UniqueHuman Privacy Policy Addendum for California Residents

Effective Date: June 3, 2026 · Last Reviewed: June 3, 2026

1. Introduction

This CPRA Privacy Addendum supplements the information in our Privacy Policy for residents of California.

This Privacy Policy Addendum for California Residents (the "California Privacy Addendum") supplements the information contained in UniqueHuman's Privacy Policy and describes our collection and use of Personal Information (as defined below). This California Privacy Addendum applies solely to all visitors, users, and others who reside in the State of California ("Consumers" or "you"). We adopt this notice to comply with the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, the "CPRA") and any terms defined in the CPRA have the same meaning when used in this notice.

2. Scope of this California Privacy Addendum

This California Privacy Addendum applies to Personal Information that we collect on our Platform when you use our products and services. However, it does not apply to any Personal Information we may collect if you are an employee, job applicant, contractor, or have a similar relationship with UniqueHuman Inc., or if you have a business-to-business relationship with us.

This California Privacy Addendum applies to information that we collect through our Platform when you use our products and services (both online and offline) and that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household ("Personal Information"). Publicly available information that we collect from government records and deidentified or aggregated information are not considered Personal Information and this California Privacy Addendum does not apply to such information.

This California Privacy Addendum does not apply to employment-related Personal Information collected from our California-based employees, job applicants, contractors, or similar individuals ("Personnel").

This California Privacy Addendum also does not apply to certain Personal Information excluded from the scope of the CPRA, such as protected health information ("PHI") covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA). PHI is governed by our Notice of Privacy Practices.

3. Information We Collect About You and How We Collect It

The Personal Information we collect, and have collected over the past 12 months, includes the following categories: Identifiers; records about you; demographic information; commercial information; internet and network activity; geolocation data; audio and sensory information; professional/employment-related information; and inferences. We may also collect the following categories of Sensitive Personal Information: account log-in credentials; precise geolocation; and health information.

UniqueHuman collects, and over the prior twelve (12) months has collected, the following categories of Personal Information about Consumers:

Personal Information Category	Applicable Pieces of Personal Information Collected
Identifiers.	Real name; email address; physical address; telephone number; date of birth; state of residence; device identifiers (device model, device ID, cookie IDs); and IP address.
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	Name; address; telephone number; medical information; and health insurance information. Some Personal Information included in this category may overlap with other categories.
Protected classification characteristics under California or federal law.	Age (including date of birth); biological sex.
Commercial information.	Information related to your transactions, subscriptions, and the products or services obtained, considered, or purchased.
Internet or other similar network activity.	Browsing history; search history; preference and marketing information; account settings; and information regarding your interactions with and use of our Platform.
Geolocation data.	Non-precise location derived from your IP address, and local time and time zone. Precise geolocation (GPS) is treated as Sensitive Personal Information — see below.
Audio, electronic, or other sensory information.	Voice inputs you choose to submit through our voice journaling feature and related transcripts.
Professional or employment-related information (Business Contacts only).	Job title; organization; professional licenses; credentials or affiliations; and other professional information.
Inferences.	Inferences drawn from the information we collect about your health patterns, migraine triggers, preferences, and behavior, including to provide personalized health insights and predictions.

Sensitive Personal Information

Sensitive Personal Information Category	Applicable Pieces Collected
Account log-in credentials.	Account username and password.
Precise geolocation.	GPS coordinates collected solely to obtain local weather and environmental conditions (barometric pressure, temperature, humidity) for migraine trigger analysis. Not used for tracking or advertising.
Health information.	Health and fitness data from Apple HealthKit (heart rate, sleep, blood oxygen, etc.); sleep and mindfulness data; menstrual and reproductive health data; health records from FHIR-connected providers; uploaded medical documents; migraine journal entries; and medication information — all collected only with your explicit permission.

UniqueHuman will not collect additional categories of Personal Information without providing you notice.

4. Sources of Personal Information

We collect Personal Information about you from the sources described in our Privacy Policy.

As described in our Privacy Policy, we collect your Personal Information: directly from you when you create an account or use our Services; automatically through cookies and similar technologies when you interact with our Platform; from third-party sources you choose to connect (such as Apple HealthKit, wearables, and healthcare providers via FHIR APIs); from other third parties such as service providers and business partners; and from publicly available sources.

5. Purposes for Our Collection of Your Personal Information

We only use your Personal Information for the purposes described in our Privacy Policy, which include:

Providing and improving our Platform, Services, and AI-powered health features, including migraine predictions, personalized insights, voice journaling, and clinical report generation.
Registering, verifying, and maintaining your account.
Processing orders, subscriptions, and payments.
Communicating with you regarding your account, service updates, and (where you have opted in) promotional communications.
Developing and improving our AI and machine learning tools and models.
Ensuring the security and integrity of our Platform and Services.
Complying with legal obligations.
Performing services on behalf of UniqueHuman, including customer service, analytics, and similar services.

UniqueHuman will not use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

6. Third Parties to Whom We Disclose Your Personal Information for Business Purposes

We may disclose your Personal Information to certain categories of third parties for various business purposes. When we disclose Personal Information to non-affiliated third parties for a business purpose, we enter a contract that describes the purpose and requires the recipient to keep that Personal Information confidential and not use it for any purpose except the specific business purpose for which it was disclosed.

In the preceding twelve (12) months, UniqueHuman has disclosed the following categories of Personal Information for one or more business purposes to the following categories of third parties:

Personal Information Category	Categories of Third Party Recipients
Identifiers.	Cloud hosting and infrastructure providers; AI service providers (Anthropic Claude, OpenAI, VAPI, Deepgram, ElevenLabs); analytics and error monitoring providers (Firebase, Sentry, PostHog, Datadog); payment processors; affiliates and subsidiaries of UniqueHuman; or potential or actual buyer or other successor in interest.
Personal information categories listed in the California Customer Records statute.	Cloud hosting and infrastructure providers; AI service providers (Anthropic Claude, OpenAI, VAPI, Deepgram, ElevenLabs); analytics and error monitoring providers (Firebase, Sentry, PostHog, Datadog); payment processors; affiliates and subsidiaries of UniqueHuman; or potential or actual buyer or other successor in interest.
Protected classification characteristics under California or federal law.	Cloud hosting and infrastructure providers; AI service providers (Anthropic Claude, OpenAI, VAPI, Deepgram, ElevenLabs); analytics and error monitoring providers (Firebase, Sentry, PostHog, Datadog); payment processors; affiliates and subsidiaries of UniqueHuman; or potential or actual buyer or other successor in interest.
Internet or other similar network activity.	Cloud hosting and infrastructure providers; AI service providers (Anthropic Claude, OpenAI, VAPI, Deepgram, ElevenLabs); analytics and error monitoring providers (Firebase, Sentry, PostHog, Datadog); payment processors; affiliates and subsidiaries of UniqueHuman; or potential or actual buyer or other successor in interest.
Geolocation data.	Cloud hosting and infrastructure providers; AI service providers (Anthropic Claude, OpenAI, VAPI, Deepgram, ElevenLabs); analytics and error monitoring providers (Firebase, Sentry, PostHog, Datadog); payment processors; affiliates and subsidiaries of UniqueHuman; or potential or actual buyer or other successor in interest.
Inferences.	Cloud hosting and infrastructure providers; AI service providers (Anthropic Claude, OpenAI, VAPI, Deepgram, ElevenLabs); analytics and error monitoring providers (Firebase, Sentry, PostHog, Datadog); payment processors; affiliates and subsidiaries of UniqueHuman; or potential or actual buyer or other successor in interest.

Sensitive Personal Information Category	Categories of Third Party Recipients
Account log-in credentials.	Cloud hosting providers; affiliates and subsidiaries of UniqueHuman.
Precise geolocation.	Cloud hosting providers; weather data providers (Apple WeatherKit); affiliates and subsidiaries of UniqueHuman.
Health information.	Cloud hosting providers; AI service providers; healthcare providers you designate; affiliates and subsidiaries of UniqueHuman. We do not disclose health information for advertising or marketing. We do not sell health information.

We disclose your Personal Information to the categories of third parties listed above for the following business or commercial purposes:

Auditing related to ad impressions and compliance with applicable standards.
Helping to ensure the security and integrity of our products, services, and IT infrastructure.
Debugging to identify and repair errors that impair existing intended functionality.
Performing services on our behalf, including maintaining accounts, providing customer service, processing transactions, providing analytic services, and providing storage.
Undertaking internal research for technological development and demonstration.

We may also disclose any or all categories of Personal Information to any third party (including government entities and/or law enforcement) as necessary to: comply with federal, state, or local laws or a court order; comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons; cooperate with law enforcement; comply with a government agency request for emergency access; or exercise or defend legal claims.

7. To Whom Do We Sell or Share Your Personal Information

UniqueHuman does not sell your Personal Information for monetary consideration. We do not sell or share your health information under any circumstances. Our use of analytics cookies may be considered a disclosure of certain non-health Personal Information for other valuable consideration under the CPRA's broad definition.

"Sale" of Your Personal Information

UniqueHuman does not sell Personal Information as the term "sell" is commonly understood to require an exchange for money. However, our use of analytics cookies on our Website may be considered a "sale" as the term is broadly defined in the CPRA to include other valuable consideration. This is limited to our use of third-party analytics cookies (Firebase, PostHog, Sentry, Datadog) and their use in understanding how people use and interact with our Website. We do not sell your health data, PHI, or Sensitive Personal Information under any circumstances.

"Sharing" for Cross-Context Behavioral Advertising

UniqueHuman may share limited non-health identifiers and internet activity data with third-party advertising services for cross-context behavioral advertising, subject to your right to opt-out. We do not share health data, PHI, or Sensitive Personal Information for any advertising or marketing purpose.

Sale or Sharing of Personal Information of Minors Under 16

We do not have actual knowledge that we "sell" or "share" the Personal Information of minors under the age of 16. Our Services are not directed to or intended for individuals under 18 years of age, and we block users under 18 from creating accounts.

8. Consumer Data Requests

You have certain rights with respect to your Personal Information under the CPRA, including the right to know, access, correct, and delete your Personal Information (each under certain limitations).

The CPRA provides California residents with specific rights regarding their Personal Information. You may exercise these rights yourself or through your Authorized Agent.

Right to Know. You have the right to request that UniqueHuman disclose certain information about our collection and use of your Personal Information over the past 12 months, including: the categories collected; the sources; our purposes; the categories of third parties with whom we shared it; and categories of third parties to whom we sold or shared it. You may make this request twice within any 12-month period at no charge.
Access to Specific Pieces of Information (Data Portability). You have the right to request a copy of the specific pieces of Personal Information we have collected about you in a portable, readily usable format. We will not disclose your account password, security question answers, or information whose disclosure would create a substantial, articulable, and unreasonable risk to your security.
Correction. You have the right to request that we correct any inaccurate Personal Information about you. You may also update certain information directly within the UniqueHuman app under Settings.
Deletion. You have the right to request that UniqueHuman delete your Personal Information. You may delete your account and all associated data directly within the UniqueHuman app through Settings — deletion is immediate and permanent. We may retain certain information as required by law or to complete transactions, detect security incidents, or comply with legal obligations.
Non-Discrimination. We will not discriminate against you for exercising any of your CPRA rights. We will not deny you goods or services, charge different prices, provide a different quality of service, or suggest that you may receive a different level of service as a result of exercising your rights.

Exercising Your CPRA Privacy Rights

To exercise the rights described above, please submit a request to us by:

Emailing us at privacy@uniquehuman.ai
Deleting your account directly in the UniqueHuman app (Settings → Delete Account) for immediate data deletion
Visiting uniquehuman.ai

Only you, or your Authorized Agent that you authorize to act on your behalf, may make a Consumer Request related to your Personal Information. All Consumer Requests must provide sufficient information to allow us to reasonably verify your identity and describe your request with sufficient detail to properly understand, evaluate, and respond to it.

Authorized Agents

You may authorize your agent to exercise your rights under the CPRA on your behalf by providing them with written authorization or power of attorney in accordance with applicable laws (an "Authorized Agent"). We may request that your Authorized Agent submit proof of identity and authorization. We may deny a request from an Authorized Agent who fails to submit adequate proof of identity or authority.

9. Your Choices Regarding Our "Sale" or "Sharing" of Your Personal Information

If you are 16 years of age or older, you have the right to opt-out of our sale and/or sharing of your Personal Information.

If you are 16 years of age or older, you have the right to direct us not to sell your Personal Information for monetary or other valuable consideration or share it for cross-context behavioral advertising at any time (the "right to opt-out"). We do not sell or share the Personal Information of users we actually know are under 18 years of age.

To exercise your right to opt-out, you may:

Email us at privacy@uniquehuman.ai with "Opt-Out of Sale/Sharing" in the subject line.
Configure your browser to send a Global Privacy Control (GPC) signal. We recognize and support GPC signals. For more information, see globalprivacycontrol.org.
Adjust your cookie preferences in your browser settings.

Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize our "sale" or "sharing" of your Personal Information. You may change your mind and opt back in at any time by adjusting your cookie preferences.

10. Your Choices Regarding Our Use and Disclosure of Your Sensitive Personal Information

We do not use or disclose your Sensitive Personal Information for purposes other than those necessary to provide you with our products and services, and as otherwise permitted under the CPRA.

We use or disclose your Sensitive Personal Information only for the following purposes:

To perform the services or provide the goods reasonably expected by an average Consumer who requests such goods or services.
To detect security incidents and resist malicious, deceptive, fraudulent, or illegal actions.
To ensure the safety of natural persons.
To perform services on our behalf such as maintaining accounts, providing customer service, processing transactions, providing analytics, and providing storage.
As necessary to comply with federal, state, or local laws or a court order; to comply with a regulatory inquiry, investigation, subpoena, or summons; to cooperate with law enforcement; or to exercise or defend legal claims.

Because we only use your Sensitive Personal Information for the purposes above or as otherwise permitted under the CPRA, we are not required to provide you with a right to limit the use and disclosure of your Sensitive Personal Information beyond those already described.

11. Changes to This California Privacy Addendum

We will post any changes to our California Privacy Addendum on our Website. If we make material changes, we may notify you through your contact information.

UniqueHuman reserves the right to amend this California Privacy Addendum at our discretion and at any time. When we make changes, we will post the updated addendum on the Website and update the effective date. Your continued use of our Platform following the posting of changes constitutes your acceptance of such changes.

12. Contact Information

If you have any questions about this California Privacy Addendum or wish to exercise your rights under California law, please contact us using the information below.

Email: privacy@uniquehuman.ai

Website: uniquehuman.ai

General Support: contact@uniquehuman.care

Postal Address:
UniqueHuman Inc.
Attn: Legal / Privacy
3500 South DuPont Highway
Dover, Kent County, Delaware 19901
United States