Sleep Coaching Privacy Notice

DUSQ is a product of Ezymind Nexus, Inc. (operating as DUSQ), a Delaware corporation, registered address 131 Continental Dr, Suite 305, Newark, DE 19713, a wholly-owned subsidiary of Ezymind Healthcare Private Limited (India).

The DUSQ entity responsible for your data depends on your location, as set out in clause 1.1 below.

This notice explains how DUSQ collects, uses, shares, and protects your health-related and personal data in connection with the sleep coaching feature (the “Coaching Service”). It supplements the DUSQ Privacy Policy and, for Washington State residents, the DUSQ Consumer Health Data Privacy Policy. Where this notice and the general DUSQ Privacy Policy differ on a coaching-specific point, this notice governs.

1. Who is responsible for your data

1.1 Controller / Data Fiduciary. If you are in the United States or outside India, Ezymind Nexus, Inc. (Delaware, USA) is responsible for your coaching data. If you are in India, Ezymind Healthcare Private Limited (India) is the Data Fiduciary. The two are affiliated companies under common control and are referred to together as “DUSQ.”

1.2 Coaching is operated from India. Your coaches and parts of our coaching operations are located in India. This means that, to provide coaching to you, your coaching data is processed in and accessed from India, including where you are a United States resident. Ezymind Healthcare Private Limited processes this data on behalf of, and under contract with, Ezymind Nexus, Inc. for United States customers, solely to operate the Coaching Service. This is the specific affiliate relationship disclosed for the purposes of the My Health My Data Act.

1.3 Not HIPAA. DUSQ is a consumer wellness provider and is not a HIPAA covered entity. Your coaching data is not protected health information under HIPAA, but it is protected under this notice and the laws described below, including consumer health data laws.

2. The data we collect

In connection with the Coaching Service, we collect:

(a) Consumer health data and wellness data: your DUSQ sleep and physiological metrics (for example sleep and readiness measures, autonomic signals, heart-rate-derived measures, device-usage and adherence data) and any environment data from your device, to the extent you have enabled DUSQ to collect it.

(b) Coaching conversation content: the messages you exchange with your coach, including anything about your sleep, habits, routines, and wellbeing that you choose to share.

(c) Intake and profile information: your sleep goals, routine information, and other details you provide at intake or during coaching.

(d) Account and technical data: identifiers, device and app information, and usage logs needed to deliver and secure the service.

2.1 We do not ask you to share, and you should not share, information about diagnosed medical conditions, medications, or symptoms that need medical attention. If you do, we treat it as consumer health data under this notice.

3. Where your data comes from

We collect this data from you directly (your messages, intake, and settings), from your DUSQ device and app (sleep and wellness metrics you have enabled), and from our own systems (usage and security logs).

4. Why we use your data, and your consents

The coaching consent screen asks you for the following, which map to the purposes below:

Consent on screen	Purpose	Required?
Share my data with my coach	To let your assigned coach and the coaching team see your sleep and wellness data and conversation so they can help you. This is necessary to provide coaching.	Required for coaching
I have read the Sleep Coaching Terms	To confirm you understand coaching is not medical care (see Part A).	Required for coaching
Use my conversations to improve the service	To let DUSQ review coaching conversations to train coaches and improve the Coaching Service. This does NOT include using your conversations to train artificial intelligence or machine-learning models, which we would do only with your separate, specific consent.	Optional, separate

4.1 We also process your data where necessary to secure the service, to respond to your requests, to comply with law, and to protect the rights and safety of you or others. We will not use your consumer health data for a new, unrelated purpose without your consent.

4.2 Optional consent is genuinely optional. The Coaching Service works the same whether or not you give the optional consent. You can decline or withdraw it without losing coaching.

4.3 We keep a record of your consent. When you give or withdraw a consent, we keep a record of what you were shown and what you chose, so that your choices can be honoured and demonstrated.

5. We do not sell your consumer health data

5.1 DUSQ does not sell your consumer health data or coaching data, and does not share it for cross-context behavioural advertising or targeted advertising. We do not seek any authorization to sell consumer health data, because we do not sell it. If this ever changes, we will first obtain the separate signed authorization that the law requires.

6. Who sees your data, and when we disclose it

Within DUSQ. Your coaching data is seen by your assigned coach, by supervisors who review coaching quality and safety, and by authorized DUSQ personnel who operate and support the service, including personnel in India. These are internal personnel, not third parties.

We disclose your data outside DUSQ only as described here:

(a) Service providers (processors): vendors who host and secure our systems and help us operate the Coaching Service, under contracts that require them to protect your data and use it only on our instructions. Categories include cloud hosting and infrastructure, security, and communications tooling.

(b) Legal and safety: where we reasonably believe it is necessary to comply with law, enforce our terms, or protect the rights, safety, or property of you, us, or others. This includes acting on a safety concern a coach becomes aware of, as described in Part A clause 4.2.

(c) Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to protections consistent with this notice.

6.1 Disclosing your data to our coaches, affiliate, and processors to deliver the coaching you asked for is not a “sale” or, under applicable law, a “share” of your data. We do not share your consumer health data with third parties for their own purposes, and any sharing that is not necessary to provide coaching is done only with your separate consent.

7. International transfer of your data

7.1 DUSQ operates in both the United States and India, and coaching is delivered from India. To provide the Coaching Service, your data is processed in, or accessed from, India and the United States, and locations where our service providers operate. We put appropriate safeguards in place for these transfers as required by applicable law, and transfers between our two entities are governed by an intra-group arrangement limiting use to operating the Coaching Service.

7.2 For India Data Principals, any transfer of personal data outside India is carried out in accordance with the Digital Personal Data Protection Act, 2023, and applicable restrictions in force from time to time.

8. How long we keep your data

8.1 We keep your coaching data for as long as you use the Coaching Service and for a reasonable period afterwards, unless you ask us to delete it sooner or the law requires a different period. We keep consent records for as long as the law requires.

8.2 When you ask us to delete your coaching data, or when you withdraw the consent needed for coaching, we will delete or de-identify it, including from backups on our normal backup cycle, except where we must keep certain records to comply with law or to establish or defend legal claims.

8.3 Where Indian law requires us to notify you before deletion at the end of a retention period, we will give the notice the law requires.

9. Your rights

Depending on where you live, you have some or all of the following rights over your coaching data:

(a) to access and get a copy of your data;

(b) to correct inaccurate data;

(d) to withdraw any consent you have given, at any time, as easily as you gave it (see clause 10);

(e) to appeal a decision we make about your request, and to be free from discrimination for exercising your rights;

(f) to use an authorized agent to make a request on your behalf, where the law allows;

(g) for India Data Principals, the right of grievance redressal and the right to nominate another person to exercise your rights in the event of death or incapacity;

(h) to complain to a regulator, including the relevant US state authority (such as the Washington or Nevada Attorney General) or, in India, the Data Protection Board of India.

9.1 How to exercise. Contact us using the details in clause 13, or use the in-app controls where available. We will verify your request and respond within the time the law requires, and in any event within 45 days, with an extension only where the law allows. There is no charge for a reasonable request.

9.2 US state rights. Residents of Washington, Nevada, and other US states have rights over consumer health data under their state laws. Washington residents should also see the separate DUSQ Consumer Health Data Privacy Policy. As DUSQ grows and further state privacy laws become applicable to us, additional rights, including rights relating to sensitive personal information under laws such as the California Consumer Privacy Act, may apply, and we will honour them when they do.

10. How to withdraw consent

10.1 You can withdraw your coaching data consents at any time through the in-app coaching settings, or by contacting us. Withdrawal is designed to be as easy as giving consent. Withdrawing the consent needed for coaching will end the Coaching Service, because we cannot coach you without it. Withdrawing the optional improvement consent does not affect your coaching. Withdrawal does not affect processing we already carried out lawfully before you withdrew, and we will stop the processing it covered within a reasonable time, including at our processors.

11. How we protect your data

11.1 We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of coaching data, including access controls that limit coaching data to your coach and authorized personnel, encryption in transit and at rest where appropriate, and contractual protections with our service providers. No system is perfectly secure, but we work to protect your data using a reasonable standard of care.

12. If there is a data breach

12.1 If a breach affecting your data occurs, we will notify you and the relevant authorities as required by law. In the United States this includes the Federal Trade Commission’s Health Breach Notification Rule, under which we will notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery, and will notify the FTC (and, where required, the media) on the timeline the rule requires, as well as any applicable US state data-breach notification laws. In India we will notify the Data Protection Board and affected Data Principals as required by the Digital Personal Data Protection Act, 2023, and the rules under it.

13. Contact and Grievance Officer

13.1 Privacy contact (US and general): [entity], [privacy email], [address].

13.2 India Grievance Officer / point of contact: [name], Ezymind Healthcare Private Limited, [address], [email], [phone]. If we are a Significant Data Fiduciary under Indian law, our Data Protection Officer’s details will be published here.

13.3 Washington residents: you may exercise your rights using the contacts above and should also see the separate DUSQ Consumer Health Data Privacy Policy. You may also contact the Washington Attorney General.

14. Children

14.1 The Coaching Service is for adults aged 18 and over. We do not knowingly collect coaching data from anyone under 18. If we learn that we have, we will delete it.

15. Changes to this notice

15.1 We may update this notice. If a change is material, we will give reasonable notice before it takes effect and, where the law requires, obtain your fresh consent. The effective date is shown at the top.