11.6 CONSUMER HEALTH DATA — WASHINGTON, NEVADA, AND CONNECTICUT. This Section is also published separately at www.orastudios.co/consumer-health-privacy. It applies to residents of those states whose consumer health data we collect, and we apply the same standards to every client.

(a) What we collect. Information you give us about injuries, surgeries, chronic conditions, pain, physical limitations, pregnancy or postpartum status, heat sensitivity, relevant medications, physician clearance, requested modifications, and incident and injury reports; range-of-motion or form observations you ask us to record; heart rate, calories, and activity metrics from a platform you connect; and inferences we draw solely to instruct you safely. Your attendance at a fitness class may itself be consumer health data under Washington law, and we treat it accordingly.

(b) Sources. You; your instructor’s notes of what you tell them; a platform you connect; an incident report; a physician’s clearance you submit.

(c) Purposes. Only to provide instruction and modifications safely, respond to and document a medical incident, accommodate a condition or disability, and comply with legal, insurance, and safety obligations.

(d) Disclosure. Only to the instructors and management at the studio on a need-to-know basis; to the booking platform and cloud host that store it as processors under contract; to emergency personnel and your emergency contact in a medical emergency; to our insurers and legal advisors in connection with an incident or claim; and as required by law. We do not disclose consumer health data to advertising networks, analytics providers, data brokers, or any recipient for its own purposes.

(e) No sale. We will not sell your consumer health data and will not seek the valid authorization that selling it would require. No employee or vendor is authorized to sell it.

(f) No health-facility geofencing. We do not implement a geofence around any health care facility to identify or track consumers, collect consumer health data, or send messages relating to it. Our geofencing is limited to our own premises for check-in and is disabled if you decline location permission.

(g) Your rights. Confirm whether we collect, share, or sell your consumer health data; obtain a list of all third parties and affiliates that received it, with contact information; withdraw consent; and request deletion, including from archives and backups. On a valid deletion request we delete it from live systems, direct every processor and recipient to delete it, and remove it from backups on the next scheduled backup cycle. We respond within forty-five days, extendable once by forty-five days, with the appeal right in Section 10.8.

(h) How to exercise. info@orastudios.co with the subject “Consumer Health Data Request,” at www.orastudios.co/privacy-request, or at 772-333-4140. You will not be denied services, charged more, or given lower-quality service for exercising these rights.

(i) Our people. Access is limited to those for whom it is necessary to the purposes above, each trained on these restrictions and subject to contractual and disciplinary consequences for misuse.