Privacy Policy

Personal Information We Collect

We may collect the following categories of personal information:

• Contact and account information, such as your name, email, mailing address, phone number, and account credentials.
• Demographic information, such as age, including birthdates, and gender.
• Health screening information that you provide in response to surveys within the Services, including information about your health, health history, allergies, medications you take, symptoms you are experiencing, images, and pregnancy status.
• Payment information needed to complete any purchases you make on the Site or within the Services, including payment card information, billing information, and your transaction history. Payment card information is processed by our payment service provider in accordance with its privacy policies and terms.
• Communications that we exchange with you, including when you contact us with questions, feedback, or otherwise.
• Marketing information, such as your preferences for receiving communications about our Services and publications, and details about how you engage with our communications.
• Sensitive personal information, including social security numbers, driver's license numbers, or passport numbers; racial or ethnic origin; genetic data; biometric data processed for the purpose of uniquely identifying you; information about your health; medical or health insurance information, including insurance policy number; information concerning your sex life or sexual orientation; and citizenship, citizenship status, or immigration status.

Personal Information from Other Sources

• Social media information. We may maintain pages on social media platforms, such as Instagram and X. When you visit or interact with our pages on those platforms, you or the platforms may provide us with information through the platform.
• Medical providers, pharmacies, and lab testing providers. We may receive information from affiliated medical groups and pharmacies in connection with the Services, including your treatment plans and information about your prescriptions. If you request lab tests in connection with the Services, we may receive information about your test results from our lab testing partners to facilitate your use of the Services.
• Publicly available sources, such as public profiles and websites.

Automatically-Collected Data

• Device data, such as your computer's or mobile device's operating system, manufacturer and model, browser type, IP address, unique identifiers, language settings, mobile device carrier, and general location information such as city, state, or geographic area.
• Usage data, such as pages or screens you viewed, how long you spent on a page, browsing history, and access times.

We may combine information that we receive from the various sources described in this Privacy Policy, including third party sources, and use or disclose the combined information for the purposes identified in this Privacy Policy.

How We Use Personal Information

We use personal information for the following purposes:

Service delivery. We use personal information to provide, operate, and administer the Services. This includes:

• Creating and maintaining your account on the Services.
• Analyzing health screening information to help you decide on treatment options.
• Facilitating access to treatments and lab testing.
• Processing your payments and completing transactions with you.
• Communicating with you about the Services, including by sending announcements, updates, security alerts, and support and administrative messages.
• Understanding your needs and interests to personalize your experience with the Services.
• Providing support for the Services and responding to your requests, questions, and feedback.

Research and development. We may use and analyze personal information for research and product development purposes, including to develop aggregated or de-identified statistics, to analyze and improve the Services, to identify usage trends, and to operate and expand our business activities.

For our internal business purposes. We may use personal information for internal business purposes, such as operating our digital properties and customizing the content; maintaining internal business records, such as accounting, document management and similar activities; enforcing our policies and rules; management reporting; auditing; and IT security and administration.

Marketing and advertising. Where permitted by applicable laws, we may use personal information for marketing and advertising purposes, including direct marketing and interest-based advertising. We may send newsletters and email marketing in accordance with your preferences, tailor communications to your interests and use of the Services, and engage third-party advertising companies to display ads promoting our services across the web.

To comply with law. We may use personal information as we believe necessary or appropriate to comply with lawful requests and legal processes, such as to respond to subpoenas or requests from government authorities; investigate and respond to claims against us, our personnel, and our customers; establish, exercise, or defend legal claims; protect our, your, our customers', and other third parties' safety, property, or rights; detect, prevent, and respond to security incidents and health and safety issues; and protect against malicious, deceptive, fraudulent, or illegal activity.

Compliance, fraud prevention, and safety. We may use personal information to protect our or others' rights, privacy, safety, or property, enforce the terms and conditions that govern the Services, and protect, investigate, and deter against fraudulent, harmful, unauthorized, unethical, or illegal activity.

In connection with a corporate transaction. We may use personal information in connection with a corporate transaction, such as if we acquire, sell, or transfer all or a portion of our business or assets, including through a sale in connection with bankruptcy and other forms of corporate change.

Anonymized, de-identified, or aggregated information. We may use anonymized, de-identified, or aggregated information for any purpose permitted by law.

How We Use Health Information

As part of the Services, we may receive sensitive information about your health, including your responses to health screening questionnaires and information we receive from medical groups, pharmacies, and lab testing providers (collectively, "Health Information"). We use this information for the service delivery purposes described above and as required for legal and compliance purposes. We may also aggregate and anonymize Health Information for research and development purposes, provided such information cannot be linked to you.

Some of the Health Information we receive may constitute "protected health information" or "PHI" pursuant to the Health Insurance Portability and Accountability Act ("HIPAA"). For example, we may receive PHI from licensed pharmacies or medical groups as a "business associate" to such pharmacies or medical groups for the provision of the Services to you. Our receipt of PHI is governed by HIPAA and our agreements with the pharmacies and medical groups that provide such PHI to us. For more information about your rights under HIPAA, please contact the pharmacy or medical group directly.

How We Share Personal Information

We may share personal information with:

• Health care partners. Our affiliated medical groups may receive and analyze your Health Information to provide you with treatment options. We also share information with lab testing partners, pharmacies, and other healthcare professionals to facilitate the delivery of our Services.
• Affiliates and subsidiaries. We may share information with our parent entities, corporate affiliates, subsidiaries, business units, and other companies that share a common ownership.
• Vendors. We may share personal information with vendors necessary to complete transactions you request, such as shipping companies and logistics providers.
• Service providers. We share personal information with companies and individuals that provide services on our behalf or help us operate our Services or our business, including cloud hosting, analytics, customer relationship management, marketing, IT support, and other services.
• Advertising partners. We may share personal information that we collect on our Sites with third party advertising companies, where permitted by applicable laws.
• Professional advisors. We share personal information with professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.
• Authorities and others. We may share personal information with law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate. We may share personal information when required by law or for legal, safety, or security purposes.
• Business transferees. We may share personal information with acquirers and other relevant participants in business transactions involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale, or other disposition of all or any portion of the business or assets of, or equity interests in, Barefaced RX or our affiliates, including in connection with a bankruptcy or similar proceedings.
• The public. We may share certain information publicly, such as when you have an opportunity to make comments regarding us or our products. Any personal information in comments, reviews, or other content that you share in public areas of our Services or Sites may be read, collected, or used by other users or the public.

SMS Privacy Notice

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. SMS opt-in data and consent records will not be shared with third parties except as necessary to provide messaging services, comply with law, or support Barefaced RX's service operations.

Your Choices

Unsubscribe from direct marketing communications. You may opt out of marketing-related communications by following the opt out or unsubscribe instructions contained in the marketing communication we send you. You may continue to receive service-related and other non-marketing communications.

Update your account. You may contact us at any time to delete your account or update your account information.

Opt out of interest-based advertising. You may limit online tracking by blocking cookies in your browser, blocking advertising ID use in your mobile settings, using privacy plug-ins or browsers, using platform opt outs, or using advertising industry opt out tools.

• For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit www.allaboutcookies.org.
• You can opt out of Google Analytics by downloading and installing the browser plug-in available at https://tools.google.com/dlpage/gaoptout.
• Google offers advertising settings at www.adsettings.google.com and Facebook offers advertising controls at https://www.facebook.com/about/ads.
• You can also use industry opt out tools from the Digital Advertising Alliance at optout.aboutads.info, the Digital Advertising Alliance mobile app choices at https://youradchoices.com/appchoices, and the Network Advertising Initiative at optout.networkadvertising.org.

Note that because these opt out mechanisms are specific to the device or browser on which they are exercised, you will need to opt out on every browser and device that you use.

Do Not Track. Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to "Do Not Track" or similar signals. To find out more about "Do Not Track," please visit http://www.allaboutdnt.com.

Data Security

We employ a number of technical, organizational, and physical safeguards designed to protect the personal information we collect. However, no security measures are failsafe and we cannot guarantee the security of your personal information. The safety and security of your information also depends on you. Where you have chosen a password for the use of the Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Use of Artificial Intelligence and Data Processing

We may use artificial intelligence ("AI") technologies to process certain data and provide services on our website. This section explains how AI interacts with your data.

• Data usage. AI systems may analyze de-identified or aggregated data to improve service delivery, enhance user experience, and provide tailored recommendations. Any use of your data will comply with applicable privacy laws, including HIPAA and any applicable state laws.
• Transparency and oversight. AI-generated outputs are subject to periodic review to ensure accuracy and compliance with applicable laws, as required by applicable law.
• Data protection. We do not use your personal information beyond its intended and stated purpose. AI systems are designed to exclude direct identifiers, consistent with de-identification standards under HIPAA.
• Third-party tools. We may use third-party AI tools to support our Services. These tools are subject to strict contractual obligations to ensure compliance with privacy and security standards.

By using our website, you consent to the use of AI technologies as described in this Privacy Policy.

Children

Our Services are not intended for use by children without the consent of their parents or guardians. If we learn that we have collected personal information through our Services from a child under 13 without the consent of the child's parent or guardian as required by law, we will delete it.

Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy. We may also provide notification of changes in another way that we believe is reasonably likely to reach you, such as via email if you have an account where we have your contact information, or another manner.