Consumer Health Data Privacy Policy

Last Updated: September 20, 2024

This Consumer Health Data Privacy Policy supplements the Rev Privacy Policy (the “Privacy Policy”) and applies to personal data defined as “consumer health data” (“CHD”) by the Washington state My Health My Data Act (“MHMDA”) and Nevada’s Consumer Health Data Privacy Law (“Nevada CHD Law”). Undefined capitalized terms shall have the meaning in the Privacy Policy.

Categories of CHD Collected

As described further in our Privacy Policy, and depending on how you interact with Rev and applicable law, we may collect the following categories of CHD, as broadly defined in the MHMDA and Nevada CHD Law:

• Individual health conditions, treatment, diseases, or diagnoses: E.g. in connection with you seeking healthcare services or medications from Rev.

• Social, psychological, behavioral, and medical interventions: E.g. through collection of your medical history as part of the treatment services you seek on or through Rev.

• Health-related surgeries or procedures: E.g. through collection of health-related surgeries or procedures within your medical history as part of the treatment services you seek on or through Rev.

• Use or purchase of prescribed medication: E.g. through your purchase of medication through Rev or through the medical history you provide to us.

• Bodily functions, vital signs, symptoms, or measurements of health information: E.g. as part of you seeking healthcare services or medications from Rev.

• Diagnoses or diagnostic testing, treatment, or medication: E.g. as part of the medical history collected by Rev, or when you otherwise seek healthcare services or medications from Rev.

• Gender-affirming care information: E.g. as part of the medical history collected by Rev, or when you otherwise seek healthcare services or medications from Rev.

• Reproductive or sexual health information: E.g. as part of the medical history collected by Rev, or when you otherwise seek healthcare services or medications from Rev.

• Genetic data: E.g. where such information is included in medical history collected by Rev.

• Data that identifies a consumer seeking health care services: E.g. as part of the medical history collected by Rev, or when you otherwise seek healthcare services or medications from Rev.

• Other information that may be used to infer, derive, or extrapolate data related to the above or other health information.

Sources of CHD

As described further in our Privacy Policy, we collect information, which may include CHD from the following sources: (1) directly from you; (2) automatically through your use of the Services; (3) social media and other content platforms; and (4) other third-party sources.

Purposes for Collection of CHD

We describe the purposes for collection and use of CHD in the “Purposes for How We Use Your Information” section of our Privacy Policy. As further described there and subject to applicable law, we may collect and use CHD as directed by you or with your consent, or (1) to provide and manage the Services; (2) to analyze and improve the Services; (3) for advertising and marketing; and (4) for legal purposes, such as to comply with laws or to establish, exercise, or defend our legal rights.

How and Why We Share CHD

We may share each of the categories of CHD described above for business purposes to the categories of entities described in the “How We Disclose Your Information” section of our Privacy Policy. As further described in our Privacy Policy and subject to applicable law, we may share the categories of CHD:

• to deliver products and services to you, including to complete any transactions initiated by you;

• to ensure a consistent level of service across our products and services;

• to enhance our products, services, and your customer experience;

• with your consent, such as disclosures for certain advertising or promotional efforts, including allowing third parties to collect CHD across our Websites;

• to protect Rev and others, including to enforce our Terms of Use, Privacy Policy, or other contracts with you, and for fraud prevention;

• to comply with our legal obligations; and

• in connection with any negotiation or completed acquisition, merger, or purchase involving our business assets.

As described in our Privacy Policy, we reserve the right to create Aggregate/De-Identified Data from the information we collect through the Services and our disclosure of such Aggregate/De-Identified Data is in our discretion.

As further described in our Privacy Policy, and subject to applicable law (e.g. subject to your consent in certain situations), we may share CHD with the following categories of third parties and affiliates:

• Health Care Providers and Services;

• Service Providers;

• Advertising Networks;

• Joint Product/Marketing Partners;

• For the Protection of Rev and Others (e.g. to governmental or regulatory agencies);

• For Legal Purposes (e.g. to governmental entities in response to legal process);

• As Necessary for Business Transfers;

• At Your Direction or With Your Consent (such as sharing with other users/public if you post in public forums or interact with other users); and

• With the following affiliates: listed here.

How To Exercise your MHMDA or Nevada CHD Law Rights

Subject to exceptions, the MHMDA and Nevada CHD Law extends certain rights to CHD. Depending on your jurisdiction, this may include requests (1) to confirm whether Rev is collecting, sharing or selling your CHD; (2) to access your CHD; (3) to delete your CHD; and (4) to withdraw your consent to the collection or sharing of your CHD. You can seek to exercise these rights through this webform. Depending on the nature of your request, we may contact you for further information if appropriate to authenticate your identity. Note, however, that Rev will never ask you for sensitive personal or financial information when authenticating your identity, and no Rev employee will ask you to tell them your password.

If we deny your request in whole or in part, you may appeal that decision by: webform. If you are a resident of Washington and your appeal is denied, you can contact the Washington State Attorney General at www.atg.wa.gov/file-complaint. If you are a resident of Nevada and your appeal is denied, you can contact the Nevada Attorney General at https://ag.nv.gov/Complaints/File_Complaint/.

Updates to this CHD Policy

We reserve the right to change this CHD Policy at any time to reflect changes in the law, our data collection and use practices, the features of our Services, or advances in technology. We will make the revised CHD Policy accessible through the Services, so you should review it periodically. The date this CHD Policy was last revised is identified at the top of the document. You are responsible for periodically monitoring and reviewing any updates to the CHD Policy. If we make a material change to the CHD Policy, we will provide you with appropriate notice in accordance with legal requirements. Your continued use of our Websites or Apps after such amendments (and notice, where applicable) will be deemed your acknowledgment of these changes to this CHD Policy.

If you have any questions about this CHD Policy or Rev's privacy practices, please contact us at:

Rev Health LLC, 12002 Corporate Dr., Dallas TX 75228

privacy@rev.coayments Sunshine Act requires that detailed information about payment and other payments of value worth over ten dollars ($10) from manufacturers of drugs, medical devices, and biologics to physicians and teaching hospital be made available to the public. You may search this federal database for payments made to physicians and teaching hospitals by visiting this website: https://openpaymentsdata.cms.gov/

Rev Health LLC, along with its subsidiaries ("Rev Health," "we," or "us"), owns and operates the website located www.revhealth.co (the "Website"). We may also currently own or operate, or may do so in the future, a Rev Health mobile application (collectively, the "Platform"). Your access to and use of the Platform—including any part thereof and its content ("Content")—as well as any products or services provided through the Platform or by Rev Health, and any affiliated website, software, or application owned or operated by Rev Health (collectively, including the Platform and the Content, the "Service"), are governed by this Privacy Policy unless otherwise specified. Capitalized terms not defined herein have the meanings assigned to them in the Rev Health Terms and Conditions ("Terms and Conditions").

We are committed to respecting your privacy. This Privacy Policy explains how Rev Health collects, uses, and discloses information to provide you with the Service.

By creating, registering, or logging into an account through the Service, or by otherwise accessing or using the Service, you acknowledge the most recent version of this Privacy Policy. We will update this Privacy Policy as necessary to reflect material changes in the Service or in our use of personal information, and as required by applicable law. Any changes will be posted with an updated "Last Updated" date at the top of the Privacy Policy. If we make material changes, we will provide notice or obtain consent as required by law.

If you are using the Service on behalf of someone else, you represent that you are authorized to act on that individual's behalf and that they acknowledge the practices and policies outlined in this Privacy Policy.

Limitations on Use by Minors

The Service is intended for individuals who are at least eighteen (18) years old, or older if required by applicable state laws in your jurisdiction. Individuals aged between thirteen (13) and eighteen (18) (or the age of majority in their jurisdiction) may use the Service solely for obtaining a medical consultation for acne treatment using topical skincare products (where available), provided a parent or legal guardian consents in accordance with our Terms and Conditions and the Service requirements. The Service is not designed or intended to attract or be used by children under thirteen (13) years of age. If we become aware that we have collected personal information from a person under thirteen (13) years of age, we will make reasonable efforts to refrain from using or maintaining such information.

If you are under sixteen (16) years of age, you (or your parent or legal guardian if under age 13) may request the removal of content or information about you posted on the Platform. Please submit a "Request for Removal of Minor Information" to either:

By Mail:

Rev Health LLC

12002 Corporate Dr.

Dallas, TX 75229

Please send via U.S. Certified Mail, Return Receipt Requested, to allow for confirmation of mailing, delivery, and tracking.

By Email:

support@revhealth.co

Subject Line: "Removal of Minor Information"

In your request, please include:

The nature of your request;

Identification of the content or information to be removed;

The location of the content or information on the Platform (e.g., by providing the URL);

A statement that the request is related to the "Removal of Minor Information";

Your name, street address, city, state, zip code, email address, and your preferred method of response (mail or email);

We will not accept requests via telephone or fax. Rev Health is not responsible for failing to comply with requests that are incomplete, incorrectly labeled, or incorrectly sent.

Please note that we are not required to erase or enable the erasure of content or information in certain circumstances, such as when required by law, when we maintain the content on behalf of your Providers as part of your electronic medical record, when the content is posted by a third party, when the information has been anonymized, when you have not followed the instructions for requesting removal, or when you have received compensation for providing the content.

The above description outlines Rev Health' voluntary practices concerning the collection of personal information from certain minors and is not an admission that Rev Health is subject to the Children's Online Privacy Protection Act or any similar laws.

Protected Information

When you create an account with Rev Health, you establish a direct customer relationship that allows you to access and utilize various functions of the Platform and Service as a user. In this relationship, you provide information such as your name, email address, shipping address, phone number, and certain transactional information, which we do not consider to be "protected health information" or "medical information."

However, when using certain components of the Service, you may provide health or medical information that may be protected under applicable laws. Rev Health is not a "covered entity" under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). One or more of the Labs, Pharmacies, or Medical Groups (as defined in our Terms and Conditions) may be a "covered entity" or "business associate" under HIPAA, and Rev Health may act as a "business associate" in some cases. It is important to note that HIPAA may not apply to your transactions or communications with Rev Health, the Medical Groups, Providers, Labs, or Pharmacies. To the extent that Rev Health is deemed a "business associate," we may be subject to certain HIPAA provisions concerning "protected health information" ("PHI") that you provide to us, the Medical Group, or the Providers. Any medical or health information subject to specific protections under applicable state laws (collectively with PHI, "Protected Information") will be used and disclosed only in accordance with such laws. Information not considered Protected Information under applicable laws may be used or disclosed as permitted by this Privacy Policy. Protected Information does not include information that has been de-identified in accordance with applicable laws. The Medical Groups and Providers have adopted a Notice of Privacy Practices describing how they use and disclose Protected Information. By accessing or using any part of the Service, you acknowledge receipt of this Notice from your Medical Group and Provider(s).

By accessing or using any part of the Service, you understand that any information you submit to Rev Health not intended and used solely for diagnosis and treatment by the Medical Group and Providers, laboratory services by the Labs, or prescription fulfillment by the Pharmacies is not considered Protected Information and will be subject only to our Privacy Policy and applicable state laws governing privacy and security. For clarity, information you provide to register and set up an account—such as name, date of birth, username, email address, shipping address, and phone number—is not considered Protected Information.

Collection of Personal Information

The personal information we collect depends on how you interact with us, the services you use, and the choices you make. We collect information from different sources and in various ways when you use our services, including:

Information You Provide Directly: This includes your name, email address, phone number, billing and physical addresses, demographic data (such as gender, date of birth, and zip code), social media information, payment details, content and files you upload (like photographs, videos, documents), and communications you send to us.

Sensitive Personal Information: This may include government-issued identifiers (e.g., driver's license, passport number, social security numbers), account access information (usernames, passwords), sensitive demographic data (racial or ethnic origin), contents of communications via the Service, biometric information for identity verification, health data, and information about your sex life or sexual orientation.

Information Collected Automatically: When you use our services, we automatically collect information such as device identifiers, IP address, browser type, operating system, geolocation data (depending on your device and settings), and usage data (pages viewed, time spent on pages, access times).

Information We Generate or Infer: We may infer new information from data we collect, such as your likely preferences or characteristics, based on your interactions with our services.

Information from Third-Party Sources: We may obtain information from third parties such as partners, co-branding or marketing partners, service providers, and publicly available sources.

You may choose not to provide certain information, but this may limit your ability to use certain features of the Service.

Rev Health provides management services to medical providers and certain pharmacies accessible through the Service. As a result, we may store additional health information on their behalf, including your medical records, communications with providers, medical history, and prescription information.

Cookies, Mobile IDs, and Similar Technologies

We use cookies, web beacons, mobile analytics and advertising IDs, and similar technologies to operate our websites and online services and to help collect data such as usage information, identifiers, and device information.

Cookies: Small text files stored on your device by a website, used to recognize your browser over time.

Web Beacons: Electronic images embedded in websites or emails that allow tracking of user interactions.

Mobile Analytics and Advertising IDs: Identifiers generated by mobile operating systems used by apps similarly to how websites use cookies.

Usage: We and our analytics and advertising partners use these technologies to collect personal information when you use our services. This data helps us store your preferences, enable sign-in, analyze performance, track interactions, develop inferences, deliver tailored advertising, combat fraud, and fulfill other legitimate purposes.

Controls: You can manage cookies and similar technologies through your browser settings, mobile device settings, and other tools. Refer to the "Choice and Control of Personal Information" section below for details.

Use of Personal Information

We use the personal information we collect for purposes described in this Privacy Policy or as otherwise disclosed to you, subject to the limitations in the "Protected Information" section above. These purposes include:

Product and Service Delivery: To provide and deliver the Service, including troubleshooting, facilitating navigation, confirming your location, and personalizing services.

Business Operations: For billing, payment processing, accounting, account administration, internal operations improvement, system security, fraud detection, identity verification, legal compliance, and protecting our rights and property.

Product Improvement and Research: To develop, test, or improve the Service and related products or services, identify new offerings, and analyze traffic and user behavior.

Personalization: To understand your preferences and enhance your experience.

Customer Support: To provide support, fulfill requests, respond to inquiries, and manage orders.

Communications: To send you information about Rev Health, Labs, Pharmacies, Medical Groups, Providers, confirmations, invoices, technical notices, updates, security alerts, and administrative messages. Also, to communicate on behalf of your Provider(s) to facilitate telehealth services.

Marketing: To inform you about new services, offers, promotions, rewards, contests, upcoming events, and information about our services and those of selected partners.

Advertising: To promote and market Rev Health, the Service, and related products and services.

We combine data collected from different sources to provide a seamless and personalized experience.

We may use information about your browsing and activity on the Service to promote and market our services and measure advertising efforts. This may include information related to visiting health-related pages on the Service. In some states, we may be required to obtain your consent before using sensitive personal information. We do not use Protected Information for advertising or marketing.

We may de-identify your information and use or sell such de-identified information for any lawful purpose not prohibited by applicable law. We will not attempt to re-identify de-identified data except as permitted by law.

Disclosure of Personal Information

We disclose personal information with your consent or as necessary to complete transactions or provide services you have requested. Subject to the limitations in the "Protected Information" section, we may disclose personal information to:

Service Providers: Vendors or agents working on our behalf for purposes described in this Privacy Policy.

Marketing and Advertising Partners: For delivering personalized advertising or reaching others with similar interests.

Financial Services and Payment Processing: Banks and entities necessary for payment processing, fraud prevention, credit risk reduction, analytics, or related financial services.

Affiliates: Subsidiaries, affiliates, and related companies for shared data systems or business operations.

Labs, Pharmacies, Medical Groups, or Providers: To facilitate services and payment collection on their behalf.

Corporate Transactions: In events such as mergers, acquisitions, financing, bankruptcy, or sale of assets.

Legal and Law Enforcement: To comply with laws or respond to valid legal processes.

Security and Protection: To protect customers, prevent fraud, maintain service security, or protect rights and property.

Third-party analytics and advertising companies may also collect personal information through our website and apps. These third parties may combine this data across multiple sites. For example, we use Google Analytics to understand user interactions; you can learn more at Google's Privacy Policy.

We may disclose de-identified information in accordance with applicable law.

Choice and Control of Personal Information

You have various ways to control your personal information:

Access, Correction, and Deletion: You may access, copy, correct, or delete personal information by contacting us using the methods described at the end of this Privacy Policy.

Data Sales and Targeted Advertising: To opt-out of data "sales" or targeted advertising, use the Global Privacy Control setting, click on "Your Privacy Choices" at the bottom of our webpage.

Communications Preferences: You can opt-out of promotional communications by following instructions in the messages or contacting us. Note that you may still receive service-related communications.

Browser and Platform Controls: Manage cookies through your browser settings, use the Global Privacy Control, or adjust mobile advertising ID settings on iOS and Android devices.

If we decline your request, you may appeal by contacting us as described below.

Data Retention

We retain personal information as long as necessary to provide services, fulfill transactions, comply with legal obligations, resolve disputes, enforce agreements, and for other legitimate business purposes. Retention periods vary based on factors like data type, user expectations, consent, and legal obligations.

Transactions

When conducting transactions through the Service (e.g., purchasing products or services), you may need to provide information such as your credit card number, billing and shipping addresses, phone number, and email address. By submitting this information, you grant Rev Health the right to provide it to third parties (e.g., payment processors) to facilitate the transaction.

All monetary transactions occur through online payment processing applications provided by third-party vendors Adyen and Stripe (collectively, "Payment Vendors"). Their privacy policies and security measures are available on their respective websites. Rev Health' relationship with Payment Vendors is contractual; they are independent entities not subject to our control.

Jurisdictional Issues

The Service is intended for use within certain states in the United States, as described in our Terms and Conditions. Accordingly, this Privacy Policy and our collection, use, and disclosure of your information are governed by U.S. law.

California Privacy Rights

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

Notice at Collection: You have the right to know what personal and sensitive personal information we collect, the purposes, whether it's sold or shared, and retention periods.

Right to Know: You can request disclosure of the personal information we have collected about you.

Rights to Request Correction or Deletion: You can request that we correct inaccurate personal information or delete personal information, subject to certain exceptions.

Right to Opt-Out: You can opt-out of the "sale" or "sharing" of your personal information.

We do not knowingly sell or share personal information of minors under 16 years of age.

To exercise these rights, email us at privacy@revhealth.co.

Miscellaneous

We employ reasonable physical, technical, and administrative measures to protect your information. You are responsible for keeping your account password secure and confidential. Please notify us immediately if you believe your account security has been compromised.

You may choose not to provide certain information, which may limit your ability to use some features of the Service. You can opt-out of certain communications by emailing us your preferences. Note that we may still send service-related communications.

We do not currently respond to "Do Not Track" signals. Rev Health may update this Privacy Policy at any time. Changes will be posted on this page with an updated "Last Updated" date. It is your responsibility to review this Privacy Policy periodically.

What's included