Consumer Health Data Privacy Notice

Effective Date: February 23, 2026

This Consumer Health Data Privacy Notice supplements the Flex Privacy Notice and explains how Flex Technology Co (“Flex,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes Consumer Health Data (as defined below) through the https://www.withflex.com/ website (the “Site”), and through the related HSA/FSA checkout services that we provide for online stores (all collectively, the “Services”). It does not address our privacy practices relating to Flex job applicants, employees and other personnel.

Please note that this Consumer Health Data Privacy Notice is not a contract and does not create any legal rights or obligations not otherwise provided by law.

What is Consumer Health Data

The term “Consumer Health Data” as used in this Consumer Health Privacy Notice means any personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status as defined in applicable consumer health data privacy laws in the United States (“Consumer Health Privacy Laws”), such as the Connecticut Data Privacy Act, the Nevada Consumer Health Data Privacy Law and the Washington My Health My Data Act.

Collection of Consumer Health Data

The Consumer Health Data we collect depends on the context of your interactions with us and, in most cases, is information that you decide to share with us. This includes information collected through your communications with us, from your other interactions with our Services, or that we may infer through your use of the Services. Consumer Health Data does not include information that is considered deidentified under the Consumer Health Privacy Laws.

Examples of Consumer Health Data that we may receive include:

• Information you share about your health-related conditions, symptoms, experiences, diagnoses, testing, or treatments.
• Information about purchases you make through our Services using your HSA/FSA account.
• Letters of Medical Necessity relating to your purchases through our Services.
• Any other health-related information that you include in your communications with us.

Sources of Consumer Health Data

The Consumer Health Data we collect depends on the context of your interactions with our Services and, in most cases, is information that you decide to share with us or that we receive from a medical professional who prepares a Letter of Medical Necessity for you.

For more information, please see the “Our Collection and Use of Personal Information” section of our Privacy Notice.

Use of Consumer Health Data

We may process and/or use your Consumer Health Data (including with your consent where required by the Consumer Health Privacy Laws) for the following purposes:

• To manage and provide the Services.
• To respond to your questions, concerns, and other requests for assistance.
• To customize your experience on the Services.
• To create anonymous, aggregated, or de-identified data.

We may also combine your Consumer Health Data with other personal information we collect directly from you or receive from other sources.

Disclosure of Consumer Health Data

We may share the categories of Consumer Health Data set forth above as follows:

• Service Providers: We work with a variety of service providers who help us process your Consumer Health Data, such as to facilitate the operation of our Site and Services and to support our communications with you.
• Claim Administrators and Their Designated Agents: We may provide your Consumer Health Data to third party administrators and claim agents to support FSA/HSA claim submission and adjudication.
• Business Transactions: We may take part in or be involved with a business transaction, such as a merger. We may disclose Consumer Health Data to a third party during the negotiation of or in connection with such a transaction.
• Legal Obligations and Rights: We may disclose Consumer Health Data to third parties in connection with the establishment, exercise, or defense of legal claims; to comply with laws or to respond to lawful requests and legal processes; to protect our rights and property and the rights and property of others, including to enforce our agreements and policies; to detect, suppress, or prevent fraud; to protect the health and safety of us and others; or as otherwise required by applicable law.
• With Your Consent: We may disclose Consumer Health Data about you to other service providers or publicly with your consent or at your direction. For example, with an individual’s consent or at their direction we may post their testimonial on our Site or Services-related publications.

Your Privacy Rights

Depending on your state of residence, you may have the following rights with respect to Consumer Health Data we collect about you:

• Right to Access / Confirm: You may have the right to confirm whether we are collecting, sharing, or selling Consumer Health Data about you and with whom we may be disclosing such Consumer Health Data, and to access such data.
• Right to Withdraw Consent: If you have provided your consent for our processing or sharing of your Consumer Health Data, you may have the right to withdraw your consent.
• Right to Delete: You may have the right to request that we delete your Consumer Health Data and that all third parties to whom we have disclosed your Consumer Health Data delete such data.

How to Exercise Your Privacy Rights

To exercise any of the privacy rights set forth above or to review or request changes to data, please submit a request to support@withflex.com.

Before processing your request, we will need to authenticate your identity. To authenticate your identity, we will generally require matching a minimum amount of information you provide us with the information we maintain about you in our systems. This process may require us to request additional information from you, including, but not limited to, your email address and phone number.

In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to authenticate your identity or locate your information in our systems. If we are unable to comply with all or a portion of your request, we will explain the reasons for our decision and provide information on your right to appeal the decision, if applicable.

Changes to this Consumer Health Data Privacy Notice

We may update this Consumer Health Data Privacy Notice from time to time. When we make changes to this Consumer Health Data Privacy Notice, we will notify you by changing the date at the beginning of this Consumer Health Data Privacy Notice. If we make material changes to this Consumer Health Data Privacy Notice, we will notify individuals through appropriate communication channels. All changes shall be effective from the date of publication unless otherwise specified.