Consumer Health Data Privacy Policy

Effective as of May 19, 2026.

MDFL, Inc. ("MindFlow", "we", "us" or "our") provides a brain-computer interface (BCI) platform — including EEG-based wearable hardware and a cognitive AI software platform — designed to continuously and passively sense neural signals and translate them into real-time cognitive state intelligence. This includes a broad range of cognitive states such as attention, fatigue, stress, overload, engagement, uncertainty, readiness, intent, and flow. Our Technology includes devices with biological sensors that are either created by MindFlow or a third-party partner ("Device"), as well as the software and AI systems that process the data those Devices collect.

This Consumer Health Data Privacy Policy ("Consumer Health Data Privacy Policy") applies to the extent US state consumer health data-specific privacy laws to which we are subject (e.g., the Washington My Health My Data Act) ("Consumer Health Data Privacy Laws") apply to our processing of certain health status-related data, such as "consumer health data" as defined by such laws ("Consumer Health Data"). Consumer Health Data does not include "publicly available information" or "deidentified data", as such terms or similar terms are defined by Consumer Health Data Privacy Laws. This Consumer Health Data Privacy Policy describes how MindFlow processes Consumer Health Data that we collect through the Device and corresponding end-user applications from MindFlow (the "Apps") (the Device and the Apps, collectively, the "Services").

This Consumer Health Data Privacy Policy supplements our Services Privacy Policy. In the event of a conflict between our Services Privacy Policy and this Consumer Health Data Privacy Policy, this Consumer Health Data Privacy Policy shall control only with respect to Consumer Health Data and to the extent required by applicable Consumer Health Data Privacy Laws.

Consumer Health Data We Collect

Consumer Health Data you may provide to us through the Services includes the following, to the extent that such data is linked or reasonably linkable to you and identifies your past, present, or future physical or mental health status. We will obtain your consent where required by applicable Consumer Health Data Privacy Laws:

• Profile data, such as whether you are left-handed or right-handed, your health conditions that you may choose to disclose to us (e.g., ADHD), and your preferences and characteristics, which we may generate from the Consumer Health Data we collect.
• Cognitive state data, such as your real-time and session-level scores across the full range of cognitive states our platform monitors — including attention, fatigue, stress, overload, engagement, uncertainty, readiness, intent, and flow — as well as generated insights derived from those scores (such as your optimal performance windows, recovery patterns, or cognitive load trends).
• Session data, including activity names, session notes you create in the App, and session duration and frequency of use.
• Responses to surveys and questionnaires, such as your voluntary responses regarding your work habits, user goals, or cognitive experience.
• Communications data based on our exchanges with you, including when you contact us through the App in relation to your use of the Services.
• Feedback data, including information you voluntarily share and upload to us when you complete our product feedback form or request support.
• Brainwave data, such as raw EEG data and cognitive state outputs derived from raw EEG data across the full range of cognitive states our platform monitors. We will only collect raw EEG data if you opt-in to such collection.
• Longitudinal cognitive profile data, comprising cognitive state patterns built over time as our platform personalizes to your individual neural signals across all monitored cognitive dimensions.
• Device usage data, such as accelerometer data that measures vibration, calibration data, electrode impedance readings, and data about sensor signal quality.

Sources of Consumer Health Data

We collect Consumer Health Data directly from you when you use the Services, including when you use a Device that includes MindFlow technology. We may also create, infer, or generate Consumer Health Data from such data — including cognitive state outputs derived by our AI platform from raw EEG signals.

Where you use a third-party application that is powered by the MindFlow API ("Partner Developer application"), we may receive Consumer Health Data from that application pursuant to a data processing agreement with the Partner Developer. Partner Developers receive only derived cognitive state outputs — not raw EEG signals — unless you separately and explicitly authorize otherwise.

How We Use Your Consumer Health Data

We use Consumer Health Data for the purposes below (with each purpose described in more detail in the Services Privacy Policy) or as otherwise disclosed to you. We will obtain your consent where required by applicable Consumer Health Data Privacy Laws.

We do not use your Consumer Health Data to make automated decisions with legal or similarly significant effects without human review. We do not use your Consumer Health Data to infer protected characteristics (such as race, religion, political views, or sexual orientation) for advertising or profiling purposes.

Future Capabilities

MindFlow is developing additional capabilities that may, in the future, use real-time cognitive state data to suggest non-invasive interventions — such as audio cues, environmental adjustments, pacing recommendations, or neurofeedback signals — to guide users toward desired cognitive states such as focus, reduced stress, or recovery from overload. Any such capability will be opt-in only and subject to a separate consent process before activation.

How We Share Your Consumer Health Data

We may "share" (as applicable Consumer Health Data Privacy Laws define that term) Consumer Health Data with your consent or as we determine necessary to provide the Services to you, or as otherwise permitted or required by law. We will obtain your consent where required by applicable Consumer Health Data Privacy Laws. For example, we may share your Consumer Health Data with the following categories of third parties:

• Third parties designated by you. We may share your Consumer Health Data with third parties where you have instructed us or provided your consent to do so.
• Partner Developers. We may share derived cognitive state outputs — not raw EEG signals — with Partner Developers who access our platform through our API, pursuant to written data processing agreements that restrict their use of the data and prohibit resale or misuse.
• Authorities and others. We will access, share, and preserve Consumer Health Data when we believe that doing so is necessary to comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies. We will also share Consumer Health Data if we believe it is necessary to protect our customers and/or the rights or property of ourselves or others.
• Business transferees. We may disclose Consumer Health Data to acquirers and/or other relevant participants in corporate events (including negotiations of or due diligence for such events) such as investments in MindFlow, financing of MindFlow, public stock offerings, or the sale, transfer or merger of all or part of our business, assets, or shares. Consumer Health Data transferred in such events will remain subject to this Policy or a successor policy with equivalent protections.
• Professional advisors. We may disclose Consumer Health Data to professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.

Your Consumer Health Data Choices

You may have certain rights to your Consumer Health Data under applicable Consumer Health Data Privacy Laws. Any of the rights discussed below may be subject to certain limitations (for example, a monetary charge).

• Withdraw consent. To the extent we rely upon your consent for either our collection or sharing of your Consumer Health Data, you have the right to withdraw such consent from any future collection or sharing. Upon withdrawal, we will stop collecting new Consumer Health Data and will delete your historical brainwave data and longitudinal cognitive profile data within 30 days of a verified request, subject to legal retention requirements.
• Access and confirm. You have the right to ask us to confirm whether we have collected, shared or sold your Consumer Health Data. Further, you have the right to access (in other words, request a copy of) the Consumer Health Data that we have collected, shared or sold. You also have a right to access a list of all "third parties" (as applicable law may define that term) and affiliates with whom we have shared or sold your Consumer Health Data and receive certain corresponding information.
• Deletion. You have the right to ask us to delete your Consumer Health Data.
• Restrict AI platform use. You have the right to opt out of the use of your brainwave data and longitudinal cognitive profile data for AI platform improvement beyond your own personalization, without affecting your ability to use the Services.
• Appeal. You have the right to appeal our denying a right you have attempted to exercise. We will provide details on how to appeal our denial in connection with such action.

If a Consumer Health Data Privacy Law applies to you and your Consumer Health Data and you wish to exercise your rights above, please email us at hello@mindflow-us.com. We may need to verify your identity to process your request. To confirm your identity, we may ask you to verify personal information we already have on file for you. If we cannot verify your identity based on the information we have on file, we may request additional information from you (such as government identification), which we will only use to verify your identity, and for security or fraud-prevention purposes.

Declining to provide information. We need to collect or process Consumer Health Data to provide certain services, including the Services, to you. If you do not provide the information we identify as required or mandatory, or if you request that any required Consumer Health Data be deleted or withdraw your consent for future collection or sharing of any required Consumer Health Data, we may not be able to provide those services to you.

Changes to This Consumer Health Data Privacy Policy

We reserve the right to modify this Consumer Health Data Privacy Policy at any time. If we make material changes to this Consumer Health Data Privacy Policy, we will notify you by updating the date of this Consumer Health Data Privacy Policy and posting it on the Services or other appropriate means. Any modifications to this Consumer Health Data Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your use of the Services after the effective date of any modified Consumer Health Data Privacy Policy indicates your acknowledging that the modified Consumer Health Data Privacy Policy applies to your interactions with the Services and our business.

For changes that materially affect how we collect or use your brainwave data or longitudinal cognitive profile data, we will provide at least 30 days' advance notice and will seek your renewed consent before those changes apply to your data.

How to Contact Us

Email: hello@mindflow-us.com

Nevada Supplemental Consumer Health Data Privacy Policy

This Supplement applies to our processing of Consumer Health Data about Nevada consumers, for purposes of providing additional disclosures required by Nevada's Consumer Health Data Privacy Law. We collect, use, process, and share Consumer Health Data for the purposes and manners described above in our Consumer Health Data Privacy Policy. In addition:

Review and Revision of Consumer Health Data. If you are a Nevada consumer and you would like to review and/or revise your Consumer Health Data, you may submit a request to us via the method listed in the Your Consumer Health Data Choices section of our Consumer Health Data Privacy Policy.

Third Party Collection of Consumer Health Data Across Sites. We do not allow third parties (i.e., non-service providers) to collect Consumer Health Data over time and across different Internet websites or online services when you use our Services.