This policy applies to consumers in Washington State and is published under Washington's My Health My Data Act. It covers "consumer health data" collected by Yinbo Intelligent Technology (shenzhen) Co., Ltd, trading as Intiwave. Because our products relate to sexual well-being, we treat information that could reveal that you use or are interested in them as consumer health data. Our Privacy Policy describes the same practices in full. What you listen to, how long you play, what you save and your intensity settings stay on your phone and are not collected by us, so they are not covered here.

• **That you own an Intiwave device**: when you pair a device, its identifier is linked to your account, so that the membership included with it is granted once per device; and when the app checks for a firmware update, the identifier and firmware version are sent so that we can offer the right update. • **What you bought**: orders on our website and subscriptions in the app, so that we can deliver, unlock and support what you paid for. • **Playback link requests**: when you play a track from our library, the app asks for a short-lived link to it, so that we can check you are allowed to play it. We do not keep a listening history from these requests. • **Where you signed up**: if you join our waitlist or newsletter, the page or app screen you signed up on, so that we know which pages work and can credit a referring partner. • **Product usage counts**: the current app does not send any. If we add them, they will be off by default, contain no reference to content, and this policy will be updated first.

• From you, when you create an account, place an order or sign up • From the Intiwave app on your phone • From your Intiwave device, through the app, when you pair it • From Apple, Google and our subscription provider, which tell us whether a subscription is active • From our payment processor, which tells us whether a payment succeeded

We do not sell consumer health data. We share it only as needed to provide what you asked for, with these categories of service providers, who process it on our instructions: • **Hosting and content delivery** (Supabase, Cloudflare) — all of the categories in Section 2 • **Subscription management** (RevenueCat) — subscription status and purchase history • **Payment processing** (Stripe, Apple, Google) — what you bought • **Email** (Klaviyo) — where you signed up, if you joined the waitlist or newsletter • **Shipping partners** — your name and address only; packages do not describe their contents We have no affiliates that receive this data. **Advertising tags on our website**: the Meta (Facebook) pixel never loads for visitors in Washington State, whatever they choose on our cookie banner, so we do not share consumer health data with advertising platforms. Outside Washington it loads only after the cookie banner is accepted, and only on our home, about, press, careers, partner and referral pages.

You have the right to: • Confirm whether we collect, share or sell your consumer health data, and access it • Receive a list of every third party and affiliate with whom we have shared it, with an active email address or other contact for each • Withdraw your consent to collection or sharing • Have your consumer health data deleted To delete your account and its data, use Profile → Legal & data → Delete account in the app; it takes effect immediately, and backup copies expire within 30 days. For any other request, email privacy@intiwave.com with the subject "Washington consumer health data". We may ask you to confirm your identity, and we respond within 45 days; where reasonably necessary we may extend this once by 45 days and will tell you why. **Appeals**: if we decline your request, reply to our answer with the word "Appeal". We will answer the appeal within 45 days and explain our decision. If you are not satisfied, you can contact the Washington State Attorney General at atg.wa.gov.