Data Protection & Privacy

Effective Date: May 25, 2023

This Policy describes the practices of Prism Labs Inc. (“Prism” or “we”) concerning information that it obtains when you use the Prism-powered body scanning feature in The Company's applications. By using the body scanning technology, you consent to the collection, use, retention, and other handling of body scans and other data as described below.

1. Collection and Use of Data

The Company uses technology by Prism to provide its body scan service. In each scan, The Company sends Prism images of you and related data, including gender, height, and weight. Prism uses this to provide the scanning service, including:

• to build 3D body scans of you from head to toe (including some basic face geometry);
• to calculate insights such as your body composition (like body fat percentage and lean body mass); and
• to improve Prism’s technology.

Because the scans include rough measurements of face geometry, some data in the scans may be considered “biometric identifiers” under laws such as the Illinois Biometric Information Privacy Act (BIPA), even though Prism does not use the scans for reidentification purposes.

2. Disclosure of Information

Subject to applicable law, Prism may share the images, the full scans, and other data it has, as follows:

• To service providers. Prism may share the scans and other data with affiliates and other service providers that support the purposes described in Section 1, such as providers of data storage, web hosting, and security.
• To The Company. Prism sends The Company a scan and body insights data. The Company's use of the scan and other data are subject to their own policies and practices, not this Policy.
• In connection with business changes. Subject to applicable law, Prism Labs may share the scans and other data for an actual or contemplated business sale, merger, consolidation, change in control, transfer of substantial assets, or reorganization of Prism, or due diligence in anticipation of such an event (for example, if a company were to acquire Prism, it may also acquire the scans and other data we hold).

• To other third parties. Prism may share the scans and other data with third parties where (i) required by applicable law, including responses to legal process (such as a qualifying subpoena or warrant); or (ii) the disclosure completes a financial transaction requested by you or your legally authorized representative.

We may seek your additional consent to these or other disclosures, or we may omit your data from the transfer, where we believe this is required by applicable law.

3. Retention of Information

Prism stores the data described in this Policy, including the body scans that include face geometry, for the purposes described in Section 1 above. For known residents of Illinois, subject to any applicable exception under BIPA, Prism will permanently destroy any scans of face geometry when the first of the following occurs:

• The purpose for collecting such information has been satisfied; or
• Within 3 years of your last interaction with Prism Labs.

To select a destruction method for the scans of face geometry, Prism will take into consideration (i) available technology, (ii) the nature of the data, and (iii) the means by which the data has been stored. Prism may retain other data about Illinois residents, as well as scans and other data about individuals who reside elsewhere, under different retention policies and procedures.

_{A list of data subprocessors can be found at www.prismlabs.tech/subprocessors}