PRIVACY NOTICE

Sana Skin, Inc. helps make the Goeckerman therapy for eczema and psoriasis accessible to you at home. We use the information you share with us to help provide you with a customized experience throughout your treatment journey.

Sana Skin, Inc., together with its fully owned and operated brands (“Sana Skin”, “Solay”, “Solay Health,” “we,” “us,” or “our”) take your privacy and trust in us seriously. We are committed to protecting the privacy and security of the information that you share with us.

The purpose of this Privacy Notice is to explain how we may collect, use, store, disclose, or otherwise process your personal information when you interact with us through our website located at https://solayhealth.com, our products and services, and/or other communication channels under our control such as email, telephone, or social media that link to this Privacy Notice (collectively, “Services” or “Website”).

The Services are controlled and operated by us from the United States and are not intended to subject us to the laws or jurisdiction of any country other than the United States. All capitalized terms not otherwise defined in this Privacy Notice have the same meaning as set forth in the Sana Skin Terms of Service.

Clinical services offered under the Solay Health brand are provided by CA Solay Healthcare Group, PC, a professional corporation, and its licensed clinicians (the “Provider Entity”). Certain health information we collect may be protected under applicable state medical privacy laws, such as the California Confidentiality of Medical Information Act (“CMIA”). This Privacy Notice describes how we collect, use, and disclose information through the Services, including health information, subject to those laws.

If you have questions or concerns about this Privacy Notice, please contact us at privacy@solayhealth.com or by mail at 9207 N Ashland Ave, Niles, IL 60714.

1. Collection of Information

Sana Skin collects and stores a variety of information when you use our Services so that we can provide the Services to you. If we do not have this information, you may not be able to access or use part or all of our Services. The specific types of information we collect will depend on the Services you use, but may include the following:

2. Personal Information

Personal information means information associated with or used to identify or contact a specific person. Personal information we collect may include:

• Identifiers such as your first and last name, date of birth, sex or gender, physical address, email address, phone number, identification numbers, etc.
• Audio, visual, and other electronic information such as photographs and videos for purposes other than diagnosis or treatment, such as before-and-after photographs, which we use for marketing only with your separate signed authorization, which you may revoke
• Commercial information such as your order history, products purchased or considered, payment information, and shipping history
• Internet and network activity information such as IP address, approximate location (such as country) derived from your IP address, device information, log data, and cookies and similar technologies
• Inferences drawn from the personal information described above (but not from your health information) such as your preferences, characteristics, and behavior, etc.

Health Information

Health information is a type of personal information that includes any identifying information we collect relating to your medical history, including symptoms, diagnoses, treatment and outcomes. Health information we collect may include:

• Audio, visual, and other electronic information such as photographs and videos for purposes of diagnosis or treatment
• Medical history such as medical conditions, medications, allergies, treatment options, prescriptions, and any other health-related information for purposes of diagnosis or treatment.
• Commercial information such as your order and shipping history, which we treat as health information because the products you order may reveal a health condition

Sources of Information

We collect information about you from the following categories of sources:

You (Actively)

You may actively provide us information when you use our Services such as through our websites, emails, social media, surveys, sweepstakes and promotions, customer support, or any other online or offline interactions.

You (Passively)

You may also passively provide us information through your interactions and use of our Services such as your IP address, access times, hardware and software information, device information, device event information (e.g., crashes, unsuccessful logins, browser type), the web page you’ve viewed or engaged with before or after using the Services, and other relevant information. We may use cookies and other tracking technology to collect this information. For more information on the cookies and other tracking technology we use, please see the Cookie section below.

Third Parties

We may receive information from third parties such as affiliates, business partners, and service providers to operate our business and improve your experience and interactions with us.

3. Use of Information

Sana Skin and our service providers may use information about you to:

• Provide teledermatology and related services;
• Verify your identity as the holder of an account with us;
• Administer your account, process payments, troubleshoot issues, and provide you with customer support;
• Communicate with you about the Services, and to deliver any administrative notices or alerts and communications relevant to your use of the Services;
• Allow you to participate in sweepstakes, contests, or other promotions;
• Market our services to you, subject to the choices described in Section 10;
• Tailor the features, performance and support of the Services to you and your preferences;
• Provide, operate, analyze usage of, and improve the Services, including performing product research and development;
• Investigate, detect, deter, prevent, report, defend against, or take other action regarding security incidents, abusive behavior, suspected fraud, malicious or illegal activities, or violations of our Terms of Service or other policies;
• Make sure our terms, policies, and agreements with you and any third parties are enforced;
• Comply with applicable laws and regulations.

4. Sharing of Information

We understand the importance of protecting the confidentiality of your information and limit our disclosure of your personal and/or health information to the following possible scenarios:

• To licensed medical providers (including those who provide healthcare services, drugs, or medical devices) so that they may provide you with the teledermatology and related products and services you request;
• To our affiliated entities, which may use it only for the purposes described in this Privacy Notice;
• With your consent or at your direction;
• To the parent or legal guardian of a minor patient, as described in Section 6 and subject to applicable law;
• To third-party service providers acting on our behalf under contracts that restrict their use of your information to providing services to us;
• In order to protect the safety and security of Sana Skin, the Services, our operations, our systems, our properties, our customers, or any other related person or entity;
• In order to investigate, detect, deter, prevent, report, defend against, or take other action regarding security incidents, abusive behavior, suspected fraud, malicious or illegal activities, or violations of our Terms of Service or other policies;
• In order to establish, exercise, or defend our legal rights where it is necessary for our legitimate interests or the legitimate interests of others;
• In order to comply with applicable laws or legal processes such as a court order or subpoena;
• In connection with any reorganization, restructuring, merger, sale, acquisition, financing, dissolution, or other transfer of assets under the condition that the recipient agrees to respect your information in a manner that is consistent with this Privacy Notice.

Text messages. We do not share your mobile phone number, text-message opt-in data, or consent with third parties or affiliates for their marketing or promotional purposes. The disclosures described in this Section exclude text-message opt-in data and consent, except to service providers that help us deliver text messages to you.

5. Cookies and Other Tracking Technology

We use cookies and other tracking technologies to collect information about your use of our Services. Cookies are small files, typically composed of letters and numbers, that your computer or mobile device saves when you visit certain websites. When you return to a website that saved a cookie on your device, the website recognizes that cookie and your browsing device.

We use first-party cookies and similar technologies to make our Services function properly; to provide a secure browsing experience during your use of our Services; and to remember your preferences for your convenience.

We use the following types of cookies on our Services:

• Strictly Necessary Cookies, which are needed for the Website or Services to operate as reasonably expected by you.
• Functional or Preference Cookies, which remember your name or choices.
• We do not use advertising or targeting cookies. We do not use cookies, pixels, or similar technologies to build advertising profiles, to retarget you with advertising on other websites or platforms, or to engage in cross-context behavioral advertising. We do not permit third-party advertising networks to collect information about you through our Services.

To manage cookies, you can take the following steps:

• First-Party Cookies: You can enable, disable, or delete cookies through the browser you are using to access our Services. To do this, follow the instructions provided by your browser (usually located within the “Help”, “Tools” or “Edit” settings). Please note, if you set your browser to disable cookies, you may not be able to access secure areas of our Services, and/or parts of the Services may not work properly for you. You can find more information about how to change your browser cookie settings at https://www.allaboutcookies.org.

Analytics. We use Vercel Web Analytics, provided by Vercel Inc. (“Vercel”), to understand how visitors find and use our Website so that we can improve it. Vercel Web Analytics does not store analytics cookies or similar identifiers on your device and does not track you across other websites. We do not enable advertising, retargeting or audience-building features, and we do not use analytics to identify you individually or to advertise to you elsewhere. As with any request to a website, the service receives technical information including your IP address, the pages you view, your referring page, and your browser and device type; we use this information only in aggregate to measure Website traffic, and we do not use it, or combine it with other information, to identify you. For more information on Vercel’s privacy practices, please visit vercel.com/legal/privacy-notice. Because this service places nothing on your device, there is no analytics cookie for you to remove through your browser’s cookie controls; if you prefer that no analytics data is collected, you can block analytics scripts using your browser’s built-in tracking protection or a content-blocking extension. If we change analytics providers, we will update this Notice and will continue to apply the limits described in this paragraph.

6. Minors

Our providers treat patients under the age of 18. Where the patient is a minor, the account must be created and controlled by the patient’s parent or legal guardian, who enters into the applicable patient agreements on the minor’s behalf, provides consent to treatment, and is responsible for the account and its credentials. Minors may not create an account or enter into patient agreements on their own behalf. Our Website is not directed to children under 13, and we do not knowingly collect personal information directly from children under 13.

Because a minor patient’s account is held by a parent or legal guardian, the personal information and health information we collect about a minor patient is provided to us by, and accessible to, that parent or legal guardian. Sana Skin does not knowingly collect information directly from a minor without the authorization of their parent or legal guardian. A parent or legal guardian’s access to a minor patient’s information is subject to any limits imposed by applicable law. When a minor patient turns 18 while in our care, we will ask the patient whether they would like to continue using the existing account or transition to their own adult account. After the patient turns 18, a parent’s or guardian’s access to the patient’s information continues only with the patient’s authorization or as otherwise permitted by applicable law.

Please contact us if you believe we have collected user information about a child without consent from their parent or guardian so we can take corrective action. Please send such requests to privacy@solayhealth.com.

7. Security of Information

Sana Skin understands the importance of securing your information. We are continuously implementing and updating our administrative, technical, and physical security measures to protect your information.

Please be aware that using the Internet comes with inherent risks. No method of data transmission or method of physical or electronic storage can be guaranteed to be perfectly secure. There is some risk that an unauthorized third party may find a way to circumvent our security or that a transmission of your information over the Internet will be intercepted. Sana Skin takes the measures stated above to provide a level of security appropriate to the risks of processing your information. While no system can guarantee absolute security, we maintain safeguards designed to protect your information that are appropriate to its sensitivity.

Aside from our efforts in securing your information, it is your responsibility to protect the security of your account credentials and keep your password confidential. If you notice suspicious activity or believe that your account may have been compromised in some way, please contact us immediately at privacy@solayhealth.com.

8. Data Breach Notification

In the event of a data breach involving your personal information or health information that triggers notification obligations under applicable law, Sana Skin will notify affected individuals in accordance with the timeframes and methods required by applicable federal and state law. Notification may be provided by email, postal mail, or other means as required. Where required by law, we will also notify applicable regulatory authorities. If you have questions about our data breach notification procedures, please contact us at privacy@solayhealth.com.

9. Retention of Information

We may retain your information as required or permitted by applicable laws and regulations. For example, if you are a resident of certain jurisdictions you may be able to request to have your personal information deleted. If your request is granted, we may still be required by medical laws to retain your health information for a period of time. The Provider Entity retains medical records for at least seven (7) years, or longer where required by applicable law, including for records of minor patients, after which they may be destroyed.

For non-medical personal information, we retain your data only as long as reasonably necessary to fulfill the purposes for which it was collected, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. When personal information is no longer needed for these purposes, we will securely delete or anonymize it.

10. Your Choices

In order to provide our Services to you, we may send you communications related to your transactions, security, or the administration of this website. Transactional emails are emails we send you relating to your account or in connection with providing you the Services such as emails changing your account credentials, emails in response to your support request, and emails from your medical provider.

From time to time, Sana Skin may also send you marketing emails to provide you with free newsletters, surveys, offers, and other promotional materials. If you wish to stop receiving marketing emails from us, you can opt out by clicking the unsubscribe link at the bottom of any marketing email or contact us at privacy@solayhealth.com. Please be aware that you cannot opt out of transactional emails. You may opt in to receive text messages. You can opt out of text messages at any time by replying “STOP” to any text message from us.

Your patient account (your “User Account”) is hosted on the SimplePractice platform, a third-party practice-management service that acts as our service provider and is contractually required to protect the confidentiality and security of your information. You may access your User Account by going to solay.clientsecure.me and following the prompts to log in. You can edit your account information as necessary, such as your email address, name, phone number, and more. When you update your account information, we may keep a copy of your previous account details for our records and to prevent fraud or other activities that violate our terms, policies and agreements. However, if you do not provide us with some of your personal information, such as your name or email, we will no longer be able to provide you with access to our Services.

If you are a California resident, please see Section 11 regarding your rights.

11. California Privacy Right; California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA)

If you are a California resident you have the following rights subject to certain exceptions:

• The right to know what personal information we collected, the categories of sources, the business or commercial purpose for collecting it, the categories of third parties to whom we disclose it, and the specific pieces of personal information we hold about you. You may request this information beyond the prior 12-month period unless doing so would be impossible or involve disproportionate effort;
• The right to request deletion of personal information;
• The right to correct inaccurate personal information that we maintain about you;
• The right to opt out of the sale or sharing of personal information, where a business engages in such activity;
• The right to limit the use and disclosure of sensitive personal information to those uses necessary to perform the services reasonably expected by an average consumer (this right applies only where a business uses sensitive personal information to infer characteristics about you, which we do not do); and
• The right to non-discrimination for the exercise of privacy rights.

Sensitive Personal Information. Certain information we collect, including health information, government-issued identification numbers, and account log-in credentials, may be considered sensitive personal information under the CPRA. We use and disclose sensitive personal information only to provide the Services you request, to operate our business, and for the other purposes described in this Privacy Notice, and we do not use or disclose it for the purpose of inferring characteristics about you. We do not sell or share sensitive personal information.

You may submit a request to access, correct, or delete your personal information by emailing privacy@solayhealth.com. Before we approve your request(s), we will ask you to verify certain Personal Information that we have on file. Please note that requests pursuant to the CCPA are limited to non-medical personal information as the CCPA does not apply to health information governed by the CMIA.

We do not sell or share your personal information. We do not sell your personal information for monetary or other valuable consideration, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We do not use advertising or targeting cookies, and we do not disclose identifiers such as your IP address or device ID to advertising networks. We do not sell or share the personal information of consumers we know to be under 16 years of age. Because we do not sell or share personal information, we do not offer a “Do Not Sell or Share My Personal Information” link; if this practice ever changes, we will update this Privacy Notice and provide the opt-out mechanisms required by law before doing so.

We will not discriminate against you for exercising your rights under the CCPA. If we offer a sweepstakes, discount, or other benefit in exchange for personal information, we will describe its material terms, how to opt in, and how to withdraw at the time of the offer.

You may designate an authorized agent to make a request on your behalf. In order to designate an authorized agent, your authorized agent must provide privacy@solayhealth.com with either (a) a valid power of attorney pursuant to California Probate Code sections 4121 to 4130, or (b) written permission signed by you authorizing the agent to act on your behalf. If the agent provides signed permission, we may also ask you to verify your identity directly with us or to confirm that you gave the agent permission.

If we deny your request in whole or in part, we will explain the basis for the denial. You may appeal our decision by emailing privacy@solayhealth.com with the subject line “Privacy Request Appeal.” We will respond to your appeal in accordance with applicable law.

The table below summarizes the categories of personal information, as identified by the CCPA, that Sana Skin has collected in the last twelve months, and the third parties with whom we may share your information for a business purpose as described in Section 4, above. The sources from which we collect personal information can be found in Section 2 above entitled “Sources of Information.” For purposes of this Section 11 only, “personal information” has the meaning given in the CCPA, but excludes information exempted from the scope of the CCPA, such as health information that is exempt from the CCPA, as noted above.

Categories of Personal Information Collected	Categories of Recipients
A. Identifiers	Affiliated Entities; Medical Providers; Service Providers (Customer Support/Feedback, Payment Processing, Operating Systems, Website Optimization, Data Analytics)
B. Certain Personal Information (§ 1798.80(e))	Affiliated Entities; Medical Providers; Service Providers (Customer Support/Feedback, Payment Processing, Operating Systems, Website Optimization, Data Analytics)
C. Certain Characteristics of Protected Classifications	Affiliated Entities; Medical Providers; Service Providers (Customer Support/Feedback, Website Optimization, Data Analytics)
D. Commercial Information	Affiliated Entities; Medical Providers; Service Providers (Payment Processing, Operating Systems, Website Optimization, Data Analytics)
E. Internet or Network Activity Information	Service Providers (Customer Support/Feedback, Operating Systems, Website Optimization, Data Analytics)
F. Certain Audio/Electronic/Visual/Similar Information	Affiliated Entities; Medical Providers; Service Providers (Operating Systems, Website Optimization, Data Analytics)
H. Inferences	Service Providers (Website Optimization, Data Analytics)

“Shine the Light” Law (California Civil Code § 1798.83)

California law permits California residents to request certain details about how their information is disclosed with third parties for third-party direct marketing purposes. We do not share your information with third parties for their direct marketing purposes.

Do Not Track and Opt-Out Preference Signals

Certain web and mobile browsers allow you to send a signal to inform websites that you do not want your online activities tracked. Because we do not track you across other websites, do not use advertising or targeting cookies, and do not sell or share your personal information, there is no cross-context behavioral advertising for such a signal to opt you out of. Our Services do not change how they operate in response to browser Do Not Track signals, because we do not engage in the cross-site tracking those signals are meant to prevent. Where we are required to treat an opt-out preference signal, such as Global Privacy Control (GPC), as a valid request to opt out of the sale or sharing of personal information, we will honor it.

12. Privacy Rights for Residents of Other U.S. States

Several other U.S. states have enacted comprehensive privacy laws that grant their residents certain rights regarding personal information. Sana Skin is committed to honoring applicable rights. Depending on your state of residence and applicable law, you may have the following rights:

• The right to access or know what personal information we collect about you;
• The right to request deletion of your personal information;
• The right to correct inaccurate personal information that we maintain about you;
• The right to opt out of the sale of your personal information or targeted advertising. Sana Skin does not currently sell personal information or engage in targeted advertising;
• The right to data portability, including receiving your personal information in a portable format;
• Where your state’s law provides it, the right to obtain a list of the specific third parties to which we have disclosed your personal information; and
• The right to non-discrimination for exercising your privacy rights.

These rights may be subject to certain exceptions and limitations under applicable state law, and the specific rights available to you depend on your state of residence.

To exercise these rights, you may contact Sana Skin at privacy@solayhealth.com. We may need to verify your identity before processing your request.

If we deny your request in whole or in part, we will explain the basis for the denial and inform you of your right to appeal. You may appeal our decision by emailing privacy@solayhealth.com with the subject line “Privacy Request Appeal.” We will respond to your appeal within the timeframe required by your state’s applicable law.

If we deny your appeal, you may contact the Attorney General of your state to submit a complaint.

13. International Transfers

Your information may be transferred to, and maintained on, computers located outside of your state, province, country, or other governmental jurisdiction, including the United States, where the data protection laws may differ from those of your jurisdiction. Sana Skin takes steps to protect your information during such transfers and processes it in accordance with this Privacy Notice and applicable law.

14. Updates

We may update this Privacy Notice from time to time and make changes to our information practices as permitted by law. You can reference the date at the top of this Privacy Notice to determine when this Privacy Notice was last updated. Any changes will become effective when we post the revised Privacy Notice on the Services. If you are registered for the Services, we will notify you of any material changes to this Privacy Notice by email or by a prominent notice on our Website prior to the changes becoming effective. If we make a material change to how we use or disclose health information we have already collected, we will obtain your consent where required by law. Except where your consent is required, your use of the Services following such notification means that you acknowledge and accept the revised Privacy Notice.

15. Accessibility

If you need this Privacy Notice in an alternative format because of a disability, please contact us at privacy@solayhealth.com.