DRAFT — pending attorney review.

Privacy Policy

[Legal entity name — TBD]

Effective: [TBD at publication]

This Privacy Policy describes how [Legal entity name — TBD] ("Sundial," "we," "us," or "our") collects, uses, shares, and protects personal information when you use Sundial: Family Health, our mobile application, and the websites, features, and services we make available through it (together, the "Services").

Sundial is a family health service. When you connect a health data source (a "Source"), Sundial brings together the health signals that Source provides, shows you dashboards, a morning brief, and alerts, lets people you choose to connect with see the information you choose to share, and offers an artificial intelligence ("AI") chat that can answer questions about that information. This Policy explains what information makes that possible, why we use it, who receives it, and the choices and rights you have in relation to it.

By creating a Sundial account or using the Services, you acknowledge the practices described in this Policy. If you do not agree with this Policy, please do not use the Services. This Policy does not apply to a Source or any other third-party service you connect or visit, which is governed by that service's own privacy policy and terms.

In this Policy, "personal information" means information that identifies, relates to, or could reasonably be linked to you or your household. "Health signals" means the health and activity measurements described in Section 1. "Connected people" means the other Sundial users you choose to connect with in the Services.

Index

• 1. Personal information we collect
• 2. How we use your personal information
• 3. How we share your personal information
• 4. Your choices
• 5. Other sites and services
• 6. Security
• 7. International data transfers
• 8. Children
• 9. Changes to this Privacy Policy
• 10. How to contact us

1. Personal information we collect

We collect personal information in three ways: information you provide to us directly, information we obtain from Sources and other third parties you connect or use to sign in, and information collected automatically when you use the Services. We collect only the information described in this Section. We do not collect advertising identifiers, we do not use advertising technology, and we do not obtain personal information from data brokers.

Information you provide to us

• Account information. Your name, email address, and, if you choose to provide one, a profile photo. You sign in with Apple, Google, or your email address and password. If you create an account with email and password, we email you a one-time verification code when you create the account to confirm the address is yours; returning sign-ins do not use a code.
• Content you create. Journal entries, day ratings, tags, events, custom signals and check-ins you create (including a user-submitted signal, as described in Section 3), chat messages you send, and alert rules you set, including the signals, conditions, thresholds, and schedules your alerts use.
• Questionnaire answers. Your answers to the five-question get-to-know-you questionnaire presented when you set up your account, which helps Sundial select relevant factors, interpret your baselines, and suggest features for you.
• Communications with us. The contents of messages you send to us, for example when you contact support or respond to a request from us, and any information you choose to include in them.
• Settings and preferences. The choices you make in the Services, including which signals you mark Private, whether AI personalization is turned on, your data-retention selection, and your notification preferences.

Information we obtain from third-party sources

Most health information in Sundial comes from Sources you choose to connect. We receive that information only because you connected the Source and, where the Source requires it, authorized that sharing in the Source's own consent flow.

• Health signals from connected Sources. Sleep, heart rate, heart-rate variability (HRV), activity, steps, body temperature — presented in Sundial as a deviation from your usual — blood glucose, and cycle tracking when you enable it. These signals come from Apple Health and from the other services and devices you connect. What we receive depends on the Source, the device, and the access you have granted in that Source.
• Sign-in information. When you sign in with Apple or Google, we receive the identifiers and account information those services provide for sign-in, such as your name and email address, so that we can create and secure your account. Google is used for sign-in only.
• Subscription status. If you subscribe, Apple processes your payment. We receive your subscription status from Apple so that we can provide the features your plan includes. We never receive or store your payment card number.

Automatic data collection

When you use the Services, we and our service providers automatically collect limited technical information that is needed to operate, deliver, and secure the Services:

• Push notification tokens. A token provided by your device and our push provider so that we can deliver the alerts, briefs, and other notifications you have asked for. You can turn notifications off in your device settings.
• Device and technical information. Basic information about the device and software you use, such as device type, operating system and app version, language and time-zone settings, and identifiers needed for the app to function and remain secure.
• Service and security logs. Records of requests to our systems, errors and crashes, and security events, used to keep the Services working, investigate problems, and detect and prevent abuse and fraud.

We do not use this information to build advertising profiles, and we do not collect information about your activity on other companies' apps or websites for advertising purposes.

2. How we use your personal information

We use personal information for the purposes described below. We do not sell personal information or consumer health data, we do not share it for cross-context behavioral advertising, we do not use it for advertising at all, and we do not train AI models on it.

• To provide the Services. To create and maintain your account, connect the Sources you choose, receive and display your health signals, and provide dashboards, morning briefs, alerts, the journal, and the other features you use.
• To personalize the Services. To tailor what Sundial shows you — including baselines, factors, and suggestions — using your health signals, your questionnaire answers, and the content you create, so that the information presented is relevant to you rather than generic.
• For AI features, when you turn them on. When AI personalization is turned on, to let AI write chat answers, morning briefs, and summaries for you, and to help Sundial understand journal entries you write. The underlying numbers in those outputs are computed deterministically by Sundial; AI phrases and presents them. See Section 3 for how information is shared with AI services for these tasks.
• To send you communications about the Services. To deliver the alerts, briefs, and notifications you have configured, and to send you administrative messages about your account, your Sources, security, and changes to the Services or this Policy.
• For safety, security, and fraud prevention. To verify accounts, protect the security and integrity of the Services, detect, investigate, and prevent fraud, abuse, and unauthorized access, and enforce our terms.
• To comply with law. To meet our legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.
• To improve the Services. To understand how the Services are used and to develop and improve them, using aggregated or de-identified information only. Aggregated and de-identified information cannot reasonably be used to identify you, and we do not attempt to re-identify it.

If we wish to use personal information for a purpose that is materially different from the purposes described in this Policy, we will update this Policy and, where required, ask for your consent before doing so.

3. How we share your personal information

We share personal information only as described in this Section. We do not sell personal information or consumer health data, and we do not disclose it for anyone else's advertising.

People you connect with

Sharing with connected people is controlled by you. When you connect with another person in Sundial, that person can see the information Sundial shares for a connection — including dashboards, morning briefs, and alerts about you — except for any signal you have marked Private.

A signal you mark Private is never shown to connected people. You can mark a signal Private, and change that choice, in the Services at any time. Sharing begins only when you make a connection, and what a connected person sees is governed by your Private choices at the time they view it. Content you have already shared remains where it was shared if you later change a setting, in the same way that a message you have sent remains with its recipient; your change governs new sharing from that point.

Service providers and processors

We share personal information with companies that provide services to us, under contract, only to the extent they need it to do their work for Sundial. Those contracts limit their use of the information to providing their services to us and require them to protect it. We confirm that each third party with which user data is shared will provide the same or equal protection of user data as stated in this Privacy Policy.

The following is the complete list of the categories and named providers with which we share personal information for the purposes described in this Policy. This list is maintained in this Policy; if we add a provider that receives personal information, we will update this list.

Artificial intelligence services

Some Sundial features use AI. This subsection describes how personal information is handled for those features, wherever it appears in this Policy.

• Only what the task needs. For each AI task, Sundial sends only the information that task needs — for example, the readings and entries relevant to a brief or a chat answer — and not your entire record by default.
• On your device. Some AI processing happens on your own device. Information processed only on your device for that task never leaves your phone for that processing.
• Apple Private Cloud Compute. Some AI processing uses Apple's Private Cloud Compute. That processing does not store your data.
• Cloud AI services. Other AI tasks are performed by Anthropic or OpenAI, listed above, under contract to provide answers only. They do not train models on Sundial data and they do not sell it.
• No training on your data. Sundial does not train AI models on your personal information, your health signals, or your content. If Sundial ever offers to train a personal model for you, it will ask for your separate opt-in first. That is not a current practice.
• Your control. You can turn AI personalization off at any time, as described in Section 4. Turning it off stops new AI use of your data immediately.

Legal and safety disclosures

We may disclose personal information when we believe disclosure is required or appropriate to comply with applicable law, a court order, or another lawful request; to enforce our terms; or to protect the rights, property, safety, or security of Sundial, our users, or others, including by detecting and preventing fraud and abuse.

Business transfers

If Sundial is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, personal information may be transferred as part of that transaction, subject to the commitments in this Policy. We will notify you of a transfer of this kind — for example, through the Services or by email — before your personal information becomes subject to a different privacy policy.

4. Your choices

You control your information in Sundial. Most of the rights and controls in this Section can be exercised in the Privacy & Legal Center in the app, or by emailing us at the address in Section 10. We will verify your identity before acting on a rights request, using the account and, for export, the biometric check described below.

Access and the list of third parties

You may access the personal information Sundial holds about you, including your health signals, content, and settings, in the Services. You may also ask who your information is shared with. The complete list of third parties with which we share personal information is the roster in Section 3, and it is also available through your access rights in the Privacy & Legal Center.

Export your data

You may export everything Sundial holds about you. The export is provided as a ZIP file that you download in the app. Export is protected by a biometric check, and the download link expires 14 days after it is issued. If a link expires before you download it, you may request a new export.

Correct your data

You may correct personal information about you that is inaccurate, by editing it in the Services where that information can be edited, or by contacting us. Health readings come from your connected Sources; correcting a reading at its Source is the most reliable way to correct it everywhere it is used.

Delete your account and data

You may delete your account in the Privacy & Legal Center or by contacting us. Deletion is immediate: when you confirm deletion, your account is deleted at once. There is no grace period and no cancellation.

• Permanent deletion. Your personal information is deleted, including destruction of the encryption keys for your data, which makes any remaining encrypted copies unrecoverable. Backup or snapshot residue is crypto-shredded and expires within 30 days.

Some information may be retained where, and only for as long as, the law requires us to keep it, or to establish, exercise, or defend legal claims. Content you previously shared with connected people remains where it was shared, as described in Section 3.

Withdraw consent and control sharing

• Turn off AI personalization. You may turn AI personalization off at any time in the Services. New AI use of your data stops immediately. Answers already produced and shared remain where they were shared, like a sent message.
• Disconnect a Source. What flows into Sundial from a Source is controlled at the Source. To stop a signal, or a Source as a whole, from flowing into Sundial, use the toggle in the native service where you connected it, or disconnect the Source there. Sundial offers no separate in-app switch that stops inflow for a single signal.
• Mark signals Private. You may mark any signal Private at any time. A Private signal continues to be available to you, and is never shown to connected people.
• Manage connections. You may add or remove connections with other people in the Services. Removing a connection ends that person's access to newly shared information about you through Sundial.

Retention

Health readings are kept for the period you select in the Privacy & Legal Center — 90 days or 1 year — and the default is 90 days. When the selected period passes for a reading, it is deleted on a rolling basis. Account data is kept while your account is active. Chat and brief content is kept under the same controls as your other data in the Privacy & Legal Center, and is included in deletion and export as described in this Section.

Your state privacy rights

Depending on where you live, state privacy law may give you rights in relation to your personal information, including the right to know and access the personal information collected about you, the right to request its deletion, and the right to correct inaccurate personal information. Washington and California law are examples of laws that provide rights of this kind. You can exercise the rights described in this Section in the Privacy & Legal Center or by contacting us, and we will respond as the law applicable to you requires.

We state this plainly: Sundial does not sell personal information, and it does not share personal information for cross-context behavioral advertising. Because we do not sell personal information, there is no sale from which to opt out. We will not discriminate against you for exercising a privacy right.

If someone makes a request on your behalf, we may ask for evidence that they are authorized to act for you, and we may still need to verify your identity directly before completing the request.

5. Other sites and services

The Services connect to Sources and may contain links to, or integrations with, websites, applications, devices, and services that we do not operate. Apple Health, the services and devices you connect as Sources, and the sign-in and subscription services of Apple and Google are examples.

When you use a third-party service, that service collects and uses your information under its own privacy policy and terms, not this Policy. The access a Source has, and the access Sundial has to that Source, are controlled in that Source's own settings and consent screens. We encourage you to read the privacy policy of every Source and service you connect. We are not responsible for the privacy practices of third-party sites and services.

If you disconnect a Source or remove a third-party integration, information already received by Sundial from that Source remains subject to this Policy — including your retention, export, and deletion controls — until it is deleted under Section 4.

6. Security

We use administrative, technical, and organizational measures designed to protect personal information, including encryption in transit and at rest, access controls that limit who and what systems can reach personal information to what is needed for their work, and a biometric step-up — a fingerprint or face check on your device — before a data export can be downloaded.

No method of transmission over the internet or method of storage is completely secure, and we cannot guarantee absolute security. You also protect your information by protecting the device and the Apple, Google, or email account you use to sign in, because access to any of them can give access to Sundial. If you believe your account has been compromised, contact us promptly at the address in Section 10.

7. International data transfers

Sundial and the service providers listed in Section 3 may process and store personal information in the United States and in other countries in which we or they operate. The privacy and data-protection laws of those countries may differ from the laws of the country or state in which you live.

Where personal information is transferred in this way, we rely on the contracts with our service providers, which limit their use of the information to providing services to us and require them to protect it, and on the protections described in this Policy, which apply to your information regardless of where it is processed for Sundial. By using the Services, you understand that your information may be processed in a country other than your own.

8. Children

You must be 18 years or older to hold a Sundial account. The Services are offered to account holders who meet that requirement, and we do not knowingly collect personal information from a person under 18 as an account holder.

If you believe that a person under 18 has provided us with personal information as an account holder, or that we have collected such information in error, please contact us at the address in Section 10. We will review the matter and, where appropriate, delete the account and its information.

9. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example when the Services change, when we add a Source or a service provider, or when the law changes. When we update this Policy, we will post the revised Policy and change the effective date at the top of it.

If a change materially affects how we collect, use, or share personal information, we will notify you before the change takes effect — for example, through the Services or by email — so that you can review it and exercise the choices in Section 4. Your continued use of the Services after a change takes effect means the revised Policy applies to your information from that point, except where your consent is required for a new use, in which case we will ask for it first.

10. How to contact us

If you have questions about this Privacy Policy or our privacy practices, or if you wish to exercise a right described in Section 4, please contact us:

Email: privacy@sundial.app [confirm]

[Legal entity name — TBD]

Mailing address: [Address — TBD]

Please include enough information for us to identify your account and understand your request. We will respond as promptly as we reasonably can and, for rights requests, within the time the law applicable to you requires.