HapNex Consumer Health Data Privacy Notice

Version 1.5 · Prepared 2026-10-04 · Effective upon publication, subject to applicable material-change notice requirements

1. Scope and contact

This notice explains how HapNex, Inc., a Delaware corporation, handles health-related event requirements alongside its general Privacy Policy. Washington My Health My Data rights apply where HapNex and the person or processing concerned fall within that law. Its consumer definition concerns Washington residents or people whose health data is collected in Washington, acting in an individual or household context, with employment-context information excluded. The company's mailing address alone does not determine coverage. Contact team@hapnex.ai; mailing address: 56 Broad St STE 91263, Boston, MA 02109, United States.

2. Categories and purposes

We may receive a person's food-allergy or health-related dietary requirement, mobility or accessibility requirement, or information needed to communicate or accommodate that requirement. Where the requirement is linked or reasonably linkable to a person, related contact, booking and event context are included. We ask for service requirements, not diagnoses, medical records or unrelated history. Small-group counts can remain identifiable. We use the minimum necessary information to assess and coordinate the requested event item, confirm which accommodation the caterer or venue can provide, communicate about it, and address a related incident or request. We do not build health profiles or infer unrelated health conditions from ordinary browsing.

3. Sources

Sources are the person providing a requirement directly, an organizer who actually has permission or another lawful basis to provide it, and a relevant vendor or venue communicating about the requested service or a related incident. We do not acquire consumer health lists from data brokers. A representative's assertion does not replace any legally required authorization from the affected person.

4. Sharing and recipients

Shared categories are only the requirements and associated context the recipient needs for that event item or authorized purpose. Recipients may be the booked caterer, the relevant venue or accessibility service provider, the event coordinator, and providers that securely host or support those functions under restricted instructions. An organizer receives another person's details only with authority for that disclosure. Necessary incident handling may involve an insurer, claims adviser or legal adviser within a lawful, disclosed purpose. We do not share these requirements with company affiliates; no affiliate is a recipient under this notice. We do not send raw health requirements to AI model providers or connected calendars. Advertising and conversion-measurement providers receive no health requirements or identifiers revealing them. We do not sell consumer health data or use it for targeted advertising. We do not use geofencing around health-service locations to identify or track people, collect health data or send health-related advertising.

5. Choices before collection and sharing

Providing details is optional. Before collecting designated requirements, we explain the data, purpose and withdrawal route and ask for a specific affirmative collection choice. Before sharing them, we separately explain the necessary recipients and purpose and ask for a sharing choice. General terms acceptance is not that consent. Where law permits processing strictly necessary for a service the affected person requested without additional consent, that exception is limited to that service and is not blanket permission from an organizer. You can skip the details, ask for human coordination or withdraw future collection and sharing consent through team@hapnex.ai. We explain the effect on remaining services and discuss feasible alternatives without unlawful discrimination. A new health-data category or purpose requires its disclosure and any required affirmative consent first.

6. Access deletion and appeals

Where the Washington law applies, you can confirm processing, access your health data and the recipient list with contact methods, withdraw collection or sharing consent, and request deletion. Email team@hapnex.ai; no new account is required. We use reasonable authentication, respond without undue delay within 45 days, and explain within that period any necessary one-time extension of up to 45 days. Authentication does not restart the clock. Requests are free at least twice annually, subject only to lawful excessive-request rules. We notify relevant affiliates, processors, contractors and third parties of a valid deletion request and require its handling under applicable law. Our general 35-day backup-overwrite commitment continues to apply; we do not extend it simply because Washington law permits a longer archive period. For a denial, reply to appeal. We explain the appeal outcome within 45 days and, if denied, provide a way to complain to the Washington Attorney General. Legal retention must have an applicable legal basis; a possible future claim is not a general deletion exception.

7. Retention security and changes

Designated dietary, allergy and accessibility requirements are ordinarily deleted 90 days after the event or sooner in response to an applicable deletion right. The general Privacy Policy identifies separate record periods and security practices. Necessary legally permitted holds are documented, limited, reviewed and ended when their basis ends; they cannot override a mandatory deletion right. We require processors to follow the disclosed purpose and safeguards and help carry out valid requests. We publish material changes and give the notice required by the general Privacy Policy before they apply. This notice does not authorize a new feature whose consent, sharing, security or deletion controls are not ready.