Nerdstrong Fitness Privacy Policy

Version [1.0]. Effective 11.4.2026. Last updated 11.4.2026.

This Privacy Policy explains how Nerdstrong Fitness, LLC, an Oregon limited liability company ("Nerdstrong," "we," "us," or "our"), collects, uses, shares, and protects personal information. It applies to our website at nerdstrong.fitness (the "Website"), the Nerdstrong members app (the "App"), the check-in kiosk and door access system at our studio, our text and email messages, our Facebook Page and Instagram account, and our studio at 3450 N Williams Ave, Retail 17, Portland, Oregon 97227 (together, the "Services").

If you live in Washington State, our Consumer Health Data Privacy Policy in Exhibit A also applies to you, and it controls if it conflicts with this Privacy Policy on any question about consumer health data.

1. Summary

1.1 The Short Version. (i) This Privacy Policy covers everyone whose information we handle: website visitors, people who contact us or sign up for information, drop-in and class pack customers, online customers, and members. (ii) We collect what we need to answer your questions, sell and deliver our services, book your classes, coach you safely, secure the studio, and run the App. (iii) We built and run our own membership and booking software, so your account information is not held by an outside membership software company. (iv) We do not sell your personal information. (v) We do not use advertising pixels, ad retargeting, or third-party advertising trackers on the Website or App, and we do not upload customer or lead lists to Meta, Google, or any other platform. (vi) We do not share your mobile number or text message consent with anyone for their marketing. (vii) We use artificial intelligence from Anthropic to help write, and in limited cases send, our messages. AI does not receive the injury notes or medical details on your profile. See Section 7. (viii) Health and injury notes are visible only to the staff who need them to coach you safely.

2. Who This Privacy Policy Covers

2.1 Everyone We Deal With. This Privacy Policy applies to personal information about:

(i) Website and App visitors, including people who browse without creating an account;

(ii) Leads, meaning people who contact us, ask about classes or pricing, sign up for updates, or are referred to us;

(iii) Customers, meaning people who buy a Single Drop-In, Class Pack, Personal Training, the Foundations Course, or an Online Membership, whether or not they also hold a studio membership;

(iv) Members, meaning people who hold a Monthly or Prepaid Membership; and

(v) Other people whose information we receive, such as emergency contacts that customers and members give us and witnesses named in incident reports.

2.2 "You." In this Privacy Policy, "you" means any of the people described in Section 2.1. Some sections, such as those about the Community board, apply only to members, and say so.

2.3 Not Covered. This Privacy Policy does not cover information about Nerdstrong employees and job applicants in that role, which we handle under separate notices.

3. Information We Collect

3.1 Information You Give Us. When you contact us, sign up, buy, book, or use the Services, you may give us: (i) your name, email address, mobile phone number, mailing address, and date of birth; (ii) what you are interested in, your fitness goals, and how you heard about us; (iii) emergency contact name and phone number; (iv) purchase history, membership or package choices, and billing details; (v) your signatures on our Membership Agreement and releases, including the version signed and the date and time; (vi) your text and email preferences; (vii) a profile photo, if you add one; (viii) for members, posts, outing listings, RSVPs, comments, and reports you make on the App's Community board; (ix) habit check-ins you choose to record in the App; (x) the reason you give when you ask to freeze or hold a membership; and (xi) messages you send us by email, text, the App, or the Website, including anything you choose to tell us about an injury or health condition.

3.2 Information From Others. We may receive information about you from: (i) a member or customer who refers you to us or names you as an emergency contact; and (ii) our staff and other people who report an incident involving you. If someone refers you to us, we will not send you marketing texts unless you agree to them yourself. Our membership platform does not import contact details, messages, or lead form entries from Facebook, Instagram, or Google.

3.3 Payment Information. Card and bank details are collected and stored by our payment processor, Stripe, Inc. ("Stripe"). We do not store full card or bank account numbers. We see only limited details, such as the card type, last four digits, and expiration date. Stripe may also use payment information to prevent fraud and meet its own legal obligations, as described in Stripe's privacy policy.

3.4 Health and Fitness Information. We collect limited health and fitness information, described in Section 8.

3.5 Information Our Staff Record. Our staff may record class attendance, check-ins, no-shows, and late cancellations; injuries and limitations you tell a coach about that affect how you train; membership holds and their reasons; incident reports if someone is injured or a safety concern arises; general notes from conversations with leads, customers, and members; and notes about Community board reports and moderation actions. Staff are instructed to record health information only in the injury and medical fields described in Section 8, and not in general notes.

3.6 Door Access Information. Our studio uses a keyless door access system provided by [door access provider name]. When you are given access, we record the access credential assigned to you (such as an App key, PIN, or card) and the date, time, and door of each entry. [Our door access system does not use fingerprints, facial recognition, or any other biometric information.]

3.7 Information Collected Automatically. When you use the Website or App, we and our service providers may collect device and usage information, such as your device type, browser, IP address, pages viewed, and the date and time of your visit. When we send email, we track whether the email was opened and whether links in it were clicked. See Sections 10 and 11.

3.8 What We Do Not Collect. We do not collect heart-rate, wearable-device, or precise location data from your device, and we do not ask you to complete a medical history questionnaire. If we decide to start collecting any of these, we will update this Privacy Policy first and, where the law requires, ask for your consent.

4. How We Use Information

4.1 Answering Leads and Selling Our Services. We use personal information to respond to questions, send information you asked for, follow up about classes and memberships, and, if you have agreed, send news and offers.

4.2 Running the Services. We use personal information to: (i) create and manage your account, purchases, and membership; (ii) process payments, renewals, cancellations, freezes, holds, and refunds; (iii) book classes, personal training, and sessions and send reminders; (iv) deliver online workouts and Online Memberships; (v) coach you safely, including adapting exercises to injuries or limitations you have told us about; (vi) give you access to the studio and keep it secure; (vii) for members, operate the App and its Community board, including showing your outing posts and RSVPs to other members; (viii) contact your emergency contact if you are hurt or ill; and (ix) respond to your questions and requests.

4.3 Safety, Security, and Legal Obligations. We use personal information to keep our studio and Community board safe; to review and respond to reports of misconduct, injuries, or incidents, including by reviewing door access records; to enforce our Membership Agreement, releases, Studio Rules, and Community Guidelines; to prevent fraud and misuse; to keep records we are required or permitted by law to keep; and to protect our rights in legal claims.

4.4 Communications. We use your contact information to send service messages (such as receipts, booking confirmations, schedule changes, and billing notices) and, if you have agreed, news and offers. Some of these messages are written or sent with the help of artificial intelligence. See Sections 7, 9, and 10.

4.5 Running and Improving Our Business. We use attendance, sales, booking, and usage information, mostly in summary form, to plan schedules, understand which classes and offers work, and improve classes, the Website, and the App. Staff may use AI to help with this analysis, as described in Section 7.

4.6 Social Media. We post to our Facebook Page and Instagram account and review statistics about our own posts, such as reach and engagement. We do not use your personal information to target advertising on these platforms.

5. Who Can See Your Information

5.1 Other Members. When a member posts or joins a Member Outing, other members can see that member's first name, last initial, and profile photo (if added). The meeting place and start time of an outing are shown only to members who have joined it. Email addresses, phone numbers, and other account details are not shown to other members. Leads and customers who are not members do not appear on the Community board.

5.2 Nerdstrong Staff. Staff can access information only as needed for their role. Coaches can see injuries and limitations recorded on your profile so they can coach you safely. Custom profile fields holding medical details are limited to administrators unless a coach needs specific information to keep you safe. Staff see only totals from habit check-ins, not your individual entries. Door access records are available only to administrators.

6. How We Share Information

6.1 We Do Not Sell Your Information. We do not sell personal information, and we do not share it with third parties for their own marketing or advertising. We do not upload customer, member, or lead lists to Meta, Google, or any other platform, for advertising or any other purpose.

6.2 Our Own Platform and Our Service Providers. Our membership, booking, customer records, and App platform is software that Nerdstrong built and operates itself (our "membership platform"). It is not provided by an outside membership software company. To run it and the rest of the Services, we share personal information with the companies below, which provide services to us. We use them only under terms that limit their use of your information to providing services to us, except as noted for Stripe in Section 3.3. They are:

(i) Website, App, and membership platform hosting: Vercel, Inc.;

(ii) Database hosting: Neon, which stores the data in our membership platform and App;

(iii) Artificial intelligence: Anthropic, PBC, which provides the Claude AI model described in Section 7;

(iv) Text messaging: Twilio Inc.;

(v) Payments: Stripe, Inc.;

(vi) Email delivery: Resend, which sends our service and marketing emails and provides email open and click counts;

(vii) Business email, calendar, and documents: Google LLC, through Google Workspace [confirm];

(viii) Door access: [door access provider name];

(ix) Website builder: [Squarespace, if still used];

(x) Online workout video delivery: [provider name, if separate from the platforms above]; and

(xi) Professional advisers, such as accountants, insurers, and lawyers.

6.3 Facebook, Instagram, and Google. Our membership platform connects to Meta Platforms, Inc. only to publish posts to our Facebook Page and Instagram account and to read statistics about those posts. It does not send customer, member, or lead information to Meta, and it does not read Messenger or Instagram messages or import lead form entries. If you message us, comment, or leave a review on Facebook, Instagram, Google, or another outside platform, that platform collects your information under its own privacy policy, which we do not control, and our staff may read and reply to you on that platform.

6.4 Legal and Safety Reasons. We may share information when we believe in good faith it is reasonably necessary to comply with law, a subpoena, or a court order; to respond to an emergency involving risk of injury or death; to report or assist with a possible crime; to give our insurer notice of an incident or claim; or to protect the rights, safety, or property of Nerdstrong, our customers, members, or others.

6.5 Business Transfers. If Nerdstrong is sold, merged, or reorganized, personal information may be transferred to the new owner, who will be required to honor this Privacy Policy for information collected under it.

6.6 With Your Permission. We may share information in other ways if you ask us to or agree.

7. Artificial Intelligence

7.1 How We Use AI. We use Claude, an artificial intelligence model provided by Anthropic, PBC, within our membership platform. Claude may: (i) draft replies to messages you send us by email, text, the App, or the Website, for staff to review; (ii) draft reminders, follow-ups, and announcements, for staff to review; (iii) send messages automatically in two limited cases, when we have turned this feature on: replies to questions from leads, and follow-up messages after a drop-in visit; and (iv) help our staff analyze attendance, booking, sales, and membership information to plan schedules, offers, and member outreach.

7.2 Information AI Receives. To do these tasks, Claude receives the information needed for the task, such as your name, the services you have bought, your membership status and holds, your attendance and upcoming bookings, and the content of the conversation it is helping with. If you send us a message that mentions an injury or health condition, Claude may read that message in order to draft or send a reply to it.

7.3 Information AI Does Not Receive. Claude does not receive: (i) the injury and limitation notes on your profile; (ii) the medical details in administrator-only profile fields; (iii) counts or summaries of injuries; (iv) whether a membership hold is for injury, illness, or another health reason, or the reason typed for a hold; (v) incident reports; or (vi) your payment card or bank details. Staff are instructed not to include health information in general notes, which Claude may see.

7.4 Anthropic's Role. Anthropic processes this information as our service provider, to provide the AI service to us. Under Anthropic's commercial terms, Anthropic does not use our content to train its AI models, and it keeps our content only for a limited period set out in those terms and its data processing addendum.

7.5 People Make the Decisions. Staff review AI-drafted messages before they are sent, except the two kinds of automatic messages described in Section 7.1(iii). AI does not decide whether to sell, refund, cancel, freeze, suspend, or end a membership or purchase, how to handle a safety report, or what moderation action to take on the Community board. Our staff make those decisions.

7.6 Knowing When You Are Talking to AI. Every message sent automatically by AI, without a person reviewing it first, identifies itself as coming from Nerdstrong's AI assistant. You can ask to talk to a person at any time by saying so in your reply or emailing support@nerdstrong.fitness.

7.7 Not Medical Advice and Not for Emergencies. AI messages are not medical advice, and AI does not monitor messages for emergencies. In an emergency, call 911.

7.8 Your Text and Email Choices Still Apply. Whether a message is written by a person or with AI, we send it only through the text and email programs you have agreed to, and your opt-outs apply to both.

8. Health and Fitness Information

8.1 What We Collect. The health and fitness information we hold is limited to: (i) injuries and physical limitations you tell our staff about and that staff record on your profile; (ii) medical details you choose to give us that are recorded in administrator-only profile fields; (iii) membership holds for injury or illness and any reason you give for them; (iv) health information you choose to include in a message to us; (v) incident reports if you are injured or become ill at the studio, or if an injury on a Member Outing is reported to us; and (vi) habit check-ins (water, sleep, and protein) you choose to record in the App.

8.2 What Is Not Recorded. Our releases ask you to tell a coach about any injury, illness, or pregnancy that may affect your training. Telling a coach does not mean it is recorded. A coach records information only if it is needed to adapt your training, and you may ask what is recorded about you at any time.

8.3 How We Use It. We use health and fitness information only to coach you safely, process holds you request, reply to messages you send us, respond to injuries and emergencies, keep incident records, and provide the App features you choose to use. We do not use it for marketing or business analysis, and we do not share it with anyone except the service providers that host, store, and deliver our systems and messages (Vercel, Neon, Resend, and Twilio), Anthropic only as described in Section 7.2, your emergency contact or emergency responders in an emergency, our insurer in connection with an incident, or as required by law.

8.4 Your Choices. You may ask us to correct or delete health and fitness information about you, subject to Section 12.3. You may stop recording habit check-ins at any time.

9. Text Messages

9.1 Who This Section Covers. This Section applies to anyone who gives us a mobile number, including leads, customers, and members.

9.2 Two Separate Text Programs. Nerdstrong sends two kinds of text messages, and you choose each one separately. (i) Service texts include replies to your questions, class and appointment reminders, booking and waitlist updates, follow-ups after a drop-in visit, schedule changes, purchase, billing, and account notices, and safety or closure notices. (ii) News and offers texts include promotions, follow-ups about memberships and packages, new class announcements, events, and other marketing. We send news and offers texts only to people who have separately agreed to receive them.

9.3 Consent. You agree to each text program by checking its own box when you contact us or sign up on the Website, in the App, or at the studio kiosk, or by changing your preferences later. Agreeing to news and offers texts is never a condition of buying anything. If you text us first, we may reply to that conversation, but we will not send you news and offers texts unless you have agreed to them.

9.4 AI-Assisted Texts. Some of our texts are drafted or sent with the help of artificial intelligence, as described in Section 7.

9.5 Frequency and Timing. Message frequency varies. Service texts are sent as needed for your questions, bookings, and account. News and offers texts are typically sent no more than [4] times per month. We send news and offers texts only between 8:00 a.m. and 8:00 p.m. Pacific time and no more than three times in any 24-hour period.

9.6 Costs. Message and data rates may apply, depending on your mobile plan. Nerdstrong does not charge for text messages.

9.7 How to Stop. You may stop text messages at any time. (i) Reply STOP to any text to stop all texts from that number. (ii) To stop only news and offers texts and keep service texts, or the reverse, change your text preferences in the App or your online account, or ask us at the studio or at support@nerdstrong.fitness. We will send one message confirming that you have opted out, and we will honor your request promptly and within the time the law requires. You may opt back in at any time.

9.8 Help. Reply HELP to any text, or contact us at support@nerdstrong.fitness or (503) 820-0062.

9.9 Mobile Information Is Not Shared. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text message opt-in data and consent are excluded from every category of sharing described in this Privacy Policy and will not be shared with any third party, except our service providers, including Twilio and the providers that host our own membership system (Vercel and Neon), solely to send our messages to you.

9.10 Carriers. Mobile carriers are not liable for delayed or undelivered messages.

10. Email

10.1 Service and Marketing Email. We send service emails about your questions, purchases, account, membership, and bookings. If you agree, we also send news and offers by email. Our emails are delivered by Resend. Some emails are drafted or sent with the help of artificial intelligence, as described in Section 7.

10.2 Email Tracking. Our emails may contain technology, provided through Resend, that tells us whether an email was opened and which links were clicked. We use these counts to understand which messages are useful. We do not use them for advertising and do not share them with third parties other than our service providers.

10.3 Unsubscribing. You may unsubscribe from marketing emails using the link in any marketing email or by changing your preferences. You will still receive service emails about any purchase, account, or membership you have.

11. Cookies and Analytics

11.1 Website. Our Website uses cookies and similar technologies that are necessary for it to work, such as remembering your login and checkout session. Our payment processor, Stripe, may set cookies during checkout to process payments and prevent fraud. Our website and hosting providers may also collect basic visitor statistics, such as page views and general location by city or region, to help us understand how the Website is used. [Describe any analytics settings once confirmed.]

11.2 No Advertising Trackers. We do not use advertising pixels (such as the Meta pixel), Google Analytics, ad retargeting, or cross-site advertising trackers on the Website or App. If we add any of these in the future, we will update this Privacy Policy before doing so, explain how you can opt out, and keep them off pages where you log in, book, buy, or manage your account.

11.3 Your Browser Settings. You can set your browser to block or delete cookies. Blocking necessary cookies may stop parts of the Website from working.

12. How Long We Keep Information

12.1 Retention Periods. We keep personal information only as long as needed for the purposes in this Privacy Policy, including the following.

(i) Lead information: for [24] months after our last contact with you if you do not buy anything, and then it is deleted.

(ii) Customer records (drop-ins, Class Packs, Personal Training, Foundations, and Online Memberships):for [3] years after your last purchase or the end of your Online Membership.

(iii) Member account and membership records: while your account is active and for [3] years after your membership ends.

(iv) Payment, tax, and accounting records: for [7] years after the transaction.

(v) Signed agreements and releases: for [7] years after your last purchase or membership ends, or longer if a claim is pending or reasonably expected.

(vi) Injury and limitation notes, medical profile fields, and reasons given for health-related holds: while your account is active and for [12] months after your last purchase or membership ends, unless the information is part of an incident report.

(vii) Incident reports and Community board safety reports, including related door access, outing, RSVP, and moderation records: for at least [6] years after the incident or report, and longer if a claim is pending or reasonably expected.

(viii) Door access logs: for [12] months, unless needed for an incident report.

(ix) Messages and AI conversation records kept in our systems: for [24] months after the conversation, unless needed for a purchase, membership, incident, or legal record.

(x) Text and email consent and opt-out records: for [5] years after you opt out or your account closes.

(xi) Community board posts: until you delete them or your account closes, except where they are part of a safety report.

(xii) Habit check-ins: until you delete them or your account closes.

12.2 Deletion. When a retention period ends, we delete or de-identify the information in our membership platform and ask our service providers to do the same where they hold it. Stripe keeps payment records for the periods set by its own legal obligations.

12.3 Records We Must Keep. We may keep information longer, or decline to delete it, where we need it to comply with law, resolve disputes, defend or bring legal claims, or keep safety and incident records.

13. Security

13.1 How We Protect Information. We use reasonable administrative, technical, and physical safeguards to protect personal information, including role-based access for staff within our membership platform, administrator-only fields for medical details, administrator-only door access records, technical limits on the information given to AI, payment processing through Stripe so that we do not store full card numbers, secure service providers, and staff training. No system is completely secure, and we cannot guarantee the security of information sent over the internet.

13.2 Security Breaches. If a breach of security affects your personal information, we will notify you, and government authorities where required, as required by Oregon law and any other law that applies.

14. Your Choices and Requests

14.1 What You Can Ask For. Whether you are a lead, customer, or member, you may ask us to: (i) tell you what personal information we hold about you and give you a copy; (ii) correct information that is inaccurate; (iii) delete your information, subject to Section 12.3; (iv) stop sending you marketing texts or emails; and (v) have a person, rather than AI, respond to you.

14.2 Updating Your Account. If you have an account, you can update most account information and your text and email preferences in the App or your online account.

14.3 How to Make a Request. Email support@nerdstrong.fitness, write to us at the address in Section 18, or ask at the studio. We may need to confirm your identity before acting on a request. We will respond within a reasonable time and within any time the law requires.

14.4 No Discrimination. We will not deny you service, charge you a different price, or treat you differently because you made a privacy request.

15. Washington Residents

15.1 Consumer Health Data. If you live in Washington State, or your consumer health data is collected in Washington, our Consumer Health Data Privacy Policy in Exhibit A describes the consumer health data we collect and your rights under the Washington My Health My Data Act. It is also available through the "Consumer Health Data Privacy Policy" link on our Website homepage.

16. Age Requirement

16.1 Adults Only. The Services are for people 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. If you believe a minor has given us information, contact us at support@nerdstrong.fitness.

17. Changes to This Privacy Policy

17.1 Updates. We may update this Privacy Policy from time to time. We will post the new version on the Website and in the App with a new "Last updated" date. If we make a material change, such as using information in a new way, giving AI new categories of information, adding new automatic AI messages, adding a new service provider that receives health information, or adding advertising trackers, we will notify customers and members by email or in the App before the change takes effect and, where the law requires, ask for your consent.

18. Contact Us

Nerdstrong Fitness, LLC

3450 N Williams Ave, Retail 17, Portland, Oregon [ZIP]

Email: support@nerdstrong.fitness

Phone and text: (503) 820-0062

Exhibit A: Consumer Health Data Privacy Policy

Version [1.0]. Effective [date].

Publish this Exhibit as its own page and link to it from the Website homepage with a link titled "Consumer Health Data Privacy Policy."

This Consumer Health Data Privacy Policy applies to "consumer health data," as defined in the Washington My Health My Data Act, that Nerdstrong Fitness, LLC ("Nerdstrong," "we," or "us") collects about Washington residents and about anyone whose consumer health data is collected in Washington, whether that person is a lead, customer, or member. It supplements our Privacy Policy.

1. Categories of Consumer Health Data We Collect and Why

1.1 Injuries and Physical Limitations. Information about injuries and limitations that you tell our staff about and that staff record on your profile. Purpose and use: to adapt exercises and coach you safely.

1.2 Medical Details. Medical information you choose to give us that is recorded in administrator-only profile fields. Purpose and use: to keep you safe during classes and sessions and to respond to an emergency.

1.3 Health-Related Holds. That you have asked to hold your membership because of injury or illness, and any reason you give. Purpose and use: to process the hold you requested.

1.4 Health Information in Your Messages. Anything about an injury or health condition that you choose to include in a message to us. Purpose and use: to read and reply to your message.

1.5 Incident Information. Information about an injury or illness recorded in an incident report, including a report of an injury on a Member Outing. Purpose and use: to respond to the incident, improve safety, notify our insurer, and keep records needed for legal claims.

1.6 Habit Check-Ins. Water, sleep, and protein check-ins you choose to record in the App. Purpose and use: to provide the habit-tracking feature you requested. Staff see only totals.

1.7 Fitness Goals and Interests. Fitness goals or health-related reasons for training that you share when you contact us or sign up. Purpose and use: to answer your questions and recommend suitable classes or sessions.

1.8 Information That Could Indicate Health Status. Your attendance at, and purchases of, fitness classes, personal training, the Foundations Course, and Online Memberships. Purpose and use: to provide and manage the services you purchased, and, in summary form, to plan schedules and offers.

1.9 Collection Limited to What You Request. We collect and use consumer health data only to the extent necessary to provide the services you have requested, or with your consent. We do not use consumer health data for marketing.

2. Sources of Consumer Health Data

We collect consumer health data from: (i) you, when you contact us, tell staff, request a hold, fill in your profile, or use the App; (ii) our staff, who record information you give them and their own observations in incident reports; and (iii) other members or witnesses who report an incident involving you.

3. Consumer Health Data We Share

3.1 Categories Shared. We share the categories of consumer health data in Section 1 only as described below. We do not sell consumer health data.

3.2 Categories of Recipients. Our membership, booking, and App software is built and operated by Nerdstrong itself. We share consumer health data only with: (i) service providers (processors) that host and store that software and its data, namely Vercel, Inc. and Neon, under contracts limiting their use of it to providing services to us; (ii) service providers (processors) that deliver our messages, namely Resend (email) and Twilio Inc. (text), limited to health information contained in messages we send to you, such as a reply to a message in which you mentioned an injury, under contracts limiting their use of it to providing services to us; (iii) Anthropic, PBC, as a service provider (processor), limited to the health information you include in your own messages (Section 1.4), fitness goals (Section 1.7), and attendance and purchase information (Section 1.8), only to draft or send replies to you and to help staff with the uses described in those Sections, under contract terms limiting its use to providing services to us; (iv) emergency responders and your emergency contact, in an emergency; (v) our insurer and professional advisers, in connection with an incident or claim; and (vi) government authorities, where required by law or legal process. Anthropic does not receive the information in Sections 1.1, 1.2, 1.3, or 1.5. Our payment processor, Stripe, Inc., does not receive consumer health data, other than the fact of a purchase described in Section 1.8.

3.3 Affiliates. Nerdstrong has no affiliates with whom we share consumer health data.

3.4 Consent Before Other Sharing. We will not share consumer health data with any third party for any purpose other than those listed in Section 3.2 without first obtaining your separate consent.

4. Your Rights

4.1 Your Rights. You have the right to: (i) confirm whether we collect, share, or sell your consumer health data; (ii) access that data, including a list of all third parties and affiliates with whom we have shared it and an active email address or other online way to contact them; (iii) withdraw any consent you have given; and (iv) have your consumer health data deleted, including from our service providers' systems.

4.2 How to Make a Request. Email support@nerdstrong.fitness with the subject line "Consumer Health Data Request," or ask at the studio. We will verify your identity before acting on a request. We will respond within 45 days after receiving your request. If we need more time, we may extend that period once by up to 45 more days and will tell you within the first 45 days.

4.3 Appeals. If we decline your request, you may appeal by emailing support@nerdstrong.fitness with the subject line "Consumer Health Data Appeal." We will tell you in writing what we decided, and why, within 45 days after receiving your appeal. If we deny your appeal, we will give you a way to contact the Washington Attorney General to submit a complaint.

4.4 No Discrimination. We will not treat you differently because you exercised these rights.

5. Contact

Nerdstrong Fitness, LLC, 3450 N Williams Ave, Retail 17, Portland, Oregon [ZIP]. Email: support@nerdstrong.fitness. Phone: (503) 820-0062.

Exhibit B: Text Message Consent Language for Sign-Up Screens

This Exhibit is not published as part of the Privacy Policy. Use the language below on every screen or form where someone gives us a mobile number: Website contact and lead forms, drop-in, class pack, and online checkout, App sign-up and preferences, and the studio kiosk. Each box must start unchecked, and the two boxes must be separate. If you later collect leads through Meta or Google lead forms, add the same Box 2 language to those forms, or do not send news and offers texts to leads who come from them, and update Sections 3.2 and 6.3 of the Privacy Policy first.

Box 1: Service Texts

[ ] Text me replies to my questions, class reminders, booking updates, follow-ups after a drop-in visit, schedule changes, and purchase, account, and billing notices from Nerdstrong Fitness at the mobile number I provided. Some messages may be written or sent with the help of AI. Message frequency varies. Message and data rates may apply. Reply STOP to cancel or HELP for help. See our [Privacy Policy] and [Terms].

Box 2: News and Offers Texts

[ ] Yes, send me news, offers, and promotions by text from Nerdstrong Fitness at the mobile number I provided. Messages may be sent using automated technology, including AI. Consent is not a condition of any purchase. Up to [4] messages per month. Message and data rates may apply. Reply STOP to cancel or HELP for help. See our [Privacy Policy] and [Terms].

Record Keeping. For each box checked, store the lead, customer, or member ID, mobile number, exact wording shown, version, date and time, and where consent was given (Website form, App, kiosk, or checkout).).