SHARING CONSENT

This Sharing Consent (the “Consent”) explains how you can use the NovaBloom application ("Application") to share selected Health Information with an adult you (the “user”) choose. You may choose a Recipient, parent, family member, friend, or other eligible adult to receive selected Health Information through the sharing feature (the "Sharing Feature").

1. Voluntary Nature of Authorization

The Sharing Feature is optional, and you do not have to use it to use any other part of the Services. You do not have to accept this Consent to create or maintain an account, participate in a Family Plan, or use any Application feature other than the Sharing Feature. Use the Sharing Feature only if you trust the Recipient and choose to share sensitive health information with that person.

2. Separate Authorization

This Consent is separate from the Terms of Service, Privacy Policy, Consumer Health Data Privacy Notice, Family Plan Consent, and any consent to collect or process information for your account. Accepting any of those documents does not authorize sharing through the Sharing Feature, and this Consent does not change those documents or modify those terms.

3. User Direction

By accepting this Consent, you agree to the Sharing Feature terms and acknowledge the categories of information and Recipients, the purposes of sharing, and how to stop sharing, but you do not authorize sharing with anyone until you separately confirm sharing with a specific Recipient. NovaBloom will share information only at your direction and only after you affirmatively confirm sharing with the named Recipient.

4. Definitions

"Recipient" means a specific adult you choose to receive Shared Information through the Sharing Feature, including a Recipient, parent, family member, friend, or other adult.

"Shared Information" means only the categories of Health Information that you select for a particular Recipient through the in-app controls and separately authorize for that Recipient. NovaBloom will not share a category that you have not affirmatively selected and authorized for that Recipient.

"Health Information" means information relating to the user's menstrual cycle, period dates, fertility, ovulation, pregnancy, symptoms, sexual activity, contraception, temperature, mood, mental health, body, wellness, health status, or any other health-related information entered into, generated by, inferred from, or displayed within the Application.

"Historical Information" means Health Information created, entered, generated, logged, or stored before Recipient Sharing is enabled.

"Future Information" means Health Information created, entered, generated, logged, or stored after Recipient Sharing is enabled.

5. Category Selection -- User Controls

For each Recipient, you choose each category of Health Information through the in-app controls, and no category is selected unless you turn it on. No category is shared by default. The categories that may be available for selection, depending on the Application features used and data logged by the user, are:

(a) menstrual cycle information, including current cycle day and phase, period dates, duration, flow, spotting, and predictions; (b) reproductive and fertility information, including ovulation, fertile windows, fertility status and predictions, basal body temperature, and cervical fluid; (c) pregnancy, pregnancy-loss, postpartum, and breastfeeding information; (d) sexual health information, including sexual activity and contraception; (e) symptoms, pain, medications, supplements, and other treatment information; (f) mood, mental health notes, and journal entries; (g) sleep, energy, skin, digestive, body, wellness, and other health-status information; (h) Application-generated health insights, inferences, and predictions; and (i) health-related goals and reminders.

6. Historical and Future Information

Depending on the Application's configuration, Recipient Sharing may disclose Historical Information, Future Information, or both, within the categories the user has selected. If time-period controls are available, review them before you authorize sharing so that you understand whether you are sharing past information, future information, or both. Before you authorize a Recipient, NovaBloom will show whether each selected category includes Historical Information, Future Information, or both, and will not share it unless you confirm the displayed scope for that Recipient.

7. Recipient of Information

Shared Information may be disclosed only to the specific Recipient identified in the applicable Per-Recipient Authorization and only for the purpose of allowing that Recipient to view the categories selected by the user. You must provide and confirm each Recipient's first name and email address, and you represent that the Recipient is at least 18 years old and that you have the right to provide that information to NovaBloom. The Company may rely on the identification information provided by the user. The Company is not responsible for disclosures resulting from inaccurate, outdated, misspelled, mistyped, misdirected, forwarded, compromised, or otherwise incorrect Recipient identification information provided by the user.

8. Recipient Account and Access

NovaBloom will send the Recipient an invitation that identifies you by name and identifies the Application, which may reveal that you use a menstrual and sexual health tracking application, but the invitation will not contain Health Information; NovaBloom will not share any Shared Information unless the Recipient creates or signs in to an account, confirms being at least 18 years old, and accepts any applicable Recipient terms.

The Company may, in its sole discretion, deny, suspend, limit, or terminate a Recipient’s access at any time if the Company determines that the access may violate applicable law or Company policies, create a security risk, involve unauthorized use, or create a risk of harm to any person. The Company has no obligation to monitor any Recipient’s access or use of shared information, to investigate any Recipient’s conduct, or to take any action described in this section, and the Company is not responsible for any Recipient’s access to, use of, or disclosure of information a user chooses to share. Any decision by the Company not to deny, suspend, limit, or terminate a Recipient’s access does not constitute approval of that Recipient’s conduct or a waiver of the Company’s right to take action later.

The Company will delete an unaccepted Recipient’s first name and email address when the user cancels the invitation or if the Recipient does not accept the invitation within 7 days.

9. View-Only Access

The Sharing Feature gives the Recipient view-only access to the Shared Information you select unless NovaBloom clearly tells you otherwise before you authorize sharing. Recipient Sharing does not authorize the Recipient to edit the user's entries, change the user's settings, modify the user's account, submit information on the user's behalf, make health decisions for the user, communicate with health care providers on the user's behalf, manage the user's subscription, or act in any legal capacity on the user's behalf.

10. Sensitive Nature of Information

Shared Information is highly sensitive. It may reveal or allow others to infer information about the user’s menstrual cycle, fertility, ovulation, sexual activity, contraception use, pregnancy, pregnancy loss, reproductive health conditions, mood, mental health, physical health, and other private matters. Shared Information is consumer health data, sensitive data, or similarly protected information under many state, federal, and international privacy laws, as described in the Privacy Policy and the Consumer Health Data Privacy Notice.

11. Risks After Disclosure

After a Recipient views Shared Information, the Company cannot control whether the Recipient takes a screenshot, makes a copy, verbally discloses it, or otherwise uses or retains it outside the Application. After a Recipient views Shared Information, the Company cannot prevent the Recipient from taking a screenshot, recording or copying the information, disclosing it to others, or otherwise using or retaining it outside the Application. Information a Recipient copies or retains outside the Application will not be deleted when you stop sharing, delete Shared Information, or delete your account, and it is not subject to the Company’s policies for responding to subpoenas, warrants, or other legal requests.

The user acknowledges that any Shared Information may be captured and retained by a Recipient in a form the Company cannot retrieve, modify, or delete, and that the user assumes this risk by choosing to share. The Company is not responsible for any Recipient’s use, retention, or disclosure of Shared Information, and you should share information only with people you trust.

12. Relationship Change Risks

Your relationship with a Recipient may change. Separation, divorce, relationship conflict, domestic disputes, custody proceedings, changes in household circumstances, or changes in device or account control may affect whether continued Recipient Sharing is appropriate and safe. The Company does not monitor the user’s relationships or circumstances and will not revoke Recipient Sharing unless the user does so through the Application or asks the Company to do so.

The user is solely responsible for deciding whether to enable, continue, limit, or revoke Recipient Sharing, and should revoke it promptly if the user no longer wants a Recipient to receive Shared Information or if any change in the user’s circumstances makes continued sharing unsafe or unwanted. Revoking Recipient Sharing ends the Recipient’s access going forward but does not affect Shared Information the Recipient has already viewed or retained, which may be used or disclosed by the Recipient, including in legal proceedings

13. Device and Account Security Risks

The user acknowledges that the Recipient's device, email account, phone number, authentication method, cloud backup, or account credentials may be accessed by other people. Shared Information may be visible to or accessible by third parties who use or control the Recipient's devices or accounts. The Company is not responsible for unauthorized access to Shared Information caused by the Recipient's device settings, account sharing, compromised credentials, unlocked devices, shared devices, cloud backups, or other security vulnerabilities outside the Company's control.

14. Coercion Acknowledgment

By accepting this Sharing Consent, the user confirms that the user is choosing to enable Recipient Sharing voluntarily and is not doing so because of coercion, threats, pressure, or direction from any other person, including the Recipient. If the user feels unsafe or pressured to share, the user should not accept this Sharing Consent and should seek help from a trusted person or appropriate legal, medical, or emergency services. If the user has already enabled Recipient Sharing under pressure, the user may revoke it at any time through the “My People” page, and the Company will not notify the Recipient. The Company may, but is not required to, suspend or disable Recipient Sharing if it determines that a user may be sharing under coercion, and the Company has no obligation to monitor for or investigate coercion.

15. User Representations

By accepting this Consent and each Per-Recipient Authorization, the user represents that: (a) the user is the individual whose Health Information will be shared; (b) the user has authority to direct the disclosure; (c) the user has accurately identified the intended Recipient by first name and email address; (d) the Recipient is at least 18 years old; (e) the user has the right to provide the Recipient's first name and email address to the Company; and (f) the user is acting voluntarily and without coercion or undue influence.

16. Duration of Authorization

This Consent begins when the user accepts it through the single checkbox, but sharing with a Recipient begins only after the user completes a Per-Recipient Authorization for that Recipient and the Recipient completes any required invitation steps.

This Consent remains in effect until the user withdraws it, disables Recipient Sharing, or deletes the user’s account, or until the Company discontinues the Recipient Sharing feature or terminates the user’s access to it. Each Per Recipient Authorization remains in effect until the earliest of the following: the user revokes it or removes the Recipient; the Recipient declines the invitation, stops receiving Shared Information, or deletes the Recipient’s account; the Company terminates the Recipient’s access; or this Consent ends. When this Consent ends, every Per Recipient Authorization ends with it.

If the Company materially changes the Recipient Sharing feature or the categories of data that can be shared, the user must accept the revised Consent before sharing continues.

17. Ongoing Disclosure Authorization

A Per-Recipient Authorization permits ongoing sharing of the authorized categories with that Recipient without renewed authorization until the user withdraws it; however, the user must affirmatively authorize any additional category before it is shared, and if the Company materially changes how the Sharing Feature works or the categories available for sharing, the user must accept the revised Sharing Consent before sharing continues.

18. Right of Revocation

The user may stop sharing with any Recipient, or turn off all Recipient Sharing, at any time through the sharing controls in the Application. Stopping sharing will be as easy as starting it, and the Company will end the affected Recipient’s access to Shared Information as soon as the request is processed, which will occur within immediately. The user may also submit a request to stop sharing by emailing privacy@novabloom.io, and the Company may verify the user’s identity before acting on a request submitted outside the Application.

19. Effect of Revocation

Revocation stops future disclosures after the Company has processed the revocation request. Revocation does not affect Shared Information already disclosed to, viewed by, retained by, copied by, downloaded by, recorded by, or otherwise obtained by the Recipient before revocation was processed. Unless the Recipient is separately required by applicable law or a separate written agreement to delete or return information, the Company has no obligation to retrieve, delete, or disable information already in the Recipient's possession.

20. Changes to Shared Categories

The user may change the categories shared with any Recipient at any time. Turning a category off stops sharing it immediately, and turning on an additional category requires you to authorize that category before NovaBloom shares it with that Recipient. Category changes apply prospectively after being processed by the Application. Changes do not affect information already disclosed to or retained by the Recipient before the change was processed.

21. No Medical, Legal, or Emergency Use

Recipient Sharing is not designed or intended for medical diagnosis, treatment, emergency response, safety monitoring, legal compliance, contraception supervision, pregnancy monitoring, fertility treatment management, or any other purpose requiring professional advice or real-time intervention. Designation of a Recipient does not make that person a health care provider, emergency contact, or legal representative. The user and the Recipient remain independently responsible for seeking professional medical advice and emergency assistance as appropriate.

22. No Sale of Health Information

This Consent is intended solely to authorize a user-directed disclosure of Shared Information to the specific Recipient designated by the user. It does not authorize the Company to sell the user's Health Information to the Recipient or any other person, use Shared Information for targeted advertising, or disclose Shared Information to data brokers, advertising networks, analytics providers, or unrelated third parties.

23. Company Rights to Protect Safety and Security

The Company may suspend, limit, disable, or terminate Recipient Sharing without notice if the Company reasonably determines that continued sharing may violate applicable law, violate Company policies, create a security risk, facilitate unauthorized access, involve coercion, or otherwise compromise the safety, security, or lawful operation of the Application. The Company is not obligated to monitor ongoing relationships or independently assess whether a Recipient designation remains appropriate over time.

24. Recipient Conduct

The Recipient is solely responsible for the Recipient's conduct after receiving Shared Information. The Company is not responsible for the Recipient's use, misuse, retention, disclosure, publication, interpretation, or reliance on Shared Information. The Company is not responsible for disputes, emotional distress, relationship conflict, reputational harm, economic harm, safety concerns, or other consequences arising from the user's decision to share Health Information with the Recipient, except to the extent liability cannot be limited under applicable law.

25. Records of Authorization and Disclosure

The Company will keep a record of the user’s acceptance of this Consent, each authorization for a Recipient, the categories and time scope you authorize, and each withdrawal or category change. These records shall be maintained in accordance with applicable law and the Company's Privacy Policy.

26. International and State-Specific Rights

Depending on where the user lives, the user may have additional rights under applicable privacy laws, including but not limited to the California Consumer Privacy Act, Washington My Health MY Data Act, Colorado Privacy Act, Virginia Consumer Data Protection Act, General Data Protection Regulation, and other applicable state, federal, and international laws. These rights may include the right to access, delete, correct, restrict, withdraw consent, or appeal certain privacy decisions. NovaBloom will provide the methods required by applicable law for you to exercise these rights. Nothing in this Consent waives rights that cannot be waived under applicable law.

27. Release for Authorized Disclosures

To the fullest extent permitted by applicable law, the user releases the Company from claims, losses, liabilities, damages, costs, and expenses arising from disclosures of Shared Information made in accordance with this Consent and the user's selections, settings, and instructions through the Recipient Sharing feature.

28. Limitation of Liability

To the fullest extent permitted by applicable law, the Company will not be liable for indirect, incidental, consequential, special, exemplary, punitive, or loss-of-privacy damages arising from the user's voluntary use of Recipient Sharing, the Recipient's conduct, or disclosures authorized by the user, except to the extent such limitation is prohibited by applicable law.

29. Indemnification for Unauthorized Conduct

To the fullest extent permitted by applicable law, the user agrees to indemnify and hold harmless the Company from claims, losses, liabilities, damages, costs, and expenses arising from the user's misidentification of the Recipient, unauthorized use of another person's account, misrepresentation of authority, violation of this Consent, or use of Recipient Sharing in a manner that violates applicable law or Company policies.

30. Severability

If any provision of this Consent is determined to be invalid, unenforceable, or contrary to applicable law, that provision shall be modified to the minimum extent necessary to make it enforceable, or severed if modification is not possible. The remaining provisions continue in full force and effect.

31. Term and Survival

This Consent remains effective until revoked prospectively, Recipient Sharing is disabled, the Recipient is removed, the user account is terminated, or the Company terminates the Recipient Sharing feature. Sections 11 (Risks After Disclosure), 12 (Screenshots, Recordings, and Copies), 20 (Effect of Revocation), 25 (Recipient Conduct), 26 (Records of Authorization and Disclosure), 28 (Release for Authorized Disclosures), 29 (Limitation of Liability), 30 (Indemnification for Unauthorized Conduct), and 31 (Severability) shall survive termination or revocation of this Consent.

32. Electronic Signature

By checking the box next to the link to this Consent, you electronically sign and accept this Consent; you will separately confirm sharing with each identified Recipient and do not need to accept this full Consent again for that Recipient. This electronic acceptance constitutes a legally binding signature, and any other applicable electronic signature law, and has the same legal effect as a handwritten signature.