California Resident Privacy Notice

Effective Date: 01.22.26

This California Resident Privacy Notice (“California Notice”) supplements the information contained in Harbor's Privacy Policy and State Privacy Law Addendum and applies solely to individual residents of the State of California (“consumers” or “you”).

This Notice is provided pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the “CCPA/CPRA”).

Any capitalized terms not defined in this Notice have the meanings set forth in the Privacy Policy or State Privacy Law Addendum.

Categories of Personal Information We Collect

Within the past twelve (12) months, Harbor has collected the following categories of personal information, as defined by the CCPA/CPRA:

• Identifiers (such as name, email address, postal address, IP address, and account identifiers)
• Personal information categories described in Cal. Civ. Code § 1798.80(e)
• Commercial information (such as transaction and purchase history)
• Internet or other electronic network activity information
• Geolocation data (general location only)
• Sensitive personal information, including health-related information provided in connection with use of the platform

We collect this information directly from you, automatically through your use of the Services, and from service providers and partners involved in operating the platform.

Purposes for Collection and Use

We collect and use personal information for the business and operational purposes described in the Privacy Policy, including to:

• Operate and maintain the Harbor platform
• Facilitate access to licensed healthcare providers
• Process payments and fulfill orders
• Provide customer support and communications
• Conduct analytics, security, and fraud prevention
• Comply with legal and regulatory obligations

Sale or Sharing of Personal Information

Harbor does not sell consumer health data.

Harbor may share limited personal information for purposes of advertising, analytics, or measurement, as permitted by the CCPA/CPRA and described in the Privacy Policy.

Harbor does not use data brokers and does not knowingly sell personal information of consumers under sixteen (16) years of age.

Your California Privacy Rights

Subject to certain exceptions, California residents have the right to:

Right to Know / Access

Request information about the personal information we have collected, used, disclosed, or shared.

Right to Correct

Request correction of inaccurate personal information.

Right to Delete

Request deletion of personal information, subject to legal exceptions.

Right to Limit Use of Sensitive Personal Information

Where applicable, request limitations on certain uses of sensitive personal information.

Right to Opt Out of Sharing for Targeted Advertising

Request that we stop sharing personal information for cross-context behavioral advertising, where applicable.

Right to Non-Discrimination

You will not receive discriminatory treatment for exercising your privacy rights.

How to Submit a Request

To exercise your California privacy rights, contact us at:

Email: legal@visitharbor.com

Please include:

• Your name
• The email address associated with your account
• A description of your request

We may require verification of your identity before processing your request. We will respond within 14 days, or as otherwise permitted by law.

Authorized Agents

You may designate an authorized agent to submit a request on your behalf. We may require proof of authorization and verification of your identity before processing the request.

Right to Appeal

If we deny your request, you may appeal our decision by submitting an appeal request to legal@visitharbor.com. We will respond to appeals within the timeframe required by applicable law.

Contact Information

If you have questions about this California Notice or our privacy practices, contact: