Consumer Health Data Privacy Statement

Last Updated June 1, 2026

Please refer to our Privacy Statement for full details about how Invivyd collects, uses, shares or otherwise processes your Personal Data.

This Consumer Health Data Privacy Statement (“Statement”) applies to the Consumer Health Data of residents of the State of Washington and the State of Nevada that Invivyd collects, uses or shares, including when you visit the Website or otherwise interact with us. Please read this Statement carefully. Should you have any questions about this Statement or how we handle Consumer Health Data, please contact us at privacy@invivyd.com.

Consumer Health Data We Collect

As may be required under applicable local law, the chart below provides the categories of personal data that we may collect, use, and share the following categories of consumer health data, either directly from you or from third parties such as healthcare providers, insurance companies, or data brokers, as permitted by law:

Category of Data	Examples
Health Conditions & Diagnoses	Medical conditions, diagnoses, symptoms, status, disease history, mental health information, diagnostic testing
Reproductive & Gender-Affirming Health Data	Information regarding gender-affirming care or reproductive or sexual health, including data that could identify a consumer seeking such services
Medication & Treatment Data	Prescription history, dosage information, medication adherence, treatment outcomes, surgeries, procedures
Location Data (Health-Related)	Pharmacy visits, clinic or hospital visits inferred from precise geolocation
Device & App Usage Data	Data from connected health apps, wearables, or Invivyd digital tools
Communications Data	Messages exchanged with our patient support nurses, chatbots, or care coordinators
Survey & Self-Reported Data	Health questionnaires, symptom diaries, quality-of-life assessments

In addition to the above, we may collect, use, and share other information that may be used to infer or derive data related to the above or other health information.

Sources of Consumer Health Data

Consumer Health Data may be collected directly from you, from your interactions with our Websites and Services, from information we lawfully obtain from other sources, such as public records or websites, or other third parties, as described in the Collecting and Using your Personal Data section of our Privacy Statement.

Why Invivyd Collects and Uses Consumer Health Data

We primarily collect and use Consumer Health Data in connection with providing a product or service you have requested or authorized — including to provide and manage clinical research opportunities, patient support programs, and other services we offer, to process and manage safety and quality concerns, and to conduct other legitimate business activities, as permitted by applicable law. In some circumstances — for example, where the purpose is not to provide a product or service you have requested — we may collect and use Consumer Health Data only with your specific, separate consent. Where we share Consumer Health Data with third parties, we will obtain your separate and distinct consent for such sharing via an opt-in form, checkbox, or written authorization, in addition to any consent obtained for collection. Your consent to collection does not constitute consent to sharing.

With your consent, and based on your choices, we may use your Consumer Health Data for other purposes – for example, for advertising or marketing purposes. See the How to Exercise Your Rights section below for more details on the controls and choices you may have.

We may also de-identify or anonymize Consumer Health Data so that it can no longer reasonably be used to identify you. We will maintain and use de-identified information only in de-identified form and will not attempt to re-identify it, except as otherwise permitted under applicable law.

Categories of Third Parties with whom Invivyd may Disclose Your Consumer Health Data

Invivyd may share your Consumer Health Data with third parties only in compliance with applicable laws and regulations. For example, we may share your Consumer Health Data with the following categories of third parties:

Third parties and service providers, who work on Invivyd’s behalf to provide certain services.
Invivyd affiliates that may access Consumer Health Data include entities within the Invivyd corporate family. You may contact any of these entities by sending an email to privacy@invivyd.com. The following categories of Invivyd affiliates may receive Consumer Health Data: U.S. subsidiaries and operating entities; research and development affiliates; and international affiliates where required to support global pharmacovigilance or other legally mandated programs. A current list of Invivyd affiliates that may receive your Consumer Health Data is available upon request by contacting us at privacy@invivyd.com.
Business partners with whom Invivyd collaborates regarding our investigational products and programs, such as scientific advisors, joint venture partners and strategic collaboration partners.
Third parties involved in a merger, acquisition, sale, bankruptcy or other transaction in which that third party assumes control of our business or data (in whole or in part).
Legal, regulatory, or other enforcement authorities and other third parties if required by law, court order or governmental regulation, or if such disclosure is otherwise necessary in support of any criminal or other legal investigation or proceeding in the United States and other countries where we operate.
Third parties who protect against and prevent fraud, illegal activity (such as identifying and responding to incidents of hacking or misuse of our websites and mobile applications) and claims and other liabilities.

How to Exercise Your Rights Related to Consumer Health Data

Depending on your state of residence, you may have the following rights with respect to your Consumer Health Data, subject to certain exceptions and verification requirements:

Right to Confirm, Access, and Know: You have the right to confirm whether we are collecting, sharing, or selling your Consumer Health Data, and to access such data, including a list of all third parties and affiliates with whom we have shared or sold your Consumer Health Data, along with contact information for those parties (Washington residents may exercise this right up to twice annually).
Right to Withdraw Consent / Opt-Out: You may withdraw any consent you have provided for the collection, sharing, or selling of your Consumer Health Data at any time, without penalty. Upon receipt of your withdrawal request, we will cease processing your Consumer Health Data as soon as reasonably practicable. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
Right to Delete: You have the right to request deletion of your Consumer Health Data held by us and, where applicable, by our affiliates, processors, contractors, and other third parties to whom we have disclosed your data.
Right to Correct: You may have the right to request correction of inaccurate Consumer Health Data we hold about you.
Right to Non-Discrimination: You have the right not to receive discriminatory treatment as a result of exercising any of your rights under applicable law.

To exercise any of these rights, please submit a request using any of the following methods: Online (preferred): Email: privacy@invivyd.com; Phone: +1 781-819-0080; or Mail: Invivyd, Inc., Attn: Chief Privacy Officer, 209 Church Street, New Haven, CT 06510.

We will respond to your request consistent with applicable law and will verify your identity before processing certain requests. We will not discriminate against you for exercising your rights.

Please note: When you contact us to exercise your rights under this Supplement, you may share, and we may collect, Consumer Health Data as part of that communication (for example, when you describe the health data at issue in your request). We will use any Consumer Health Data collected in connection with your rights request solely for the purpose of processing and responding to that request, consistent with applicable law.

Appeal Process

If you disagree with our refusal to take action on a request to exercise your Consumer Health Data rights, you have the right to appeal our decision. Please contact us using the methods above within 60 days of receiving our decision. We will acknowledge your appeal and respond in writing within 45 days of receipt, including a written explanation of our decision. If we deny your appeal, Washington residents may raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint. Nevada residents who wish to appeal a denial may submit a complaint to the Nevada Attorney General at ag.nv.gov/complaints.

Nevada Supplement

This section applies to Nevada consumers and provides additional information as required under the Nevada Consumer Health Data Privacy Law (NV CHDP). We collect, use, process, and share Consumer Health Data for the purposes described in this Supplement. Nevada consumers may submit a request to review and revise their Consumer Health Data by contacting us using the methods in the section above. We will respond within 45 days of receipt, with the right to extend an additional 45 days where permitted by applicable law. We will notify you before making any material changes to our privacy practices regarding your Consumer Health Data. Third parties, including advertising networks, analytics providers, and social media platforms, may collect Consumer Health Data through cookies, pixels, and similar tracking technologies on our websites and online services. Such collection is subject to the privacy policies of those third parties. Nevada consumers may contact us at privacy@invivyd.com to obtain additional information about how such third parties collect Consumer Health Data through our digital properties.

Geofencing Prohibition

Invivyd does not implement geofences around facilities that provide in-person health care services for the purpose of identifying or tracking consumers seeking health care services, collecting Consumer Health Data, or sending health-related notifications, messages, or advertisements. This prohibition applies regardless of whether consumer consent has been obtained and applies to all facilities providing in-person health care services, including hospitals, clinics, pharmacies, reproductive health facilities, and mental health facilities.

Data Security

We use technical, administrative, and procedural measures designed to protect Consumer Health Data from unauthorized access, use, or disclosure. These measures include access controls, encryption, and contractual obligations on our service providers. No security measure is 100% effective, and we cannot guarantee the absolute security of your Consumer Health Data. If you have reason to believe your Consumer Health Data has been compromised, please contact us immediately at privacy@invivyd.com.

Third-Party Websites and Services

Our website and digital services may contain links to third-party websites, applications, or content not owned or controlled by Invivyd. Invivyd is not responsible for the privacy practices of any third-party property, and this Supplement does not apply to Consumer Health Data you provide to or that is collected by third parties. We encourage you to review the privacy policies of any third-party sites you visit.

Changes to our Consumer Health Data Privacy Statement

Invivyd may, at any time, revise this Supplement by updating this posting. If we make revisions to this Supplement, we will update the date of the Supplement accordingly. Additionally, when required under applicable law, we will request additional consent to collect and process your Personal and Consumer Health Data.