US Supplemental Privacy Notice for SheHerMe

This US Supplemental Privacy Notice supplements the Privacy Notice for the SheHerMe App (the “SheHerMe Privacy Notice”) and applies to US residents to the extent applicable state privacy law applies. It does not create rights where a law does not apply or an exemption is available.

For SheHerMe users in the United States, the controller is Lovehoney Group US Trading Limited, 103 Foulk Road, Suite 202, Wilmington, Delaware 19803-3741, USA. Privacy contact: privacy@lovehoneygroup.com.

1. Personal information we collect and use

The SheHerMe Privacy Notice describes our processing in more detail. Depending on the features you use, we may process:

• Identifiers and account information, including email address, account, authentication and session identifiers, IP address, device identifiers, push token and consent records. Sources: you, your device and any sign-in provider you choose. Uses: App and account operation, authentication, security, notifications, email updates and recordkeeping. Retention: for the account or service period; consent, security and similar records may be retained longer for compliance, security or legal claims.
• Age-group information, if relevant to a feature. Source: you. Use: the relevant App function. Retention: while needed for that function or your account.
• Device, network and App activity information, including device, operating-system and App information, security logs, technical usage and diagnostic data, and connected-device identifiers, connection, firmware, error and use information. Sources: your device, the App and connected devices. Uses: operation, security, support, connected-device functions and, with consent, App analytics and error diagnostics. Retention: only as needed for those purposes, subject to configured retention periods, backup cycles and legal requirements.
• Sensitive personal information, including symptoms, menstruation or cycle data, journal entries, health or wellbeing information, sex-life information and connected-device information that reveals health or sex-life information. Sources: you and connected devices. Uses: requested wellbeing, journal and connected-device functions and storage or display of your entries and history. Retention: generally for the duration of your account; account deletion initiates deletion subject to limited backup periods and legal retention requirements.
• Support and communications information, including contact details, your request and information you choose to provide. Source: you. Uses: responding to you, support, security and legal or compliance matters. Retention: as long as needed for those purposes.

California Notice at Collection

For California residents, the information above also serves as our Notice at Collection. We collect the listed categories for the stated purposes and retain them using the stated criteria. We do not sell any of these categories or share them for cross-context behavioral advertising under the California Consumer Privacy Act (CCPA).

2. Disclosures, sale, sharing and targeted advertising

Except as described in Section 4 for consumer health data, we may disclose relevant personal information to Lovehoney Group companies and to service providers or contractors supporting hosting, authentication, connected-device and backend functions, email delivery, analytics and diagnostics, customer support, security and IT. We may also disclose information to competent authorities or professional advisers where required by law or necessary for legal claims.

We do not sell personal information, share it for cross-context behavioral advertising under the CCPA, process it for targeted advertising under applicable state privacy laws, or use it for profiling in furtherance of decisions producing legal or similarly significant effects. We do not use or disclose sensitive personal information for purposes that would require us to offer the CCPA right to limit. Accordingly, no categories above were sold or shared in the preceding 12 months, and we do not sell or share personal information of consumers under 16.

3. Your US state privacy rights

Depending on your state and applicable law, you may have rights to:

• confirm whether we process your personal information and access or obtain a copy of it;
• correct inaccurate personal information;
• delete personal information, subject to applicable exceptions;
• obtain a portable copy of certain personal information;
• obtain information about third parties to whom personal information has been disclosed, where applicable;
• withdraw consent where applicable; and
• appeal a refusal to act on a request where applicable law provides an appeal right.

Applicable law may also provide opt-out rights for sale, targeted advertising, cross-context behavioral advertising or certain profiling. As described above, SheHerMe does not currently engage in those activities. We will not discriminate against you for exercising rights provided by applicable law.

4. Consumer health data

Washington residents: SheHerMe has a separate Washington Consumer Health Data Privacy Policy that provides the disclosures and rights required by the Washington My Health My Data Act. It is available through the SheHerMe privacy information and the public SheHerMe privacy page.

Nevada consumer health data

For Nevada residents, consumer health data consists of the health, wellbeing, reproductive and sexual-health information described in Section 1, including symptoms, menstruation or cycle information, journal entries and connected-device information to the extent it reveals such information. Sources are you and compatible devices you connect. We use and process this data to provide the wellbeing, journal and connected-device functions you request, including receiving, storing, organizing, retrieving, displaying and deleting it, and as necessary for security or legal obligations.

The same categories may be shared with service providers acting as processors only as necessary to provide the SheHerMe services you request. We do not currently share consumer health data with third parties or affiliates as those terms are used in Nevada law, and we do not permit third parties to collect consumer health data over time and across different Internet websites or online services when you use SheHerMe.

Nevada law may give you the right to confirm whether we collect, share or sell consumer health data about you, obtain a list of third parties with whom it has been shared or to whom it has been sold, require us to cease collecting, sharing or selling it, and request deletion. You can review consumer health data displayed in your account through the App. Use the methods in Section 5 to request changes, exercise these rights or appeal a refusal to act.

We notify affected consumers of material changes to this Nevada consumer health data disclosure through a clear notice in the App. The effective date appears in this notice.

5. How to exercise your rights

Submit a privacy request by emailing privacy@lovehoneygroup.com or through the Lovehoney Group Privacy Center at https://privacy-center.lovehoneygroup.com/. We may take reasonable steps to verify your identity.

Where applicable, an authorized agent may act for you. We may verify the agent’s authority and your identity. If applicable law gives you an appeal right, you may appeal a refusal by emailing privacy@lovehoneygroup.com and identifying the decision you want reviewed.

Effective date: September 30, 2026