FERGUSON REPRODUCTIVE LAW | FERTILITYFORGE™ LEGAL STUDIO WASHINGTON CONSUMER HEALTH DATA PRIVACY POLICY Copyright © 2026 by Ferguson Reproductive Law Effective Date: July 25, 2026 Last Updated: July 28, 2026 This Consumer Health Data Privacy Policy is provided jointly by Ferguson Reproductive Law, a California law firm (the "Firm"), and Heresy Werks, LLC, a California limited liability company ("Heresy Werks"), under the Washington My Health My Data Act, Chapter 19.373 RCW (the "Act"). It applies to consumer health data, as the Act defines that term, that either of us collects from a Washington consumer through either of two surfaces. The Firm collects consumer health data through its public website at fergusonreproductivelaw.com (the "Website"), which is the Firm's marketing and informational site. Heresy Werks collects consumer health data through the FertilityForge platform, including FertilityForge™ Legal Studio (the "Platform"), which is the software through which the Firm delivers certain legal services. In this policy, "we," "us," and "our" refer to the Firm with respect to the Website and to Heresy Werks with respect to the Platform. Where a practice differs between the two, this policy says so. This policy addresses only consumer health data under the Act. The Firm's Website Privacy Policy and the FertilityForge™ Legal Studio Privacy Policy describe our other information practices. 1. Categories of Consumer Health Data We Collect Through the Platform, we collect the following categories of consumer health data: • Information about your use of, or attempt to obtain, reproductive or fertility services, including the type of reproductive-law agreement you pursue and your matched status; • Information about reproductive and fertility circumstances, including a gestational carrier's prior-birth history and cohabitation intent, the genetic origin and gamete sourcing of embryos, and the method of conception; • The medical clearance status and the psychological clearance status recorded for a carrier or donor; • Information about the clinic or agency involved in your matter; and • Information you provide in the course of preparing a reproductive-law agreement that reveals your reproductive or health circumstances. Through the Website, we collect the following categories of consumer health data: • Reproductive, fertility, or other health circumstances that you choose to describe in the message field of our contact form, which is an open-text field whose contents you control; and • The fact that you have sought or inquired about reproductive-law services, which may be inferred from your submission of an inquiry to the Firm or from your request for a consultation. Note on the Website. The Website asks for your name, your email address, and a message. It asks no health question, and the consultation scheduler collects only your name and your email address. Any clinical or reproductive detail the Firm receives through the Website is detail you chose to send. 2. Sources of Consumer Health Data We collect consumer health data from the following sources: • Directly from you, through the Platform's guided intake and walkthrough and through documents you upload; • Directly from you, through the Website contact form and the Website consultation scheduler; • From others involved in your matter, such as a counterparty, counsel, clinic, or agency, in the course of the legal services delivered through the Platform; and • From a Referring Agency that has referred you to the Firm, including in documents such as a match sheet or a compensation package, where that agency has confirmed it holds the authority and the consent necessary to send that information to us. 3. Purposes for Collecting and Using Consumer Health Data We collect and use consumer health data collected through the Platform for the following purposes: • To prepare and tailor the reproductive-law agreement for your matter; • To explain sections of the agreement and answer your questions during the walkthrough; • To support the review, clearance, and management of your matter; and • To communicate with you about your matter. We collect and use consumer health data collected through the Website for the following purposes: • To evaluate your inquiry and determine whether the Firm is able to represent you; • To respond to your inquiry and to schedule and conduct a consultation; • To perform the conflict-of-interest check the Firm's professional obligations require; and • To comply with law and with the Firm's professional obligations. No Other Use. We do not use consumer health data for advertising, for marketing, for profiling, or to build audiences. 4. Categories of Consumer Health Data We Share From the Platform, we share the following categories of consumer health data only as necessary to provide the services you request and to operate the Platform: • Reproductive and fertility information and agreement content, in sanitized form from which direct identifiers have been removed, with our artificial-intelligence provider to generate explanations, answer questions, and prepare draft language; and • Limited matter information necessary to deliver transactional email. From the Website, we share the following categories of consumer health data only as necessary to receive and respond to your inquiry: • The contents of your inquiry, including anything you wrote in the message field, with our website-hosting provider, which stores form submissions on our behalf, and with our email provider, which delivers your inquiry to the Firm; and • Your name and email address with our scheduling provider, if you book a consultation. No Artificial-Intelligence Processing of Website Data. Consumer health data collected through the Website is never sent to our artificial-intelligence provider. The Website performs no artificial-intelligence processing of any kind. No Sale and No Advertising. We do not sell consumer health data, and we do not share consumer health data for advertising, from either surface. 5. Categories of Third Parties and Specific Recipients 5.01 Categories of Third Parties. We may share consumer health data with the following categories of third parties: an artificial-intelligence processing provider, an email-delivery provider, a website-hosting provider, a consultation-scheduling provider, and, where required, entities to which disclosure is compelled by law or valid legal process. 5.02 Specific Recipients, Platform. The specific entities that may receive consumer health data collected through the Platform are Anthropic, PBC, our artificial-intelligence processing provider, which receives sanitized inputs from which direct identifiers have been removed; and Proton AG (Proton Business Mail), our email-delivery provider, which transmits transactional email containing limited matter information. 5.03 Specific Recipients, Website. The specific entities that may receive consumer health data collected through the Website are Squarespace, Inc., our website-hosting provider, which hosts the Website and stores contact form submissions; Google LLC, our consultation-scheduling provider, which receives your name and email address when you book a consultation and which processes that information under its data processing terms for business customers; and Proton AG (Proton Business Mail), our email provider, which delivers your inquiry to the Firm. 5.04 Contacting a Recipient. You may contact each recipient identified in Sections 5.02 and 5.03 through the contact information published on its website. 5.05 The Relationship Between Us. The Firm and Heresy Werks are under common ownership. Consumer health data collected through the Platform is used by the Firm, which delivers legal services through the Platform and handles that information as confidential client information under its professional obligations. Heresy Werks does not receive, and has no access to, consumer health data collected through the Website. 6. How to Exercise Your Rights 6.01 Your Rights. If you are a Washington consumer, you have the right to confirm whether we collect, share, or sell your consumer health data and to access that data; to obtain a list of all third parties and affiliates with which we have shared your consumer health data, together with a way to contact each; to withdraw your consent to our collection or sharing of your consumer health data; and to have your consumer health data deleted. 6.02 How to Submit a Request. For consumer health data collected through the Website, contact the Firm at privacyinfo@fergusonrlaw.com. For consumer health data collected through the Platform, contact Heresy Werks at info@heresywerks.com. If you are unsure which applies, write to either address and we will route your request. State the right you wish to exercise. Because neither the Website nor the Platform gives you an account, we verify your identity directly before acting on a request, and we ask for no more information than is necessary to do so. 6.03 Our Response. We respond within forty-five (45) days. Where reasonably necessary, we may extend our response by an additional forty-five (45) days and will tell you if we do. If we deny a request, we will explain why and how to appeal, and you may contact the Washington Attorney General. 6.04 Deletion, Platform. When you request deletion of consumer health data collected through the Platform, we delete it from our active systems and instruct the parties with which we have shared it to do the same. Where we are required to retain certain information to comply with a legal obligation or a professional file-retention obligation, we retain only what is required for that purpose and delete the remainder. 6.05 Deletion, Website. When you request deletion of consumer health data collected through the Website, the Firm deletes the message you sent and any health-related content it contains, from both the stored form submission and the Firm's email. The Firm retains only a minimal conflicts record: the names given, any adverse or related party named, the date of the inquiry, and a brief subject description. That record is retained because the Firm's professional obligations require it to check future matters against people who have already consulted it. It is not consumer health data. 6.06 Retention Absent a Request. Where an inquiry submitted through the Website does not lead to representation and you make no deletion request, the Firm keeps the full submission for twelve (12) months and then reduces it to the minimal conflicts record described in Section 6.05. Where an inquiry leads to representation, the resulting client file is governed by your retainer agreement and by the Firm's professional file-retention obligations. 6.07 Consent. We collect and share consumer health data as described in this policy with your consent, as necessary to provide a product or service you have requested, or, where the data reaches us from a Referring Agency, on the basis of the consent that agency is required to obtain from you before it sends the data to us. On the Website, the health information we receive is information you chose to send us in order to obtain a response to your inquiry, and we collect and use it to provide that requested service. On the Platform, we ask for your consent separately from your acceptance of the Terms of Use, and we ask for your consent to share separately from your consent to collect. Where we hold consumer health data about you that reached us from a Referring Agency, you may contact us to confirm that we hold it, to withdraw your consent, or to request deletion, and we will respond to you through your attorney if you are represented in the matter. We do not sell consumer health data and would not do so without your separate written authorization. 6.08 Withdrawing Consent. You may withdraw your consent at any time using the contact information in Section 6.02. Withdrawal is not retroactive and does not affect processing that already occurred. Where withdrawing consent leaves us unable to continue a service you requested, we will tell you so.