Consumer Health Data Privacy Policy

Version 1.3. Effective October 7, 2026. Version 1.2, effective August 25, 2026, applies until then. The change adds the Butter Health list.

Cozy Butter is operated by Cozy Butter LLC, an independent company co-founded by Kim Carlos of The Plus SideZ Podcast and Amanda Bonello of the GLP-1 Studio. Cozy Butter LLC is the business responsible for the data described here.

Because Cozy Butter is a community for people who use GLP-1 medications, some of what you share with us is consumer health data: personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. This policy explains how we treat that data. It supplements our Privacy Policy, and where consumer health data is concerned, this policy controls. It is written to meet the Washington My Health My Data Act, Nevada's consumer health data law (SB 370), the health data provisions of the Connecticut Data Privacy Act, and similar laws in other states.

Cozy Butter LLC is not a HIPAA covered entity and is not a healthcare provider. What you share here is not protected health information under HIPAA, which is one of the reasons this policy exists.

1. Categories of consumer health data we collect, and why

• Health information you choose to share in the community. Posts, comments, direct messages, chat during live sessions, and profile details that mention your health, weight, body measurements, medications (such as which GLP-1 medication you use), dose changes, side effects, symptoms, diagnoses, reproductive or sexual health, or mental health. Collected so we can host and display it in the community and, for posts in open spaces, to public view, as you have asked us to.
• Program and event participation. Your registration and attendance for coaching sessions, fitness classes, and support events, which can indicate that you are seeking or receiving health support, along with recordings of sessions you appear in. Collected to run those programs and to send you the reminders you requested.
• The fact of your membership. Joining a GLP-1 community can itself imply an interest in these medications. Collected because it is inseparable from providing the Service.
• Tool inputs. Information you enter into our calculators and guides, such as height, weight, age band, or a side effect you are looking up. These tools run entirely in your browser. What you type is not transmitted to us and is not stored on any server.
• Butter Health list answers. If you choose to join the Butter Health list, the answers you give on its signup form and in its polls and surveys, which can include the GLP-1 medication you take and, for a specific opportunity, a health condition. Collected with your separate consent, to match you to media opportunities, studies and product testing, and to create aggregated, de-identified insights as described in Section 5.

We collect consumer health data only to provide the services you have requested, and we do not use it for any other purpose without first asking for your separate consent.

What we do not collect or do. We do not collect precise location data, biometric data, biometric identifiers, voiceprints, face geometry, or genetic data. We do not use facial recognition in our events or recordings. We do not use algorithms to derive or infer health information about you beyond what you tell us. We do not use consumer health data for advertising, and we do not use it to make decisions about you. We do not use geofencing around any health facility, pharmacy, or provider location for any purpose, including advertising, notifications, or data collection.

2. Categories of sources

The community is public. Health information you post in an open space is visible to anyone on the internet and may be indexed by search engines. That visibility is a choice you make post by post. Spaces marked members-only, direct messages, and anything you send us by email are not visible to the public.

We collect consumer health data from one source: you, when you post, send a message, fill in your profile, register for an event, take part in a live session, or write to us. We do not buy, rent, license, or otherwise acquire consumer health data about you from data brokers, advertising platforms, healthcare providers, insurers, or anyone else.

3. Who we share it with

We share the categories of consumer health data listed above only with the service providers that store and move data on our behalf, and only so they can provide their service to us. Here are the specific companies, and an email address for each, as the law requires:

These providers process data to run the Service under written agreements and are not permitted to use it for their own purposes, to sell it, or to disclose it onward. We do not share consumer health data with advertisers, ad networks, data brokers, social media platforms, employers, insurers, or law enforcement, except where a valid legal process requires it and after we have narrowed what is produced.

AI tools. We use Claude, made by Anthropic, and ChatGPT, made by OpenAI, to help draft our own content and artwork. We do not send member posts, member messages, or member personal information to these tools, and we use them under settings that exclude our content from model training. See our AI Policy.

Shared administration. Cozy Butter LLC does not run all of its own back-office systems. Some of them are provided by companies our co-founders own. Today that is GLP-1 Studio LLC, owned by co-founder Amanda Bonello, which provides and administers our email, our internal file storage, and our business phone number. Plus SideZ Media LLC, owned by co-founder Kim Carlos, does not currently run any system that holds consumer health data. If either company begins providing one, we will update the list above and tell you before it starts.

Consumer health data reaches those systems mainly when you write to us by email. Administrators at the company providing that support can technically reach it, and under a written agreement may use that access only to keep those systems running for Cozy Butter. They may not use it for their own products or marketing, and they may not disclose it onward. This is administrative access. It is not a sale, and it is not sharing your data for anyone else's purposes.

Other affiliated companies. If we ever want to share consumer health data with an affiliated company for any purpose beyond the administration described above, we will update this policy and obtain your consent first.

Business transfers. If Cozy Butter LLC is involved in a merger, an acquisition, a financing, or a sale of its business or assets, consumer health data may transfer as part of that transaction. Any successor will be bound to honor this policy for data collected before the transfer, or will give you notice and obtain your consent before applying a materially different practice. A transfer of this kind is not a sale, and we will post notice of it here and inside the community.

4. Additional services in the future

We may offer or facilitate additional health-related products and services in the future, some of which could be provided by an affiliated company or by an independent third party. If that happens, it will be optional, it will be described to you before you use it, and it will be governed by its own separate notice. Data you gave us for the community will not be carried into any such service, combined with data collected there, or used for it, unless you ask us to and give consent at that time. Nothing in this policy commits us to offering any additional service.

5. We do not sell consumer health data

We do not sell your consumer health data, and we will not sell it without first obtaining a valid written authorization from you that meets the requirements of applicable law. Such an authorization would be separate from any other consent, would name the buyer and the purpose, and you could revoke it at any time.

Aggregated and de-identified insights. We may publish and license insights built from information that has been aggregated and de-identified so that it cannot reasonably be used to infer information about you or be linked to you. An example would be the share of members reporting a particular side effect in their first month, expressed across hundreds of people. Our standards, which are commitments rather than aspirations:

• We remove direct and indirect identifiers before analysis, applying the eighteen-identifier standard used for de-identification under the HIPAA Safe Harbor method as our floor, whether or not HIPAA applies to us.
• We suppress small cells. No figure is published or licensed if it derives from fewer than eleven people.
• We do not include verbatim posts, quotations, photographs, member names, or free-text answers in a licensed or published dataset.
• We publicly commit to maintaining and using this data only in de-identified form, we will not attempt to re-identify it, and we will not combine it with other datasets in a way that could re-identify anyone.
• We contractually require every recipient to do the same, to refrain from re-identification and onward sale, and to accept our audit rights.
• We do not license this data to advertisers or data brokers.

Your switch. If you turn on Do not sell or share my personal information in your privacy choices, we will exclude data derived from your account from these insights entirely, even in de-identified form. We also honor the Global Privacy Control signal automatically. If you join the Butter Health list, the answers you give through it are covered by the agreement you accept when you join, which is your separate choice to take part in insights. Your switch still applies to everything else, and you can leave the list at any time by emailing [email protected].

6. How long we keep it, and who can see it

Consumer health data lives in your community account for as long as your account is open, and is deleted within 30 days of your deletion request or of you closing your account, other than the small number of records the law requires us to keep. Backups holding deleted content are overwritten within 90 days. Recordings of sessions are kept inside the community while the program runs and reviewed at least once a year for removal.

Inside Cozy Butter, access to consumer health data is limited to the founders and the small number of moderators and contractors who need it to run the community, each of whom is under a written confidentiality obligation. Administrative accounts require multi-factor authentication.

7. Your rights

• Confirm and access. Confirm whether we are collecting, sharing, or selling consumer health data about you, and access that data, including a list of all third parties with whom we have shared it and an email address for each. The current list is in Section 3.
• Withdraw consent. Withdraw consent from our collection and sharing of your consumer health data. Withdrawing consent for collection means we can no longer host your posts, so it will usually mean closing your account.
• Delete. Have your consumer health data deleted, including from our service providers and from archived or backup systems. The simplest complete path is deleting your community account, and you can also ask us to delete specific content.
• Correct. Ask us to fix consumer health data that is wrong.
• No retaliation. We will not deny you service, charge you a different price, or provide a lower quality of service because you exercised a right.

To exercise any of these rights, email [email protected] from the address on your account, or write to Cozy Butter LLC, 3800 Business Highway 151, #113, Marion, IA 52302. We verify a request by confirming you control the account email. We will respond without undue delay, and in all cases within 45 days, extendable once by 45 days where reasonably necessary, in which case we will tell you why before the first 45 days are up.

8. Appeals

If we decline a request, you may appeal by replying to our decision with the word "appeal." Within 45 days of receiving your appeal we will tell you in writing what we did, or did not do, and why. If your appeal is denied, you may contact the attorney general of your state. Washington residents may contact the Washington Attorney General at atg.wa.gov/file-complaint, and Nevada residents may contact the Nevada Attorney General at ag.nv.gov.

9. If there is a breach

If we learn that consumer health data has been accessed or acquired without authorization, we will investigate, contain it, and notify you and the appropriate authorities as the law requires, including under state breach notification laws and the Federal Trade Commission's Health Breach Notification Rule where it applies. We will tell you what happened, what data was involved, and what steps you can take.

10. Changes and contact

Material changes to this policy will be posted here with a new version number and date, and we will give notice inside the community or by email at least 14 days before they take effect. We will not use consumer health data collected earlier in a way that conflicts with what this policy said at the time it was collected without first obtaining your consent. Questions can go to [email protected], or by mail to Cozy Butter LLC, 3800 Business Highway 151, #113, Marion, IA 52302.

Amendments

Changes made after a version takes effect are listed here, newest first.

October 13, 2026 (announced September 29, 2026). Polls, surveys and insights. From October 13, results from polls and surveys in the community may be used in reports and insights that we publish, share or sell. Reports and insights contain only totals and percentages. They do not include your name, email address, username, photo, the words you wrote, or anything else that identifies you, and no figure comes from fewer than eleven people. You are counted, not named. If you do not want your answer used, do not answer that poll. We use only polls posted on or after October 13 this way. Polls or surveys that ask about your health are covered by a separate consent at the time you answer. We may license reports and insights to any company, including brands that advertise with us. We do not sell, license or share consumer health data that identifies a member with anyone. When we license a dataset, rather than a finished report, we contractually require the recipient to refrain from re-identification and onward sale and to accept our audit rights. From that date, the sentence “We do not license this data to advertisers or data brokers” now reads “We do not license this data to data brokers”, and the requirement placed on “every recipient” applies to datasets we license.

October 13, 2026 (announced September 29, 2026). Service providers. The companies named in the tables in this policy are examples of each category, and we may change providers within a category.

October 13, 2026 (announced September 29, 2026). AI tools and member content. From October 13, we use AI tools to help us run Cozy Butter, with things like organizing messages, posts, comments and emails that members send us, creating content, and more. We use AI providers under business terms. The AI providers named on this page are examples, and we may use others. From that date, this replaces the sentence “We do not send member posts, member messages, or member personal information to these tools.” See our AI Policy.

September 29, 2026. Research studies and opportunities. Taking part in a study, research project, product test or other opportunity is your choice. Before you take part in one, or give any information for it, we explain it and ask you to agree to it separately. We tell you what it asks for, who is running it or, if that company asked to keep its name private, what kind of company it is, what information that company receives, how it will be used, and how to withdraw. If you agree, we share only what that opportunity needs with the company running it. This is an exception to the statements that we share information only with our service providers and that we do not share it with advertisers. A company kept private receives only results that do not identify you, unless you give your information to it directly, for example by filling in its screener. Nothing in this note applies to you unless you agree for that opportunity. You can ask us for a list of the companies that received your information.

September 29, 2026. Wording. We changed the word “never” to “do not” in a few sentences. What we do has not changed.

September 28, 2026. Anonymous quotes. With a member’s permission, we may quote something they wrote, such as a survey answer or a post, on our websites and in insight reports, without their name. We ask each person before we use their words, and we only use a quote if they say yes. We do not attach a name, photo, or any other detail that could identify them, and anyone can ask us to take their quote down at any time. This is an exception to the sentence “We do not include verbatim posts, quotations, photographs, member names, or free-text answers in a licensed or published dataset.”