Privacy Notice

LINGO SENSING TECHNOLOGY UNLIMITED COMPANY

LINGO PRIVACY NOTICE GLOBAL

July 2024

Table of Contents

1. What is Lingo?
2. What Does this Privacy Notice Cover?
3. How Can I Use the Lingo System?
4. What If Delivery of the Lingo System to Me Is Sponsored by My Employer?
5. What If I Obtain Access to the Lingo System from a Third Party and Not Direct from Lingo?
6. How Do We Collect Your Personal Data?
7. What Personal Data Do We Collect and How Do We Use It?
8. When Does Lingo Share Your Personal Data with Suppliers?
9. What Cookies and Other Tracking Technologies Are Used?
10. Third-Party Integrations
11. How Long is My Personal Data Retained?
12. What Security Measures Are Put in Place to Protect Personal Data?
13. What About Updates to this Privacy Notice?
14. How Do I Contact Lingo?
15. What If I Contact Lingo on Social Media?
16. What About Specific Jurisdictions?
    1. What If I'm a User from the UK?
       1. What Are Lingo's Legal Bases for Processing My Personal Data?
       2. Where is My Personal Data Stored and Will My Personal Data be Transferred Cross-Border?
       3. What Are My Rights When I Use Lingo Products and Services?
       4. How Can I Delete My Personal Data?
    2. What If I'm a User from the U.S.?
       1. California and Other U.S. State Privacy Laws
       2. Washington My Health My Data Act Consumer Health Data Policy
       3. Consumer Health Data Privacy Policy for Other U.S. States

Lingo is a health and wellness coaching program that includes information about metabolic health, personalized recommendations and coaching, and individual health and wellness insights that are all supported by Lingo technology (Lingo biosensors and Lingo App). Lingo gives you background information on metabolic health and shows how your body responds (for example, your glucose levels) to your daily activities, including food and exercise. Together this information and real-time data provide actionable insights that empower you to manage and optimize your daily wellbeing. Essentially, Lingo helps you understand how your body works so you can make changes to become healthier! The Lingo System delivers its coaching program by interacting with users within and outside of the Lingo App, including through email, SMS, push notifications, phone, in-person, surveys, and other communication mechanisms. The program is supported by the biosensor which collects indicators of your biological state – for instance, your glucose and ketone levels. These measurements are known as 'biomarkers'. The biosensor provides real-time biomarker data to the Lingo App, which translates the data into individualized insights to help people make informed decisions and change behavior, for example to improve energy levels, manage weight or enhance athletic performance, according to your goals.

The biosensor is applied to the back of the upper arm. The sensor sends data to the smartphone app via Bluetooth technology on a continual basis. The Lingo App translates the biomarker data into actionable insights to provide visibility into how your biomarkers change based on your body's reaction to different foods, activity or emotions that affect biomarker levels. You can review the data measurements displayed as the Lingo Count through the Lingo App.

In this Privacy Notice we refer to the Lingo App together with the biosensor as the Lingo System.

The Lingo System is provided by Lingo Sensing Technology Unlimited Company, a company from Abbott Laboratories, which is located in Ireland.

For the UK, Lingo Sensing Technology Unlimited Company ("Lingo") is the controller of the Personal Data described in this Privacy Notice.

Lingo's address in Ireland is 70 Sir John Rogersons Quay, Dublin 2, D02 R296, Ireland.

Lingo's address in US is Abbott Diabetes Care Inc. 1360 South Loop Road, Alameda, CA 94502.

• If you are a UK resident, please see the What If I'm a User from the - UK? Section in this Privacy Notice which sets forth additional information and rights you may have.
• If you are a California or other U.S. state resident, please see the What If I'm a User from the U.S.? Section which sets forth additional information and rights you may have.

When we refer to 'we', 'us', or 'our' in this Privacy Notice we mean Lingo Sensing Technology Unlimited Company.

This Privacy Notice explains how we use information that identifies or relates to you as an individual or could be used to reasonably identify you ("Personal Data" or "Personal Information") when you interact with us through:

• Lingo Coaching Program (for example, emails, surveys, interviews and other mechanisms)
• Lingo's biosensor
• Lingo's mobile applications (like the Lingo App, SMS, WhatsApp or other communication mechanism)
• Lingo's social media pages or websites (such as "hellolingo.com", "shop.hellolingo.com", and "support.hellolingo.com") ("Lingo Websites"), Community Pages (such as "facebook.com/")
• Your Lingo Account
• Together these are referred to as the 'Lingo Products and Services'.

You should read the Terms of Sale and EULA for further information on how we provide the Lingo System to you.

When we refer to 'you', 'your' or the 'user' in this Privacy Notice we mean the individual who uses any components of the Lingo Products and Services.

Using Lingo is easy! There are just a few steps to follow:

• Order your Lingo plan online or purchase in store
• We will send you biosensors if ordered online or pick up onsite if purchased in store
• You download the Lingo App
• You wear the biosensor
• You can begin using Lingo

As part of getting started with Lingo products and services, you will set up your Lingo Account. Your Lingo Account allows you to review, analyse and evaluate your biomarker data and other information you enter into your Lingo Account. It gives you insights into your nutrition, diet and metabolism, mood and energy levels. You may also be able to synchronize or share your Personal Data with other "Vendors" that offer additional products or services You can control your account preferences from your Lingo Account.

For the UK, you can only use Lingo if you are over 18 years old. For the US, you can only use Lingo if you are over 18 years old and not on insulin. We do not knowingly collect or use any Personal Data of children and we do not knowingly allow children to order the Lingo System. Each user is required to confirm their age and their country of residence. If you think your child is using any Lingo Products and Services, please contact us using the details below in section [XIV].

Lingo may not be available in your country.

We may collaborate with your employer to allow you to use the Lingo System through a sponsored program. If you receive access to the Lingo System due to an agreement we have in place with your employer, your use may be subject to additional conditions not set out in this Privacy Notice. The description of our use of your Personal Data is as set out in this Privacy Notice unless the conditions set in the agreement indicate otherwise – the conditions will take precedence over this Privacy Notice.

We may work with a company that allows you to purchase the Lingo System within an existing membership program (for instance, as part of an insurance product). The way that Lingo uses your Personal Data will be as set out in this Privacy Notice unless you are informed otherwise. For instance, there could be situations where our engagement with that third party means we act as a processor and not a controller or we act as a processor in addition to acting as a controller. Where that is the case, the use of your Personal Data will be governed by the third party's privacy notice.

We collect your Personal Data directly from you when you order the Lingo System and engage with us through Lingo Products and Services. When you create your Lingo Account and set up your profile with us we will ask you to provide your full name, age, email address and phone number.

In certain places, we provide open text fields in the Lingo App. Please only enter information into open text fields that relates to your personal use of the coaching program. Do not provide us with information about other people.

When you use the Lingo System, the biosensor automatically collects information about your biomarker levels while you wear it.

We may also assign and infer certain Personal Data about you depending on your use of Lingo Products and Services. For instance, we may include you in a certain profile group based on information that you explicitly share with Lingo or inferred through data generated by or shared with Lingo. You will receive communications from us depending on your profile group. For instance, if we profile you as an individual whose metabolism is particularly sensitive to certain types of carbohydrates, we may suggest foods, recipes, or routines that mitigate those sensitivities

If your use of the Lingo System is provided in collaboration with a third party (see section VIII below) we may also collect your Personal Data from that third party as part of an integrated service that is offered. When we refer to an integrated service, we mean that we will exchange Personal Data with the Partner through an API (application programming interface) which allows Lingo's technical system to communicate with the third party technical system. We will ask you to authorize such integration and allow you to change the authorization via the Lingo System. You should also consult the privacy notice of that third party to understand how they use and share your Personal Data with us.

We use your personal data for a number of purposes depending on how you interact with us. These purposes are:

1. To monitor visits to the Lingo Websites and to maintain our websites
2. To fulfil your order for the Lingo System including customer support on your order
3. For your use of the coaching program (including the use of the Lingo App) including creating an account, handling support queries including recommendations for your use of Lingo Products and Services
4. To manage and send direct marketing communications, to develop marketing strategies, to oversee the business development of Lingo and research insights to understand how people use the Lingo System
5. For product research and services development purposes
6. For scientific research purposes
7. To prevent fraud and misuse of the Lingo System and to protect our or a third party's rights

We will provide recommendations to our users about how they can change their behaviour to improve their health e.g. recipe ideas or exercise routines.

When we refer in this Privacy Notice to our use of 'deidentified data', we mean where we have removed identifying information as far as possible so that none of our employees or service providers entrusted with the relevant data processing activity are able to relate the data to an individual. Please note that deidentified data is still Personal Data according to certain privacy law. When we refer to 'anonymous data' this means we have taken further reasonable steps to strip out all attributes that could make that data Personal Data.

Taking each purpose in turn, we describe our use in a bit more detail.

We need to have an idea of who is visiting our websites, maintain our websites, and understand the effectiveness of certain content as well as protect our websites from parties who may wish to disrupt our delivery of Lingo. For these purposes, we collect and use website usage data such as log-files, IP address, time of visit, browser type, referrer and other technical information on your device, in order to create aggregated (= non-personal) reports and analysis as below:

When you complete the form to order Lingo, we need to obtain your contact details and payment details to send you the biosensors and process the transaction. The collection of certain personal data set out below is necessary in order for you to enter into a contract with us for the supply of the Lingo System to you.

We need to collect Personal Data when you set up your Lingo Account in order to provide you with the coaching program services. Then, as you use Lingo, we collect and you may continue to share Personal Data related to your nutrition, health, and wellness that enables Lingo to provide you with personalized recommendations and educational content about diet and exercise, sleep, mood, and general wellness. You may provide us with additional (optional) Personal Data described below. The recommendations and educational content may be provided in the Lingo app or via email. Please note that a number of the communications we send to you are 'service' or 'transactional' emails because they are part of the service, we provide to you. However, if you decide you do not want to receive such communications, please contact us. To understand when we use your personal data for direct marketing see purpose [X] below.

Please note that we treat all data collected through the biosensor as health data and that by acknowledging this Privacy Notice you agree on the processing of such data as described in this Privacy Notice. [It is always your choice to provide us with more of your Personal Data. Providing additional data allows us to provide a more personalised and relevant Lingo experience.]

As part of using the Lingo System, you may wish to contact us through Customer Support channels by phone, email, social media or online chat (if available).

Together all the data listed under this purpose is referred to as 'Lingo Service User Data'.

We carry out analysis on the Personal Data we collect about our users so that we can better understand trends in our audience and gain insights into how we reach more people to tell them about the Lingo System. For instance, we may choose to advertise at, or sponsor sports events based on these analyses and trends.

Where we are not using Personal Data for targeted marketing or to otherwise communicate with you, we deidentify data promptly before carrying out our analysis.

We want to make the Lingo System a great and easy to use experience for all our users. We are constantly looking for way to develop and improve our products and services. Therefore, we will use Personal Data from our users to understand their use of the Lingo System and to analyse where we can improve its functionality and output. We will seek your consent to do so, when required by applicable law. This includes where we receive feedback from users through surveys or other tools. Where we are carrying out analysis of Lingo Service User Data to consider how we can research, develop and improve our products and services, we always do so using deidentified or anonymous data. In carrying out our processing for product and services development purposes, we engage our parent company Abbott Laboratories to act as a processor to review deidentified, pseudonymised and anonymous aggregated data on our behalf.

You can always tell us if you don't want to be contacted to provide your feedback. However, please note that if your use of the Lingo System is provided in collaboration with a third party, through a study or specific program (employer, marketing, beta), providing feedback to us about your experience of the Lingo System may be compulsory. You will be notified of this as part of your participation.

Lingo is committed to improving the lives of people by powering scientific discoveries and creating meaningful innovations for people like you. We invest in scientific research activities with the overall aim of providing greater access to life-changing applications and products and to advance wellness programs (including publishing research findings).

Primarily, this purpose relates to Lingo's own scientific research purposes using data collected through the Lingo System to carry out secondary research in the area of health and wellness. In particular, real-world data generated through use of the Lingo System may be used in research studies. We may partner with third parties who are carrying out their own clinical trials who wish to use the Lingo System as part of their trial. Where this takes place, we will not have access to identifiable clinical trial data. We may also partner with third parties to connect data from the Lingo System with other data sources. We will seek your consent to do so, when required by applicable law. We may also invite you to participate in research studies overseen by an ethics committee and for which your informed consent would be needed before participation; your participation in this type of research is completely voluntary and details of your data and how it will be used will be described in that consent process.

Where we reasonably suspect fraudulent activity, we will carry out checks, scans and other investigations on users accessing the Lingo Websites and Lingo System. In exceptional circumstances, we may need to use any of the Personal Data we hold on you to protect our legal rights or a third party's rights where we consider such action is justified. In the UK, in such circumstances, our lawful basis is our Legitimate interests and either to establish, exercise or defend legal claims or where necessary for reasons of substantial public interest e.g. to prevent or detect criminal activity.

• Suppliers

We share Your Personal Data with third parties who provide, maintain, host, support and facilitate your use of the Lingo Products and Services. We consider these parties Suppliers and the extent to which we share data with them is limited to providing our services. For instance, we share your Personal Data with third-party suppliers to send you Lingo surveys relating to the direct marketing, marketing and insight purposes described in Section 6 above when you opt in to receive them.

Our list of Suppliers that we use is:

• Microsoft Inc.
• Databricks Inc.
• Commercetools GmbH
• Arvato Bertelsmann
• Okta Inc
• Braze Inc
• OneTrust LLC
• Adobe Inc.
• TrustArc Inc.
• Sprinklr Inc.
• ACI Worldwide Inc.
• Riverty GmbH
• Zendesk

We share Personal Data with suppliers for these reasons:

• Because the supplier is assisting with the provision of the Lingo Products and Services to you as our supplier and such sharing of data is necessary to perform the services;
• Because the supplier is our affiliate as part of the Lingo or Abbott group of companies and the affiliate assists with the provision of services to you;
• Because the law requires or permits us to share Personal Data or the sharingis justified in exceptional circumstances.

We obtain consent to such sharing when required by applicable law. Taking each type of data sharing in turn, we explain each below in more detail:

Abbott and Lingo Affiliates

Our local Abbott and Lingo affiliates offer the Lingo Products and Services through country web shops via the Lingo Websites and assist us with order fulfilment and shipment of the Lingo Products and Services. Where You opt-in to receive direct marketing communications from us, we may share your Personal Data with the local affiliated Abbott or Lingo company with whom we may collaboratively market a product or service or conduct a program or activity, where required. We may also share the minimum amount of your Personal Data necessary when we require assistance from Abbott affiliated companies in your country or region to help diagnose technical support inquiries when you request support. We also share your Personal Data with our Abbott and Lingo affiliates where they help to provide Lingo Products and Services, and will obtain consent to do so, when required under applicable law.

Third Party Collaboration

We may choose to collaborate with third parties to offer enhanced products and services such as data integration, enhanced wellness programs, bundled sales, or complimentary marketing programs. We will share your Personal Data where the arrangement we have with these parties requires this (with your consent where applicable). Please see section [X] below for more information about how we collaborate with third parties and the impact on your personal data.

Other permitted data sharing

Separately, we may need to disclose your Personal Data where we are legally required to or permitted to do so or to protect our rights or the rights of others.

For instance, to: (i) respond to requests from any competent law enforcement body, regulatory or government agency, court or other third-party where we believe the disclosure is necessary or appropriate (ii); comply with a regulatory requirement, judicial proceeding, court order, government request or legal process served on us; (iii) protect the safety, rights or property of our customers, the public, Lingo or others; (iv) exercise, establish or defend Lingo's legal rights or where we believe it is necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of this Privacy Notice; or (v) as evidence in litigation in which we are involved. Your personal data may be subject to foreign laws and may be accessible by foreign governments, courts, law enforcement and regulatory agencies.

We use cookies and similar technologies to collect technical information. Cookies are text files containing small amounts of data which are downloaded to Your computer or device when You visit a website. Cookies and similar technologies are useful because they allow us to recognise Your device and improve Your experience with the Lingo App. When You consent to do so, we use Adobe Analytics tools only to help analyse usage and traffic on the Lingo App. For more information about how Adobe uses information they receive when You use Adobe Analytics tools, including how that information may be combined with other information You make available to Adobe, please visit Adobe's Privacy Center - https://www.adobe.com/privacy.html. Lingo's use of Adobe's tools is subject to Adobe's privacy policy and terms of service.

Your web browser (such as Firefox, Safari or Chrome) then sends these cookies or similar files or data back to the website on each subsequent visit so that we can recognise You. These cookies can only be read by the server that sent them to Your browser. Our systems may not recognise Do Not Track (DNT) headers or similar mechanisms from some or all browsers.

Through our use of cookies and similar technologies, we may collect the following technical information: Your domain name, browser type and operating system, IP address and troubleshooting data to help us provide the Lingo Products and Services to You. For more information about how we use cookies and Your choices, please review the Cookie Policy.

The Lingo System may include third-party features or integrations for your optional use. For example, we may integrate the Lingo System with third party health apps or application programming interfaces (APIs) such as Apple HealthKit, FitBit, or Google Health Connect.

Further, we may integrate in such a way, that you may transfer data from these third-party apps directly to the Lingo App. The sharing of these data to Lingo requires your authorization. Such data may include nutrition/diet/food diary, hydration logs, sleep, heart rate, heart rate variability, body temperature, activity, exercise, daily calories burned, weight, body mass, and readiness score or energy related metrics (derived form a combination of these and stress management) as is used to help you understand how lifestyle choices and glucose impact your body.

We may separately provide you with services such as nutrition counselling or expert advice from a third-party provider based on data from Lingo. In order to provide these services, we may also share your relevant data such as glucose, Lingo Count, sleep, diet/food logs, exercise, stress), with this third-party provider for this purpose via software integration if you have consented to it.

By using these integrations, you understand that our Suppliers may process the information obtained through the integration to provide the features and services of the Lingo System as described above in the Section VIII Suppliers. Your use of these integrations is voluntary, and you have the ability to change or revoke the authorization of data sharing at any time in Lingo and in most cases in the third-party application. This Privacy Notice does not apply to any Personal Data that you provide directly to a third-party app or service.

Unless You delete your Lingo Account, Lingo will retain personal data uploaded to your Lingo Account for the following periods:

• Creation/use of Lingo Account and provision of the Lingo Products and Services: for a period of 2 years following your last interaction with us as a customer accessing your Lingo Account and, where you contact us for customer support, for a period of at least 2 years or longer if required by law following your last interaction with our customer support team;
• Scientific research: If your data is used by us for scientific research, we will continue to process your Personal Data for scientific research purposes, unless you withdraw your consent or object to our use. After [25] years of collecting this Personal Data from you or unless statutory retention periods apply, we will fully anonymise this data to continue to use it in anonymised form for scientific research purposes and obtain consent to do so, when required under applicable law. Where anonymization has occurred, no further deletion will take place.
• Product and service development: Where your Personal Data is used for the improvement of our products and services, we will retain your Personal Data for a maximum period of 6 years. We will take steps to ensure such Personal Data is held in pseudonymised, de-identified, anonymised, and/or aggregated data formats.

Unless otherwise stated above, Lingo will continue to store your Personal Data while you have an active Lingo Account. Your Lingo Account will be considered inactive after two (2) years of no Lingo Account activity. Once your Lingo Account is considered inactive or you delete your Lingo Account, all Personal Data will be permanently and irrevocably deleted unless: (1) Lingo is required or permitted to retain Personal Data (e.g. for archiving purposes, which will depend on the country of origin, and could be for up to 10 years); or (2) Your Personal Data has already been or is in the process of being anonymised.

We may notify you prior to deleting your Lingo Account if your Lingo Account has been inactive for two (2) years by sending an email to the email address associated with your Lingo Account so that you have an opportunity to ensure your Lingo Account stays current and available for your use.

We have implemented administrative, technical and physical safeguards to protect your personal data, including health-related information, from unauthorised or unlawful access, accidental loss, destruction, damage, misuse, disclosure and alteration, including the use of cryptographic technologies. Lingo restricts access to personal data by its employees on a need-to-know basis. Personal data including health-related information is treated as confidential and may only be accessed by authorised personnel who are required to respect the principles of proportionality and necessity.

Biosensors transmit Biosensor data to the Lingo App using NFC (Near Field Communication) and Bluetooth technologies. Encrypted Bluetooth connections for Biosensors are established during an NFC communication between the Biosensor and the Lingo App.

Please be aware that your Lingo Account may be unavailable during periods of routine maintenance.

We may update this Privacy Notice from time to time and will use reasonable efforts to notify you when we are providing an update. If material changes to the Privacy Notice are made, you will be asked to review and acknowledge the updated Privacy Notice either by email, within the Lingo App or when you log into your Lingo Account. If you do not want your personal data be processed as described in the updated Privacy Notice, you can close your Lingo Account and ask us to delete your Personal Data. Your rights as set out in section [XVI] remain unaffected.

In exceptional circumstances, we reserve the right to update and amend this Privacy Notice to reflect technological advancements or legal or regulatory changes without telling you. Such updates should not change the way we use your Personal Data or, if they do, we consider these to be material changes which we will notify you of.

You can contact us by emailing us at privacy@abbott.com or writing to:

Privacy Officer

Lingo Sensing Technology Unlimited Company

1420 Harbor Bay Parkway

Alameda, CA 94502

USA

In communicating with us, please include the email address you used to create your Lingo Account and a detailed explanation of your request.

Data Protection Officer: The contact information for our European data protection officer and other useful contact information is available at www.eu-dpo.abbott.com.

Lingo has appointed the following local representative in the UK:

Abbott Laboratories Ltd, Abbott House, Vanwall Business Park, Vanwall Road, Maidenhead, Berkshire, SL6 4XE, UK.

We love hearing from our users on social media about their experience with Lingo! For example, Lingo may have a fan page or a company page on Facebook, YouTube, LinkedIn and Instagram that you can use or visit. However, you should be aware that if you send information to Lingo via social media, it will not always be protected since communications on social media are not always private and confidential. We also use third party social listening tools to review what is said on social media about Lingo.

Our webpage may also use plug-ins from the social media platforms. When you enter our website that contains a plug-in, your browser will create a direct link to the servers of the social media platforms. They may receive information about you, the fact that you have visited our website, your IP-address and whether you have interacted with their plug-in at our website. The social media companies will receive the information whether you are a user on their social media platform or not. You can prevent the social media plug-ins from loading by using a script-blocker add-on, which you can download for your browser.

We do not influence the collection or processing of Personal Data carried out by social media platforms.

You can read more regarding how they process your Personal Data at the following links.

Instagram: https://help.instagram.com/155833707900388

Facebook: https://en-gb.facebook.com/privacy/explanation

LinkedIn: https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy

In the UK, Lingo acts as a joint data controller with the social media platform for the collection of your Personal Data when you visit our company page on the social media platform. Note that these data will be stored with the social media companies in the USA. You can read more regarding our joint controllership (or other arrangement) with the platforms at the following links:

Facebook and Instagram: https://www.facebook.com/legal/controller_addendum

LinkedIn: https://legal.linkedin.com/pages-joint-controller-addendum

YouTube: https://business.safety.google/controllerterms/

This Section supplements the disclosures made in this Lingo Privacy Notice and applies to Lingo users in the United Kingdom.

The following chart shows the purposes for which we process your Personal Data and the legal bases to support our processing of your Personal Data.

Lingo as controller of your Personal Data is based in Ireland. Certain services are provided within the EU so that your Personal Data will be stored in the EU, and we use third party service providers to host and store your Personal Data. However, for customer service escalations, scientific research, marketing, product development, sales aspects of the services we provide for Lingo Products and Services which involve the transfer of your Personal Data to countries outside Ireland. We transfer Personal Data to our affiliate Lingo company [and to Abbott affiliates] in the USA as well as to third party suppliers based in the USA. Whenever we transfer Personal Data cross-borders we ensure that there are appropriate safeguards in place.

For transfers of Personal Data to the Lingo and Abbott companies in the USA, we rely on European Commission approved Standard Contractual Clauses or on our intra-group data transfer agreement which also includes the protection provided by the European Commission approved Standard Contractual Clauses. For transfers to third parties in the USA, we rely on their registration with the EU-US Data Privacy Framework (plus UK Extension where relevant) or we enter into Standard Contractual Clauses with them. Please note that the laws of the USA may not offer an equivalent level of protection for personal data when compared to the privacy and data protections laws in Your country of residence. Our transfers of your Personal Data to the USA only occurs to the extent it is necessary for us to provide you with technical or other customer support or where we need to make the data transfer to maintain the Lingo Products and Services.

In certain circumstances, we will ask for your explicit consent to transfer your Personal Data. We will provide you with the relevant additional information to inform you about the implications of providing your consent where this takes place. You understand that by providing such a consent to an international transfer of Personal Data to a country outside the EU and UK, the recipient country provides a level of data protection which may be lower than the level of data protection in your jurisdiction. In particular, you acknowledge that the recipient country may allow extensive data access rights by third parties with no or little legal protection safeguards. Additionally, the rights of individuals may be affected, and there may be state control mechanisms in that recipient country. Furthermore, in that recipient country, personal data might be processed for another purpose than the purpose for which it was collected.

Please contact us if you would like to receive a copy of the safeguards that we rely on when transferring your personal data cross-borders.

We recognise that it's important that you have control over how your Personal Data is used. The law may provide you with rights to control your Personal Data depending on where you are located. These rights may include:

• The right of correction/ restriction: You may correct your profile information (your name, mobile phone number (where it is applicable), billing and home address (where applicable) date of birth, email address and password) through your Lingo Account settings or through the settings within your Lingo App. We are not able to correct or amend any Biosensor readings that you have uploaded into your Lingo Account, but we will assist you with deleting your Lingo Account and creating a new one so that you can enter correct information and start to upload information from your Biosensor to your Lingo Account.
• The right to opt out (or unsubscribe from) any marketing material from us. We provide a reminder at the bottom of any marketing-related email you receive from us. Please note we may continue to send You communications directly related to service delivery of Lingo Products or Services or directly in relation to Your purchase of Lingo Products and Services.
• The right to access Personal Data that Lingo holds about You.
• The right to object to the processing of Your Personal Data.
• The right not to be subjected to automated decision-making where the automated decision-making would have a significant effect on you, such as something that creates legal consequences.
• The right to have your personal data ported (in certain circumstances) to another person or, if it is technically feasible for us to do so, to another company.
• Where you have provided your consent, the right to withdraw your consent to Lingo's processing of your personal data, without detriment or negative consequences. If you withdraw your consent to our processing of your data, you will no longer be able to use the Lingo Products and Services. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
• The right to have your Personal Data deleted. Please see the section below entitled + How can I delete my Personal Data?
• The right to lodge a complaint with a data protection supervisory authority. In the UK, this is the Information Commissioner's Office – www.ico.org.uk. Please find a list of relevant supervisory authorities for the European Union member states here: https://edpb.europa.eu/about-edpb/about-edpb/members_en

Please note that these rights may be restricted according to the law that applies to our use of your Personal Data. We acknowledge that you may have other rights depending on relevant data protection and privacy laws.

To exercise these rights, please contact us using any of the methods set out in the section titled How do I contact Lingo below.

Users can request to delete their account by directly contacting customer service via phone or email. Users can also use delete account request via app which notifies customer service of the delete request.

This Section supplements the disclosures made in this Lingo Privacy Notice and applies to Lingo users in the United States, depending on the user's state of residency.

This Section applies to residents of U.S. states with applicable U.S. State Privacy Laws. For purposes of this Section, "Personal Information" is information that identifies or relates to you as an individual or could be used to reasonably identify you. Personal Information includes "personal data" as that term is defined in applicable U.S. State Privacy Laws. Personal Information also includes "Sensitive Personal Information," and "Sensitive Data" (collectively referred to as "Sensitive Personal Information" herein) as those terms are defined by applicable U.S. State Privacy Laws. Personal Information does not include information that is publicly available, de-identified, or aggregated. Examples of Personal Information include, but are not limited to, your name, email address, mailing address, phone number, date of birth and gender. Additionally, under applicable U.S. State Privacy Laws, inferences drawn from Personal Information which are used to indicate an individual's racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life or sexual orientation, or citizenship status may also be considered Sensitive Personal Information.

Lingo may collect, use, and disclose the following types of Personal Information.

Sensitive Personal Information. Depending on your interactions with us and the Lingo Products and Services, we collect Lingo Service User Data concerning health that is considered sensitive under certain applicable U.S. privacy laws, including:

• Biosensor information – readings, data and measurements (including glucose and body temperature)
• Lingo Count (i.e., glucose point calculations relating to the coaching program), glucose target ranges, average glucose values and comparable health related data categories relating to your coaching program;
• User generated data you upload to your Lingo Account (e.g., food, exercise, sleep, stress level, fasting, weight, height, energy, hunger, mood levels);
• For the coaching program – age, date of birth, height, weight, sex, gender, activity (only collected through third party integrations, such as data on length of workout and conditions of workout), sleep (only collected through third party integrations, such as sleep schedule, duration and patterns), meals (logged by users on the Lingo App and those collected through third party integrations), Heart rate variability (only collected through third party integrations); and
• Inferences (e.g., coaching program recommendations such as Lingo Products and Services, areas to focus on to reduce glucose point score, changes to behaviour to improve health such as recipe ideas or exercise routines, diet, sleep and mood).

We use and disclose sensitive Personal Information to our service providers to deliver our services to you through the Lingo System, to provide the coaching program to you, to provide customer support, to monitor your progress through your workouts and to suggest recommendations.

We do not sell your Personal Information for money, but some of the ways in which we may disclose your Personal Information to certain third parties that provide services to us, such as analytics and targeted advertising services, may be considered a "sale" under certain applicable U.S. State Privacy Laws. We do not have actual knowledge that we sell or disclose the Personal Information of consumers under 16 years of age.

We may "sell" or "disclose" to third parties for cross-context behavioral advertising, targeted advertising or other marketing purposes the following categories of Personal Information:

• Identifiers
• Internet or other electronic network activity information
• Geolocation data

The third parties to which this Personal Information is "sold" or "disclosed" are advertisers and analytics vendors which upon receipt of Personal Information may process it according to their own practices as described in their privacy policies.

We may allow certain companies to place tracking technologies, such as cookies or tracking pixels on our websites, where permissible. Those companies receive information about your interaction with our websites that is associated with your browser or device and may use that data for targeted advertising (i.e., to serve you relevant ads on our websites or others). For more information please see our Cookie Policy.

At our discretion, we may also disclose aggregated, anonymized, or de-identified information that is not personally identifiable to third parties.

Depending on where you reside, you may have certain rights and choices (with certain limitations and exceptions) regarding our processing of your Personal Information. Please note that some of these rights may vary depending on your state of residence and whether your state has an applicable U.S. State Privacy Law.

• You may have the right to opt-out of the "sale" of your Personal Information as that term is defined by applicable U.S. State Privacy Law. You may also have the right to opt-out of sharing your Personal Information for cross-context behavioral advertising purposes or the disclosure of your Personal Information for targeted advertising as those terms are defined by applicable U.S. State Privacy Law. To exercise your opt-out rights visit our website and click the "Your Privacy Choices" link found at the bottom of the website, and then click the box that reads "Opt-Out of Sale or Sharing and Targeted Advertising."
• If you are a California resident, you may have the right to limit how we use Sensitive Personal Information. You can learn more about limiting your Sensitive Personal Information by visiting www.Abbott.com and clicking the "Your Privacy Choices" and then follow the instructions on how to "Limit the Use of Sensitive Personal Information".
• Resident of states with applicable U.S. State Privacy Laws may also have the right to withdraw your consent for, or opt-out of, our processing of your Sensitive Personal Information. To submit a request to withdraw your consent or opt-out of the processing of your Sensitive Personal Information/Sensitive Data, please click here.

Additionally, residents of states with applicable U.S. State Privacy Laws may have certain rights with respect to the collection and use of their Personal Information. Those rights may vary by state. Such rights may be effectuated by submitting a request by clicking Privacy Rights Request. The potential rights include the right to:

• Know the categories and/or specific pieces of Personal Information collected about you, including the categories from which the Personal Information is collected, the business purpose for collecting the Personal Information, whether your Personal Information was disclosed to third parties, the categories of Personal Information, if any, that we disclosed to third parties, the categories of and/or the third parties to whom your Personal Information was disclosed
• Access or obtain a copy of the specific pieces of Personal Information we retain about you
• Request deletion of your Personal Information
• Request correction of inaccurate Personal Information

Once you have submitted your request, we will respond within the time frame permitted by the applicable U.S. State Privacy Law. To help protect the security of your Personal Information, we will need to verify your identity in connection with any requests. We may contact you by email to verify your request. Depending on your request, we may ask you for information such as your name, an email address, or phone number that you have used with us. We take steps to ensure that only you or your authorized representative can exercise rights with respect to your Personal Information.

You may be permitted to make certain requests through an authorized agent. For all requests via authorized agents, we require that your agent provide us with your Personal Information as required on the request form and provide signed documentation demonstrating that you authorized the agent to submit a request on your behalf. If you are an authorized agent making a request, we may require and request additional information to protect the Personal Information entrusted to us.

There may be situations where we cannot grant your request, for example, if you make a request for access and we cannot verify your identity, we will not be able to comply with the request. We may also be unable to comply with your request to delete if we have a legal or regulatory obligation to keep your Personal Information, such as when you participate in scientific research. Other reasons your request may be denied are if it jeopardizes the privacy of others or would be impracticable to honor.

Where we deny your request in whole or in part, we will take steps to inform you of the denial and provide an explanation of our actions and the reasons for the denial. Residents of certain states may have the right to appeal Abbott's decision to deny your request regarding your Personal Information, in whole or in Part. To appeal our decision click Notice of Appeal. We will process and respond to your appeal within the time frame permitted by the applicable U.S. State Privacy Law.

We will not discriminate against you if you exercise your rights as described in this Privacy Policy. For example, we will not deny goods or Services to you, or charge you different prices or rates, or provide a different level of quality of products or Services. We will not restrict or deny you access to our Services or provide a different level of quality of products or Services because of choices and requests you make in connection with your Personal Information. Please note, certain choices may affect our ability to deliver Lingo Products and Services. For example, if you sign up to receive marketing communications or promotions, then ask Lingo to delete all of your Personal Information, we will be unable to send you marketing communications or promotions. Additionally, requesting to delete your personal information will include deletion of any accounts you may have created with us as well as any memberships in any of our financial incentive programs and you may no longer receive the rewards and promotions related to those programs.

You may exercise any of your applicable rights and choices set forth above in relation to your Personal Information by contacting us using the details provided under the "How Can I Contact Abbott" section above or by clicking here.

California's Shine the Light Law: California law permits customers in California to request certain details about how their Personal Information is shared with third parties, and in some cases affiliates, if Personal Information is shared for those third parties' or affiliates' own direct marketing purposes. We do not share Personal Information with third parties or affiliates for those third parties' or affiliates' own direct marketing purposes. Californians may request information about our compliance with this law by contacting us at [privacy@abbott.com]. Alternatively, you may send a letter to the following address:

Abbott Laboratories

Attention: Privacy Office, Department EC10 100 Abbott Park Road

Abbott Park, IL 60064-6048

Any such request must include your name and "California Shine the Light Privacy Rights Request" in the first line of the description and, if sent by mail, must include your street address, city, state, and zip code.

Lingo recognizes the Global Privacy Control ("GPC") where required by applicable U.S. State Privacy Law. Residents of certain states, requiring GPC recognition may opt-out of the "sale" or disclosure of Personal Information for cross-context behavioral advertising purposes and/or targeted advertising as those terms are defined by applicable U.S. State Privacy Laws. To communicate your desire to opt-out, you may configure your browser to turn on the -signal, which will transmit your opt-out request to Lingo automatically.

To turn on the GPC signal, you can download one of the supported browsers or extensions. You may visit https://globalprivacycontrol.org/#download for a list of the available browsers or extensions. If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use.

This Washington Consumer Health Data Privacy Policy ("Policy") describes how we Process the Consumer Health Data of Washington residents and individuals whose Consumer Health Data is Collected in Washington ("Washington Consumers") pursuant to the Washington My Health My Data Act (the "Washington Act").

In the event of a conflict between any other policy, statement, or notice and this Policy, this Policy will prevail as to Consumer Health Data Collected under the Washington Act. Capitalized terms that are not otherwise defined in this Policy and Section shall be defined as they are in the Washington Act.

"Washington Consumer Health Data" means personal information that is linked or reasonably linkable to a Washington Consumer and that identifies the Washington Consumer's past, present, or future physical or mental health status. Washington Consumer Health Data does not include Publicly Available Information or Deidentified Data.

Lingo may Collect the following categories of Washington Consumer Health Data about Washington Consumers:

• Individual health condition, treatment, disease, or diagnosis information;
• Bodily function, vital sign, symptoms, or measurement of physical or mental health status information;
• Biometric Data that is generated from the measurement or technological Processing of an individual's physiological, biological, or behavioral characteristics and that identifies a Washington Consumer;
• Precise Location Information that could reasonably indicate a Washington Consumer's attempt to acquire or receive health services or supplies;
• Data that identifies a Washington Consumer seeking Health Care Services; and
• Information Processed to associate or identify a Washington Consumer with the data listed above that is derived or extrapolated from non-health information, such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning.

Lingo may obtain the Washington Consumer Health Data described above from the following sources:

• Directly from you when you visit our website, order the Lingo System, engage with us through Lingo Products and Services, participate in a promotion or reward program, participate in a clinical trial, engage with customer service on phone calls and any other way that you may be able to interact with us;
• Automatically from the Biosensor when you use the Lingo System and wear the Biosensor;
• From one of our Partners, if your use of the Lingo System is provided in collaboration with a Partner as part of the integration service that is offered; or
• Drawn from the other categories of Personal Information we Collect, depending on your use of Lingo Products we may make inferences related to Washington Consumer Health Data.

Lingo may Collect and use the Washington Consumer Health Data of Washington Consumers described above to the extent necessary to provide a product or service requested by the Washington Consumer or with the Washington Consumer's Consent, including to:

• Provide the services requested by Washington Consumers;
• Monitor visits to the Lingo Websites and to maintain our websites;
• Fulfill your order for the Lingo System including customer support on your order;
• Support your use of the Lingo System (including the coaching program), including recommendations for your use of Lingo Products and Services;
• Manage and send direct transactional communications;
• Manage and send direct marketing communications, to develop marketing strategies, to oversee the business development of Lingo and research insights to understand how people use the Lingo System (including cross-context behavioural advertising purposes);
• Use for scientific research purposes;
• Oversee the business development of Lingo and research insights to understand how people use the Lingo System; and
• Prevent, detect, protect against, and respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any activity that is illegal under Washington state or federal law; preserve the integrity and security of our systems; and investigate, report, or prosecute those responsible for any illegal action under Washington state or federal law.

We may also Collect and use Washington Consumer Health Data for our internal business purposes, such as data analysis, audits, developing new products, enhancing our Services, identifying usage trends and determining the effectiveness of our promotional campaigns. We may also use inferences drawn from Washington Consumer Health Data to create a profile reflecting your preferences.

Where we require the Washington Consumer's Consent for Collection for a specified purpose, a description of those purposes is provided to you at the time of Collection.

The categories of Third Parties (which does not include our Processors) with which Lingo may Share Washington Consumer Health Data are: suppliers of services that support the Services, business partners, e-commerce support vendors, government agencies and law enforcement, analytics and research providers.

Lingo may share the following categories of Washington Consumer Health Data: individual health condition, bodily function, vital sign, symptoms, or measurement of physical health status information; diagnosis or diagnostic testing, Biometric Data that is generated from the measurement or technological Processing of an individual's physiological, biological, or behavioral characteristics and that identifies a Washington Consumer; Precise Location Information that could reasonably indicate a Washington Consumer's attempt to acquire or receive health services or supplies data that Identifies a Washington Consumer seeking Health Care Services; information Processed to Associate or Identify a Washington Consumer with the data listed herein that is derived or extrapolated from non-health information, such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning.

We may also disclose or transfer Washington Consumer Health Data to:

• Our Processors to provide goods and services in a manner consistent with the purpose for which the Washington Consumer Health Data was Collected and disclosed;
• Parties with whom the Washington Consumer has a direct relationship for the purpose of providing a product or service requested by the Washington Consumer, in circumstances where we maintain control and ownership of the data and the party only uses the Consumer Health Data at our direction for the purpose for which the Washington Consumer Health Data was Collected or Consented to; or
• External parties as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the party may assume control of all or part of Lingo's assets.

The Washington Act provides certain rights with respect to Washington Consumer Health Data, including a right to confirm, access, delete or withdraw consent relating to such data, subject to certain exceptions. To exercise your privacy rights, please submit a request through our Washington Consumer Health Data Rights Request Form. Any privacy rights request you submit to us is subject to a verification process. We will not fulfill your request unless you have provided sufficient information for us to reasonably verify you are the Washington Consumer about whom we Collected Washington Consumer Health Data. Please follow the instructions we provide you and promptly respond to any follow-up inquires so that we may confirm your identity.

If your request to exercise a right under the Washington Act is denied, you may appeal that decision by clicking "Notice of Appeal." We will process and respond to your appeal within the time permitted by the Washington Act.

If you have questions about your Consumer Health Data, please contact us by clicking on the "Contact Us" link on the website you are visiting or by emailing us at privacy@abbott.com. Alternatively, you may send a letter to the following address:

Abbott Laboratories

Attention: Privacy Office, Department EC10 100 Abbott Park Road

Abbott Park, IL 60064-6048

In all communications to Lingo, please include the email address used for registration (if applicable), mention of Lingo and a detailed explanation of your request. We will do our best to respond to all reasonable requests in a timely manner.

We reserve the right to amend this Policy at any time. If Lingo changes its privacy practices, a new Policy will reflect those changes and the effective date of the revised Policy will be set forth at the top of this section.

Certain Personal Data may be considered "Consumer Health Data" under additional U.S. applicable privacy laws (collectively "Consumer Health Data Privacy Laws"), including, but not limited to, Nevada's and Connecticut's Health Data Laws. Capitalized terms that are not otherwise defined in this Policy and Section shall be defined as they are in applicable law.

Lingo may Collect the following categories of Consumer Health Data about Consumers:

• Information relating to social, psychological, behavioral or medical interventions;
• Information relating to bodily functions, vital signs or symptoms;
• Biometric Data or Genetic Data related to any of the above;
• Information listed above that is derived or extrapolated from information that is not Consumer Health Data, including, without limitation, proxy, derivative, inferred or emergent data derived through an algorithm, machine learning or any other means.

Lingo may obtain the Consumer Health Data described above from the following sources:

• Directly from you when you visit our website, order the Lingo System, engage with us through Lingo Products and Services, participate in a promotion or reward program, participate in a clinical trial, engage with customer service on phone calls and any other way that you may be able to interact with us;
• Automatically from the Biosensor when you use the Lingo System and wear the Biosensor;
• From one of our Partners, if your use of the Lingo System is provided in collaboration with a Partner as part of the integration service that is offered; or
• Drawn from the other categories of Personal Information we Collect, depending on your use of Lingo Products we may make inferences related to Washington Consumer Health Data.

Lingo Collects, uses, and Shares or discloses the Consumer Health Data of Consumers described above to the extent necessary to provide a product or service requested by the Consumer, with the Consumer's Consent, or as legally required, including to:

• Provide the services requested by Consumers;
• Monitor visits to the Lingo Websites and to maintain our websites;
• Fulfill your order for the Lingo System including customer support on your order;
• Support your use of the Lingo System (including the coaching program), including recommendations for your use of Lingo Products and Services;
• Manage and send direct transactional communications;
• To manage and send direct marketing communications, to develop marketing strategies, to oversee the business development of Lingo and research insights to understand how people use the Lingo System (including cross-context behavioural advertising purposes)
• For scientific research purposes
• Oversee the business development of Lingo and research insights to understand how people use the Lingo System; and
• Prevent, detect, protect against, and respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any activity that is illegal under state or federal law; preserve the integrity and security of our systems; and investigate, report, or prosecute those responsible for any illegal action under state or federal law.

We may also Collect and use Consumer Health Data for our internal business purposes, such as data analysis, audits, developing new products, enhancing our Services, identifying usage trends and determining the effectiveness of our promotional campaigns. We may also use inferences drawn from Consumer Health Data to create a profile reflecting your preferences.

Where we require the Consumer's Consent for Collection for a specified purpose, a description of those purposes is provided to you at the time of Collection.

The categories of Third Parties (which does not include our Processors) with which Lingo Shares or discloses Consumer Health Data are certain: suppliers of services that support the Services, business partners, e-commerce support vendors, government agencies and law enforcement.

Lingo may share or disclose the following categories of Consumer Health Data: information relating to any health condition or status, disease, or diagnosis; information relating to social, psychological, behavioral, or medical interventions; information related to surgeries or other health-related procedures; information relating to the use or acquisition of medication; bodily function, vital sign, symptoms, or measurement of physical or mental health status information; information related to bodily functions, vital signs or symptoms; information related to Reproductive or Sexual Health Care; information relating to Biometric Data related to any of the information herein; information related to the Precise Geolocation Information of a Consumer that Lingo uses to indicate an attempt by a Consumer to receive Health Care Services or Products; information listed herein that is derived or extrapolated from information that is not Consumer Health Data, including, without limitation, proxy, derivative, inferred or emergent data derived through an algorithm, machine learning or any other means.

Applicable Consumer Health Data Laws provide certain rights with respect to Consumer Health Data, including a right to confirm, access or obtain a copy, amend, delete or withdraw consent relating to such data, subject to certain exceptions. To exercise your privacy rights, please submit a request through our Consumer Health Data Rights Request Form.

Any privacy rights request you submit to us is subject to a verification process. We will not fulfill your request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we Collected Consumer Health Data. Please follow the instructions we provide you and promptly respond to any follow-up inquires so that we may confirm your identity.

If your request to exercise a right under a Consumer Health Data Privacy Law is denied, you may appeal that decision by clicking "Notice of Appeal." We will process and respond to your appeal within the time permitted by the applicable Consumer Health Data Privacy Law.

If you have questions about your Consumer Health Data, please contact us by clicking on the "Contact Us" link on the website you are visiting or by emailing us at privacy@abbott.com. Alternatively, you may send a letter to the following address:

Abbott Laboratories

Attention: Privacy Office, Department EC10 100 Abbott Park Road

Abbott Park, IL 60064-6048

In all communications to Lingo, please include the email address used for registration (if applicable), mention of Lingo and a detailed explanation of your request. We will do our best to respond to all reasonable requests in a timely manner.

We reserve the right to amend this Policy at any time. If Lingo changes its privacy practices, a new Policy will reflect those changes and the effective date of the revised Policy will be set forth at the top of this section.