This Consumer Health Data Privacy Policy (“Health Data Policy”) describes how Trevi Therapeutics, Inc. (“Trevi,” “we,” “us,” or “our”) collects, uses, and discloses Consumer Health Data and explains the rights available to Washington residents under the Washington My Health My Data Act and individuals in other states with similar laws that protect their Consumer Health Data.

Please note that this Health Data Policy does not apply in all situations where we may process health data. For example, it does not apply to information governed by clinical trial consents or regulated by the Health Insurance Portability and Accountability Act and its implementing regulations (“HIPAA”).

For information about our general privacy practices please review our Privacy Policy. If there is a conflict between this Health Data Policy and our Privacy Policy, this Health Data Policy controls with respect to Consumer Health Data.

1) CONSUMER HEALTH DATA WE COLLECT

“Consumer Health Data” means personal information that identifies or is reasonably capable of being associated or linked with your past, present, or future physical or mental health, healthcare, or attempts to seek healthcare. Depending on your interactions with us, we may collect the following categories of Consumer Health Data:

• Information about health conditions, symptoms, diagnoses, treatments, medications, or procedures;
• Measurements of bodily functions, vital signs, or other health characteristics;
• Information relating to reproductive, sexual or gender-affirming healthcare;
• Information that identifies you as seeking or receiving health-related services; and
• Inferences derived from other information that identify or suggest health status.

2) SOURCES OF CONSUMER HEALTH DATA

We may collect Consumer Health Data directly from you, automatically when you use our website, through your use of our Services, through your offline interactions with us, or from third parties (such as service providers, business partners, or healthcare professionals, where permitted by law).

3) HOW WE USE CONSUMER HEALTH DATA

We use Consumer Health Data for the following purposes:

• To provide products or services you request, including patient support or assistance programs
• To communicate with you and respond to inquiries
• To operate, maintain, and improve our business and Services
• To protect patients, consumers, and the integrity of our Services
• To comply with legal, regulatory, and safety obligations, including pharmacovigilance
• For internal analytics, auditing, fraud prevention, and quality improvement

We collect and use Consumer Health Data only as necessary to provide requested products or services, to comply with legal or safety obligations, or with your affirmative, express consent, unless otherwise permitted or required by law.

4) SHARING OF CONSUMER HEALTH DATA

We may share Consumer Health Data with:

• Service providers that perform services on our behalf;
• Business partners or collaborators related to specific products or services;
• Government authorities or regulators where required by law; and
• Parties involved in a corporate transaction, such as a merger or acquisition.

We do not sell Consumer Health Data. We do not share Consumer Health Data for marketing, targeted advertising, or social sharing purposes without your consent, where such consent is required by law.

5) DE-IDENTIFIED DATA

We may de-identify Consumer Health Data so that it cannot reasonably be used to identify you. We maintain such information in de-identified form and do not attempt to re-identify it except as permitted by law.

6) RETENTION OF CONSUMER HEALTH DATA

We retain Consumer Health Data only for as long as reasonably necessary to fulfill the purposes described in this Health Data Policy or as required by law (for example, for safety, regulatory, or recordkeeping obligations).

7) YOUR PRIVACY RIGHTS

Subject to certain legal exceptions, you have the right to:

• Confirm whether we collect or share your Consumer Health Data
• Access your Consumer Health Data
• Correct inaccurate or incomplete Consumer Health Data
• Delete Consumer Health Data
• Withdraw consent for the collection or sharing of Consumer Health Data
• Obtain a list of third parties with whom your Consumer Health Data has been shared
• Be free from discrimination for exercising your rights

We will respond to verified requests within 45 days, as required by law. If we deny your request, you may appeal our decision by replying to our response or by indicating in your follow‑up communication that you wish to appeal.

8) SUBMITTING REQUESTS

You may submit a privacy request by contacting us at: Privacy@TreviTx.com

To protect your information, we may need to verify your identity and request additional information. We may deny requests as permitted by law, including where retention is required for regulatory or safety purposes.