Notice of Privacy Practices

SECTION 1: WHO IS COVERED BY THIS NOTICE

This Notice applies to BetterSkin Group, LLC ("BetterSkin") and its affiliated healthcare providers and physician practices (collectively, the "Practice"). It describes how we may use and disclose your protected health information ("PHI") and explains your rights with respect to that information.

PHI is information that identifies you and relates to your past, present, or future physical or mental health condition; the provision of healthcare to you; or the past, present, or future payment for healthcare provided to you. This includes not only your clinical records and treatment information, but also the fact that you sought a dermatology consultation through BetterSkin, the fact that a prescription was issued or filled on your behalf, and other information that identifies you in connection with healthcare services.

SECTION 2: OUR USES AND DISCLOSURES OF YOUR HEALTH INFORMATION

2.1 Uses and Disclosures for Treatment, Payment, and Healthcare Operations

• Treatment: We may use and disclose your PHI to provide, coordinate, or manage your healthcare. For example, we share your information with the licensed dermatology provider conducting your telehealth visit, and with our partner pharmacy to fulfill a prescription.
• Payment: We may use and disclose your PHI to obtain payment for your care, including sharing information with our payment processors for billing purposes.
• Healthcare operations: We may use and disclose your PHI for internal healthcare operations, including quality assessment, provider credentialing, training, legal and compliance functions, and business management activities that support healthcare delivery.

2.2 Prescription Fulfillment and Telehealth Platform

If your provider issues a prescription, we share the relevant PHI with our partner pharmacy to fill and ship your prescription. Our partner pharmacy operates as a Business Associate under a signed Business Associate Agreement.

We use Healee, operated by Eight Investments Inc. (our Business Associate), as our telehealth technology platform. Healee processes PHI solely to provide telehealth platform services under a signed Business Associate Agreement effective June 15, 2026. Healee does not use your PHI for advertising or marketing purposes and is prohibited from doing so under our Business Associate Agreement.

2.3 Tracking Technology and Your PHI

BetterSkin does not place third-party advertising pixels, analytics tags, or tracking scripts on any authenticated page, clinical page, telehealth flow, or patient intake questionnaire. These technologies are restricted to our public marketing site and over-the-counter shop, and only with your separate affirmative consent. No PHI — including the fact that you sought a telehealth consultation, your intake responses, your provider match, your prescription status, or your appointment information — is transmitted to advertising or analytics platforms.

We do not use PHI to build advertising audiences, retargeting lists, or lookalike audiences. We do not upload patient lists derived from health signals to any advertising platform. We do not link analytics accounts to advertising platforms in a way that would allow PHI to flow between systems.

2.4 Patient Imagery

BetterSkin does not use patient photos, videos, or before-and-after imagery in any marketing, advertising, or promotional material without a signed HIPAA Authorization from the patient specifically naming that use. Informal permission does not constitute a valid HIPAA authorization. Signed authorizations are retained on file for each specific marketing use.

2.5 Marketing Communications

Under HIPAA, "marketing" means a communication about a product or service that encourages recipients to purchase or use the product or service. We are required to obtain your written authorization before using your PHI for marketing, with limited exceptions.

The following communications are not considered marketing under HIPAA and do not require your authorization:

• Appointment reminders and follow-up communications about your treatment;
• Communications describing health-related products or services related to your current treatment, where we receive no remuneration or where the remuneration is reasonably related to the cost of the communication (such as refill reminders for a currently prescribed medication); and
• General health education communications that are not product-specific.

We do not segment marketing communications by your skin condition, prescribed product, or consultation history. Marketing emails and SMS messages are sent based on non-health signals and require your separate affirmative consent.

2.6 Required and Permitted Disclosures

We are required or permitted by law to disclose your PHI in certain circumstances, including:

• To you: upon your request, regarding your own PHI;
• Public health: to authorized public health authorities for disease reporting, vital statistics, and similar purposes;
• Health oversight: to government agencies for audits, inspections, and licensure;
• Judicial and administrative proceedings: in response to a valid court order or subpoena;
• Law enforcement: to law enforcement officials as required or permitted by law;
• Serious threat to health or safety: to prevent or lessen a serious and imminent threat; and
• HHS: to the U.S. Department of Health and Human Services for compliance and enforcement purposes.

2.7 Business Associates

We share PHI with Business Associates — vendors that perform services on our behalf — under signed Business Associate Agreements that require them to protect the privacy and security of your PHI. Our Business Associates include Healee (Eight Investments Inc.) as our telehealth platform, our partner pharmacy for prescription fulfillment, and other service providers as described in our Privacy Policy. No Business Associate may use your PHI for marketing or advertising purposes without your specific authorization.

SECTION 3: YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION

3.1 Right to Access Your PHI

You have the right to inspect and obtain a copy of PHI we maintain about you in a designated record set. We will provide access within 30 days of your request. We may charge a reasonable cost-based fee for copies.

3.2 Right to Request Amendment

If you believe PHI we hold about you is incorrect or incomplete, you may request amendment in writing. We may deny your request if the information was not created by us, is not information you would be permitted to inspect, or is accurate and complete.

3.3 Right to an Accounting of Disclosures

You have the right to request a list of disclosures of your PHI made during the six years prior to your request, other than disclosures for treatment, payment, and healthcare operations, disclosures made to you, and certain other categories permitted by law.

3.4 Right to Request Restrictions

You have the right to request restrictions on how we use or disclose your PHI. We are required to agree to your request to restrict disclosure to a health plan for services you paid for out of pocket in full, where the disclosure is not required by law.

3.5 Right to Request Confidential Communications

You have the right to request that we communicate with you by alternative means or at an alternative location. We will accommodate reasonable requests. Contact [email protected].

3.6 Right to a Copy of This Notice

You have the right to receive a paper or electronic copy of this Notice at any time by contacting [email protected].

3.7 Right to Notice of a Breach

We will notify you without unreasonable delay, and in no case later than 60 days after discovery, if your unsecured PHI has been subject to a breach.

SECTION 4: OUR OBLIGATIONS

We are required by law to: maintain the privacy and security of your PHI; provide you with this Notice; notify you following a breach of your unsecured PHI; and abide by the terms of this Notice currently in effect.

We reserve the right to change our privacy practices and to make the new practices effective for all PHI we maintain, including PHI created or received before the change. If we make a material change, we will update this Notice and post it at www.betterskin.com. The effective date of any revision appears at the top of this Notice.

SECTION 5: HOW TO CONTACT US / HOW TO FILE A COMPLAINT

Questions about this Notice or your privacy rights:

Privacy Officer, BetterSkin Group, LLC

120 N Marina St Suite C, Prescott, AZ 86301

[email protected]

To file a complaint with the federal government:

U.S. Department of Health and Human Services, Office for Civil Rights

200 Independence Avenue, S.W., Washington, D.C. 20201

1-877-696-6775 | www.hhs.gov/ocr/privacy/hipaa/complaints

You will not be penalized or retaliated against for filing a complaint.

BetterSkin Group, LLC | 120 N Marina St Suite C, Prescott, AZ 86301

[email protected] | www.betterskin.com