Additional Privacy Information For California Residents

These Additional California Privacy Disclosures (the "CA Disclosures") supplement the information contained in our Privacy Notice and apply solely to individual residents of the State of California ("consumers").

These CA Disclosures provide additional information about how we collect, use, disclose and otherwise process personal information of individual residents of the State of California within the scope of the California Consumer Privacy Act of 2018 ("CCPA").

Unless otherwise expressly stated, all terms in these CA Disclosures have the same meaning as defined in our Privacy Notice or as otherwise defined in the CCPA.

Scope of Disclosures

When we use the term "personal information" in these CA Disclosures, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. It does not include information that is made publicly available from government records, that is deidentified or aggregated such that it is not reasonably capable of being associated with an individual, or that is otherwise excluded from the CCPA's scope.

For the purposes of these CA Disclosures, personal information does not include:

• Publicly available information from government records.
• Deidentified, aggregated or anonymized information that is maintained in a form that is not capable of being associated with or linked to you.
• Information excluded from the CCPA's scope, such as health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data.

Categories of Personal Information We Collect

In the last 12 months, we have collected the following categories of personal information from and about you:

• Identifiers, such as full name, account name, mailing address, email address, and IP address.
• California Customer Records (Cal. Civ. Code § 1798.80(e)), such as phone number, mailing address, email address, account information, and payment information.
• Protected Classification Characteristics, such as age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, veteran or military status, genetic information.
• Commercial Information, such as service information and payment information including transactions history and insurance information if you use insurance to purchase a product.
• Internet/Network Information, such as mobile device content, IP address, browsing history, and usage information.
• Geolocation Information, such as your approximate location as determined though data like your IP address.
• Professional or Employment Information, such as the name and address of the company you work for in connection with job applications.
• Sensory information, including recordings of calls with us, where permitted by law.
• Other Personal Information, such as testimonial information, inquiry information, feedback information, demographic information (including information such as your due date, your baby’s birth date, your return-to-work plan, your anticipated return-to-work date, your feeding plan (i.e., breastfeeding, formula), and your baby’s name(s)), and any other personal information an individual chooses to provide us. We also collect health information such as delivery method (i.e., natural or C-section), your pumping history, and how you are generally feeling (i.e., how is your mood or how are you sleeping.
• Inferences, such as predictions about which services may be of interest to an individual.

We collect this information directly from individuals, their browser or device when they interact with our services, our affiliates, an individual’s employer, our service providers and business partners, social media and professional networks, information providers and other publicly available sources. For more information about the personal information that we collect and how we collect it, please refer to the Personal Information We Collect section of our Privacy Notice.

How We Use Personal Information

We use the above categories of personal information for a variety of purposes. For example, we use personal information to communicate with customers about our services, to provide customers with our services, to facilitate partner integrations, to process payments, and to otherwise operate our business. For more information about our use of Personal Information, please refer to the How We Use Personal Information section of our Privacy Notice.

Disclosure and Sale of Personal Information

As further described in the How We Share Your Personal Information section of our Privacy Notice, we disclose personal information to third parties for business purposes.

Disclosure for Business Purposes

In the last 12 months, we have disclosed for business purposes all categories of personal information outlined above to the following categories of recipients: Affiliates, Employers, Data Analytics Providers, Marketing Partners, Business Partners, Service Providers, and certain other third parties where individuals have provided consent or direction, or where we are complying with law or protecting our rights (such as to our legal advisors).

Sale of Personal Information

As is common practice among companies that operate online, in the last 12 months, we have allowed certain third-party providers to collect information about consumers directly through our website and other online services for purposes of analyzing and optimizing our services, delivering ads, providing content and ads that are more relevant, measuring statistics and the success of ad campaigns, and detecting and reporting fraud. As a result of this practice, in the last 12 months, we have sold the following categories of personal information to these third-party providers, subject to each consumer’s settings and their right to opt-out:

• Identifiers, such as IP address.
• Commercial Information, such as service information, including services of interest or orders made in connection with our services.
• Internet/Network Information, such as log data (including operating system and browser type) and analytics data (including usage and activity on our website and online services)
• Geolocation Data, such as general geographic location based on IP address.

Since our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal information from children under the age of 16, we do not sell personal information of consumers we know to be under the age of 16.

For more information about how we otherwise disclose personal information, please refer to the How We Share Your Personal Information section of our Privacy Notice.

Your California Privacy Rights

If you are a California resident, the CCPA allows you to make certain requests about your personal information. Specifically, the CCPA allows you to request us to:

The Right to Know

You have the right to request any or all of the following information relating to the personal information we have collected about you or disclosed in the last 12 months, upon verification of your identity:

• The specific pieces of personal information we have collected about you;
• The categories of personal information we have collected about you;
• The categories of sources of the personal information we have collected about you;
• The categories of personal information that we have disclosed about you to third parties for a business purpose, and the categories of recipients to whom this information was disclosed;
• The categories of personal information we have sold about you (if any), and the categories of third parties to whom this information was sold; and
• The business or commercial purposes for collecting or, if applicable, selling personal information about you.

The Right to Request Deletion

You have the right to request the deletion of personal information that we have collected from you, subject to certain exceptions.

The Right to Opt Out of Personal Information Sales

You have the right to direct us not to sell personal information we have collected about you to third parties now or in the future.

The Right to Non-Discrimination

You have the right not to receive discriminatory treatment for exercising any of the rights described above.

However, please note that if the exercise of the rights described above limits our ability to process personal information (such as in the case of a deletion request), we may no longer be able to provide you our products or services or engage with you in the same manner.

"Shine the Light"

California residents that have an established business relationship with us have rights to know how their information is disclosed to third parties for their direct marketing purposes under California's "Shine the Light" law (Civ. Code § 1798.83).

How to Exercise Your California Privacy Rights

To Exercise Your Right to Know or Right to Deletion

Please submit a request by:

• Emailing [email protected] with the subject line "California Rights Request";
• By using our contact form located here; or
• Calling 1-888-WILLOW-3 (1-888-945-5693).

We will need to verify your identity before processing your request. In order to verify your identity, we will generally either require the successful login to your account or the matching of sufficient information you provide us to the information we maintain about you in our systems. Although we try to limit the personal information collected in connection with a request to exercise the right to know and/or the right to deletion to that personal information identified in our Privacy Notice, certain requests may require us to obtain additional personal information from you. In certain circumstances, we may decline a request to exercise the right to know and/or right to deletion, particularly where we are unable to verify your identity.

To Exercise Your Right to Opt Out of Personal Information Sales

As is common practice among companies that operate online, we permit third party advertising networks, social media companies and other third party businesses to collect and disclose your personal information (including preferences, geolocation, commercial information and internet, network and device information) directly from your browser or device through cookies or tracking technologies when you visit or interact with our websites, use our apps or otherwise engage with us. These third parties use this information for the purposes of serving ads that are more relevant, for ad campaign measurement and analytics, and for fraud detection and reporting and may sell that information to other businesses for advertising and other purposes. By visiting here, you can opt out from sales of this type of personal information by businesses that participate in the opt-out tool. To make opt-out requests related to mobile apps on your device for businesses participating in the DAA's CCPA App-based Opt-Out Tool, you can download the appropriate app at www.youradchoices.com/appchoices. To learn more about how third parties collect information through tracking technologies and what other choices you may have in relation to those activities, please see Third Party Tracking and Online Advertising section of our Privacy Notice.

To Submit a Request as an Authorized Agent

In certain circumstances, you are permitted to use an authorized agent (as that term is defined by the CCPA) to submit requests on your behalf through the designated methods set forth above where we can verify the authorized agent’s authority to act on your behalf by:

• For requests to know or delete personal information:
• Receiving a power of attorney valid under the laws of California from you or your authorized agent; or
• Receiving sufficient evidence to show that you have:
• Provided the authorized agent signed permission to act on your behalf;
• Verified your own identity directly with us pursuant to the instructions set forth in these CA Disclosures; and
• Directly confirmed with us that you provided the authorized agent permission to submit the request on your behalf.
• For requests to opt out of personal information sales: Receiving a signed permission demonstrating your authorized agent has been authorized by you to act on your behalf.

We may deny a request in the event we are not able to verify the authorized agent’s authority to act on your behalf.

Minors Under Age 16

We do not and will not "sell" the personal information of consumers we know to be less than 16 years of age, unless we receive affirmative authorization (the "Right to Opt In") from either the minor who is between 13 and 16 years of age, or the parent or guardian of a minor less than 13 years of age.

Shine the Light Disclosure

The California "Shine the Light" law gives residents of California the right under certain circumstances to request information from us regarding the manner in which we share certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes. We do not share your personal information with third parties for their own direct marketing purposes.