Privacy notice

Privacy Policy

Last Updated: November 3, 2026

This Privacy Policy describes how Eight Sleep, Inc. ("Eight Sleep", "we", "us", "our") collects, uses and discloses information about you when you use our website (https://www.eightsleep.com/) (the "Website"), mobile application (the "App"), the Pod, another Eight Sleep device, or any other services, tools and features offered by us, or when you otherwise interact with us (collectively, the "Services"). For the purposes of this Privacy Policy, "you" and "your" means you as the user of the Services.

Eight Rx. Eight Rx, LLC ("Eight Rx") is a separate company and a wholly owned subsidiary of Eight Sleep. Eight Rx operates a consumer health platform that connects its members with independent, physician-owned medical practices whose licensed clinicians provide telehealth care (the "Eight Rx Services"). Section 12 of this Privacy Policy describes how Eight Rx collects, uses and discloses information in connection with the Eight Rx Services. Eight Rx, not Eight Sleep, is responsible for that information. Except where Section 12 says otherwise, Sections 1 through 11 describe Eight Sleep's practices only. Neither Eight Sleep nor Eight Rx provides medical care.

For the purposes of data protection laws, Eight Sleep is the data controller for the information described in Sections 1 through 11, and Eight Rx is the data controller for the information described in Section 12. Our representative in the European Economic Area, UK and Switzerland is the Prighter Group, whose contact details are set out in Section 11 below. If you are an EEA, UK or Swiss resident, you may also make a request here.

Please read this Privacy Policy carefully. This Privacy Policy explains how we collect, use, and disclose your information. Where applicable law requires your consent for certain processing, including the processing of health data, we will ask for that consent separately, and you may withdraw it at any time as described below. If you do not understand or agree to this Privacy Policy, please do not use or access the Services.

If you are a U.S. resident, please also review our Consumer Health Data Privacy Policy, which describes how we handle consumer health data under Washington, Nevada, and other state consumer health privacy laws, including Eight Rx's handling of consumer health data.

1. CHANGES TO THIS PRIVACY POLICY

We may modify this Privacy Policy from time to time, in which case we will update the "Last Updated" date at the top of this Privacy Policy. If we make material changes to how we use or disclose information we collect, we will use reasonable efforts to notify you (such as by emailing you at the last email address you provided us, by posting notice of such changes on the Services or by other means consistent with applicable law) and will take additional steps as required by applicable law, including obtaining your consent where required before collecting new categories of health data or using health data for new purposes. If you do not agree to any updates to this Privacy Policy, please do not continue using or accessing the Services.

2. COLLECTION AND USE OF INFORMATION

When you use or access the Services, we collect certain categories of information about you from a variety of sources. In addition to the specific uses discussed below, we may use this information to provide and improve the Services, to conduct research and development and to maintain our business relationship, in our legitimate interests, including to enhance the safety and security of our Services, providing customer support, complying with applicable legal obligations, enforcing any applicable terms of service, and protecting our rights and the rights of our employees, users or other individuals.

Information You Provide to Us

Some features of the Services, such as creating an account, setting up your device(s), and enabling functionality of your device(s), may require you to directly provide certain information, including information about yourself. You may elect not to provide this information, but as this information is required to enable us to provide you with the Services, choosing not to provide this information may prevent you from using, or accessing features of, the Services.

Information that you directly submit through our Services includes:

• Basic contact details, such as name, address, phone number, and email. We use this information to create and maintain your account and provide the Services, as required to perform our contract with you, and because it is in our legitimate interest to communicate with you (including, with your consent where required, to tell you about certain promotions, products or services that may be of interest to you). Where you provide the same email address at checkout and during app account creation, we may associate your purchase record with your app account for purposes of service delivery, account setup, and personalization of the Services.
• Account information, such as username and password. We use this information to provide the Services, as required to perform our contract with you, and because it is in our legitimate interest to maintain and secure your account with us. If you choose to register an account, you are responsible for keeping your account credentials safe. We recommend you do not share your access details with anyone else. If you believe your account has been compromised, please contact us immediately.
• Payment and transaction information, such as credit card information and billing address, which we collect using a third-party payment processor, and information about your purchases. We use this information to process your payment and provide the Services, as required to perform our contract with you.
• Health and wellness information, such as information you choose to provide about your health and wellness when setting up your account in the App, blood panel and other laboratory results from tests you order through the Services, and clinical health data you authorize us to access from your healthcare providers through third-party health record platforms such as HealthEx (as described below under "Information Collected From Other Sources"). We use this information with your consent, to the extent consent is required by applicable privacy law. Where we are required to obtain your consent or authorization to collect, use, or disclose health information, we obtain it separately from your acceptance of this Privacy Policy. If you reside in the US, please refer to the Eight Sleep Consumer Health Data Privacy Policy for more information.
• Any information you choose to input into our AI-powered tools ("Input"), which we use to generate and output new information or content ("Output") as a part of the Services, including to personalize insights, assist in our provision of customer support and otherwise provide the Services. We do not use your personal data to train large language models or third-party generative AI systems. When you connect clinical health records, we use automated tools, including AI service providers acting on our behalf under contract, to organize and standardize that information, including clinician notes.
• Automated Decision-Making and Profiling. We use automated processing, including through our Autopilot and AI-powered features, to analyze your sleep and biometric data and make automated adjustments to your Pod's temperature, firmness, and other settings. These automated decisions are made to personalize and improve the Services for you and do not produce legal or similarly significant effects. You may adjust or disable automated features at any time through the App settings. Where required by applicable law, you have the right to request information about the logic involved in automated decision-making, to contest the results of profiling, and to request human review of a decision.
• Applicant details, such as information included in your resume or CV and job history. We use applicant details to process your application for employment and because it is in our legitimate interest to evaluate your candidacy.
• Any other information you choose to include in communications with us, for example, when sending a message through the Services, because it is in our legitimate interest to be responsive to you.

Information Collected Automatically

If you use the Pod or other Eight Sleep device(s), the device(s) will automatically collect a variety of metrics to provide the Services, such as to personalize your sleep statistics and sleep recommendations and to provide health statistics in the App, as required to perform our contract with you and with your consent, to the extent consent is required by applicable privacy law. If you are a US resident, please refer to the Eight Sleep Consumer Health Data Privacy Policy for more information about our processing of certain data collected through the device(s). When your device syncs with your App, data recorded on your device is transferred from your device(s) to our servers.

We and third parties may also use cookies, pixels, or other tracking technologies ("Tracking Technologies") on the Website and your App to automatically collect certain information about your interactions with the Services. This information is collected and used either with your consent (where consent is required by applicable law) to personalize the Services for you, and to target, deliver and measure interest-based advertising, or because it is in our legitimate interests to tailor your experience with the Services, provide you with offers or promotions, run analytics, better understand user interactions with the Services. Such information includes:

• Device information and online identifiers, such as device type, operating system, unique device identifier, internet protocol (IP) address, cookie ID and other online identifiers.
• Location information, such as approximate location based on IP address and, if you choose to provide it, precise geolocation.
• Other information regarding your interaction with the Services, such as browser type, log data, date and time stamps, scroll-to-page interactions, session statistics, clickstream data, purchase history and related information, ad views and impressions, and interactions with marketing emails and SMS messages.

Most browsers accept cookies automatically, but you may be able to control the way in which your devices permit the use of cookies. If you so choose, you may block or delete certain of our cookies from your browser; however, blocking or deleting cookies may cause some of the Services, including any portal features and general functionality, to work incorrectly.

You may also opt-out of the collection and use of information for interest-based advertising by advertisers that are part of certain industry alliances, including through tools offered by the National Advertising Initiative, the Digital Advertising Alliance or the European Interactive Digital Advertising Alliance, by clicking the links provided.

Opt-out preference signals. Our website honors the Global Privacy Control ("GPC") and "Do Not Track" browser signals as requests to opt out of the sale or sharing of personal information and of targeted advertising. When your browser sends either signal, we turn off the cookies and Tracking Technologies used for those purposes on that browser from the first page you load, without requiring any further action from you. The signal applies to the browser and device on which it is enabled, so you will need to enable it on each browser and device you use, or use the "Your Privacy Choices" link in the footer of every page of our website to set your preference directly.

For more information on how we use cookies, please see our Cookies Policy.

Information Collected From Other Sources

We may obtain information about you from outside sources, including information that we collect directly from third parties and information from third parties that you choose to share with us. Such information includes:

• Information we receive from third-party apps and accounts, such as Apple Health and Google Health Connect, which we use with your consent and in order to perform our contract to provide the Services.
• Information we receive from third-party health record connectivity platforms, such as HealthEx, including laboratory and diagnostic test results, vital signs, medications, allergies, health conditions and diagnoses, and clinician notes from your healthcare providers. We access this information with your consent to provide personalized health insights and your Biological Age score within the App. We use automated tools, including AI service providers acting on our behalf, to organize and standardize this information. With your separate consent, we may also use this data in pseudonymized form (with your name and contact information removed) to improve our health models, develop new features, and publish aggregate research findings that do not identify you.
• Information we receive from our laboratory and clinician partners, such as blood panel and other laboratory test results from tests you order through the Services, which we use with your consent to provide your results, personalized health insights, and your Biological Age score.
• Information we receive from consumer marketing databases or other data enrichment companies, which we use in our legitimate interests to better customize advertising and marketing to you.
• Information we receive when you choose to link any social media platforms to your account, such as Facebook or X, which we use in our legitimate interests to maintain your account and login information.

Any information we receive from outside sources will be treated in accordance with this Privacy Policy. We are not responsible for the accuracy of the information provided to us by third parties and are not responsible for any third party's policies or practices. For more information, see the section below, Third-Party Websites and Links.

Deidentified Information

Finally, we may deidentify or anonymize your information such that it cannot reasonably be used to infer information about you or otherwise be linked to you (or we may collect information that has already been deidentified/anonymized), and we may use such deidentified/anonymized information to improve our Services and better understand our users, share such deidentified/anonymized information with third parties, and for any other purpose in accordance with applicable law.

Where you separately consent, we may also use your health, clinical, and sleep data in pseudonymized form (with direct identifiers such as your name and contact information removed, but associated with demographic information and general location) to improve our health models, develop new features, and publish aggregate research findings that do not identify you. If you withdraw this consent, we will stop using your data for these purposes going forward, but we cannot remove its contribution from models that have already been trained. Pseudonymized data retains certain indirect identifiers and is not considered deidentified information under this section.

Partner and Household Account Linking

If you share your Pod with another person, you may invite them to link their Eight Sleep account to your Pod so that each user can independently control their side of the bed and track their own sleep data. When accounts are linked, both users will be able to view each other's sleep and health data within the App, including:

• Sleep metrics, such as sleep score, sleep stages, time asleep, and sleep consistency;
• Biometric data, such as heart rate, heart rate variability, and respiratory rate;
• Temperature preferences and adjustments; and
• Leaderboard and comparative features, such as the Sleep Fitness leaderboard, which displays linked users' sleep performance data.

By sending or accepting a partner invitation, you consent to this mutual sharing of sleep and health data with the linked user. This consent is separate from, and in addition to, your consent to Eight Sleep's collection and use of your data as described elsewhere in this Privacy Policy.

You may unlink your account at any time through the App settings (see our Help Center for instructions). Unlinking will revoke the other user's ongoing access to your sleep and health data going forward. Once unlinked, the other user will no longer be able to view any of your sleep and health data, including data recorded during the linked period.

3. DISCLOSURE OF YOUR INFORMATION

We may disclose your information for legitimate purposes subject to this Privacy Policy, including the following categories of third parties:

• Our affiliates or others within our corporate group, as a matter of our legitimate interests to efficiently provide the Services. This includes Eight Rx. Eight Sleep shares Pod data and Pod alerts with Eight Rx only if you give your separate, express authorization, as described in Section 12, and you may withdraw that authorization at any time.
• Vendors or other service providers who help us provide the Services, including for system administration, cloud storage, security, customer relationship management, customer communications, including personalized sleep reports you choose to receive (which may include health and wellness metrics such as sleep scores, heart rate, and heart rate variability to deliver personalized reports and communications to you), marketing communications, AI processing, web analytics, payment networks, and payment processing, in our legitimate interests to ensure the reliable and safe operation of the Services and, where applicable, with your consent.
• Laboratory and clinician partners to fulfill blood panel and other tests you order through the Services, as necessary to perform our contract with you and with your consent.
• Third parties to whom you request or direct us to disclose information, such as through your use of social media widgets or connecting with third party applications or integrations such as Apple Health, Google Health Connect, and HealthEx with your consent or to perform our contract with you.
• Professional advisors, such as auditors, law firms, or accounting firms, as a matter of our legitimate interests to assess, protect, enforce and defend our rights and to comply with our legal and regulatory obligations.
• Third parties in connection with or in anticipation of an asset sale, merger, bankruptcy, or other business transaction, as a matter of our legitimate interests to run a successful and efficient business.
• Linked account users: If you link your account with another Eight Sleep user as described in Section 2 above, we will disclose your sleep and health data (including sleep metrics, biometric data, temperature preferences, and leaderboard performance) to that linked user through the App. This disclosure is made at your direction when you send or accept a partner invitation. You may revoke this disclosure at any time by unlinking the account through the App settings.

We may also disclose your information as needed to comply with applicable law or any obligations thereunder or in our legitimate interests to cooperate with law enforcement, judicial orders, and regulatory inquiries, to enforce any applicable terms of service, and to ensure the safety and security of our business, employees, and users.

We do not disclose your personal information to third parties for the third parties' direct marketing purposes, unless you have affirmatively opted in to such sharing.

4. SOCIAL FEATURES

Certain features of the Services allow you to initiate interactions between the Services and third-party services or platforms, such as social networks ("Social Features"). Social Features may include features that allow you to access our pages on third-party platforms, and from there to "like" or "share" our content. Use of Social Features may allow a third party to collect and/or use your information. If you use Social Features, information you post or make accessible may be publicly displayed by the third-party service. Both we and the third party may have access to information about you and your use of both the Services and the third-party service. For more information, see the section below, Third-Party Websites and Links.

5. THIRD-PARTY WEBSITES AND LINKS

We may provide links to third-party websites or platforms. If you follow links to sites or platforms that we do not control and are not affiliated with us, you should review the applicable privacy notice, policies and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms. Information you provide on public or semi-public venues, such as third-party social networking platforms, may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators.

6. CHILDREN'S PRIVACY

Our Services are not intended for children under the age of 16, and we do not seek or knowingly collect any personal information about children under the age of 16. We do not knowingly sell or share the personal information of consumers under 16 years of age, or knowingly process such consumers' personal information for targeted advertising. If we become aware that we have unknowingly collected information about a child under 16, we will make commercially reasonable efforts to delete such information from our database. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the details set out in Section 11 to request that it be deleted.

7. DATA SECURITY AND RETENTION

Despite our reasonable efforts to protect your information, no security measures are impenetrable, and we cannot guarantee "perfect security." Any information you send to us electronically, while using the Services or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use unsecure channels to send us sensitive or confidential information.

We retain your information for as long as is reasonably necessary for the purposes specified in this Privacy Policy. When determining the length of time to retain your information, we consider various criteria, including whether we need the information to continue to provide you the Services, resolve a dispute, enforce our contractual agreements, prevent harm, promote safety, security and integrity, or protect ourselves, including our rights, property or products.

Clinical health data accessed through third-party health record platforms such as HealthEx is retained for up to one year, corresponding to the duration of your consent authorization. When your consent expires or is revoked, Eight Sleep automatically deletes your stored clinical health data. You may also request deletion at any time by disconnecting the health record platform in the App settings or by contacting us at privacy@eightsleep.com.

Blood panel and other laboratory results from tests you order through the Services are retained for the applicable retention period or until you request deletion.

8. DATA TRANSFERS

The information we collect from you may be stored and processed in countries outside the country in which you live.

We transfer personal information, subject to European and UK privacy laws (e.g., the GDPR), to countries outside the EEA and/or UK, such as the United States, subject to the European Commission's standard contractual clauses for the transfer of personal data to third countries; specifically, module one (controller to controller transfer) and/or module two (controller to processor transfer), as relevant, or the UK Information Commissioner's international data transfer addendum to the EU standard contractual clauses, as relevant, unless the data transfer is to a country that has been determined by the European Commission and/or the relevant UK authorities, as applicable, to provide an adequate level of protection for individuals' rights and freedoms for their personal data.

Please contact us using the details set out in Section 11 should you like further information on this.

9. PRIVACY RIGHTS

Depending on where you live, you may have certain rights in relation to your personal information. However, please note that a number of these rights only apply in certain circumstances, and these rights may be limited by law.

• Access / Know: You may have the right to request access to the personal information we hold about you, and to obtain details about how we use and share your information, and with whom we share or have shared it in the past.
• Deletion / Erasure: You may have the right to request that we delete personal information we hold about you.
• Correction: You may have the right to request that we correct inaccurate personal information we hold about you.
• Portability: You may have the right to receive a copy of the personal information we hold about you and to request that we transfer it to a third party.
• Restriction of Processing: You may have the right to require us to stop, suspend or restrict our processing of personal information we hold about you, other than for storage purposes.
• Objection: You may have the right to object to our processing of your personal information.
• Opt-Out of Marketing: You may opt out of marketing, including from SMS messages, by using the unsubscribe / opt-out instructions provided in our communications to you. If you opt out, we may still send you transactional or administrative messages.
• Withdrawal of Consent: Where we rely on consent to process your personal information, you may have the right to withdraw this consent at any time.
• Right to Complain: You may have the right to complain to us and/or your local data protection authority about how we process your personal information.
• Right to Opt Out of Sale, Sharing, or Targeted Advertising: You may have a right to direct us not to "sell" or "share" your personal information (as those terms are defined in applicable laws) or process your personal information for targeted advertising. To exercise this right, click the "Your Privacy Choices" link in the footer of any page of our website and switch off the toggle next to "Sale of Personal Data" in the preferences panel that opens, or enable the Global Privacy Control signal in your browser, which we honor automatically. For information on how we process opt-out preference signals, see Opt-out preference signals under Information Collected Automatically above.

If you are a UK resident, you have a statutory right to submit a data protection complaint directly to us. We will acknowledge your complaint within 30 days of receipt, take appropriate steps to investigate it without undue delay, and communicate the outcome to you, including your right to escalate the matter to the UK Information Commissioner's Office (ICO). You may submit a complaint through any of the contact methods described in Section 11 below or through any other channel by which you contact us.

Submitting a Request

To make a request described in this Section, please email us at privacy@eightsleep.com. If you are an EEA, UK or Swiss resident, you may also make a request here. We will not discriminate against you for exercising any of these rights. Further information may be needed to verify your identity before exercising these rights. You may designate, in writing or through a power of attorney document, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us.

If we deny your request, you may appeal our decision by contacting us through the methods described in Section 11. We will not require you or your authorized agent to pay a fee for the verification of your request or appeal.

10. U.S. RESIDENTS

This Section 10 applies to you if you are a resident of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or any other U.S. state with a comprehensive consumer privacy law that applies to us. We refer to the California Consumer Privacy Act as the "CCPA". For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws. Where required by the law of your state, we obtain your consent before processing sensitive personal information, including health information.

Processing of Personal Information

In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *):

• Identifiers such as name, e-mail address and IP address: Vendors and service providers, login integration partners, at your direction to third party applications or integrations
• Personal information categories listed in the California Customer Records statute such as name, address and telephone number: Vendors and service providers
• Professional information included in an individual's resume or job history
• Commercial information such as purchase history: Vendors and service providers, marketing partners
• Internet or other similar network activity such as information regarding your interaction with the Services: Vendors and service providers, marketing partners, login integration partners
• Geolocation data such as IP address
• Account access credentials* such as account log-in information for the Services: Vendors and service providers, login integration partners
• Characteristics of protected classifications under California or federal law such as sex (including gender and pregnancy) and age: Vendors and service providers, at your direction to third party applications or integrations
• Precise geolocation data*
• Personal information concerning an individual's health*, such as sleep and biometric metrics, health and wellness information you provide, and clinical health records (including laboratory and blood panel results, medications, conditions, and clinician notes): Vendors and service providers (for personalized communications such as periodic sleep reports), linked account users, Eight Rx (only with your separate authorization), laboratory and clinician partners, third-party integrations such as Apple Health, Google Health Connect, and HealthEx, at your direction

Internal cross-referencing: Where you use the same email address at checkout and during app account creation, we may associate your purchase record with your Eight Sleep app account for purposes of service delivery, account setup, and personalization. We do not associate accounts across different email addresses without your direction.

The business or commercial purposes for which we collect and disclose each category of personal information, and the sources from which we collect it, are described in Section 2 (Collection and Use of Information) and Section 3 (Disclosure of Your Information). We only use and disclose sensitive personal information for purposes permitted under the CCPA, such as providing the Services you request (including sleep and health reports you choose to receive), and, where required by applicable state law, with your consent. The criteria we use to determine how long we retain personal information are described in Section 7 (Data Security and Retention).

Selling or Sharing of Personal Information

We do not have actual knowledge that we "sell" or "share" (as those terms are defined under applicable law) personal information of individuals under 16 years of age. However, we do sell and share certain categories of personal information and, in the preceding 12 months, we have sold and shared the following categories of personal information about individuals for marketing, advertising, and analytics purposes:

• Identifiers such as name, e-mail address and IP address: Tracking technologies and advertising partners
• Commercial information such as purchase history
• Internet or other similar network activity such as information regarding your interaction with the Website

California Medical Information

If the California Confidentiality of Medical Information Act ("CMIA") applies to medical information we receive from or on behalf of healthcare providers, we use and disclose that information as permitted by the CMIA. To the extent the CCPA exempts information governed by the CMIA, that information is not subject to the CCPA disclosures in this Section 10.

11. HOW TO CONTACT US

Should you have any questions about our privacy practices or this Privacy Policy, please contact us at privacy@eightsleep.com. If you are a resident of the EU, UK, or Switzerland, you may contact our local representative, through the details set out below.

For questions about Section 12 or the Eight Rx Services, contact Eight Rx, LLC at rx_support@eightsleep.com or 915 Broadway, Suite 1301, New York, NY 10010.

For EU inquiries: Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria

For UK inquiries: Prighter Ltd, 20 Mortlake High St, London, SW14 8JN, United Kingdom

For Swiss inquiries: Prighter CH GmbH, Obergrundstrasse 17, 6002 Luzern, Switzerland

12. EIGHT RX

This Section 12 applies to personal information that Eight Rx, LLC ("Eight Rx", "we", "us" or "our" in this Section 12) collects when you visit Eight Rx pages, enroll in or use the Eight Rx Services, or otherwise interact with Eight Rx. Eight Rx is a separate company from Eight Sleep and is responsible for the personal information it collects. Eight Sleep acts only as a service provider to Eight Rx for that information, under a written agreement that limits Eight Sleep's use of it to providing services to Eight Rx.

Eight Rx Does Not Provide Medical Care

Telehealth consultations, diagnoses, prescriptions and other clinical services are provided by independent, physician-owned medical practices and the licensed clinicians who work with them (the "Clinicians"), through a third-party telehealth infrastructure provider. The Clinicians make all clinical decisions. The Clinicians and their practices keep your medical records, and their own privacy notices govern those records.

Based on how the Eight Rx Services currently operate, Eight Rx is not a "covered entity" or "business associate" under the Health Insurance Portability and Accountability Act ("HIPAA"), and HIPAA does not govern the personal information Eight Rx collects. Eight Rx still treats health information as sensitive and handles it as described in this Section 12 and in our Consumer Health Data Privacy Policy. Information that a Clinician, laboratory or other healthcare provider creates or holds may be protected by HIPAA or state medical privacy law while in that provider's hands.

Information Eight Rx Collects

Depending on the Eight Rx Services you use, Eight Rx collects:

• Identifiers and contact details, such as your name, date of birth, email, phone number, shipping and billing address, and the state where you are located.
• Intake and screening information, such as your answers to health questionnaires, symptoms, medical history, medications, allergies, height, weight, and the health goals you share with us.
• Pod data and Pod alerts, if you authorize Eight Sleep to share them with Eight Rx. This may include sleep stages, heart rate, heart rate variability, respiratory rate, snoring and breathing disturbance indicators, and bed temperature settings, and notifications Eight Sleep generates from that data. Pod alerts are general wellness information and are not a diagnosis.
• Information about your care, such as appointment and visit details, messages with Clinicians and support, whether you received a prescription or recommendation, and the status of your orders. Eight Rx may receive visit summaries and prescriptions from the Clinicians so that it can show them to you in the App and fulfill your orders.
• At-home sleep test information, such as test orders, kit shipping and return status, and test results and interpretations that you direct the testing provider and Clinicians to make available to you through the Eight Rx Services.
• Order and payment information, such as your membership plan, the products you buy (including CPAP equipment and supplies), prescription details needed to fill device orders, transaction history, and payment card details, which our payment processor collects.
• Device, usage and communications information, such as IP address, device identifiers, your interactions with Eight Rx pages and App screens, and your communication preferences, including SMS and push notification consents.

How Eight Rx Uses Information

Eight Rx uses this information to:

• enroll you, verify your identity, location and eligibility, and manage your membership;
• connect you with Clinicians and make your intake answers, and any Pod data you choose to share, available to them at your direction;
• schedule visits, deliver messages, and show you your care information in the App;
• process payments, collect consultation fees on behalf of the Clinicians, and fulfill orders for sleep tests, CPAP equipment and supplies, including verifying prescriptions;
• send you service, billing, renewal and safety messages and, where you consent, marketing messages about the Eight Rx Services;
• provide support, keep the Eight Rx Services secure, prevent fraud, and comply with law, including record-keeping, product complaint and safety reporting obligations; and
• create deidentified or aggregate information, which Eight Rx keeps in deidentified form and does not attempt to reidentify.

Eight Rx does not sell your personal information. Eight Rx does not use your health information, or information about your use of the Eight Rx Services, for targeted advertising. Eight Rx does not use third-party advertising pixels or ad tracking technologies on Eight Rx pages or App screens. Eight Rx uses limited analytics tools, provided by service providers under contract, to operate and improve the Eight Rx Services, and does not allow those providers to use your information for their own purposes.

How Eight Rx Discloses Information

Eight Rx discloses personal information only as follows:

• To the Clinicians, their practices and the telehealth infrastructure provider, to provide your care at your direction.
• To fulfillment partners at your direction, such as the at-home sleep test provider, the pharmacy you choose (which may contact you directly), and the supplier that ships CPAP equipment and supplies you buy from Eight Rx.
• To service providers that help Eight Rx operate, including Eight Sleep, payment processors, and hosting, security, support and communications providers, under contracts that limit their use of your information to providing services to Eight Rx.
• To Eight Sleep for Eight Sleep's own use, only as described under "Sharing Between Eight Sleep and Eight Rx" below.
• To others as required by law, to protect the safety of you or others, in connection with a sale or reorganization of Eight Rx's business, or with your consent.

Sharing Between Eight Sleep and Eight Rx

Pod data to Eight Rx. Eight Sleep shares Pod data and Pod alerts with Eight Rx only after you give your separate, express authorization in the App. You can withdraw that authorization at any time in App settings, and Eight Sleep will stop sharing new Pod data with Eight Rx within 5 business days. Withdrawing does not affect care you have already received.

Information Eight Sleep may receive from Eight Rx. Eight Rx does not share your clinical information, such as diagnoses, test results, prescriptions or visit records, with Eight Sleep, except: (a) deidentified or aggregate information; (b) whether you are an Eight Rx member and your membership status, so that Eight Sleep can apply any Autopilot membership benefit and provide account support; (c) the following information, only with your separate written authorization: sleep test results diagnosis of a sleep condition CPAP use and settings prescription status, which Eight Sleep would use to personalize Pod settings and insights improve its products; and (d) as required by law.

Retention and Security

Eight Rx keeps personal information for as long as needed to provide the Eight Rx Services, meet legal, tax, record-keeping and safety-reporting requirements, resolve disputes and enforce agreements. Clinicians keep medical records under the retention rules that apply to them. Eight Rx uses administrative, technical and physical safeguards designed to protect personal information, including encryption in transit and at rest and access controls.

Your Rights and Choices

The rights described in Sections 9 and 10 and in the Consumer Health Data Privacy Policy also apply to personal information Eight Rx holds. To exercise them with Eight Rx, contact rx_support@eightsleep.com. A request to Eight Rx does not reach the Clinicians' medical records. To access or amend those records, contact your Clinician's practice through the App. Eight Rx and Eight Sleep forward each other any request that affects information the other holds.

The Eight Rx Services are available only to adults age 18 or older located in the United States. Eight Rx does not knowingly collect personal information from anyone under 18.

Contact Eight Rx

Eight Rx, LLC, 915 Broadway, Suite 1301, New York, NY 10010, rx_support@eightsleep.com.

Consumer Health Data Privacy Policy

Effective Date: November 3, 2026

This Consumer Health Data Privacy Policy ("Policy") applies solely to personal information defined as "Consumer Health Data" subject to the Washington My Health My Data Act ("MHMDA"), the Nevada Health Data Privacy Act ("NHDPA"), or other applicable state consumer health privacy laws. This Policy covers two separate companies: Eight Sleep, Inc. ("Eight Sleep") and its wholly owned subsidiary Eight Rx, LLC ("Eight Rx"). Each company is responsible only for the Consumer Health Data it collects. The section titled "Eight Sleep: How do we collect, use, and disclose Consumer Health Data?" describes Eight Sleep's practices, and the section titled "Eight Rx: How does Eight Rx collect, use, and disclose Consumer Health Data?" describes Eight Rx's practices. This Policy supplements the Eight Sleep Privacy Policy (including its Section 12, which covers Eight Rx) and any other privacy policies applicable to our products.

What does this Policy cover?

This Policy describes what Consumer Health Data we collect, how we collect and use it, who we disclose it to and why, and the choices you may have regarding our use or disclosure of your Consumer Health Data.

When we say "Consumer Health Data" in this Policy, we mean personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status, as defined by the MHMDA and the NHDPA. Consumer Health Data does not include, among other things, data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such an individual, or other deidentified information. To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

Eight Sleep: How do we collect, use, and disclose Consumer Health Data?

To provide our products or features, we collect and process information about you, including information that may be considered Consumer Health Data. The best way to learn about the types of information we collect and how we use them is to review the Eight Sleep Privacy Policy and other privacy policies applicable to our products.

For those covered by this Policy, the table below provides a summary of our practices in relation to Consumer Health Data, to the extent personal information we collect about you is considered Consumer Health Data. In each case, our practices depend on how you interact with Eight Sleep and our products, and the information that you choose to share with us (as in many instances, providing your Consumer Health Data to us is voluntary).

Categories of Consumer Health Data that we may collect

We may collect or receive the following categories of personal information which may be considered Consumer Health Data. Not all categories will be collected or received for every individual.

• Biological information, including biological sex, height, and weight;
• Information that identifies health conditions, including sleep conditions, status, treatment, symptoms, diseases, diagnoses, surgeries, procedures, and medications;
• Information that identifies social, psychological, behavioral, and medical interventions;
• Measurements of bodily functions, vital signs, or similar characteristics identifying health status, including heart rate;
• Information identifying diagnoses or diagnostic testing, treatment, or medication, including laboratory and blood panel test results, including results from tests you order through Eight Sleep and records accessed through third-party health record platforms;
• Clinician notes and other clinical records from your healthcare providers;
• Reproductive or sexual health information;
• Precise location information; and
• Other health information, including information that may be used to infer or that is derived data related to the above.

Categories of sources of Consumer Health Data

• You (including from information from your activity with our products or that you provide directly to us (i.e., through the optional onboarding questionnaire));
• Your device(s);
• Laboratory and clinician partners that fulfill tests you order through Eight Sleep; and
• Partners, service providers, contractors, and other third parties, including third-party integrations such as Apple Health, Google Health Connect, and third-party health record connectivity platforms such as HealthEx, through which you may authorize Eight Sleep to access clinical health records from your healthcare providers, as described further in the Eight Sleep Privacy Policy.

Purposes for which we may collect, use and disclose Consumer Health Data

We collect, use, and disclose Consumer Health Data for the purposes described in our Privacy Policy and as reasonably necessary to provide you with the products and services you have requested. This may include:

• Providing and personalizing our products and services, including powering autopilot features;
• Organizing and standardizing clinical records, including clinician notes, using automated tools;
• Enhancing the safety and security of our products;
• Marketing and advertising certain features that may be of interest to you;
• Personalized communications you choose to receive containing your sleep and health metrics (such as daily or monthly sleep reports);
• Communicating with you and responding to your inquiries;
• Complying with applicable legal obligations; and
• Research and development, including analyzing and measuring trends, conducting aggregate analysis to inform future product development, and, with your separate consent, using pseudonymized health, clinical, and sleep data to improve Eight Sleep's health models and develop new features, including health condition analysis, and publishing aggregate research findings that do not identify you.

We may also collect, use, and disclose Consumer Health Data for other purposes with your consent or authorization or as otherwise permitted by law.

Categories of parties with whom Consumer Health Data may be disclosed

• Apps, websites, and third-party integrations on or using our products, such as Apple Health, Google Health Connect, and HealthEx;
• Laboratory and clinician partners that fulfill tests you order through Eight Sleep;
• New owners in the event of a change of ownership or control of all or part of our products or their assets changes;
• Partners, service providers, contractors, and other third parties, as described in the Eight Sleep Privacy Policy and any product-specific privacy notices, including email service providers who process your Consumer Health Data on our behalf to deliver personalized sleep reports and other health-related communications to you, and AI service providers who process clinical records on our behalf;
• Law enforcement or other third parties in connection with legal requests, to comply with applicable law or to prevent harm;
• Linked account users (such as a partner or household member) who you have invited to share your Pod, as described in the Eight Sleep Privacy Policy. This sharing occurs at your direction and with your consent when you send or accept a partner invitation; and
• Eight Rx, only if you give your separate authorization to share Pod data and Pod alerts with Eight Rx. You may withdraw that authorization at any time;
• Other third parties, with your consent or authorization.

Eight Rx: How does Eight Rx collect, use, and disclose Consumer Health Data?

Eight Rx operates a consumer health platform that connects members with independent, physician-owned medical practices whose licensed clinicians provide telehealth care (the "Clinicians"). Eight Rx does not provide medical care. The Clinicians' own privacy notices govern the medical records they create.

Categories of Consumer Health Data Eight Rx may collect

• Health conditions, symptoms, medical history, medications, allergies and health goals you report in intake and screening questionnaires;
• Biological information, such as biological sex, age, height and weight;
• Measurements of bodily functions, and sleep and breathing data from your Pod, and Pod alerts, if you authorize Eight Sleep to share them with Eight Rx;
• Information about diagnostic testing and treatment, including at-home sleep test orders and results, whether you received a prescription or recommendation, and orders for medical devices such as CPAP equipment and supplies;
• Visit, appointment and messaging information related to your care;
• Information about your purchases of health-related products and services, including membership status; and
• Other information that may be used to infer your health status, including derived data related to the above.

Categories of sources of Consumer Health Data for Eight Rx

• You;
• Eight Sleep (Pod data and Pod alerts, only with your authorization);
• The Clinicians, their practices and the telehealth infrastructure provider;
• At-home sleep test providers, pharmacies and device suppliers, at your direction; and
• Service providers that help Eight Rx operate.

Purposes for which Eight Rx may collect, use and disclose Consumer Health Data

Eight Rx collects and uses Consumer Health Data only as reasonably necessary to provide the Eight Rx services you request, including to:

• Enroll you and confirm your eligibility and location;
• Connect you with Clinicians and make your information available to them at your direction;
• Process payments and fulfill orders for tests, devices and supplies, including verifying prescriptions;
• Communicate with you about your membership, orders and care logistics;
• Provide support, keep the services secure and comply with law, including safety reporting obligations; and
• Create deidentified information.

Where the law requires, Eight Rx asks for your consent before collecting Consumer Health Data for any other purpose, and asks separately before sharing it. Eight Rx does not sell Consumer Health Data and does not use it for targeted advertising.

Categories of parties with whom Eight Rx may disclose Consumer Health Data

• The Clinicians and their practices, and the telehealth infrastructure provider;
• At-home sleep test providers, pharmacies and device suppliers, at your direction;
• Service providers and processors acting on Eight Rx's behalf, including Eight Sleep;
• Eight Sleep for its own use, only deidentified information or information you separately authorize;
• Law enforcement or others as required by law or to prevent harm;
• New owners in the event of a change of ownership or control of Eight Rx or its assets; and
• Others with your consent or authorization.

Specific affiliates: Eight Sleep, Inc., Eight Rx's parent company, is the only affiliate that receives Consumer Health Data from Eight Rx.

How do you exercise your rights regarding Consumer Health Data?

Depending on where you live and subject to certain exceptions, you may have certain rights related to your Consumer Health Data. This includes the right to (1) request that we confirm whether we are collecting or disclosing your Consumer Health Data (and to whom); (2) request access to your Consumer Health Data; (3) confirm whether we have disclosed or sold your Consumer Health Data; (4) request the deletion of your Consumer Health Data; and (5) request withdrawal of your consent or authorization relating to such data, including the collection and sharing of your Consumer Health Data.

To ensure the security of your account and your data, we will need to authenticate your request prior to processing it. Please allow up to 45 days for a response. If we deny your request, you may appeal that denial by following the instructions below. If your appeal is unsuccessful, you can file a complaint with the relevant government body in your state, including:

• Washington State Attorney General at https://www.atg.wa.gov/file-complaint.
• Nevada State Attorney General at https://ag.nv.gov/Complaints/CSU_Complaints___FAQ/.

To submit a request to exercise your rights, and as applicable, to appeal a consumer rights action, please contact us using the information provided below.

Material changes to this policy

We will make commercially reasonable efforts to notify you before we make material changes to this Policy. Please check this Policy periodically for updates.

Contact

If you have additional questions about this Policy, please contact us at: Eight Sleep, Inc., Email: privacy@eightsleep.com

For Consumer Health Data held by Eight Rx: Eight Rx, LLC, Email: rx_support@eightsleep.com. Each company will forward to the other any request that affects data the other holds.