PRIVACY POLICY

XAICARE LTD ("we"), a company registered in England and Wales, runs suna.health. We collect what you give us when you join the waitlist, reserve, or apply for a job with us, plus basic technical data about your visit. We use it to run your reservation, consider your application, improve the site, and measure our marketing, based on contract, our legitimate interests, and where required your consent. We share it only with service providers who help us run SUNA: • Payments: Stripe Payments Europe Ltd (Ireland) for EU/UK customers, Stripe Inc (USA) for everyone else. They store your name, email, billing address and payment method so we can charge your reservation payment, your device order when you place it, and your monthly subscription. Stripe is our PCI-compliant payments partner; we never see your card details. Stripe's privacy notice: https://stripe.com/privacy. • Hosting and email: Vercel (USA) hosts the site; Resend (USA) sends our emails. • Marketing measurement: Meta, TikTok and Pinterest receive hashed event data so we can measure and target our own ads. • Error tracking: Sentry (Sentry Inc., based in San Francisco; EU customer data is processed at their Frankfurt data center) receives error reports including your email address and user ID for debugging payment and account issues. Sentry's privacy notice: https://sentry.io/privacy/. We use Sentry's EU region to keep this data inside the EEA for UK/EU users. • Product analytics: PostHog (PostHog Inc.; we use their EU Cloud, hosted in Frankfurt) receives pseudonymous usage analytics and, where enabled, session replays of how the site is used, keyed to a random device identifier. Only loaded with your consent where consent is required. PostHog's privacy notice: https://posthog.com/privacy. • Database: Supabase (EU region). • Hiring: Google Ireland Ltd. Job applications are copied into our hiring tracker in Google Sheets so we can manage them alongside our own sourcing. Google's privacy notice: https://policies.google.com/privacy. Where data leaves the UK or EEA we rely on UK / EU adequacy decisions, the EU-US Data Privacy Framework, or Standard Contractual Clauses, as applicable. We keep your data only as long as needed or required by law. ──────────────────────────────────────── WHAT WE DO NOT DO • We do not sell your personal data. Not to anyone. Not ever. • We do not share your data with advertisers for re-targeting outside our own advertising. • We do not share your data with health insurers, employers, or background-check services. • We do not allow third-party data brokers to access your account. • We do not use your data to train models for any third party. ──────────────────────────────────────── DATA SECURITY • Sensitive fields at rest are encrypted using AES-256. • All data in transit uses TLS 1.3. • Payment card details never touch our servers (handled by Stripe, PCI-DSS). • Authentication tokens are scoped, expire, and can be revoked. • Error data sent to Sentry is processed in their EU (Frankfurt) region for UK/EU users. • We use least-privilege access controls internally; only the people who need to see something do. ──────────────────────────────────────── HEALTH DATA (SPECIAL CATEGORY) When you use SUNA, we may process information about your digestion, gut, and nutrition. Under UK GDPR this is special-category (health) data. We process it only with your explicit consent (UK GDPR Article 9(2)(a)), solely to provide your wellness insights and the SUNA service. You can withdraw consent at any time by emailing echo@suna.health, after which we stop processing and delete this data unless we are required to keep it by law. SUNA is a wellness product and does not provide medical diagnosis. ──────────────────────────────────────── JOB APPLICANTS If you apply for a role at suna.health/careers we collect your first and last name, email address, phone number, date of birth, gender, city, postcode, country and your pitch. All of these are required to submit an application. We also collect anything optional you choose to add, like links or a note on what pulls you toward gut health and nutrition. We process this to consider you for the role, on the basis of our legitimate interests in recruiting and of taking steps at your request before entering an employment contract. Your application is read by the founders. It is stored in our database (Supabase, EU region), emailed to us (Resend), and copied into our hiring tracker (Google Sheets). Where you link a public profile such as GitHub, we look at what is already public there. We keep your application while we consider you, and afterwards in case a future role fits. You can ask us to delete yours any time at echo@suna.health. Everything in "Your rights" below applies to applicants too. ──────────────────────────────────────── YOUR RIGHTS Under UK GDPR you can access, correct, delete, export, restrict, or object. Email echo@suna.health, or complain to the ICO at ico.org.uk. SUNA is for adults. ──────────────────────────────────────── CHANGES TO THIS POLICY We may update this policy as the product changes. For any material change (new data collected, new processor added, expanded data sharing), we will give reasonable advance notice by email before the change takes effect. The "Last updated" date at the top is always current. ──────────────────────────────────────── COOKIES Some cookies are required for the site to work. They're always on: • Your reservation, currency, and referrals. • Stripe payment cookies during secure checkout. Other cookies are for advertising and measurement: Meta Pixel (_fbp, _fbc), TikTok pixel (_ttp), and Pinterest tag (_epik). Where required by law we show a banner asking before any of these are set. To change your choice later: click "Cookie Preferences" in the footer, or add ?cookies=1 to any URL. Your decision is stored on your device for one year. ──────────────────────────────────────── CONTACT echo@suna.health suna.health XAICARE LTD, trading as Suna Health. Registered in England and Wales, company number 16126637. Registered office: 9th Floor, 107 Cheapside, London, EC2V 6DN, United Kingdom. Disclaimer! Wellness device. Not medical. Not diagnostic. Ask your doctor. © 2026 Suna Health