PASO — PRIVACY POLICY (UNITED STATES & GLOBAL)

Last Updated: October 12, 2026

Effective Date: October 12, 2026

1. Introduction & Data Controller

This Privacy Policy describes how ZURI GLOBAL S.R.L., a company organized under the laws of Romania, with its registered office in the Municipality of Făgăraș, 13 Cînepii Street, Brașov County, Romania, registered with the Trade Register under no. J2026027622003, Fiscal Code (CIF) 54560651 ("Company", "PASO", "we", "us", or "our"), acting as the Data Controller, collects, uses, safeguards, and discloses personal information when you access or use the PASO mobile application, website, and related digital wellness services (collectively, the "Services").

Please read this Privacy Policy in conjunction with our Terms of Service. By creating an account or using the Services, you acknowledge the collection and processing of your information as described herein.

2. Important Health Data Clarifications

2.1. Not a HIPAA Covered Entity

PASO IS A DIRECT-TO-CONSUMER DIGITAL WELLNESS AND HABIT EDUCATION SERVICE. ZURI GLOBAL S.R.L. IS NOT A "COVERED ENTITY" OR "BUSINESS ASSOCIATE" UNDER THE UNITED STATES HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA).

Personal information, self-reported nutrition logs, and wellness habits you provide in the app are not governed by HIPAA rules. Instead, your data is protected under this Privacy Policy, applicable US state privacy statutes (such as the California Consumer Privacy Act / CPRA and the Washington My Health My Data Act), and the European Union General Data Protection Regulation (GDPR).

2.2. Consumer Health Data Notice (Washington MHMDA & US State Laws)

We collect certain wellness, nutritional, and lifestyle data solely to deliver personalized educational content, habit tracking, and progress metrics. WE DO NOT SELL YOUR CONSUMER HEALTH OR NUTRITIONAL DATA TO DATA BROKERS, NOR DO WE SHARE SENSITIVE HEALTH INFORMATION WITH THIRD-PARTY ADVERTISING NETWORKS FOR CROSS-CONTEXT BEHAVIORAL MARKETING.

3. Categories of Information We Collect

3.1. Information You Provide Directly

• Account Registration Data: Name, email address, password, age (strictly confirming 18+ eligibility).
• Wellness & Profile Information: Self-reported lifestyle goals (e.g., energy levels, sleep hygiene, muscle support, mindful nutrition), general activity levels, dietary preferences, and self-reported check-in reflections.
• App Progress & Engagement: Answers to episodic knowledge checks (quizzes), habit streak counts, notes, and badge milestones.
• Customer Support Inquiries: Information provided when contacting us at support@paso.health.

3.2. Information Collected Automatically

• App Usage Data: Episodes read or listened to, session duration, features accessed, and interaction events.
• Technical & Device Identifiers: IP address, device model, operating system version, unique application instance identifier, language settings, and diagnostic crash logs.

3.3. No Wearables or Sensor Integrations

The PASO application does NOT integrate with, synchronize with, or collect data from Apple HealthKit, Google Health Connect, smartwatches, or wearable sensor devices. All metrics within the app are strictly self-reported by the user.

4. How We Use Your Information

We process your personal information strictly for legitimate operational purposes:

1. Delivering the Services: Personalizing educational micro-lessons, habit tracking, quizzes, and streak animations featuring the Paso mascot.
2. Account Management: Authenticating your account, managing subscription access, and providing customer support.
3. App Performance & Security: Detecting software bugs, preventing fraudulent access, and securing our cloud infrastructure.
4. Internal Analytics: Evaluating aggregated, de-identified usage trends to improve content quality and user experience.

5. How We Share Your Information

WE DO NOT SELL, RENT, OR TRADE YOUR PERSONAL INFORMATION OR HEALTH DATA. We only disclose information under strict contractual data protection agreements in the following limited circumstances:

1. Cloud & Infrastructure Providers: Vetted technical service providers that provide cloud hosting, database storage, and crash monitoring (e.g., AWS, Google Cloud, Microsoft Azure) located in the United States and the European Union.
2. App Store Payment Processors: All in-app subscription transactions are processed directly by Apple Inc. (App Store) or Google LLC (Google Play). We do not collect or store credit card details.
3. Legal Compliance: When required by applicable law, court order, subpoena, or to protect the safety, rights, and property of our users, the public, or ZURI GLOBAL S.R.L.
4. Business Reorganization: In connection with any merger, acquisition, or sale of company assets, subject to standard confidentiality protections.

6. Data Security & Storage

• Encryption in Transit & at Rest: All data exchanged between your mobile device and our cloud servers is encrypted using modern TLS (1.3) protocols. Data stored in our production databases is encrypted at rest using AES-256.
• Access Control: Production access is restricted to authorized technical personnel under strict multi-factor authentication (MFA) and least-privilege policies.
• Retention: We retain personal information only for as long as your account remains active or as necessary to satisfy legal compliance obligations.

7. Your Legal Privacy Rights

7.1. Global Rights (Access, Rectification & Account Deletion)

Regardless of where you reside, you have the right to:

• Access & Data Portability: Request a copy of the personal information we hold about you in a structured format.
• Correction: Request correction of inaccurate personal data.
• Erasure / Account Deletion: You can delete your account and all associated data directly inside the app under Settings > Delete Account, or by emailing us at support@paso.health.

7.2. United States Privacy Rights (California CCPA/CPRA, Washington MHMDA)

If you reside in California, Washington, Virginia, or other US states with consumer privacy legislation:

• Right to Know: You may request details about the categories and specific pieces of personal information collected in the preceding 12 months.
• Right to Opt-Out of Sale / Sharing: ZURI GLOBAL S.R.L. does not "sell" or "share" personal information or sensitive health data for behavioral advertising.
• Right to Limit Sensitive Data: We only process self-reported wellness preferences to provide the educational Services you specifically requested.
• Non-Discrimination: You will never be penalized or charged different fees for exercising your privacy rights.

To exercise these rights, email support@paso.health with the subject line "US Privacy Request".

7.3. European Union & UK Residents (GDPR Compliance)

Under the EU GDPR, our legal bases for processing are:

• Performance of our contract with you (Terms of Service);
• Your explicit consent for processing self-reported dietary preferences;
• Legitimate interests in securing and maintaining our digital platform.

8. Strict 18+ Children's Privacy Policy (COPPA Compliance)

The Services are designed and intended strictly for adults aged eighteen (18) and older. We do not knowingly market to, target, or collect personal information from individuals under 18 years of age.

If we become aware that an individual under 18 has created an account or submitted personal information, we will immediately delete the data and terminate the account. Parents or guardians who believe a minor has registered should notify us immediately at support@paso.health.

9. International Cross-Border Data Transfers

Because ZURI GLOBAL S.R.L. is headquartered in Romania (European Union) and serves users globally, your personal data will be processed on cloud infrastructure located in both the European Union and the United States. We implement Standard Contractual Clauses (SCCs) approved by the European Commission and recognized technical safeguards to ensure that personal data transferred internationally receives an adequate level of legal protection.

10. Modifications to This Privacy Policy

We may update this Privacy Policy from time to time. When updates occur, we will revise the "Last Updated" date and notify you via the mobile application or by email. Your continued use of the Services after the effective date of an updated policy signifies your acceptance.

11. Contact Us & Data Protection Inquiries

For any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us at:

• Data Controller: ZURI GLOBAL S.R.L.
• Trade Register No.: J2026027622003
• Fiscal Identification Code (CIF): 54560651
• Registered Office: Municipiul Făgăraș, Strada Cînepii, Nr. 13, Județul Brașov, România
• Privacy & Support Email: support@paso.health