InRoll Consumer Health Data Privacy Policy

INROLL LLC, a Washington limited liability company ("InRoll," "we," "us"), provides this Consumer Health Data Privacy Policy to describe how we collect, use, and share consumer health data, and how you can exercise your rights over it, as provided by applicable Washington law.

1. Categories of consumer health data we collect, and why

We collect the following categories of consumer health data, and use each only for the purpose stated:

• Health and medical information provided for a participant, such as allergies, medications, health conditions, general health notes, insurance details, immunization records, and medical documents. Purpose and use: to operate the enrollment, health, medication, and safety features the participant's organization uses to run its program, with access limited to staff roles the organization authorizes.
• Biometric data: numeric face templates derived from photos, created only for participants whose parent or guardian (or the adult participant) has given affirmative consent. Photos are scanned to locate opted-in participants; no face template is created or kept for anyone else. Purpose and use: solely to operate the optional photo face-matching feature that helps identify an opted-in participant in their organization's photos. Face matching is never used for identity verification, check-in, or pickup authorization.

We do not collect consumer health data for advertising.

2. Categories of sources

We collect consumer health data from:

• parents and guardians, who provide it for their participant;
• adult participants, who provide their own;
• the organization running the program, which may collect it from families through its forms or bring it onto the platform through an import; and
• for face templates only: derived from photos uploaded by the organization or by families, only after affirmative consent for that participant.

3. Categories of consumer health data we share

We do not sell consumer health data, and biometric data is never sold. We do not share consumer health data with third parties or affiliates for their own purposes. We disclose it only to:

• the organization running the participant's program, whose staff access it according to the roles the organization assigns; and
• service providers under contract that process it on our behalf to run the Service (the categories in Section 4).

We do not send consumer health data by email, text message, or push notification. A message about health-related activity says only that information is available and directs you to sign in to InRoll to view it.

4. Third parties and affiliates that may receive consumer health data

We have no affiliates that receive consumer health data. The categories of service providers that process it on our behalf, under contract, are:

• cloud hosting and database providers (currently Google Cloud); and
• file storage and web hosting providers (currently Cloudflare).

Our emails, text messages, and push notifications do not contain consumer health data, so our email delivery provider does not receive it.

5. How to exercise your rights

You (or, for a child, the child's parent or guardian) may ask to: confirm whether we collect, share, or sell consumer health data about you; access it, including a list of the third parties with whom it has been shared; withdraw a consent you gave (including face-matching consent, which results in prompt deletion of that participant's face templates); and delete your consumer health data.

• How to ask: email [email protected]. We will verify your identity before acting. Where the organization running the program controls the affected records, we may handle your request together with the organization.
• When we respond: without undue delay and within 45 days. If reasonably necessary we may extend once by another 45 days and will tell you why.
• Appeals: if we decline a request, we will tell you how to appeal. We answer appeals within 45 days. If your appeal is denied, we will provide a way to contact the Washington State Office of the Attorney General to raise a concern.

This policy is provided by INROLL LLC, a Washington limited liability company. Last updated: August 27, 2026.