PRIVACY POLICY
Effective as of July 30, 2026
This Privacy Policy describes how Soma Precision Health, Inc. (“Soma”, “we”, “us” or “our”)
handles personal information that we collect through our online services that link to this
Privacy Policy, including our website and desktop app (collectively, the “Service”), our
marketing and social media activities, our communications with you, and the other activities
described in this Privacy Policy.
We may provide additional or supplemental privacy policies to individuals for specific products
or services that we offer at the time we collect personal information, such as our Consumer
Health Data Policy.
Individuals in the European Economic Area / United Kingdom: See the Notice to European
users for information about your personal information and data protection rights.
State Law Privacy Rights: See the State Law Privacy Rights section below for important
information about rights you may have under applicable U.S. state privacy laws.
Recording Notice: When you grant us access to your device’s microphone and/or system audio
(the output of your device’s speakers), or communicate with our chatbot, we and our third-
party vendors monitor and record the communications to provide the Service and for other
purposes described in the How we use your personal information section below.
If you have questions or concerns about our use of your personal information, please contact
us at beta@soma-health.co.
Scope of this Privacy Policy
Soma allows users to measure and track their cognitive performance based on their voice and
other personal information. This Privacy Policy does not apply to personal information about
Soma personnel or job candidates that we process in our capacity as an employer.
Personal Information We Collect
The personal information we collect from you, directly or indirectly, will depend on how you
interact with us and with our Service. The sources from which we collect personal information
include the following:
Information you provide to us. Personal information you may provide to us through the
Service or otherwise includes:
● Contact Data. Your first and last name, email address, and other contact details.
● Account Data. Your date of birth, occupation, gender, age you learned English, account
preferences, and other information you choose to include with your account.
● User Data. Information you provide, generate, transmit, or otherwise make available to
us, such as:
o Voice and other audio collected when you grant us access to your device’s
microphone and/or system audio (the output of your device’s speakers). We
need access to your system audio to separate your voice from other people’s
voices. [Some of this information may be considered biometric data or biometric
identifiers in certain jurisdictions. For more information about how we process
biometric data or biometric identifiers, please see our Biometric Data Policy.];
o Consent Notice. You are responsible for obtaining the consent of all individuals
whose voices or audio may be captured through your device’s microphone or
system audio before using the Service. Do not use the Service in any
conversation or setting where you do not have the consent of all parties to the
capture of their voice or audio.
o Health information. For example, your physical health conditions and diagnoses
that may have affected your voice, and your body mass index;
o Calendar data. Authentication tokens for any calendar account (e.g., Google
Calendar) you choose to connect to the Service, as well as data accessible within
it, including meeting title, start and end times, attendee names and contact
details, and other meeting information;
o Self-assessments on your recorded sessions. For example, you can rate how you
felt across different metrics (e.g., energy, stress, clarity) during a recorded
session; and
o Any associated metadata. Metadata includes information on how, when, where
and by whom a piece of content was created or collected.
● Transaction Data. Information about your transaction history and payment card used to
make payments.
● Communications Data. Data from your interactions and communications with us,
including through social media, when you send us an e-mail, complete a form through
our website, provide us with any feedback or survey responses, communicate with our
chatbot, or otherwise communicate with us.
● Marketing Data. Your preferences for receiving marketing communications from us
about our Service, products, activities, events and publications.
● Other Data not specifically listed in this Privacy Policy, which we will use as described in
this Privacy Policy or as otherwise made apparent at the time of collection.
Third-party sources. We may combine personal information we receive from you with personal
information that we obtain from other sources, such as:
● Public sources, such as public records, social media platforms, and other publicly
available sources.
● Our business contacts, such as our professional contacts who share with us contact
details about individuals in their networks, including prospective vendors and partners.
Automatic collection. When you access or interact with the Service and our communications,
we and our service providers automatically log, monitor and record information about you,
your computer or mobile device, and your interaction over time with the Service and our
communications. This information includes:
● Device data, such as your computer or mobile device’s operating system type and
version, manufacturer and model, browser type, screen resolution, RAM and disk size,
CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers, language
settings, mobile device carrier, radio/network information (e.g., Wi-Fi, Bluetooth, LTE,
3G) and location data that can be derived from it, and general location information such
as city, state or geographic area that can be derived from your IP address.
● Usage data, such as pages and screens you viewed, what videos and other content you
view, how long you spent on a page or screen, navigation paths between pages or
screens, information about your activity on a page or screen, access times and duration
of access, whether you have opened our emails or clicked links within them, and other
functional information on Service performance (like diagnostics and crash logs).
● Precise geolocation. The GPS location of your device, when you grant access to it in
your device’s settings.
● Insights data. Insights we generate about your cognitive performance based on other
data we collect and your use of the Service.
Some of the information we and our service providers automatically collect is captured using
the technologies described in our Cookie Notice.
How We Use Your Personal Information
We may use your personal information for the following purposes or as otherwise described at
the time of collection:
Service delivery. We use your personal information to provide the Service, to manage and
administer your Service account, to process your payments, and to communicate with you
about our Service (including support and administrative messages).
Business operations. We use your personal information to administer and maintain our Service
and our IT systems (including monitoring, troubleshooting, data analysis, testing, system
maintenance, repair and support, reporting and hosting of data) and to operate and expand our
business activities.
Direct marketing. As permitted by applicable law, we may collect and use your personal
information to send you marketing emails we think may interest you or contact you by phone
about our products, services or events. You may opt-out of our marketing communications as
described in the Opt-out of marketing section below. If you receive text messages from us, you
may opt-out of receiving further text messages from us by replying STOP to our message.
Research and development. We may use your personal information for research and
development purposes, including to analyze and improve the Service and our business, to
develop new products and services and to train our artificial intelligence or machine learning
models, except that we do not allow your personal information to be used to train models
controlled by third parties. As part of these activities, we may create aggregated, de-identified
or anonymized data from personal information we collect. We make personal information into
de-identified or anonymized data by removing information that makes the data personally
identifiable to you. We may use this aggregated, de-identified or otherwise anonymized data
and share it with third parties for our lawful business purposes, including to analyze and
improve the Service and promote our business.
Compliance and protection. We and our service providers may use your personal information
to:
● comply with applicable laws, lawful requests, and legal process, such as to respond to
subpoenas or requests from government authorities;
● protect our, your or others’ rights, privacy, safety or property (including by making and
defending legal claims);
● audit our internal processes for compliance with legal and contractual requirements or
our internal policies;
● enforce the terms and conditions that govern the Service; and
● prevent, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal
activity, including cyberattacks and identity theft.
Notice to Google users
The Service’s use and transfer to any other app of information received from Google APIs,
including calendar data from a Google account connected to the Service, will adhere to the
Google API Services User Data Policy, including the Limited Use Requirements. In particular, we
do not transfer, sell, or use user data obtained through the Google Workspace APIs to create,
train, or improve a machine learning or artificial intelligence model beyond that specific user’s
personalized model for the appropriate use case or user-facing feature.
How We Share Your Personal Information
Except as otherwise specified in this Privacy Policy, we may share the categories of personal
information listed above with the following parties and as otherwise described in this Privacy
Policy or at the time of collection.
Service Providers. We share personal information with third parties that provide services on
our behalf or help us operate the Service or our business, such as mail delivery, hosting and
infrastructure, information technology, customer support, email delivery, marketing, audio
transcription, artificial intelligence, chatbot, and website analytics. Some of our service
providers that use cookies and other technologies are identified in our Cookie Notice.
Payment Processors. Third-party payment processors that collect your payment card data and
other transaction data to process your payments for the Service.
Linked third-party services. When you log into the Service with, or otherwise link your Service
account to, a third-party service (such as Google), we may share your personal information with
that third-party service. The third party’s use of the shared information will be governed by its
privacy policy and the settings associated with your account with the third-party service.
Other users and the public. For example, when you share summary insights and extracted
metrics about your cognitive performance with users or the public, or when you participate in
challenges with other users that rank users based on certain cognitive performance metrics.
Professional Advisors. We may share your personal information with professional advisors,
such as lawyers, auditors, bankers and insurers, where necessary in the course of the
professional services that they render to us.
Authorities and others. We may share your personal information with law enforcement,
government authorities, and private parties, as we believe in good faith to be necessary or
appropriate for the Compliance and protection purposes described above or as otherwise
permitted by law.
Business transferees. Parties (and their advisors) to business transactions (or negotiations of or
due diligence for such transactions) involving a corporate divestiture, merger, consolidation,
acquisition, reorganization, sale or other disposition of all or any portion of the business or
assets of, or equity interests in, us or our affiliates (including, in connection with a bankruptcy
or similar proceedings).
Other parties with your consent or at your direction. We may share your personal information
for other purposes disclosed to you at the time we collect the information or pursuant to your
consent or direction.
Your Choices
Privacy Rights. Residents of certain jurisdictions can exercise privacy rights with respect to the
personal information we hold, as described in the Notice to European users and State law
privacy rights sections below.
Access or update your information. If you have registered for an account with us through the
Service, you may review and update certain account information and preferences such as the
following within the menu of your desktop app:
● Disabling / enabling “automatic recording”
● Disabling / enabling notifications to alert you when Soma starts or stops collecting your
voice or other audio
● Disabling / enabling Soma’s ability to use User Data (defined above) for research and
development and training its proprietary AI models
Request account deletion. You may request account deletion of your Service account and
associated information through the “Settings” page > “Delete Account” in our desktop app or
by contacting us.
Opt-out of direct marketing. You may request to opt-out of marketing emails by following the
opt-out or unsubscribe instructions at the bottom of the email, or by contacting us with your
request. If you choose to opt-out of marketing emails, you may continue to receive marketing
emails until your opt-out is processed.
Cookies. Most browsers let you remove and/or stop accepting cookies from the websites you
visit. See our Cookie Notice for more details.
Mobile location data. You can disable our access to your device’s precise geolocation in your
mobile device settings.
Linked third-party services. If you log into the Service with, or otherwise link your Service
account to, a third-party service, you may be able to use your settings in your account with that
service to limit the information we receive from it. If you revoke our ability to access
information from a third-party service, that choice will not apply to information that we have
already received from that third party.
Do not track signals. Some Internet browsers may be configured to send “Do Not Track” signals
to the online services that you visit. We currently do not respond to “Do Not Track” signals. To
find out more about “Do Not Track,” please visit All About DNT.
Other Sites and Services
The Service may contain links to websites, mobile applications, and other online services
operated by third parties. In addition, our content may be integrated into web pages or other
online services that are not associated with us. These links and integrations are not an
endorsement of, or representation that we are affiliated with, any third party. We do not
control websites, mobile applications or online services operated by third parties, and we are
not responsible for their actions. We encourage you to read the privacy policies of the other
websites and online services you use.
Security
We employ technical and organizational safeguards designed to protect the personal
information we collect. However, security risk is inherent in all internet and information
technologies, and we cannot guarantee the security of your personal information.
Retention
[For information about our retention of biometric data and biometric identifiers, please see our
Biometric Data Policy.]
We retain personal information for as long as necessary to fulfill the purposes for which we
collected it, including for the purposes of satisfying any legal, accounting, or reporting
requirements, to establish or defend legal claims, or for the compliance and protection
purposes described above. Factors determining the appropriate retention period for personal
information include the amount, nature, and sensitivity of the personal information, the
potential risk of harm from unauthorized use or disclosure of personal information, the
purposes for which we process the personal information, whether we can achieve those
purposes through other means, and the applicable legal requirements.
When we no longer require the personal information we have collected about you, we will
either delete or anonymize it (so that it is no longer personally identifiable with you) or, if this is
not possible (for example, because your personal information has been stored in backup
archives), then we will isolate your personal information from any further processing,
employing security safeguards designed to protect it, until deletion is possible.
International Data Transfers
We are headquartered in the United States, and we and our service providers may store
personal information in and process it from the United States and other countries. These
countries may have data protection laws that are not as protective as those where you live.
Children
Our Service is not intended for anyone under the age of 18. If you are a parent or guardian of a
child from whom you believe we have collected personal information in a manner prohibited by
law, please contact us. If we learn that we have collected personal information through the
Service from a child without the consent of the child’s parent or guardian as required by law,
we will comply with applicable legal requirements to delete the information.
Changes to This Privacy Policy
We reserve the right to modify this Privacy Policy at any time. If we make material changes to
this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it
on the Service or other appropriate means. Any modifications to this Privacy Policy will be
effective upon our posting the modified version (or as otherwise indicated at the time of
posting). In all cases, your use of the Service after the effective date of any modified Privacy
Policy indicates your acknowledgment that the modified Privacy Policy applies to your use of
the Service and interaction with our business.
Contact Us
If you have any questions or comments concerning this Privacy Policy, please email us at
beta@soma-health.co.
Notice to European Users
The information provided in this notice applies only to individuals in the United Kingdom
(“UK”), the European Economic Area (“EEA”) and Switzerland (we collectively refer to these
countries as “Europe”).
The personal information that we collect from you is identified and described in greater detail
in the section of the Privacy Policy entitled Personal information we collect.
Legal bases for processing. European data protection law requires that we have a “legal basis”
for each purpose for which we process your personal information. Depending on the purpose
for collecting your information, we may rely on one of the following legal bases:
● The processing is necessary to perform a contract that we are about to enter into, or
have entered into, with you (“Contractual Necessity”).
● The processing is necessary to pursue our legitimate interests or those of a third party
and we are confident that your privacy rights will be appropriately protected
(“Legitimate Interests”).
● We need to comply with laws or to fulfill certain legal obligations (“Compliance with
Law”).
● We have your specific consent to carry out the processing for the purpose in question
(“Consent”). Generally, we do not rely on Consent as a legal basis for processing your
personal information other than in the context of direct marketing communications
where required by applicable law.
The table below identifies the legal bases we rely on in respect of the relevant purposes for
which we use your personal information. For more information on these purposes and the
categories of personal information involved, see the section in the Privacy Policy entitled How we
use your personal information
Processing purpose
Personal information processed
Legal basis
Service delivery
Contact data
● Account data
● User data
● Transaction data
Communications data
Marketing data
Device data
Usage data
Contractual Necessity. If we have not
entered a contract with you, we process your personal information based on our
Legitimate Interests (in providing the
Services you access or request)
Business operations
Contact data
● Account data
● User data
● Transaction data
Communications data
Marketing data
Device data
Usage data
Contractual Necessity. If we have not
entered a contract with you, we process your personal information based on our
Legitimate Interests (in operating, providing, and improving our business)
Research and development
Contact data
● Account data
● User data
● Transaction data
Communications data
Marketing data
Device data
Usage data
Our Legitimate Interests (in analyzing, and improving our services and our business)
Marketing
Contact data
● Account data
● Transaction data
Communications data
Marketing data
Device data
Usage data
Our Legitimate Interests (in promoting
our products and services through
marketing communications). In
circumstances or in jurisdictions where
consent is required under applicable data protection laws, we rely on your Consent to send direct marketing communications.
Sharing your personal information as
described in this Privacy Policy
Contact data
● Account data
● User data
● Transaction data
Communications data
Marketing data
Device data
Usage data
We use the original legal basis relied upon if the relevant further use is compatible with the initial purpose for which the personal information was collected. Otherwise, we rely on your Consent
Compliance and Protection
All data relevant in
the circumstances.
Compliance with Law (where processing is necessary to comply with our legal obligations). Otherwise, we rely on our Legitimate Interests (in protecting our, your or others’ rights, privacy, safety or property).
Use for new purposes. We may use your personal information for reasons not described in this
Privacy Policy where permitted by law and the reason is compatible with the purpose for which
we collected it. If we need to use your personal information for an unrelated purpose, we will
notify you and explain the applicable legal basis.
Sensitive personal information. Our application processes data classified as “special categories
of data” under GDPR. Do not register for the Service if you do not consent to our handling of it
as described in this Privacy Policy. By registering for the Service, you affirmatively confirm that
you freely give your informed, specific, unambiguous agreement to our use and disclosure of it
for the purposes explained or apparent at the time of collection or otherwise as described in
this Privacy Policy. You can contact us to revoke this consent at any time but we will not be able
to provide services or grant requests that require it.
Your rights. European data protection laws give individuals in Europe the following rights
regarding their personal information:
● Right of access. You can ask us to provide you with information about our processing of
your personal information and give you access to your personal information.
● Right to rectification. If the personal information we hold about you is inaccurate or
incomplete, you are entitled to request to have it rectified.
● Right to erasure. You can ask us to delete or remove your personal information where
there is no lawful reason for us continuing to store or process it, where you have
successfully exercised your right to object to processing (see below), where we may
have processed your information unlawfully or where we are required to erase your
personal information to comply with local law.
● Right to restrict processing. You can ask us to suspend the processing of your personal
information:
● if you want us to establish the information’s accuracy;
● where our use of the information proves to be unlawful but you do not want us
to erase it;
● where you need us to hold the information even if we no longer require it as you
need it to establish, exercise or defend legal claims;
● if you have objected to our use of your information but we need to verify
whether we have overriding legitimate grounds to use it.
● Right to object. You can object to our processing of your personal information where
we are relying on a legitimate interest (or those of a third party) and you believe it
impacts your fundamental rights and freedoms. You also have the right to object where
we are processing your personal information for direct marketing purposes.
● Right to data portability. You have the right, in certain circumstances, to ask us to
provide to you, or a third party you have chosen, your personal information in a
structured, commonly used, machine-readable format.
● Right to withdraw consent at any time. Where we are relying on consent to process
your personal information you have the right to withdraw your consent at any time.
However, this will not affect the lawfulness of any processing carried out before you
withdraw your consent.
Exercising those rights. Some of these rights may be limited where we have an overriding
interest or legal obligation to continue to process the personal information or where certain
exemptions apply. If we decline your request, we will tell you why, subject to legal restrictions.
To exercise any of these rights, please contact us. We may request specific information from
you to help us confirm your identity and process your request.
Your right to lodge a complaint with your supervisory authority. If you are not satisfied with
our response to a request you make, or how we process your personal information, you can
make a complaint to the data protection regulator in your habitual place of residence.
For users in the EEA: The contact information for the data protection regulator in your place of
residence can be found here: https://edpb.europa.eu/about-edpb/board/members_en
For users in the UK: The contact information for the UK data protection regulator is below:
The Information Commissioner’s Office
Water Lane, Wycliffe House
Wilmslow - Cheshire SK9 5AF
Tel. +44 303 123 1113
Website: https://ico.org.uk/make-a-complaint/
International data transfers. We may transfer your personal information to a country outside
of Europe that is not recognized as providing an adequate level of protection for personal
information by the relevant government body. In these cases, we take appropriate safeguards
to ensure your personal information remains protected in accordance with this Privacy Policy
and applicable laws by entering into an appropriate data transfer mechanism permitted under
Article 46 of the GDPR / UK GDPR (as applicable), such as the European Commission’s Standard
Contractual Clauses or the UK International Data Transfer Addendum (as applicable). A copy of
our data transfer mechanism can be provided on request.
State Privacy Laws
Scope. This section applies to residents of certain U.S. states with privacy laws applicable to us
that grant their residents the rights described below or require the disclosures made below
(such laws, “Applicable State Privacy Laws“). If you are not a resident of the state in which
these rights are granted under Applicable State Privacy Laws, you may not be able to exercise
these rights.
For purposes of this section, “personal information” has the meaning given to “personal data”
or similar terms under the Applicable State Privacy Laws, but does not include information
exempted from such laws.
Privacy Rights. You may have the rights listed below. The rights described in this State law
privacy rights section are not absolute, and, in certain cases, we may decline your request as
permitted by law or where the laws in your state do not afford you these rights.
• Confirmation. To confirm whether we are processing your personal information and, in
certain cases, information about the categories of personal information we have
collected, the categories of personal information we have shared with or sold to third
parties, and the categories of third parties with whom we share or sell personal
information. The specific information that may be requested varies depending on your
state of residence.
• Access. To request a copy of certain personal information that we process about you in
a portable format that can be transmitted to another entity.
• Correction. To correct inaccurate personal information that we have collected about
you.
• Deletion. To ask us to delete personal information we maintain about you.
• Opt out of
◦ Processing personal information for targeted advertising. To opt out of processing
of personal information for targeted advertising purposes.
◦ Sales of personal information. To opt-out of “sales” of your personal information as
defined by Applicable State Privacy Laws.
◦ Profiling. To opt-out of automated processing of personal information for the
purposes of certain “profiling” that will have a legal or similarly significant effect on
you.
We do not engage in processing personal information for targeted advertising, sales
or profiling purposes described above.
• Nondiscrimination. You are entitled to exercise the rights described above free from
discrimination as prohibited by Applicable State Privacy Laws.
How to exercise your rights.
• Submitting requests to confirm, access, correct, or delete your personal information.
You can submit requests to exercise the rights described above by submitting a request
to beta@soma-health.co. We cannot process your request if you do not provide us with
sufficient detail to allow us to understand and respond to it.
• Identity verification. We may need to verify your identity to process requests to
exercise your rights to confirm, access, correct, or delete, and we reserve the right to
confirm your residency. To verify your identity, we may require you to log into your
Service account if you have one, provide information we can match against information
we may have collected from you previously, confirm your request using the email
address we have on file, provide government identification, or provide a declaration
under penalty of perjury, where permitted by law.
• Authorized agents. Your authorized agent may make a request on your behalf through
the same channels described above. We may ask you and/or your agent to take steps
permitted by law based on the nature of your request to verify your agent’s authority.
• Appeals. You can ask to appeal any denial of your request in the same manner that you
may submit the request. You must submit your appeal within 45 days of the denial of
your request or within any longer timeframe provided by the Applicable State Privacy
Law in the state where you live. When sending your appeal, please include your name,
contact information, details of the original request, the date of our response, and the
reasons you believe the denial should be reconsidered. We will review your appeal and
respond in writing within the timeframe required by the Applicable State Privacy Law. If
we deny your appeal, we will explain why.
Revoke consent. When we request your consent to process your personal information, you can
contact us to revoke your consent.
Sensitive data. Our application processes data classified as “sensitive” under Applicable State
Privacy Laws. Do not register for the Service if you do not consent to our handling of it as
described in this Privacy Policy. By registering for the Service, you affirmatively confirm that
you freely give your informed, specific, unambiguous agreement to our use and disclosure of it
for the purposes explained or apparent at the time of collection or otherwise as described in
this Privacy Policy. You can contact us to revoke this consent at any time but we will not be able
to provide the services or grant requests that require it.
Consumer Health Data Policy
Effective as of July 30, 2026.
This policy supplements and forms part of our Privacy Policy and applies only to personal
information covered by our Privacy Policy that constitutes “consumer health data” subject to
the Washington State My Health My Data Act (“MHMDA”) or Nevada’s Consumer Health Data
Privacy Law. Capitalized terms not defined in this Consumer Health Data Policy are defined in
our Privacy Policy.
If you have questions about this policy, contact us at beta@soma-health.co.
Consumer Health Data We Collect
Please refer to the Personal Information We Collect section of our Privacy Policy for a
description of the personal information (including consumer health data) we may collect. For
example, you may provide us with information when you register for an account about whether
you have had any physical health conditions and diagnoses that may have affected your voice,
as well as your body mass index. Additionally, our application collects voice and other audio
when you grant us access to your device’s microphone and/or system audio (the output of your
device’s speakers) and generates insights about your cognitive performance based on
information you provide and your use of the service, which may be considered consumer health
data.
Consumer health data we collect may include information about your (i) individual health
conditions, status, treatment, diseases, or diagnosis; (ii) health-related surgeries or procedures;
(iii) bodily functions, vital signs, symptoms, or measurements of the information described in
this policy; (iv) diagnoses or diagnostic testing, treatment, or medication; (v) biometric data (to
the extent it may be considered consumer health data); (vi) data that identifies you seeking
health care services; or (vii) any information that we or our service providers/processors
process to associate or identify you with the data described in this policy that is derived or
extrapolated from nonhealth information (such as proxy, derivative, inferred, or emergent data
by any means, including algorithms or machine learning).
Sources of Consumer Health Data
As described further in our Privacy Policy, we may collect consumer health data directly from
you (such as when you register for an account with the Service) and from your interactions with
us and the Service. We may also derive insights about your cognitive performance based on
information you provide to us and your use of the service.
How We Use Consumer Health Data
Please refer to the How we use your personal information section of our Privacy Policy for a
complete description of how we use personal information, including consumer health data.
Primarily, we use consumer health data to provide the Service, operate our business, and
communicate with you about the Service, as well as for research and development and the
compliance and protection purposes described in our Privacy Policy.
How We Disclose Consumer Health Data
Please refer to the How we share your personal information section of our Privacy Policy for a
complete description of how we share personal information, including consumer health data.
Primarily, we may disclose all categories of consumer health data that we collect to our service
providers who need it to perform services for us, other users and the public (for example, when
you choose to share certain insights about your cognitive performance), and to other parties
with your consent or at your direction. While not a regular occurrence, we may also need to
disclose consumer health data to our professional advisors; to law enforcement, government
authorities and other parties to legal proceedings; and in connection with a merger or
acquisition of our business or assets.
Your Rights
The MHMDA and Nevada’s Consumer Health Data Privacy Law provide certain rights with
respect to consumer health data, such as the right to access, delete, or withdraw consent
relating to consumer health data, subject to certain exceptions. For more details, you can read
about the rights granted by the MHMDA at https://app.leg.wa.gov/RCW/default.aspx?
cite=19.373.040, and you can read about the rights granted to Nevada residents
at https://www.leg.state.nv.us/NRS/NRS-603A.html#NRS603ASec505.
You may send requests to us to exercise these rights at beta@soma-health.co.
Appeals
If your request to exercise a right under the MHMDA or Nevada’s Consumer Health Data
Privacy Law is denied, you may appeal that decision by contacting us at beta@soma-health.co.
You must submit your appeal within 45 days of the denial of your request or within any longer
timeframe provided by applicable law. When sending your appeal, please include your name,
contact information, details of the original request, the date of our response, and any reason
you believe the denial should be reconsidered. We will review your appeal and respond in
writing within the timeframe required by law. If we deny your appeal, we will explain why. If
your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington
State Attorney General at https://www.atg.wa.gov/file-complaint or the Nevada State Attorney
General at https://ag.nv.gov/Contact/.
Changes to this Policy
We reserve the right to modify this policy at any time. If we make material changes to this
policy we will notify you in the same manner that we give notice of material changes to
our Privacy Policy as described in the Changes to this Privacy Policy section.