Listen Labs Consumer Health Data Privacy Policy

1. What This Policy Covers

Merlin AI, Inc. dba Listen Labs (“Listen Labs,” “we,” “us”) provides an AI-powered customer understanding platform through which organizations hear directly from their customers and users in AI-guided interviews and surveys (each, a “Study”). This Consumer Health Data Privacy Policy (this “Policy”) explains how we collect, use, and share “Consumer Health Data” from individuals who participate in our Studies (“Participants”), and the rights available to you under applicable consumer health data privacy laws. We apply the practices described in this Policy to all Participants, regardless of location.

This Policy supplements the Listen Labs Study Privacy Policy, which governs our handling of Personal Data generally. To the extent Consumer Health Data is concerned, this Policy controls.

2. What Is “Consumer Health Data”

“Consumer Health Data” means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. Listen Labs does not design its Studies to seek out health information, and our platform is not intended for the collection of medical records. However, because Studies often include open-ended questions, you may choose to mention health-related topics in your responses. Examples of Consumer Health Data that may appear in Study responses include:

• References to health conditions, symptoms, diagnoses, or treatments, or to seeking or using health-related products or services (for example, mentioning back pain, sleep issues, allergies, or a medication you take);

• Information about bodily functions, reproductive or sexual health, or mental health that you volunteer in a response; and

• Health-related inferences that could be drawn from your responses.

Information that has been de-identified or aggregated so that it can no longer reasonably be linked to you is not Consumer Health Data and is not covered by this Policy.

3. Sources of Consumer Health Data

We collect Consumer Health Data from one source only: you. Specifically, Consumer Health Data may be contained in the responses you choose to provide during a Study (including video, audio, or text responses) and in transcripts or analyses derived from those responses. We do not purchase Consumer Health Data, collect it from data brokers, or derive it from your browsing activity.

4. Consent

Before you begin a Study, we ask for your consent to collect and process any health-related information you may choose to share in your responses. Participation is voluntary: you decide whether to mention health-related topics, and you may decline to answer any question or exit a Study at any time. If you do not provide consent, you should not share health-related information in your responses.

5. How We Use Consumer Health Data

We use Consumer Health Data solely for the following purposes:

• Conducting the Study. Recording, transcribing, processing, and analyzing your responses in order to deliver Study results and insights to the customer that commissioned the Study (the “Research Organization”), for the Research Organization’s internal research, analysis, and insight-generation in connection with the Study, as permitted by our Acceptable Use Policy;

• Security and fraud prevention. Maintaining the security and integrity of our platform and preventing fraudulent participation; and

• Legal compliance. Complying with applicable law and responding to lawful requests, including exercises of the rights described in Section 7.

We do not use Consumer Health Data for advertising or marketing to you, and we do not sell Consumer Health Data.

6. How We Share Consumer Health Data

We share Consumer Health Data only with the following categories of recipients:

• The Research Organization. Your Study responses, which may contain Consumer Health Data you chose to share, are provided to the Research Organization that commissioned the Study. Research Organizations are contractually required to use responses only for purposes authorized under our Acceptable Use Policy or their own terms presented to you before the Study;

• Service providers. Vendors that process data on our behalf to deliver the Studies (for example, cloud hosting, transcription, and AI analysis providers), each bound by contractual confidentiality and data protection obligations and prohibited from using your data for their own purposes. Our current subprocessors are listed at trust.listenlabs.ai; and

• Legal recipients. Courts, regulators, or other parties where disclosure is required by law or necessary to protect our legal rights, with disclosures limited to what is required.

• Corporate transactions. A successor or acquirer in connection with a merger, acquisition, financing, or sale of all or part of our business, provided the recipient continues to honor this Policy or provides comparable protections, and subject to any notice or consent required by applicable law.

We do not share Consumer Health Data with affiliates for their own use, and we do not sell Consumer Health Data or share it for targeted advertising. We will not sell Consumer Health Data without first obtaining a separate, valid authorization as required by applicable law.

7. Your Rights

You have the following rights with respect to your Consumer Health Data, subject to verification and applicable law:

• Right to know and access. Confirm whether we collect, share, or sell Consumer Health Data concerning you, and access that data, including a list of the third parties with whom we have shared it;

• Right to withdraw consent. Withdraw your consent to our collection and sharing of your Consumer Health Data; and

• Right to delete. Request deletion of your Consumer Health Data, including from our backups and archives on their normal refresh cycles, and we will instruct our service providers and notify recipients to do the same. Where Consumer Health Data has already been shared with or exported by a Research Organization, we will notify them of your request; copies in their possession are subject to their own privacy practices.

To exercise any of these rights, contact us at privacy@listenlabs.ai. You may also use an authorized agent. We will verify your request and respond within the timeframes required by applicable law. We will not discriminate or retaliate against you for exercising your rights.

Appeals. If we decline to act on your request, you may appeal by replying to our response or by emailing privacy@listenlabs.ai with the subject line “Appeal.” We will respond to appeals within the period required by applicable law. If your appeal is denied, you may contact the Attorney General in your state of residence.

8. Retention

We retain Consumer Health Data only as long as necessary for the purposes described in Section 5, consistent with the retention practices described in the Study Privacy Policy and our agreements with Research Organizations, after which it is deleted or de-identified.

9. Security

We protect Consumer Health Data using industry-standard administrative, technical, and physical safeguards, and we restrict internal access to personnel who need it to deliver the services. Additional detail on our security program is available at trust.listenlabs.ai.

10. Children

Our Studies are not directed to children, and we do not knowingly collect Consumer Health Data from anyone under the age required by applicable law without appropriate consent. If you believe a child has provided us Consumer Health Data, contact us at privacy@listenlabs.ai and we will delete it.

11. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy on this page with a revised effective date and, where required by law, obtain your consent to material changes.

12. Contact

If you have questions, concerns, or complaints about this Policy or our handling of Consumer Health Data, contact us at privacy@listenlabs.ai, or write to our Data Protection Officer: Florian Juengermann, Merlin AI, Inc. dba Listen Labs, 85 2nd St, STE 500, San Francisco, CA 94105, United States.