request Legal Rights & Agreement Rules
• Washington residents and people located there may appeal Legal Rights & Agreement Rules

• Nevada: If you are a Nevada resident and your request is denied, you may appeal our decision and we will provide the steps to appeal as part of responding to your request. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If your appeal is not successful, you may submit a complaint with the Nevada Attorney General at https://ag.nv.gov/Complaints/CSU_Complaints___FAQ/.
• • Nevada residents may appeal a denied request Legal Rights & Agreement Rules
• Washington: If you are a Washington resident or located in Washington and your request is denied, you may appeal our decision and we will provide the steps to appeal as part of responding to your request. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If your appeal is not successful, you may submit a complaint with the Washington State Attorney General at https://www.atg.wa.gov/file-complaint.
• • Washington residents and people located there may appeal Legal Rights & Agreement Rules