Consumer Health Data Privacy Policy

Dermasync, Inc. Consumer Health Data Privacy Policy

Introduction

This Consumer Health Data Privacy Policy (this "CHD Policy") supplements the Dermasync, Inc. Privacy Policy and applies specifically to Consumer Health Data as that term is defined under the Washington My Health My Data Act (RCW 19.373 et seq.) ("MHMDA"), the Nevada Consumer Health Data Privacy Law (SB 370), and other applicable state consumer health data laws. Because menstrual-cycle tracking is a standard feature of the Services, this CHD Policy applies to menstrual-cycle data and information logged or imported through the Services.

We provide this CHD Policy as a standalone document, so it is easy to find, read, and use. If this CHD Policy and the Dermasync Privacy Policy are inconsistent with respect to Consumer Health Data, this CHD Policy governs. Initial capitalized terms used but not defined here have the meanings given in the Dermasync Privacy Policy or applicable law.

1. Who This CHD Policy Applies To

This CHD Policy applies to residents of Washington whose Consumer Health Data is covered by MHMDA; residents of Nevada whose Consumer Health Data is covered by Nevada SB 370; residents of other states with laws that regulate consumer health data, to the extent those laws apply; and all Members whose interactions with the Services involve Consumer Health Data, to the extent we choose to extend these protections uniformly. Dermasync is a regulated entity under MHMDA and a covered entity under Nevada SB 370. Dermasync is not available in all states at this time, including residents of Washington State.

2. What Is Consumer Health Data

Under MHMDA, Consumer Health Data means personal information that is linked or reasonably linkable to a consumer and identifies the consumer's past, present, or future physical or mental health status. Nevada SB 370 uses a substantially similar definition.

For purposes of the Services, Consumer Health Data may include menstrual-cycle information (including period start and end dates, menstrual-cycle length, flow, ovulation and fertility indicators, basal body temperature, and menstrual-cycle-related symptoms), hormonal phase information, contraceptive information (including hormonal birth control), pregnancy status, lactation status, perimenopause/menopause status (including irregular or absent periods), reproductive health information and history, skin type, tone, and Fitzpatrick classification, skin history and day-to-day skin status and conditions (such as oily, dry, bumpy, acne, or redness), skin reactions and patch-test results, allergies or sensitivities to skincare active ingredients or products, medications, health conditions, wellness observations (including sleep, stress level, alcohol and sugar consumption, and exercise or physical activity), personalized wellness insights generated from any of the above, and identifiers linked or reasonably linkable to any of the above.

3. Categories of Consumer Health Data We Collect

We collect Consumer Health Data only to the extent you provide or enable access or sharing of such information. Categories of Consumer Health Data that you provide or enable access or sharing may include: reproductive and menstrual-cycle information you log or import through the menstrual-cycle tracking feature, including period dates and flow, ovulation and fertility indicators, basal body temperature, hormonal phase information, contraceptive method and use (including hormonal birth control), pregnancy status, lactation status, and perimenopause and menopause status, including irregular or absent periods; skin information, including skin type, tone, and Fitzpatrick classification, skin history, and day-to-day skin status and conditions (such as oily, dry, bumpy, acne, or redness); skin reactions and patch-test results; allergies or sensitivities to skincare active ingredients or products; wellness observations, including sleep, stress level, alcohol and sugar consumption, and exercise or physical activity; derived insights and cycle predictions; Connected Service imports such as authorized Apple HealthKit data; photographs to the extent they reveal health status, which are currently stored only on your device; and linked identifiers.

4. Sources of Consumer Health Data

We obtain Consumer Health Data directly from you when you authorize and enter information into the Services; automatically when the Services generate insights or aggregates from information you provide; and from Connected Services (Apple HealthKit) you authorize us to access.

5. Purposes for Collecting and Using Consumer Health Data

We collect and use Consumer Health Data only for disclosed purposes and only with the consent required by applicable law: to provide personalized skincare guidance, insights and routine suggestions; to provide the menstrual-cycle tracking features that support cycle-aware skincare (including cycle logging, phase identification, period and ovulation indicators, cycle history, and reminders); to generate wellness insights; to support and improve your personalized experience; or to conduct internal research, analytics, and service improvement using aggregated, anonymized, or de-identified information.

You may use the Services without entering your menstrual-cycle data. If you do not enter or import menstrual-cycle data, or you revoke prior menstrual-cycle data approval or consent or authorization for us to receive, use, or access, the Services that you will receive will be a basic mode where available, while menstrual cycle-aware personalization and phase features will be unavailable. We do not process Consumer Health Data for materially different purposes without first obtaining separate, affirmative consent where required by law.

6. Categories of Consumer Health Data We Share, and With Whom

7. What We Do Not Do With Consumer Health Data

We do not: sell your Consumer Health Data or menstrual-cycle data; share it with third parties for their own independent advertising or marketing purposes; use it for targeted or cross-context behavioral advertising; build advertising audiences, lookalike audiences, or marketing profiles for third parties; transmit it to third-party advertising SDKs, analytics providers, advertising networks, or attribution platforms; use it to send promotional marketing communications from Dermasync; use it to develop or improve the models used by our third-party AI service providers; or geofence any entity that provides in-person healthcare services, health care supplies, or health care products in a manner prohibited by MHMDA. These commitments describe our handling of Consumer Health Data. They do not limit Dermasync's ability to offer, in the future, a separate aggregated, de-identified data product built from information collected under its own distinct consent process.

8. Consent

We seek your consent before requesting, collecting, or using Consumer Health Data to operate our Services. Consumer Health Data is encrypted in transit and at rest. We also do not share Consumer Health Data with third party Service Providers or third parties, unless required by law. Where MHMDA, Nevada SB 370, or other applicable law requires it, we obtain affirmative consent before collecting Consumer Health Data for any purpose that is not strictly necessary to provide the Service you requested.

We do not sell any Identifiable Consumer Health Data. If our practices ever change, we will obtain a valid written authorization before any sale as required by MHMDA and applicable law. You may withdraw consent at any time through available in-app privacy controls or by contacting us. Withdrawal is effective going forward and does not affect prior processing in reliance on consent.

9. Your Rights Regarding Consumer Health Data

Subject to identity verification and applicable exceptions, you have rights to confirm whether we collect, share, or sell Consumer Health Data; request access; withdraw consent; request deletion; and appeal denial of a request. Upon a valid deletion request, we will delete Consumer Health Data from our records and from records of any operating Service Providers, in each case as required by law.

10. Security

We protect Consumer Health Data with current industry reasonable administrative, technical, organizational, and physical safeguards designed with the intent to prevent unauthorized access, acquisition, disclosure, alteration, loss, misuse, or destruction. Current sensitive health records are encrypted using industry standard technologies and stored only as ciphertext. Our systems are designed so that all Health Data is encrypted as ciphertext. Metadata and operational account information may remain visible as needed to operate the Services.

11. Retention and Deletion

We retain the limited Consumer Health Data we have as encrypted ciphertext only until deleted by you or upon deletion of your Dermasync account, subject to applicable legal obligations, technical limitations, dispute-resolution needs, security, fraud prevention, and backup cycles. Upon a valid deletion request or account deletion, we will delete Consumer Health Data from production systems, direct processors to do the same where applicable, and remove it from encrypted backups within a reasonable period, or within the period required by applicable law and, where no shorter period applies, generally within up to ninety (90) days, subject to system limitations and legal obligations.

12. How to Exercise Your Rights

You may exercise rights described in this CHD Policy by using available in-app privacy controls; emailing the Privacy Officer at privacy@trydermasync.com; or writing to Privacy Officer, Dermasync, 453 S. Spring Street, Suite 1212, Los Angeles, California 90013. Please include enough information for us to verify your identity and locate your account. If an authorized agent submits a request, we may require proof of authorization and information sufficient to verify both your identity and the agent’s authority. We will respond within time frames required by applicable law, generally within forty-five (45) days, and will notify you if additional time is required.

13. State-Specific Disclosures

Washington Residents (MHMDA). Our Services are currently not offered to residents of Washington State. Washington State residents have specific rights with respect to Consumer Health Data, including the rights described in Section 9. If we later provide services to residents of Washington State, they may lodge a complaint with the Washington Attorney General at atg.wa.gov. MHMDA also provides a private right of action under the Washington Consumer Protection Act.

Nevada Residents (SB 370). Nevada State residents may have rights to confirm collection, request deletion, and withdraw consent. Nevada State residents may lodge a complaint with the Nevada Attorney General at ag.nv.gov.

Other States. If you reside in another state with a law regulating consumer health data, we will comply with the rights and obligations that law imposes to the extent applicable and advised.

14. Changes to This CHD Policy

We may update this CHD Policy from time to time. Changes become effective as of the effective date shown in the revised CHD Policy unless applicable law requires otherwise. Where required by law or where we make material changes, we will notify you through the Services, website, email, or another appropriate channel.

15. Contact Us

If you have questions or concerns about this CHD Policy or our processing of Consumer Health Data, please contact us at privacy@trydermasync.com.

State-level privacy rights are described on our U.S. State Privacy Rights page.