Malibu Protocol Consumer Health Data Privacy Policy

Document control

MP-CHD-BETA-1.1

Effective date

August 19, 2026 (private beta)

Last updated

August 24, 2026

Primary focus

Washington My Health My Data Act disclosures

This Consumer Health Data Privacy Policy describes how Westward Science LLC, d/b/a Malibu Protocol ("Malibu Protocol," "Westward," "we," "us," or "our"), collects, uses, and shares consumer health data under Washington's My Health My Data Act. Our general Privacy Policy provides other privacy disclosures. Other states may require separate supplements; this notice does not claim that one Washington notice satisfies every state's law.

Consumer health data we collect and why

We may collect the following categories to provide a product or service you request:

We also use the minimum consumer health data necessary to authenticate access, protect security, prevent fraud, comply with law and contracts, respond to a consumer request, maintain required records, investigate incidents, and exercise or defend legal claims.

We will not collect or use an additional category of consumer health data or use an existing category for an additional purpose requiring consent without first disclosing the category or purpose and obtaining the required affirmative consent.

Where collection is necessary to provide a product or service a consumer requests, we rely only on that statutory basis for the data and purpose necessary to provide the request. If consent is required, the request will separately and conspicuously disclose the categories collected, specific purpose and uses, and how to withdraw consent before collection begins.

Sharing consent, when required, is separate and distinct from collection consent. It identifies the categories shared, purposes, recipient categories, and withdrawal method. Acceptance of Terms, care, or a purchase is not a substitute for any separate consent required by law.

Sources

We collect consumer health data from:

• you, including through intake, account, portal, communication, support, transaction, and privacy-request workflows;
• a legally authorized representative or person you direct;
• Beluga Health, P.A., its affiliated medical practices, and clinicians who provide or support requested care;
• independent pharmacies, laboratories, and fulfillment providers involved in your requested service; and
• processors acting for Westward, such as hosting, database, authentication, payment, communication, security, and customer-support providers.
• public marketing-page requests and the consumer's browser or device, including referrer, campaign/creator code, IP address, and essential network or security information.

Consumer health data we share

To provide a product or service you request, or with a separate consent where required, we may share:

• identity, contact, location, intake, health history, symptoms, measurements, photographs/documents, medication, treatment-preference, and consent data with the applicable medical practice and clinicians;
• identity, contact, prescription/order, allergy, delivery, and fulfillment information with an independent pharmacy or laboratory as directed by the clinician and requested by you;
• minimum necessary account, transaction, refund, fraud, and dispute data with payment processors and financial institutions;
• minimum necessary delivery information with carriers and fulfillment providers;
• information with a person or entity you direct us to share it with; and
• information required by law, lawful process, safety, security, fraud prevention, or the establishment, exercise, or defense of legal claims.

We do not sell consumer health data. We do not share consumer health data with advertising networks, data brokers, or social media platforms for targeted advertising. We do not use geofences around in-person healthcare facilities to identify or track people seeking health services, collect health data, or send health-related advertisements.

Categories of recipients

• Independent medical providers: Beluga Health, P.A. and the specific affiliated medical practice and clinician identified for your care in the clinical flow.
• Independent pharmacies and laboratories: the licensed pharmacy or laboratory named on your prescription, lab order, or fulfillment notice.
• Service processors: hosting, database, authentication, payment, communications, security, support, and fulfillment vendors that process data under contract solely to deliver the Services described above.
• Carriers and financial networks: entities required to deliver an order or process an authorized transaction.
• Professional and legal recipients: auditors, attorneys, insurers, regulators, courts, and authorities when disclosure is permitted or required.
• Westward affiliates: none as of the effective date.

For a verified access request, we will provide the legal names and contact mechanisms of third parties and affiliates with which we shared your consumer health data, to the extent required by applicable law. If a recipient changes, we update this notice and obtain any consent required before new sharing begins.

Your consumer health data rights

Subject to applicable law, you may:

• confirm whether we collect, share, or sell your consumer health data and access that data, including a list of third parties and affiliates with whom it was shared or sold;
• withdraw consent for future collection or sharing when consent is the basis;
• request deletion from our active and archived systems and require us to notify processors and other recipients as applicable; and
• appeal our refusal to act on a request.

To exercise a right or appeal, use privacy@malibuprotocol.com. You do not have to create a new account to submit a request, although we may require use of an existing account. We will authenticate the request using commercially reasonable methods appropriate to the sensitivity of the data. An authorized agent may submit a request with the proof required by law. We will not unlawfully discriminate against you for exercising a right.

We will respond without undue delay and within 45 days after receipt. When reasonably necessary because of complexity or request volume, we may extend once for up to 45 additional days if we notify you within the initial period and explain the reason. Responses are free up to twice per year, subject to the law's rules for manifestly unfounded, excessive, or repetitive requests.

If we refuse a request, you may appeal using the same conspicuous request method within 45 days (or longer if required by applicable law). We will respond to an appeal in writing within 45 days and explain the decision. If we deny the appeal, you may contact the Washington Attorney General through its consumer-complaint method at https://www.atg.wa.gov/file-complaint.

For a verified deletion request, we will delete covered consumer health data from our active systems and notify applicable affiliates, processors, contractors, and third parties as required. Deletion from archived or backup systems may be delayed only as permitted by law and no longer than six months after authentication. Legal exceptions may apply.

Withdrawing consent or deleting information needed for requested telehealth, payment, pharmacy, fulfillment, or account services may prevent us from continuing those services. A request does not require deletion of information that applicable law permits or requires us or an independent medical provider to retain, including protected medical records outside Westward's control.

Contact

• Privacy request and appeal: privacy@malibuprotocol.com
• Mailing address: Westward Science LLC, Attn: Legal Notices, 30 N Gould St # 67817, Sheridan, WY 82801

Do not include medical details in ordinary email. Use the secure care channel for clinical communications and the medical-record contact in the Provider Group's Notice of Privacy Practices for records controlled by the Provider Group.