U.S. State Privacy Rights

1. Generally Applicable State Privacy Rights

Depending on your state of residence and applicable law, you may have the right, subject to verification and applicable exceptions, to request access to and confirmation of processing; request correction; request deletion; request portability; opt out of sale or sharing; opt out of targeted advertising; opt out of certain profiling; limit use and disclosure of sensitive personal information; withdraw consent; and appeal denial of a privacy rights request. You may exercise your privacy rights at any time directly in the app by visiting your personal Dermasync account profile. If the action desired cannot be found in the profile, you may contact privacy@trydermasync.com with your request. Identity verification may be required.

2. California (CCPA / CPRA)

If you reside in California, you may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. The categories of personal information collected, sources of information, business purposes for collection, and categories of recipients are described in Sections 5, 8, 13, 14, and 15 of this Policy. We do not sell your identifiable Personal Information for monetary or other valuable consideration, and we do not sell or share your identifiable Health Data or Consumer Health Data, as those terms are defined under the CCPA. We may share ordinary Usage Data and Account Data (which excludes Health Data and Consumer Health Data) with advertising and analytics partners for cross-context behavioral advertising, marketing measurement, and campaign attribution, which may constitute “sharing” under the CCPA. You can opt out of this sharing at any time as described in Section 13 and our Cookie Policy, including through Manage Cookie Preferences, the “Your Privacy Choices” link, or a Global Privacy Control (GPC) signal. We do not knowingly sell or share the personal information of consumers under age sixteen (16).

Sensitive Personal Information; Right to Limit. The Health Data described in Section 5.C — including skin tone, which may function as a proxy for race or ethnicity — may constitute sensitive personal information, as may the precise device geolocation described in Section 5.B when you enable Precise Weather. Dermasync uses sensitive personal information only for purposes permitted under CCPA Regulations §7027(m), including performing the services requested by the Member, ensuring security and integrity of the Services, resisting malicious or fraudulent actions, and verifying quality of the Services. Because Dermasync uses sensitive personal information only for purposes permitted by the CCPA regulations, Dermasync does not provide a separate ‘Limit the Use of My Sensitive Personal Information’ link at this time. If our practices change in a way that requires such a mechanism, we will provide it as required by law.

Notice at Collection. A separate California Notice at Collection is provided to California residents at or before the point of collection. We intend the higher consent and notice approach, including affirmative consumer-health consent where required, to be presented uniformly where feasible.

3. Colorado, Connecticut, Utah, and Virginia

If you reside in Colorado, Connecticut, Utah, or Virginia, you may have rights under the Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, and Virginia Consumer Data Protection Act, respectively. Available rights may include those described in Section B.1 above, subject to state-specific exceptions and thresholds. Colorado and Connecticut residents may also submit opt-out preference signals, which we honor where technically feasible as described in Section 18.

4. Washington My Health My Data Act

Dermasync Services are currently not offered to residents of Washington State. Should Services become available in the future to the residents of Washington State, Washington State residents should review our standalone Consumer Health Data Privacy Policy, which is the operative disclosure for MHMDA purposes. As set forth in Section 11, we do not sell Consumer Health Data, do not disclose Consumer Health Data to advertisers, do not use Consumer Health Data to market third-party products or services, and do not use Consumer Health Data for targeted advertising.

5. Nevada Consumer Health Data Privacy Law (SB 370)

Nevada residents may have additional rights with respect to Consumer Health Data under Nevada SB 370. Consistent with Section 11, we do not sell Consumer Health Data of Nevada residents. Nevada residents may exercise applicable rights through the privacy settings in the Member’s profile. Other requests can be sent to privacy@trydermasync.com. Nevada residents should review our standalone Consumer Health Data Privacy Policy.

6. Other State Privacy Laws

If you reside in another state with a comprehensive privacy law or law regulating consumer health data, we will comply with applicable requirements and honor applicable Member rights consistent with such laws to the best of our capabilities.

7. Contact for Privacy Rights Requests

You may exercise state privacy rights through in-app privacy controls found in your personal Dermasync account profile. For other privacy requests, contact privacy@trydermasync.com. We may require identity verification before fulfilling any request