PRIVACY NOTICE

AVINI EXPERIENCE APP

Last Updated: October 21st, 2026

This Privacy Notice explains how Avini Health Corporation ("Avini Health," "Company," "we," "us," or "our") collects, uses, stores, shares, and protects personal information in connection with:

• The Avini Experience mobile application (the "App");
• Web pages used to view content shared through the App (the "Share Room"); and
• Supporting services necessary to operate these features.

The App is intended for individuals who already have an eligible Company customer or distributor account. These accounts are created and managed through the Company's existing account-management system, Exigo. The App does not offer account registration.

Individuals who receive shared content may access the Share Room without creating an App account.

This Privacy Notice does not govern independently operated websites or other Company services that have their own privacy notices. For information about those services, see the Company's website privacy policy at https://www.avinihealth.com/privacy-policy

TABLE OF CONTENTS

1. What Information Do We Collect?
2. How Do We Use Your Information?
3. How Do We Share Your Information?
4. Contacts and Content-Sharing Activity
5. Third-Party Services and External Websites
6. International Data Processing
7. How Long Do We Retain Information?
8. How Do We Protect Your Information?
9. Your Privacy Rights and Choices
10. Additional Privacy Rights for U.S. State Residents
11. Children's Privacy
12. Changes to This Privacy Notice
13. How Can You Contact Us?
14. How Can You Access, Correct, or Request Deletion of Your Information?

1. WHAT INFORMATION DO WE COLLECT?

In Short: We process account information, information provided through App features, technical information necessary to operate our services, and activity associated with shared content.

Account Information From Exigo

When you sign in, we receive and store information from your existing Exigo account, which may include:

• First and last name;
• Customer or distributor identification number;
• Login name;
• Sponsor and enroller identification numbers;
• Rank information;
• Account creation date;
• Customer or distributor account type;
• Account status and sign-in eligibility; and
• Online store web alias.

We may also process the email address associated with your Exigo account to help identify links shared with yourself. Where this check is used, we keep only a coded version of the email address, generated through keyed hashing.

Authentication Information

You sign in using your existing Exigo credentials.

Your credentials are transmitted through our authentication services to Exigo for verification. We do not store your Exigo password.

When an eligible user first signs in, our systems automatically create a technical authentication identity and an App profile linked to that person's Exigo account.

These records support App access and are separate from the underlying Exigo account.

Information You Provide

Contacts. Names, phone numbers, and email addresses for contacts you create manually, import from supported files, or select from your device.

When you choose to import contacts from your device, the contact information you authorize for import is uploaded to and stored on Avini Experience's servers.

This information includes contact names, the first available phone number, and the first available email address, where availabl

When you import contacts from your device, we may also store:

• The device's internal reference for each imported contact; and
• A randomly generated App installation identifier used to reduce duplicate imports.

We use this information to maintain your contact list, support content sharing, and provide contact-management, task, and follow-up features across all supported platforms.

Your imported contacts are private to your account and are not visible to other Avini Experience users. We do not sell your imported contact information or share it with third parties for their independent marketing purposes.

The installation identifier is generated by the App and is not derived from hardware or advertising identifiers.

Contact Organization. Contact groups and related organizational information you create.

Notes and Tasks. Information you enter into notes and tasks, including titles, descriptions, dates, and reminder preferences where available.

Favorites. Information identifying products or content you save.

Support and Issue Reports. Information you submit when reporting an issue, including the issue description, App screen, App version, device platform, operating-system version, and associated App profile identifier.

Sharing Information

When you create a share, we process information about the content or product being shared and the generated sharing link.

For tracked sharing activity, we may also record:

• The selected contact;
• The sharing method, such as text, email, device sharing, or copying a link;
• The time of the sharing action; and
• Related engagement and Follow Up information.

A recorded sharing action does not establish that a message was successfully delivered or received.

Engagement Points

We maintain records of qualifying sharing and product-link activity used to calculate engagement Points.

These records may be associated with an App profile and coded recipient identifiers.

Points may also be considered for Company recognition, incentives, rewards, or competitions, as described in Section 2.

Device Permissions

Contacts. The App may request permission to access device contacts so you can select contacts for import.

The App reads only contact names, phone numbers, and email addresses, and imports only contacts you select. It does not read contact photos, addresses, or other fields.

Notifications. The App may request permission to send Follow Up notifications.

If enabled, our systems may process:

• Device push notification tokens;
• Device platform information;
• Notification registration identifiers; and
• Registration and last-activity timestamps.

You may manage these permissions through your device settings.

When you share through text or email, the App opens the selected communication application with the link included. The App cannot read your messages or inbox.

Technical and Usage Information

We process technical information necessary for authentication, service operation, session management, security, and troubleshooting.

Depending on the service, this may include:

• Authentication and session identifiers;
• Activity timestamps;
• App platform and version information;
• Requested resources and technical logs;
• Browser or device information; and
• IP addresses processed by hosting, authentication, or infrastructure providers.

The App does not collect precise location or device advertising identifiers and does not include third-party advertising or analytics software development kits. Embedded content providers, such as Elfsight, are described in Section 5.

Share Room Activity

When someone opens a shared link, we may record:

• The shared link accessed;
• A randomly generated visit identifier;
• Access timestamps;
• Link-opening events;
• Video playback starts;
• Viewing progress;
• Video completion events;
• Purchase-button interactions; and
• Product-link redirects.

This information may be processed even when the visitor does not have an App account.

The Share Room uses temporary browser session storage to support visits.

Video content is delivered through Vimeo, which may separately process technical information associated with playback.

We use Elfsight for displaying the events calendar, which may collect IP addresses, browser types, and operating-system information. It uses a cookie to prevent duplicate view counts. Elfsight has its own Privacy Policy.

2. HOW DO WE USE YOUR INFORMATION?

In Short: We use information to operate the App, authenticate eligible users, support contact management and content sharing, measure engagement, administer Company recognition and competitions, maintain security, and provide support.

We process information for the following purposes.

Authentication and Eligibility. To verify eligibility through Exigo, establish App sessions, and manage access.

App Functionality. To provide products, informational content, contacts, groups, notes, tasks, favorites, and supported services.

Contact Management. To maintain contact information and organizational records users choose to create or import.

Content Sharing. To generate links, associate tracked shares with contacts, and facilitate communications initiated by users.

Sharing Activity and Reporting. To record supported engagement activity and make relevant information available to the distributor who created the share.

Follow Ups. To maintain Follow Up information associated with sharing activity. Where permitted and available, the App may send notifications containing limited information, such as the number of contacts ready for follow-up.

Engagement Points

The App calculates Points from qualifying sharing and product-link activity.

Under the current scoring rules:

• One Point may be awarded when a distributor sends a qualifying tracked share of informational content to a contact.
• One Point may be awarded when a recipient performs a qualifying purchase-button interaction or follows a tracked product link to the online store.

The system applies scoring limitations associated with recipient identities, including limits on qualifying awards within a 90-day period.

Coded recipient identifiers and applicable self-sharing checks help prevent duplicate or ineligible awards.

Company Recognition, Rewards, and Competitions

The Company may use engagement Points and associated activity to recognize distributors, offer incentives or rewards, and conduct Company-sponsored competitions.

Such activities may include performance-based rankings, recognition of qualifying achievements, and the awarding of cash or noncash prizes.

The Company determines whether to offer a particular reward or competition, including its timing, eligibility requirements, scoring criteria, number of recipients or winners, and available prizes.

Points have no cash value and cannot be purchased, exchanged, transferred, or directly redeemed through the App. Accumulating Points does not, by itself, guarantee a reward, payment, or prize. The App does not currently offer a prize competition.

The Company may establish, modify, or discontinue future recognition and incentive programs. When the Company announces a formal competition, that competition will be governed by the official rules established for that promotion. Once a competition begins, its published terms will govern its administration, subject to any changes permitted by those terms and applicable law.

Authorized Company personnel may review Points, qualifying activity, account eligibility, and related information to administer these activities, verify results, determine eligible recipients, and investigate irregularities.

Additional Uses

Technical Support. To investigate reports, troubleshoot issues, and maintain reliability.

Security and Abuse Prevention. To protect accounts, enforce usage limitations, and investigate misuse.

Legal and Administrative Purposes. To comply with applicable legal obligations, respond to lawful requests, and enforce applicable terms.

Where applicable law requires a legal basis for processing, the relevant basis depends on the purpose and may include providing requested services, legitimate interests, legal obligations, or consent where required.

3. HOW DO WE SHARE YOUR INFORMATION?

In Short: Information may be processed by service providers, shared at your direction, made available to authorized personnel, or disclosed for lawful purposes.

Service Providers

The App uses external services for operational purposes.

The personal information processed by each provider depends on its function and the features being used.

These providers may also process technical information under the terms and privacy practices applicable to their services.

Sharing With Other Users

Distributors can view supported engagement information associated with sharing links they create.

Other distributors do not gain access to an individual's private CRM records merely by using the same App.

External Shopping Destinations

When a recipient follows a purchase button or product link, the recipient may be redirected to the Company's online store.

The link may contain the sharing distributor's store alias so the shopping visit can be associated with that distributor.

The online store may process information under its own privacy notice.

User-Initiated Communications

When you choose to share through messaging, email, or another communication service, that service receives the link and any information you choose to include.

Authorized Company Personnel

Authorized Company personnel, including IT and support staff, may access information as necessary to administer services, troubleshoot issues, or process privacy requests.

Authorized personnel may also review Points, related activity records, and relevant account information when considering or administering distributor recognition, rewards, incentives, or competitions.

Recognition and Competition Disclosures

The Company may recognize distributors or announce competition results, including names, qualifying achievements, placement, and Points totals, as described in the applicable program terms or as otherwise disclosed when the recognition is offered, and subject to relevant privacy requirements.

When rewards are offered, the Company may collect additional information necessary to deliver them or satisfy applicable legal and tax obligations.

Information may be disclosed to service providers where reasonably necessary for prize fulfillment or other authorized purposes.

Legal and Business Purposes

We may disclose information where permitted or required by law, including legal proceedings, security investigations, protection of rights, and applicable business transactions.

Sale or Sharing of Personal Information

Information about the sale or sharing of personal information under applicable U.S. state privacy laws is provided in Section 10.

4. CONTACTS AND CONTENT-SHARING ACTIVITY

In Short: Distributor CRM information is maintained separately. Shared content can generate recorded engagement, including when recipients do not have App accounts.

Contact Ownership and Access

Contacts, groups, notes, tasks, and related CRM information are associated with the distributor who created or imported them.

Other distributors cannot view or manage those records through ordinary App permissions.

If several distributors independently save information about the same recipient, their CRM records remain separately maintained.

Authorized Company personnel may access applicable information for legitimate operational, support, and privacy purposes.

Tracked Sharing Links

A tracked sharing link is associated with a selected contact.

Depending on recorded activity, the distributor may see:

• Whether the link was opened;
• Whether video playback began;
• Viewing progress;
• Whether the video was completed;
• Recorded viewing counts; and
• Relevant timestamps.

These records indicate use of a shared link but do not necessarily establish who used it, particularly when links are forwarded.

Untracked Sharing Links

Untracked links are not associated with a selected contact.

However, link-level interactions, including opens and playback events, may still be recorded.

Untracked sharing does not mean that no technical or activity information is collected.

Recipient Identity Information

To recognize related contacts and reduce duplicate activity, we maintain coded representations of certain identifiers.

These may include keyed hashes derived from phone numbers, email addresses, and contact references.

Recipient identity records are associated with the relevant distributor's account.

These identifiers are pseudonymous rather than anonymous because they may remain linkable to information maintained by the Company.

They may be used to:

• Connect related contact entries;
• Maintain sharing history;
• Generate Follow Ups;
• Reduce duplicate activity; and
• Apply engagement Points limitations.

Contact Deletion and Historical Records

When a distributor deletes a contact, the contact is removed from the active contact list.

The deleted contact is scheduled for removal from active systems after approximately 90 days, together with related notes, tasks, and group memberships.

Deleting an individual contact does not automatically delete historical sharing activity, engagement Points, or recipient identity records.

Previously generated sharing links may continue working.

If a distributor later adds a contact with matching information, existing recipient identity associations may reconnect the new entry to earlier activity.

Ordinary contact deletion is different from a verified privacy-related deletion request. See Section 14.

Information for Share Recipients

People receiving shared content can view it without an App account.

Their supported interactions may nevertheless be recorded.

Recipients may contact the Company concerning their personal information or communication preferences, as described in Section 14.

5. THIRD-PARTY SERVICES AND EXTERNAL WEBSITES

The App and Share Room may link to independently operated websites or services, including:

• The Company online store;
• Company Events websites;
• The Company policies website; and
• Messaging, email, or other applications selected by users.

The App may also display embedded content from Vimeo and Elfsight.

The Events section of the App displays a calendar provided by Elfsight. When the calendar loads, Elfsight may collect technical information such as your IP address and browser and operating-system details, and may set a cookie used to count calendar views. Elfsight processes this information under its own privacy policy.

External websites and services may process information under their own privacy policies and terms.

We encourage users to review those notices.

Purchases made through external shopping destinations are governed by the applicable store's terms and privacy practices.

The App does not collect payment-card information for purchases completed through external stores.

6. INTERNATIONAL DATA PROCESSING

The Company and its service providers may store, process, or access information in the United States and other countries where their operations or infrastructure are located.

Privacy and data-protection laws may differ between these jurisdictions.

International processing and transfers are subject to applicable legal requirements.

For questions about international processing, please contact us using Section 13.

7. HOW LONG DO WE RETAIN INFORMATION?

In Short: App information is generally retained while the related Exigo account remains active, subject to record-specific schedules, valid privacy requests, and applicable law.

Active Accounts

Information may remain available while the underlying Exigo account remains active.

Not using the App, signing out, uninstalling the App, or allowing a session to expire does not automatically delete server-side information.

Record-Specific Retention

Certain records follow established cleanup schedules.

Other information, including profiles, favorites, sharing links, historical engagement activity, recipient identities, Points, and issue reports, may remain stored while relevant to the purposes described in this Notice.

These categories do not necessarily have fixed automatic expiration periods.

Recognition and Competition Information

Engagement Points and qualifying activity may be used for recognition, rewards, incentives, or competitions as described in Section 2.

Where a specific program generates additional records or requires distinct retention practices, the Company will address those practices through applicable program terms or privacy disclosures as required.

Exigo Account Termination

Termination of an underlying Exigo account ends eligibility to use the App.

Associated App information is not necessarily removed immediately when Exigo termination occurs.

The Company may coordinate removal of related App information through its administration and privacy-request processes.

If a previously terminated individual becomes eligible again, a new App profile may be created after applicable earlier account records have been removed.

Previously deleted App information is not automatically restored.

Privacy Deletion Requests

Verified requests to delete personal information are handled separately from routine record-specific cleanup.

Applicable deletion requirements and legally permitted exceptions depend on the nature of the request and relevant law.

Provider Backups and Logs

Infrastructure providers may retain information in system logs, backups, or other technical records under their own retention schedules.

Deleting active App records may not immediately remove information from every provider-controlled backup or log.

Information independently maintained by Exigo or other Company services is subject to the applicable account-management and retention processes.

8. HOW DO WE PROTECT YOUR INFORMATION?

We use technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and misuse.

These include:

• Authentication and access controls;
• Encrypted HTTPS connections for supported services;
• Database permissions designed to limit access to authorized records;
• Keyed hashing for certain recipient identifiers; and
• Restrictions on access by authorized Company personnel.

No electronic transmission or storage system is completely secure.

We cannot guarantee that unauthorized access or other security incidents will never occur.

Users should protect their devices and Exigo credentials and contact the Company if they suspect unauthorized account access.

9. YOUR PRIVACY RIGHTS AND CHOICES

In Short: Depending on applicable law, you may have rights to access, correct, delete, or limit certain processing of your personal information.

Device Permissions

You may manage contact and notification permissions through your device settings.

Disabling contact access does not automatically delete contacts already imported into the App.

Disabling notification permission prevents further notifications through the affected device permission.

Managing App Information

Supported App features allow users to manage certain contacts, groups, notes, tasks, and favorites.

Information originating from Exigo may need to be corrected through the applicable Exigo account-management process.

Privacy Requests

Depending on your location and applicable law, you may have rights to:

• Access personal information;
• Correct inaccurate information;
• Request deletion;
• Restrict or object to certain processing;
• Request data portability;
• Withdraw consent where applicable; and
• Submit complaints to an appropriate privacy or data-protection authority.

These rights may be subject to legal conditions and exceptions.

See Section 14 for request procedures.

Marketing Communications and In-App Promotions

The App displays Company products, informational materials, and events.

The App may also display promotional banners and announcements concerning new product launches, special offers, distributor recognition, incentives, rewards, and Company-sponsored competitions as those programs become available.

The App does not currently offer a prize competition. When a formal competition is offered through the App, the applicable official rules will be made accessible within the App in accordance with applicable platform requirements.

Displaying promotional content within the App does not, by itself, involve sending marketing emails, text messages, or promotional push notifications.

The App currently supports push notifications for Follow Up purposes. If the Company introduces promotional push notifications or other direct marketing communications through the App, applicable disclosures, consent options, and opt-out methods will be provided as required by law and platform policies.

Marketing communications delivered through other Company services are subject to their applicable privacy notices and opt-out methods.

10. ADDITIONAL PRIVACY RIGHTS FOR U.S. STATE RESIDENTS

Residents of California and certain other U.S. states may have additional privacy rights under applicable law.

Depending on your state of residence and the laws applicable to the Company, these rights may include:

• Requesting information about personal information we collect, use, or disclose;
• Accessing applicable personal information;
• Correcting inaccurate information;
• Requesting deletion;
• Receiving certain information in a portable format;
• Opting out of legally defined sales, sharing for cross-context behavioral advertising, or certain profiling activities, where applicable; and
• Exercising applicable privacy rights without unlawful discrimination.

Categories of Personal Information

The App and related services may process the following categories:

Sources and Purposes

Personal information may originate from App users, existing Exigo account records, contacts provided by App users, Share Room visitors, and supporting technical systems.

Sections 2, 3, and 7 explain our purposes for processing information, our disclosures to service providers and other recipients, and our retention practices.

Sale and Sharing of Personal Information

Avini Health Corporation does not sell personal information collected through the Avini Experience App or Share Room.

We do not share personal information from these services with third parties for cross-context behavioral advertising, as that term is defined under applicable California privacy law.

In the preceding 12 months, we have not sold or shared personal information collected through these services for those purposes.

We do not have actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

We may disclose personal information to service providers and other recipients for the operational purposes described in Section 3, including authentication, infrastructure hosting, content delivery, notifications, sharing functionality, and technical support.

These operational disclosures are distinct from selling information or sharing it for cross-context behavioral advertising.

If our practices change, we will update this Privacy Notice and provide any required privacy choices before implementing those changes.

Sensitive Personal Information

We use sensitive personal information, such as account login credentials, only to authenticate users. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit its use under California law.

Exercising State Privacy Rights

Where applicable, you or an authorized representative may request access to, correction of, or deletion of personal information using the contact information and procedures described in Sections 13 and 14.

We may request information reasonably necessary to verify identity or representative authority when verification is required.

We will evaluate and respond to requests in accordance with applicable law.

Where applicable law provides a right to appeal a privacy-request decision, you may submit an appeal using the privacy contact identified in Section 13.

11. CHILDREN'S PRIVACY

The App is intended for individuals who have eligible existing Company accounts.

The App and Share Room are not directed toward children.

Shared links may be accessible to individuals without App accounts.

If you believe the Company has collected or processed information concerning a child in a manner inconsistent with applicable law, please contact us using Section 13.

We will review the matter and take appropriate action.

12. CHANGES TO THIS PRIVACY NOTICE

We may update this Privacy Notice to reflect changes in our services, information practices, or applicable legal requirements.

When changes occur, we will revise the "Last Updated" date.

Where required by law, we will provide additional notice or obtain consent before material changes take effect.

We encourage users to review this Notice periodically.

13. HOW CAN YOU CONTACT US?

For questions, concerns, or privacy requests relating to the App or Share Room, contact:

Avini Health Corporation

Privacy Contact: support@avinihealth.com

Mailing Address: 6400 Park of Commerce Blvd, Suite 1B Boca Raton, FL 33487

Please identify the Avini Experience App or Share Room in your request so it can be directed to the appropriate personnel.

Privacy requests are handled by the Company's IT team or other authorized personnel designated to manage these requests.

14. HOW CAN YOU ACCESS, CORRECT, OR REQUEST DELETION OF YOUR INFORMATION?

In Short: You may contact the Company to request access to, correction of, or deletion of applicable personal information associated with the App or Share Room.

Submitting a Privacy Request

To submit a privacy request, email support@avinihealth.com.

Describe the request and identify the Avini Experience App or Share Room.

Both distributors and people receiving shared content may submit requests.

Verification

The Company may need to verify a requester's identity or authority before acting on a request.

For distributors, verification may involve information associated with their Exigo account.

For share recipients, verification may involve confirming control of a relevant email address or phone number.

Please do not provide passwords or other sensitive authentication credentials in an initial privacy request.

Distributor App Information

Requests may concern:

• App profiles and technical authentication identities;
• Contacts and contact groups;
• Notes and tasks;
• Favorites;
• Sharing links and associated activity;
• Outbound sharing records;
• Follow Ups;
• Recipient identity records;
• Engagement Points;
• Notification registrations; and
• Support or issue reports.

Authorized Company IT personnel review verified requests and coordinate applicable action.

Depending on the request and applicable law, fulfilling a deletion request may involve deleting associated App records and disabling previously generated sharing links.

Deletion requests are subject to applicable verification requirements and any retention exceptions permitted or required by law.

Recognition, Rewards, and Competitions

Earning Points or receiving recognition does not eliminate applicable personal-data rights.

However, deleting Points or related records may affect the Company's ability to verify participation, eligibility, rankings, or entitlement to a particular recognition program, incentive, reward, or competition prize.

The Company will handle privacy requests in accordance with applicable law, including where a request relates to an incentive or competition.

Exigo Account Information

The App uses an existing Exigo account as its account authority.

Deleting App-associated information does not automatically terminate the underlying Exigo account or delete information independently maintained by Exigo.

If the Exigo account remains eligible, signing in again after earlier App records have been removed may establish a new, empty App profile.

Previously deleted App information is not automatically restored.

Requests to correct or terminate the underlying Exigo account may require a separate account-management process.

Share Recipient Requests

Share recipients may request review or deletion of applicable information associated with their contact details or recorded interactions.

IT may need to identify records maintained separately by different distributors.

The scope of deletion depends on the verified request, identified information, and applicable law.

Removing recipient-related records may disable associated sharing links.

A recipient may also request that a distributor stop contacting them.

The Company may coordinate such requests with the relevant distributors.

The App does not independently control communications sent through external messaging or email applications or information stored on distributors' personal devices.

Request Processing and Confirmation

The Company uses an IT-managed process for handling privacy requests.

After receiving a request, designated personnel will review it, perform appropriate verification, and determine the applicable action.

We will inform requesters of the expected processing timeframe and confirm when their request has been completed.

Requests will be handled within applicable legal timeframes.

Limited information about requests and their handling may be retained where necessary and legally permitted to document compliance, prevent misuse, or manage disputes.