Ora STUDIOS — PRIVACY POLICY

Florida edition · Version 1.0

ORA Studios and Wellness LLC, d/b/a Ora Studios

Effective Date: [EFFECTIVE DATE] · Last Updated: [DATE]

AT A GLANCE

1. SCOPE

1.1 This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with the Ora mobile application, www.orastudios.co and related sites, our in-studio check-in devices, our email and text message programs, our social media pages, and our studio operations (the “Services”).

1.2 It does not apply to third parties whose services you separately connect or use, to information we handle about employees or job applicants, or to de-identified or aggregated information that cannot reasonably be associated with you and that we maintain without attempting to re-associate it.

1.3 Capitalized terms not defined here have the meanings in our Terms of Use.

2. INFORMATION WE COLLECT

2.1 Information you give us

2.2 Information collected automatically

2.3 Information from other sources

We do not purchase personal information from data brokers.

2.4 Sensitive information

Some information above may be sensitive personal information, sensitive data, or consumer health data under state law — including precise geolocation, health and injury information, pregnancy status, and account credentials. We use and disclose it only for the purposes permitted by applicable law and described in Sections 6 and 11, and never to infer characteristics about you.

3. HOW WE USE INFORMATION

Automated decisions. We do not use personal information to make decisions producing legal or similarly significant effects about you without human involvement. Where automation suggests classes, sets booking priority, or flags suspected abuse, a person reviews any decision to suspend an account or forfeit points, and you may contest the outcome at info@orastudios.co.

Secondary use. We will not use personal information for a materially different purpose without notice and, where required, your consent.

4. HOW WE DISCLOSE INFORMATION

Every service provider receives only what it needs, and is bound by written contract to use it solely to provide services to us, to protect it, and not to sell it or use it for its own purposes.

4.1 At your direction. We disclose information to third parties when you ask us to — connecting a wearable, sharing to social media, or sending a referral.

4.2 Other participants. Your first name and profile photo may be visible to other participants in optional leaderboard, challenge, or community features, which you can turn off at Account → Privacy.

4.3 We do not disclose health information to advertising or analytics recipients, to data brokers, or to any recipient for its own commercial purposes.

4.4 Legal disclosures. We may disclose information where we believe in good faith it is required by law, subpoena, warrant, court order, or other lawful process, or necessary to protect the rights, property, or safety of any person. We require lawful process before disclosing personal information to law enforcement absent an emergency involving a risk of death or serious physical injury, and where permitted we will notify you and allow a reasonable opportunity to object.

4.5 Corporate transactions. Personal information may be transferred in a merger, acquisition, financing, franchise transaction, reorganization, sale of assets, or bankruptcy, subject to confidentiality obligations. An acquirer remains bound by this Policy as to information collected before the transaction unless you are notified and consent to a materially different practice.

4.6 De-identified data. We may create and use de-identified or aggregated information for any lawful purpose. We maintain it in de-identified form, do not attempt to re-identify it, and contractually prohibit recipients from doing so.

4.7 Text message (SMS) opt-in data. No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We mean that literally, and we hold ourselves to it. Your mobile number and your record of SMS consent are never sold, rented, licensed, traded, or otherwise made available to any data broker, advertiser, affiliate, network, or other company for its own or anyone else’s marketing or promotional purposes. “All other categories” means every category of disclosure described in this Policy — advertising and analytics, corporate wellness partners and aggregators, and every other recipient in the table above — none of which receives your mobile number or your SMS consent record.

The single exception those words already contemplate is the delivery of the messages you asked us to send: the messaging provider that transmits our texts acts only as us and only on our instructions, is contractually barred from using your number for its own purposes, from selling it, and from sharing it further, and may not market to you or let anyone else do so. It is not a third party, an affiliate, or a marketing recipient, and it cannot become one.

5. COOKIES, ANALYTICS, AND RECORDING

5.1 What we use.

5.2 Managing cookies. Manage non-essential cookies through our Privacy Choices link, available on every page and at Account → Privacy. You may also block or delete cookies in your browser and limit ad tracking in your device settings.

5.3 Global Privacy Control. We recognize and honor the Global Privacy Control and other legally recognized universal opt-out signals as a valid opt-out of sale, sharing, and targeted advertising for that browser, and we apply the opt-out to your account wherever we can identify you. Because browser “Do Not Track” headers have no uniform meaning, we do not respond to them.

5.4 Recording and replay — please read. We and our service providers may record or replay your interactions with our website and app, and may record or transcribe chats, calls, and support communications, for quality, security, fraud prevention, and service improvement.

(a) Florida is an all-party consent state under Fla. Stat. § 934.03. We therefore give you notice before any such recording begins and ask for your consent, and we do not record where consent has not been given.

(b) These tools are configured to mask payment, credential, and health-related fields, which are never captured.

(c) Our service providers act solely on our behalf under written contract, are prohibited from using the information for their own purposes or for training any model, and do not sell it.

(d) You may decline recording of a chat or call by telling the staff member or by contacting us at info@orastudios.co, and you may use the Services without it.

6. SPECIAL CATEGORIES

6.1 Age. Ora Studios classes and accounts are for adults aged 18 and over. The Services are not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn we have collected information from a minor, we delete it. We do not sell or share any minor’s personal information or use it for targeted advertising or profiling. A parent or guardian who believes a minor has given us information may write to info@orastudios.co and we will delete it.

6.2 Precise location. Collected only with your permission, used only to show nearby studios and enable check-in. We do not use precise location for advertising and do not disclose it to advertising partners.

6.3 Health, injury, and wellness information. You are never required to give us health information to book a class or hold a membership; you give it so we can instruct you safely.

(a) We use it only for safety, instruction, accommodation, incident response, and modifications you request.     (b) It is visible only to staff who need it — the instructors teaching your classes and studio management.     (c) We do not use it for marketing, advertising, profiling, or automated scoring, and we do not sell or share it.     (d) We retain it as stated in Section 8; incident records are kept for the applicable limitations period.     (e) Section 11.6 provides additional rights for Washington, Nevada, and Connecticut residents.

6.4 Wearable and health platform data. Accessed only after your separate authorization and limited to the metrics disclosed at connection. We use it to display your activity to you and, de-identified and in aggregate, to improve programming. We do not disclose it to advertising or analytics partners. Disconnect at any time at Account → Connected Apps; we will stop receiving new data and will delete data already received on request. We comply with any further restrictions imposed by the platform’s own rules.

6.5 Biometric information. We do not collect, capture, or use biometric identifiers or biometric information — including facial geometry, fingerprints, voiceprints, or scans of hand or body geometry — and we do not use facial recognition in our studios or app.

7. SECURITY

7.1 We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, least-privilege access controls, multi-factor authentication for administrative accounts, tokenized payment credentials, logging and monitoring, vendor security diligence, staff training, and an incident response plan.

7.2 No system is perfectly secure and we cannot guarantee the security of information transmitted to or from the Services. Use a strong, unique password and tell us at info@orastudios.co if you believe your account has been compromised.

7.3 If a security incident affects your personal information, we will notify you and applicable regulators as the law requires, without unreasonable delay.

8. HOW LONG WE KEEP INFORMATION

We keep personal information only as long as necessary for the purposes in this Policy and then delete or de-identify it. Periods may be extended where a legal hold, investigation, dispute, insurance claim, or regulatory requirement applies.

9. ADVERTISING, “SALE,” AND “SHARING”

9.1 We do not sell your personal information for money. State privacy laws define “sale,” “share,” and “targeted advertising” broadly enough that our use of advertising and analytics cookies, pixels, and mobile SDKs to deliver or measure advertising on other platforms may constitute a sale or share. We treat it as one and provide the opt-out below.

9.2 What we never do. We do not disclose to advertising partners, and never use for targeted advertising or profiling: health, injury, pregnancy, or wellness information; wearable or health platform data; precise geolocation; a minor’s personal information; or the contents of your communications with our staff.

9.3 How to opt out. At any time, without an account and at no charge: (a) the Your Privacy Choices link in our website footer and at Account → Privacy; (b) enabling Global Privacy Control in your browser; (c) limiting ad tracking in your device settings; or (d) writing to info@orastudios.co. We effectuate opt-outs within fifteen days, apply them across devices wherever we can identify you, and will not ask you to reaffirm for at least twelve months.

9.4 Authorized agents. You may use an authorized agent, subject to written proof of authorization.

9.5 No retaliation. We will not deny you services, charge a different price, impose a penalty, or provide a different level or quality of service because you exercised a privacy right, except for the loyalty program benefits described in Section 12.

10. YOUR RIGHTS AND HOW TO EXERCISE THEM

10.1 Rights. Depending on your state, you may have the right to know what we collect and from whom, why, and to whom we disclose it; access a copy; correct inaccuracies; delete; obtain a portable copy; opt out of sale, sharing, targeted advertising, and certain profiling; limit our use of sensitive personal information; withdraw consent; and appeal a denial.

10.2 How to submit a request. In-app at Account → Privacy → Manage My Data; online at www.orastudios.co/privacy-request; by email to info@orastudios.co; or by phone at 772-333-4140.

10.3 Verification. We verify your identity before acting on a request to access, correct, delete, or port, using information already in our records. We will not require you to create an account to submit a request and will not use verification information for any other purpose. Sensitive requests may require additional verification.

10.4 Timing. We confirm receipt within ten business days and respond within forty-five calendar days, extendable once by forty-five days with notice. There is no charge unless a request is manifestly unfounded or excessive, in which case we tell you before proceeding.

10.5 Agents, parents, and guardians. An authorized agent may submit a request with your written permission, and we may contact you to confirm. A parent or guardian may submit a request for a registered minor.

10.6 Limits. We may decline a request in whole or part where an exception applies — to complete a transaction, comply with a legal obligation, maintain a waiver or incident record needed to establish or defend a legal claim, detect security incidents, or where compliance would compromise another person’s rights. If we decline, we identify the exception relied on and delete or de-identify the remainder.

10.7 Marketing opt-outs. Unsubscribe from any marketing email, reply STOP to any text message we send you, or disable push notifications. Replying STOP ends all text messages from us; while you hold an account we will still send you transactional and safety communications, by email and in-app message instead.

10.8 Appeals. If we deny a request, appeal by replying to our decision or writing to info@orastudios.co with the subject “Privacy Appeal.” We respond in writing within forty-five days with our reasons, and if the appeal is denied we provide a method to submit a complaint to your state attorney general.

11. YOUR STATE PRIVACY RIGHTS

11.1 Florida. Ora Studios operates a single studio in Florida. The Florida Digital Bill of Rights applies only to businesses meeting revenue thresholds far above ours, so its consumer-rights provisions do not currently reach us. We nonetheless give every client the rights described in Section 10 as a matter of policy, regardless of where you live and regardless of whether a statute requires it. Florida’s Security of Communications Act governs our recording practices — see Section 5.4.

11.2 If you live outside Florida. Several states give residents statutory privacy rights, and most of those laws apply only to businesses above size or revenue thresholds that Ora does not currently meet. We do not rely on that. If you live in a state with a comprehensive privacy law — including California, Colorado, Connecticut, Virginia, Texas, Oregon, Washington, or any state whose law takes effect after this Policy’s date — submit your request under Section 10.2 and we will honor it as though the law applied to us, including the right to know, access, correct, delete, port, opt out of targeted advertising and any sale or share, limit the use of sensitive information, withdraw consent, and appeal a denial. If our size changes so that one of these laws applies to us directly, we will update this Policy before that happens.

11.3 Sensitive information. Wherever you live, we process health information and precise geolocation only with your opt-in consent, given when you choose to provide it or enable the permission and withdrawable at any time at Account → Privacy or info@orastudios.co. We do not sell sensitive information, do not use it for targeted advertising or profiling, and do not use it to infer characteristics about you. We do not profile anyone in furtherance of decisions producing legal or similarly significant effects.

11.4 Nevada. Nevada residents may submit a verified request that we not sell covered information under Nev. Rev. Stat. ch. 603A to info@orastudios.co. We do not sell covered information as that statute defines it.

11.5 Minors. The Services are for adults. We do not knowingly collect a minor’s personal information and do not use it for targeted advertising, sale, share, or profiling, in any state.

11.6 CONSUMER HEALTH DATA — WASHINGTON, NEVADA, AND CONNECTICUT. This Section is also published separately at www.orastudios.co/consumer-health-privacy. It applies to residents of those states whose consumer health data we collect, and we apply the same standards to every client.

(a) What we collect. Information you give us about injuries, surgeries, chronic conditions, pain, physical limitations, pregnancy or postpartum status, heat sensitivity, relevant medications, physician clearance, requested modifications, and incident and injury reports; range-of-motion or form observations you ask us to record; heart rate, calories, and activity metrics from a platform you connect; and inferences we draw solely to instruct you safely. Your attendance at a fitness class may itself be consumer health data under Washington law, and we treat it accordingly.

(b) Sources. You; your instructor’s notes of what you tell them; a platform you connect; an incident report; a physician’s clearance you submit.

(c) Purposes. Only to provide instruction and modifications safely, respond to and document a medical incident, accommodate a condition or disability, and comply with legal, insurance, and safety obligations.

(d) Disclosure. Only to the instructors and management at the studio on a need-to-know basis; to the booking platform and cloud host that store it as processors under contract; to emergency personnel and your emergency contact in a medical emergency; to our insurers and legal advisors in connection with an incident or claim; and as required by law. We do not disclose consumer health data to advertising networks, analytics providers, data brokers, or any recipient for its own purposes.

(e) No sale. We will not sell your consumer health data and will not seek the valid authorization that selling it would require. No employee or vendor is authorized to sell it.

(f) No health-facility geofencing. We do not implement a geofence around any health care facility to identify or track consumers, collect consumer health data, or send messages relating to it. Our geofencing is limited to our own premises for check-in and is disabled if you decline location permission.

(g) Your rights. Confirm whether we collect, share, or sell your consumer health data; obtain a list of all third parties and affiliates that received it, with contact information; withdraw consent; and request deletion, including from archives and backups. On a valid deletion request we delete it from live systems, direct every processor and recipient to delete it, and remove it from backups on the next scheduled backup cycle. We respond within forty-five days, extendable once by forty-five days, with the appeal right in Section 10.8.

(h) How to exercise. info@orastudios.co with the subject “Consumer Health Data Request,” at www.orastudios.co/privacy-request, or at 772-333-4140. You will not be denied services, charged more, or given lower-quality service for exercising these rights.

(i) Our people. Access is limited to those for whom it is necessary to the purposes above, each trained on these restrictions and subject to contractual and disciplinary consequences for misuse.

12. NOTICE OF FINANCIAL INCENTIVE — LOYALTY PROGRAM

13. STUDIO OWNERSHIP AND WHO CONTROLS YOUR INFORMATION

13.1 Ora Studios operates one studio today, and we control the personal information collected through the app, the website, and that studio.

13.2 If we add locations operated by independent operators, the operator of the studio where you take classes will be a separate controller of what it collects in operating that studio — your bookings and attendance there, the safety information you give its instructors, and its incident records. An independent operator will be permitted to use that information only to serve you at its studio, operate its business, and comply with law. It will not be permitted to sell your personal information, disclose it for cross-context behavioral advertising, market anything other than Ora Studios services to you, or keep it after it ceases to operate an Ora studio, and each will be bound by written agreement to those restrictions and to comparable security requirements.

13.3 Submit any privacy request to us under Section 10.2 and we will route it to any studio operator holding your information and confirm completion to you, so you never have to contact each studio separately.

13.4 Affiliated brands. We do not operate other brands and do not share your personal information with any affiliated brand for its own marketing. If that ever changes, we will obtain your consent first and offer a brand-specific opt-out.

14. THIRD PARTIES, TRANSFERS, AND CHANGES

14.1 Third parties. This Policy does not apply to third parties. Payment processors, wearable and health platforms, aggregators, app stores, and social networks operate under their own policies — review them before connecting or transacting.

14.2 Location of processing. The Services are intended for users in the United States, and information is stored and processed in the United States. If you access the Services from elsewhere, your information will be transferred to and processed in the United States, where data protection law may differ from that of your jurisdiction.

14.3 Changes. We may update this Policy. We will post the updated version with a new “Last Updated” date and, for material changes — a new category of information, a new purpose, a new disclosure to a third party for its own purposes, or a change in retention — we will give advance notice by email and in-app at least thirty days before it takes effect and obtain your consent where the law requires. Material changes apply prospectively only. Prior versions are available at www.orastudios.co/privacy/archive.

15. CONTACT US

ORA Studios and Wellness LLC d/b/a Ora Studios · Attn: Privacy 1459 SW Gatlin Blvd., Port St. Lucie, FL 34953 info@orastudios.co · 772-333-4140 · www.orastudios.co/privacy-request

Appeals: info@orastudios.co · Accessibility: info@orastudios.co — we will provide this Policy in an alternative format on request.

Ora Studios Privacy Policy (Florida) · Version 1.0 · Effective [DATE]