Consumer Health Data Privacy Policy

Introduction

This Consumer Health Data Privacy Policy (this "CHD Policy") supplements the Dermasync Privacy Policy and applies specifically to Consumer Health Data as that term is defined under the Washington My Health My Data Act (RCW 19.373 et seq.) ("MHMDA"), the Nevada Consumer Health Data Privacy Law (SB 370), and other applicable state consumer health data laws (“CHD Laws”). Because menstrual-cycle tracking is a standard feature of the Services, this CHD Policy applies to menstrual-cycle data and information provided by Members using the Dermasync Services or imported through the Services.

We provide this CHD Policy as a standalone document, so it is easy to find, read, and use. If this CHD Policy and the Dermasync Privacy Policy are inconsistent with respect to Consumer Health Data, this CHD Policy governs. Initial capitalized terms used but not defined here have the meanings given in the Dermasync Privacy Policy or applicable law.

1. Who This CHD Policy Applies To

This CHD Policy applies to residents of Washington whose Consumer Health Data is covered by MHMDA; residents of Nevada whose Consumer Health Data is covered by Nevada SB 370; residents of other states with laws that regulate consumer health data, to the extent those laws apply; and all Members whose interactions with the Services involve Consumer Health Data, to the extent we choose to extend these protections uniformly. Dermasync is a covered entity under Nevada SB 370. Dermasync is not available in all states at this time, including residents of Washington State. Specifically, the Services are not currently offered to residents of Washington State; if and when they are offered, Dermasync will be a regulated entity under MHMDA, and this CHD Policy will govern.

2. What Is Consumer Health Data

Under certain CHD Laws, Consumer Health Data means personal information that is linked or reasonably linkable to a consumer and identifies the consumer's past, present, or future physical or mental health status. For purposes of the Services, Consumer Health Data may include menstrual-cycle information (including period start and end dates, menstrual-cycle length, flow, ovulation and fertility indicators, and menstrual-cycle-related symptoms), hormonal phase information, contraceptive information, pregnancy status, perimenopause/menopause status, reproductive health information, Member-reported symptoms, allergies, medications, health conditions, wellness observations, personalized wellness insights generated from any of the above, and identifiers linked or reasonably linkable to any of the above.

3. Categories of Consumer Health Data We Collect

We collect Consumer Health Data only to the extent you provide or enable access or sharing of such information. Categories of Consumer Health Data that you provide or enable access, or sharing may include reproductive and menstrual-cycle information you log or import through the menstrual-cycle tracking feature; symptom and condition information; derived insights and cycle predictions; Connected Service imports such as authorized Apple HealthKit data and linked identifiers. Photographs to the extent they reveal health status are currently stored only on your personal device and are not visible or disclosed to us.

4. Sources of Consumer Health Data

We obtain Consumer Health Data directly from you when you authorize and enter information into the Services; automatically when the Services generate insights or aggregates from information you provide; and from Connected Services (Apple HealthKit) you authorize us to access.

5. Purposes for Collecting and Using Consumer Health Data

We collect and use Consumer Health Data only for disclosed purposes and only with the consent required by applicable law: to provide personalized skincare guidance, insights, and routine suggestions; to provide the menstrual-cycle tracking features that support cycle-aware skincare (including cycle logging, phase identification, period, and ovulation indicators, cycle history, and reminders); to generate wellness insights; to support and improve your personalized experience; or to conduct internal research, analytics, and service improvement using aggregated, anonymized, or de-identified information; and, only if you enable and consent to “Anonymized Datasets,” to contribute de-identified to Anonymized Datasets as described in the Privacy Policy.

You may use the Services without entering your menstrual-cycle data. If you do not enter or import menstrual-cycle data, or you revoke prior menstrual-cycle data approval or consent or authorization for us to receive, use, or access, the Services will provide a more basic skincare experience including general education and routines, but menstrual-cycle-personalization of menstrual-phase-based skincare guidance and period and ovulation indicators will not be available and cannot be provided by the Services. We do not process Consumer Health Data for materially different purposes without first obtaining separate, affirmative consent where required by law.

6. Categories of Consumer Health Data We Share and With Whom

7. What We Do Not Do With Consumer Health Data

We do not sell, share, disclose, or transmit your Consumer Health Data to any third party for advertising or marketing purposes; for targeted or cross-context behavioral advertising; for building advertising audiences, lookalike audiences, or marketing profiles for third parties; for use by advertising SDKs, analytics providers, advertising networks, or attribution platforms; for use to send promotional marketing communications from Dermasync; for use to develop or improve models used by third-party AI Service Providers; or for geofencing by any entity that provides in-person healthcare services, health care supplies, or health care products in a manner prohibited by applicable CHD Laws. These commitments describe our handling of Consumer Health Data. This CHD Policy does not restrict the use of Anonymized Datasets as provided and described in the Privacy Policy.

8. Consent

Your consent is obtained before we request, collect, or use Consumer Health Data to operate the Services. Consumer Health Data are encrypted on your personal device before such information is transmitted and remains encrypted in transit and at rest. When required by applicable CHD Law, we obtain your affirmative consent before collecting Consumer Health Data for any purpose that is not strictly necessary to provide the Services.

We do not sell any Consumer Health Data. If our practices ever change, we will obtain a valid written authorization before any sale as required by applicable CHD Law. You may withdraw your consent with respect to our use and disclosure of Consumer Health Data at any time through privacy controls located in your personal Dermasync account profile or by contacting us. Your withdrawal of your consent regarding our use and disclosure of Consumer Health Data is only effective with respect to our use and disclosure of Consumer Health Data after the date of the withdrawal, and such withdrawal of your consent does not affect or restrict our prior use or disclosure of Consumer Health Data prior to the date of your withdrawal of your consent.

9. Your Rights Regarding Consumer Health Data

Subject to identity verification and applicable exceptions, you have rights to confirm whether we collect, share, or sell Consumer Health Data; request access; withdraw consent; request deletion; and appeal denial of a request. Upon a valid deletion request by you, we will delete your Consumer Health Data from our records and direct any Service Provider that stores Consumer Health Data on our behalf to do the same, in each case as required by law. Because Consumer Health Data is stored only as ciphertext, deletion may only effected by deleting the ciphertext and the associated key material.

10. Security

We protect Consumer Health Data with reasonable, industry-standard administrative, technical, organizational, and physical safeguards designed with the intent to prevent unauthorized access, acquisition, disclosure, alteration, loss, misuse, or destruction. Sensitive health records are encrypted using industry standard technologies and stored only as ciphertext. Our mobile application is designed so that all Health Data provided by you is encrypted as ciphertext. Metadata and operational account information, including certain Personal Information, may remain visible as needed to operate and provide the Services.

11. Retention and Deletion

Consumer Health Data is maintained as encrypted ciphertext until deleted by you or upon deletion of your personal Dermasync account, subject to applicable legal obligations and considerations, technical limitations, dispute-resolution needs, security, fraud prevention, and backup cycles. Upon a valid deletion request or account deletion, we will delete your Consumer Health Data from our records and direct any Service Provider that stores Consumer Health Data on our behalf to do the same, within a reasonable period, or within the period required by applicable law, subject to system limitations and legal obligations and considerations.

12. How to Exercise Your Rights

You may exercise rights described in this CHD Policy by using available in-app privacy controls; emailing the Privacy Officer at privacy@trydermasync.com; or writing to Privacy Officer, Dermasync, 453 S. Spring Street, Suite 1212, Los Angeles, California 90013. Please include enough information for us to verify your identity and locate your personal Dermasync account. If an authorized agent submits a request, we may require proof of authorization and information sufficient to verify both your identity and the agent’s authority. We will respond within a reasonable time or the time period required by applicable law.

13. State-Specific Disclosures

Washington Residents (MHMDA). The Services are currently not offered or available to residents of Washington State. Washington State residents have specific rights with respect to Consumer Health Data, including the rights described in Section 9 of this CHD Policy. If we later provide services to residents of Washington State, they may lodge a complaint with the Washington Attorney General at atg.wa.gov. MHMDA also provides a private right of action under the Washington Consumer Protection Act.

Nevada Residents (SB 370). Nevada State residents may have rights to confirm collection, request deletion, and withdraw consent. Nevada State residents may lodge a complaint with the Nevada Attorney General at ag.nv.gov.

Other States. If you reside in another state with a law regulating consumer health data, we will comply with the rights and obligations that law imposes to the extent applicable and advised.

14. Changes to This CHD Policy

We may update this CHD Policy from time to time. Changes become effective as of the effective date shown in the revised CHD Policy unless applicable law requires otherwise. Where required by law or where we make material changes, we will notify you through the Services, Dermasync’s websites, email messages to you, or another appropriate means as determined by us.

15. Contact Us

If you have questions or concerns about this CHD Policy or our processing of Consumer Health Data, please contact us at privacy@trydermasync.com or:

Privacy Officer
Dermasync
453 S. Spring Street, Suite 1212
Los Angeles, California 90013