U.S. State Privacy Rights

B.1 Generally Applicable State Privacy Rights

Depending on your state of residence and applicable law, you may have the right, subject to verification and applicable exceptions, to request access to and confirmation of processing; request correction; request deletion; request portability; opt out of sale or sharing; opt out of targeted advertising; opt out of certain profiling; limit use and disclosure of sensitive personal information; withdraw consent; and appeal denial of a privacy rights request. You may exercise your privacy rights at any time directly in the mobile application by visiting your personal Dermasync account profile. If the action desired cannot be found in your personal Dermasync account profile, you may contact privacy@trydermasync.com with your request. Identity verification may be required.

B.2 California (CCPA / CPRA)

If you reside in California, you may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the “CCPA”). The categories of personal information collected, sources of information, business purposes for collection, and categories of recipients are described in Sections 5, 8, 13, 14, and 15 of this Privacy Policy. We do not sell your identifiable Personal Information for monetary or other valuable consideration, and we do not sell or share your identifiable Health Data or Consumer Health Data, as those terms are defined under the CCPA. We may share ordinary website Usage Data collected through cookies on our public websites (which excludes Health Data and Consumer Health Data) with advertising and analytics partners for cross-context behavioral advertising, marketing measurement, and campaign attribution, which may constitute “sharing” under the CCPA. You can opt out of this sharing at any time as described in Section 13 of our Privacy Policy and our Cookie Policy, including through Manage Cookie Preferences, the “Your Privacy Choices” link, or a Global Privacy Control (GPC) signal. We do not knowingly sell or share the personal information of consumers under the age of 16 years old.

Sensitive Personal Information; Right to Limit. The Health Data described in Section 5.C — including skin tone, which may function as a proxy for race or ethnicity — may constitute sensitive personal information. Dermasync uses sensitive personal information only for purposes permitted under CCPA Regulations §7027(m), including performing the services requested by the Member, ensuring security and integrity of the Services, resisting malicious or fraudulent actions, and verifying quality of the Services. Because Dermasync uses sensitive personal information only for purposes permitted by the CCPA regulations, Dermasync does not provide a separate ‘Limit the Use of My Sensitive Personal Information’ link at this time. If our practices change in a way that requires such a mechanism, we will provide it as required by law.

Notice at Collection. A separate California Notice at Collection is provided to California residents at or before the point of collection. We intend the specific consent and notice approach, including affirmative consumer-health consent where required, to be presented uniformly where feasible.

B.3 Colorado, Connecticut, Utah, and Virginia

If you reside in Colorado, Connecticut, Utah, or Virginia, you may have rights under the Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, and Virginia Consumer Data Protection Act, respectively. Available rights may include those described in Section B.1 above, subject to state-specific exceptions and thresholds. Colorado and Connecticut residents may also submit opt-out preference signals, which we honor where technically feasible as described in Section 18, and may opt out of profiling as described in Section 9.

B.4 Washington My Health My Data Act

Dermasync Services are currently not offered or available to residents of Washington State. Should Services become available in the future to the residents of Washington State, Washington State residents should review our standalone Consumer Health Data Privacy Policy, which is the operative disclosure for MHMDA purposes. As set forth in Section 11, we do not sell Consumer Health Data, do not disclose Consumer Health Data to advertisers, do not use Consumer Health Data to market third-party products or services, and do not use Consumer Health Data for targeted advertising.

B.5 Nevada Consumer Health Data Privacy Law (SB 370)

Nevada residents may have additional rights with respect to Consumer Health Data under Nevada SB 370. Consistent with Section 11, we do not sell Consumer Health Data of Nevada residents. Nevada residents may exercise applicable rights through the privacy settings in the Member’s personal Dermasync account profile. Other requests can be sent to privacy@trydermasync.com. Nevada residents are directed to review our standalone Consumer Health Data Privacy Policy.

B.6 Other State Privacy Laws

If you reside in another state with a comprehensive privacy law or law regulating consumer health data, we will endeavor to comply with applicable requirements and honor applicable Member rights consistent with such laws to the extent that we are aware of such laws.

B.7 Contact for Privacy Rights Requests

You may exercise state privacy rights through privacy controls accessible to you through your personal Dermasync account profile. For other privacy requests, contact privacy@trydermasync.com. We may require identity verification before fulfilling any request.