Washington Consumer Health Data Privacy Policy

This policy applies to you if you are:

• A Washington State resident; or
• Any individual whose consumer health data (as defined below) is collected in Washington, regardless of where you reside

Agent Analog LLC (“Agent Analog,” “we,” “us,” or “our”) is a “regulated entity” under the MHMD because it conducts business in Washington and determines the purpose and means of collecting consumer health data at events held in or targeting Washington consumers.

The MHMD defines consumer health data broadly. In the context of Agent Analog's services, the following data qualifies as consumer health data under Washington law:

2.1 Biometric Data

Biometric data is expressly classified as consumer health data under the MHMD. Agent Analog collects the following biometric data when you opt in to photo delivery services:

• Facial images captured at events, including photographs from which an identifier template can be extracted
• Facial geometry derived from those images for the purpose of matching photos to attendees

Note: Under the MHMD, even a standard photograph of your face may qualify as biometric data if it can be used to extract an identifier template. Agent Analog treats all event photography subject to facial matching as consumer health data for Washington residents.

2.2 Data Agent Analog Does Not Collect

Agent Analog does not collect the following categories of data that might otherwise qualify as consumer health data under the MHMD: precise geolocation data revealing health service visits; data about bodily functions, vital signs, or symptoms; reproductive or sexual health information; mental health information; or genetic data. Our consumer health data collection is limited to biometric data as described above.

We collect consumer health data through the following sources:

• Directly from you: when you provide your photo or stand in a photo capture area at an event where Agent Analog is deployed and you have opted in to photo delivery
• Event photography: photographs taken by event photographers at events where Agent Analog is deployed, limited to photos where you have provided consent to participate in photo matching
• Our facial recognition service provider: which processes facial images on our behalf under a written data processing agreement

We do not collect consumer health data from data brokers, advertising networks, or other indirect sources.

Agent Analog uses consumer health data for one purpose only:

To match event photographs to the attendee who appears in them and deliver those photographs to you via SMS.

We do not use your consumer health data to:

• Identify you across unrelated events or platforms
• Infer health, demographic, or behavioral characteristics
• Target advertising or marketing
• Train AI or machine learning models on your individual biometric data
• Make decisions that affect your legal rights, access to services, employment, healthcare, or housing

Agent Analog does not sell your consumer health data. We do not share consumer health data with third parties for advertising or marketing purposes.

We may share consumer health data with the following categories of third parties, solely as necessary to provide photo delivery services:

• Facial Recognition / Photo Processing Service Providers: We share facial images with our photo processing service provider to perform the matching and delivery function. This provider operates under a written data processing agreement that prohibits use of your data for any purpose other than photo delivery for Agent Analog. The specific provider name is available upon request.
• Cloud Hosting Providers: Your data is stored on secure cloud infrastructure. Hosting providers do not access your consumer health data except for the technical operation of storage systems.
• Law Enforcement or Government: We may disclose consumer health data if required by law, court order, or valid legal process.

We do not share consumer health data with event organizers, sponsors, or other third parties beyond what is necessary to deliver your photos.

6.1 How We Obtain Your Consent

Under the MHMD, consent must be a clear, specific, informed, opt-in, voluntary, and unambiguous affirmative act. For Washington residents, Agent Analog obtains consent through a standalone biometric consent mechanism that is:

• Separate from general Terms of Service acceptance
• Separate from SMS opt-in consent
• Unchecked by default — you must actively choose to participate
• Presented before any facial data is captured
• Written in plain language as required by law

6.2 Consent Is Not Required for Event Participation

Participation in Agent Analog's facial recognition photo delivery feature is entirely optional. You may attend any event where Agent Analog is deployed and use all other Agent Analog services (including the SMS concierge) without providing biometric consent. Refusing to consent will not result in any adverse treatment.

6.3 Separate Authorization for Sharing

Because sharing your facial images with our photo processing service provider is necessary to perform the photo delivery service, this sharing is disclosed at the point of consent. By providing consent for photo delivery, you are also authorizing the sharing of your facial image data with our processing vendor solely for that purpose. You will not be asked to authorize additional sharing beyond what is described in this policy.

6.4 How to Withdraw Consent

You may withdraw your consent at any time by:

• Contacting privacy@agentanalog.ai
• Visiting agentanalog.ai/opt-out
• Replying STOP to any Agent Analog SMS message

Upon withdrawal of consent, we will cease collection of your consumer health data and delete existing biometric data within ten (10) business days. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Agent Analog retains consumer health data only as long as necessary to complete photo matching and delivery for the applicable event, subject to the following schedule:

• Facial geometry / biometric templates: permanently deleted no later than thirty (30) days following the conclusion of the event
• Facial images used for matching: deleted upon completion of photo delivery or within thirty (30) days of the event, whichever is sooner
• Delivered photographs: not retained by Agent Analog; stored on your device after delivery
• Consent records: retained for five (5) years from the date of consent, consistent with applicable statutes of limitations

Upon a verified deletion request from you, we will delete all consumer health data within ten (10) business days and will notify all third parties (including our photo processing provider) to do the same.

As a Washington consumer, you have the following rights with respect to your consumer health data:

• Right to Access: You may request a copy of the consumer health data we hold about you, including a list of all third parties and affiliates — with contact information — to whom your data has been disclosed.
• Right to Withdraw Consent: You may withdraw consent to collect or share your consumer health data at any time. See Section 6.4 above.
• Right to Deletion: You may request deletion of your consumer health data from our systems and from those of any third parties to whom it was shared. We will comply within ten (10) business days of a verified request.
• Right to Non-Discrimination: Agent Analog will not discriminate against you for exercising any of your rights under this policy or the MHMD.
• Right to Sue: The MHMD provides a private right of action. If you believe Agent Analog has violated the MHMD, you may bring a civil action under Washington's Consumer Protection Act (RCW 19.86) in addition to any enforcement action by the Washington Attorney General. Violations may result in civil penalties up to $7,500 per incident and potential treble damages.

To exercise any rights under this policy, contact us through any of the following methods:

• Email: privacy@agentanalog.ai (include “Washington Health Data Request” in the subject line)
• Web: agentanalog.ai/opt-out

We will respond to verifiable consumer requests within forty-five (45) days. If additional time is needed, we will notify you within the initial 45-day window. We may need to verify your identity before processing your request. We will not require you to create an account to submit a request.

Agent Analog protects consumer health data using industry-standard security measures including:

• SSL/TLS encryption for data in transit
• Encryption at rest for all stored consumer health data
• Role-based access controls limiting data access to personnel who need it to perform photo delivery
• Written data processing agreements with all vendors who access consumer health data
• Scheduled deletion protocols with audit logging

Agent Analog does not knowingly collect consumer health data from individuals under the age of 13. For minors between 13 and 17, biometric consent must be provided by a parent or guardian. If you believe we have inadvertently collected biometric data from a minor without appropriate consent, contact privacy@agentanalog.ai immediately for expedited deletion.

This policy may be updated to reflect changes in our practices or applicable law. Material changes will be posted on agentanalog.ai/privacy/washington with a revised effective date. Your continued use of Agent Analog services at Washington events after the effective date constitutes acceptance of the revised policy.

This Washington Consumer Health Data Privacy Policy governs consumer health data (including biometric data) collected from Washington residents and individuals whose data is collected in Washington. It supplements Agent Analog's general Privacy Policy and Terms of Service. In the event of any conflict between this policy and the general Privacy Policy with respect to Washington consumer health data, this policy controls.

Agent Analog LLC
311 N Robertson Blvd. #250
Beverly Hills, California 90211

Privacy & consumer health data requests: privacy@agentanalog.ai

Legal: legal@agentanalog.ai

Opt-out portal: agentanalog.ai/opt-out

Washington policy page: agentanalog.ai/privacy/washington

Effective Date: January 20, 2026