Privacy Policy

*This Privacy Policy governs the collection, use, disclosure, and protection of personal information, including sensitive health and biometric data, by DermaSci Corporation. Please read it carefully before using our Platform. If you do not agree with this Policy, you must not access or use our services.*

1. About This Policy and DermaSci Corporation

1.1 Who We Are

DermaSci Corporation (“DermaSci,” “we,” “our,” or “us”) is an Ontario corporation with its principal place of business in Ontario, Canada. We operate an artificial-intelligence-powered digital platform (the “Platform”) that connects individuals seeking evidence-based skincare and aesthetic treatments with licensed clinics and aesthetic service providers. DermaSci is not a healthcare provider, medical clinic, or regulated health professional, and nothing on the Platform constitutes medical advice, diagnosis, or treatment.

1.2 Scope of This Policy

This Policy applies to all personal information collected by DermaSci through:

• our website at www.dermasci.com and any subdomains (the “Website”);
• our mobile application(s) (the “App”);
• our AI-powered skin assessment, treatment-recommendation, and clinic-matching features (collectively, the “Services”);
• any communications between you and DermaSci, including email, telephone, and in-app messaging; and
• information provided by clinic partners regarding their patients or prospective patients.

This Policy applies regardless of your location. Jurisdiction-specific supplements for the European Union, the Province of Québec, the State of California, Mexico, and Brazil are set out in Sections 18 through 22 below and form an integral part of this Policy.

1.3 Who This Policy Covers

This Policy covers:

• “Client/Patient Users”: individuals who register for the Platform to receive skin assessments and clinic-referral recommendations;
• “Clinic Partners”: aesthetic clinics, medical spas, and related businesses that subscribe to DermaSci’s matching and lead-generation services; and
• “Clinic Staff”: employees, practitioners, and agents of Clinic Partners who access the Platform.

1.4 Age Restriction

*THE PLATFORM IS RESTRICTED TO INDIVIDUALS WHO ARE 18 YEARS OF AGE OR OLDER. We do not knowingly collect personal information from persons under the age of 18\. If you are under 18, you must not use the Platform. See Section 16 for our full children’s privacy statement.*

1.5 User Responsibility for Legal Compliance

DermaSci operates as a technology platform intermediary. While DermaSci maintains its own privacy and data protection compliance program, all users of the Platform, whether Client/Patient Users, Clinic Partners, or Clinic Staff, are independently responsible for complying with all laws, regulations, and professional standards applicable to their own activities, roles, and jurisdictions.

In particular:

• Client/Patient Users are responsible for ensuring that any personal information they submit about themselves or others (including photographs) is submitted lawfully and does not violate the privacy rights of third parties.
• Clinic Partners are independently and solely responsible for complying with all privacy laws applicable to their own collection, use, and handling of personal health information, including but not limited to Ontario’s Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A (“PHIPA”), British Columbia’s Personal Information Protection Act, SBC 2003, c 63, Alberta’s Health Information Act, RSA 2000, c H-5, applicable US state health information laws, and any other provincial, state, or federal health information legislation applicable to their practice.
• Clinic Partners who employ, retain, or are directed by any regulated health professional, including without limitation physicians, nurses, nurse practitioners, or other licensed practitioners, are required to disclose this fact to DermaSci at the time of registration and on a continuing basis, and to ensure their handling of personal health information complies with all legislation applicable to regulated health practitioners, including PHIPA where applicable. See Section 7.1 for further details.
• All users are responsible for understanding the privacy obligations that apply to their jurisdiction and role, and for obtaining independent legal advice where necessary.

DermaSci’s compliance with its own privacy obligations does not relieve any user of their separate, independent compliance obligations. DermaSci expressly disclaims any responsibility for a user’s failure to comply with laws applicable to that user’s own activities.

2. Definitions

In this Policy, the following terms have the meanings set out below:

3. Personal Information We Collect

3.1 Information You Provide Directly

When you create an account or use the Platform, we collect:

3.1.1 Account and Identity Information

• Full name
• Email address
• Password (stored in encrypted, hashed form)
• Date of birth (to verify you are 18 or older)
• Gender (optional, used to tailor recommendations)
• Province/State and country of residence

3.1.2 Skin Assessment Information

• Photographs of your skin (face, neck, body, or other areas you choose to submit)
• Written description of your skin concerns
• Skin type and tone information
• History of prior skin treatments, cosmetic procedures, or aesthetic services
• Allergies or sensitivities to skincare ingredients or treatments
• General lifestyle factors relevant to skin health (e.g., sun exposure, smoking, stress)

Important: Photographs submitted for AI analysis are treated as Health Information and as potential Biometric Data. See Sections 3.3 and 15 for specific disclosures.

3.1.3 Location Information

• City, province/state, and postal/ZIP code (provided by you to enable local clinic matching)
• Device geolocation (with your explicit permission) to identify nearby Clinic Partners

3.1.4 Communications

• Messages, inquiries, and feedback submitted through the Platform or by email
• Records of referrals accepted, appointments booked, or communications initiated with Clinic Partners through the Platform

3.2 Information Collected Automatically

When you use the Platform, we automatically collect:

• IP address and approximate geolocation derived from it
• Device type, operating system, and browser type
• Unique device identifiers and advertising identifiers (where permitted by your device settings)
• Log data: pages visited, features used, time and duration of visits, search queries
• Referring URLs and clickstream data
• Cookies and similar tracking technologies (see Section 17\)

3.3 Biometric Data

*IMPORTANT – BIOMETRIC DATA: Photographs you upload may be processed by our AI Assessment Engine in ways that constitute the collection of biometric data under applicable laws, including the Illinois Biometric Information Privacy Act (BIPA), Texas Capture or Use of Biometric Identifier Act (CUBI), and the EU General Data Protection Regulation (GDPR). Specific consents and rights apply. See Section 15\.*

Biometric data we may collect or derive includes:

• Facial geometry or spatial measurements derived from face photographs
• Skin-texture mapping and pattern analysis
• Pigmentation, vascular, and structural characteristics identified by AI analysis

We do not use biometric data for identity verification or authentication purposes. Biometric data derived from photographs is used solely for the purpose of generating skin assessment recommendations and is not sold or disclosed to third parties for marketing purposes.

3.4 Information from Clinic Partners

Clinic Partners may provide us with information about their existing or prospective patients for the purpose of referral coordination or follow-up, including:

• Patient contact details provided with the patient’s consent
• Treatment preferences and history relevant to referral matching
• Referral and appointment outcome data

3.5 Limitations on Collection

DermaSci does not collect or process:

• Government-issued identification numbers (e.g., Social Insurance Numbers, Health Card Numbers)
• Financial account numbers (payment processing is handled by a third-party processor; DermaSci does not receive or store payment card data)
• Information about children under the age of 18

DermaSci currently collects prescription and pharmaceutical information only where you voluntarily disclose it, for example, current topical medications or known treatment contraindications, for the sole purpose of generating safer and more relevant skin assessment recommendations. DermaSci does not collect this information from pharmacies, prescribing physicians, insurance providers, or any other third-party source. If DermaSci expands its collection of pharmaceutical information in the future, this Policy will be updated and, where required, fresh consent will be obtained before any expanded collection begins.

4. How We Collect Personal Information

We collect personal information through the following means:

• Directly from you when you register, complete the skin assessment questionnaire, upload photographs, or communicate with us
• Automatically through cookies, web beacons, and similar tracking technologies when you interact with the Platform
• From Clinic Partners, who may provide patient referral data in accordance with their own consent obligations and applicable law
• From third-party authentication providers if you use single sign-on (e.g., Google, Apple ID)
• From analytics providers and advertising platforms (see Section 17\)

5. Purposes for Collection, Use, and Disclosure

5.1 Primary Purposes

DermaSci collects and uses personal information for the following primary purposes:

5.2 Secondary and AI Training Purposes

*We will not use your photographs, skin assessment data, or any other Sensitive Data to train, retrain, fine-tune, or benchmark our AI models without obtaining your separate, explicit, and informed consent through a standalone consent process. Acceptance of this Privacy Policy does not constitute consent to AI training use of your data.*

5.3 Marketing Communications

We may send you promotional communications about DermaSci’s Services, new features, or relevant skincare information, subject to your opt-in consent where required by law (including under Canada’s Anti-Spam Legislation, SC 2010, c 23). You may unsubscribe at any time using the link provided in any marketing email or by contacting us at privacy@dermasci.com.

5.4 Aggregated and De-Identified Data

We may use personal information to create aggregated or de-identified data sets that do not identify any individual. Such data may be used for research, product development, industry reporting, or shared with Clinic Partners as anonymized market intelligence. We will not attempt to re-identify de-identified data, and we contractually prohibit our service providers from doing so.

6. Legal Bases for Processing Personal Information

DermaSci processes your personal information on the following legal bases, which vary by jurisdiction:

For EU/EEA residents: the specific legal basis under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) for each processing activity is further detailed in Section 20\.

For Québec residents: processing is based on the purposes described above in accordance with An Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1 (as amended by Law 25).

7. Disclosure and Sharing of Personal Information

7.1 Disclosure to Clinic Partners

*When you accept a clinic referral through the Platform, DermaSci will share your name, contact information, and a summary of your skin assessment results (but not your raw photographs unless you separately consent) with the relevant Clinic Partner. You control which referrals you accept.*

DermaSci shares personal information with Clinic Partners only:

• when you have accepted a referral and consented to the sharing of your information with that specific clinic;
• to the extent necessary to facilitate your appointment or inquiry; and
• subject to a Data Processing Agreement that requires Clinic Partners to: (a) use your data only for the purpose of the referral; (b) maintain appropriate security standards; (c) comply with applicable privacy laws; and (d) not sell or otherwise commercially exploit your data.

7.1.1 Clinic Partner Obligation to Disclose Regulated Health Professionals

Whether a Clinic Partner is subject to PHIPA or equivalent health information legislation depends on its own staffing and operational structure, specifically whether it employs or retains regulated health professionals. DermaSci relies on Clinic Partners to self-assess and disclose their regulatory status. Each Clinic Partner is required to:

• Disclose at registration whether the clinic employs, retains, or is directed by any regulated health professional, including physicians, nurses, nurse practitioners, or any other member of a regulated health profession under applicable legislation;
• Represent that this disclosure remains accurate for the duration of the Subscription Agreement, and notify DermaSci of any material change in custodian status, such as a physician joining or leaving the clinic’s structure, within a reasonable time of that change occurring; and
• Where the clinic is or becomes a health information custodian under PHIPA or equivalent legislation, comply with all applicable custodian obligations in respect of personal health information received through the Platform.

DermaSci does not independently verify the regulatory status of Clinic Partners or their practitioners. Each Clinic Partner bears sole responsibility for the accuracy of its disclosure and for its own compliance with applicable health information legislation. DermaSci expressly disclaims liability arising from a Clinic Partner’s failure to disclose its status or to comply with applicable law.

7.2 Disclosure to Service Providers

We engage third-party service providers who process personal information on our behalf under written data processing agreements. These include:

• Cloud infrastructure and data hosting providers
• AI and machine-learning infrastructure providers
• Payment processors (who receive payment data only, not health or biometric data)
• Customer relationship management (CRM) software providers
• Email and communications service providers
• Analytics and performance monitoring providers
• Legal, accounting, and professional services firms

All service providers are required by contract to: process personal information only on our documented instructions; maintain appropriate technical and organizational security measures; and not engage sub-processors without our prior written consent.

7.3 Disclosure for Legal Reasons

We may disclose personal information without your consent where required or permitted by law, including:

• in response to a court order, subpoena, or other valid legal process;
• to comply with applicable laws or regulations;
• to a government institution that has made a lawful request identifying its lawful authority;
• where we reasonably believe disclosure is necessary to prevent fraud, a security breach, or imminent harm to any person; or
• in connection with a business transaction (see Section 7.4).

7.4 Business Transactions

If DermaSci undergoes a merger, acquisition, sale of assets, reorganization, financing, or similar corporate transaction, personal information held by DermaSci may be transferred to or accessed by the other party as part of that transaction. Any such transfer is made on the basis of DermaSci’s legitimate business interests in completing the transaction and is subject to the condition that the receiving party agrees to handle personal information in accordance with privacy commitments substantially equivalent to those in this Policy.

Where a transaction is completed, DermaSci will notify affected users through the Platform or by email to their registered address within a reasonable time. Users who object to their personal information being held by the new entity may close their account at any time. Your personal information will continue to be used only for the purposes described in this Policy at the time of collection unless you are notified otherwise and, where required by law, provided with an opportunity to consent to any new purpose.

For Québec residents: the transfer of personal information in connection with a business transaction is subject to applicable requirements under Law 25, and DermaSci will take commercially reasonable steps to ensure those requirements are satisfied in connection with any such transaction.

7.5 What We Do Not Do

DermaSci does not:

• sell your personal information to third parties for their own commercial purposes;
• disclose your raw photographs to Clinic Partners without your explicit consent;
• use your personal information for targeted advertising based on your health or biometric profile; or
• share your personal information with data brokers.

8. International Transfer of Personal Information

DermaSci is an Ontario corporation and your personal information is initially stored on servers located in Canada. As we scale operations internationally, personal information may be transferred to, stored in, or processed in jurisdictions outside Canada, including the United States, members of the European Economic Area, the United Kingdom, Mexico, Brazil, and countries in the Asia-Pacific region. These jurisdictions may have privacy laws that differ from the laws of your home province or country.

8.1 Safeguards for International Transfers

Where personal information is transferred outside Canada to a country that does not provide equivalent privacy protections, DermaSci implements the following safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EU/EEA;
• UK International Data Transfer Agreements (IDTAs) for transfers from the United Kingdom;
• Binding Corporate Rules or equivalent contractual protections for transfers within our group;
• Privacy Impact Assessments (PIAs) as required under Quebec Law 25 for all cross-border transfers of personal information;
• Contractual protections requiring receiving parties to provide a level of protection substantially similar to that under Canadian federal and applicable provincial law; and
• Supplementary technical measures (e.g., encryption in transit and at rest) where the legal framework of the receiving country is assessed as inadequate.

8.2 Quebec-Specific Transfer Requirements

*Pursuant to section 17 of An Act Respecting the Protection of Personal Information in the Private Sector (Québec), DermaSci conducts a Privacy Impact Assessment (PIA) prior to communicating personal information outside Québec. A summary of completed PIAs is available upon request. By using the Platform, Québec residents acknowledge that their personal information may be communicated outside Québec subject to these safeguards.*

8.3 US Transfers and HIPAA

DermaSci is not a Covered Entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 USC § 1320d et seq. DermaSci does not provide health care services, administer a health plan, or process health insurance claims.

Whether DermaSci functions as a Business Associate under HIPAA in any particular situation depends on the Covered Entity status of the receiving Clinic Partner and the nature of the data transmitted. Where a US Clinic Partner is itself a HIPAA Covered Entity, DermaSci’s Data Processing Agreement is structured to address the applicable obligations. Clinic Partners who are Covered Entities are responsible for ensuring their own HIPAA compliance in respect of any patient information they receive through the Platform.

Health information voluntarily submitted by Client/Patient Users directly to DermaSci’s Platform is collected from the individual directly and is not received from a Covered Entity. DermaSci treats this information as Health Information under applicable Canadian privacy law and as sensitive personal information under applicable US state law, regardless of its technical HIPAA status.

Transfers of personal information to Clinic Partners in the United States are also subject to applicable US state health data privacy laws, including Washington’s My Health MY Data Act, Nevada’s Consumer Health Data Privacy Law, and equivalent legislation in other states where such laws apply to DermaSci’s data practices. DermaSci will assess and address these obligations as it expands US operations, and will seek qualified US legal counsel before commencing material US-facing activities.

9. Data Retention

We retain personal information for as long as necessary to fulfil the purposes described in this Policy, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Our general retention periods are:

Upon expiry of applicable retention periods, personal information is deleted or irreversibly de-identified using commercially reasonable methods. DermaSci reviews its retention practices periodically and may adjust retention periods where legitimate purposes no longer justify continued retention.

10. Security of Personal Information

DermaSci maintains an information security program appropriate to the size and nature of its operations and the sensitivity of the personal information it holds. Security measures are scaled and developed as the Platform grows. Current and planned measures include:

10.1 Technical Safeguards

• Encryption of all data in transit using TLS 1.2 or higher, with TLS 1.3 targeted as the standard
• Encryption of data at rest using AES-256 or equivalent standards, implemented through our cloud infrastructure provider
• Access controls and role-based access management designed to limit access to personal information to personnel with a legitimate operational need
• Multi-factor authentication for administrative and developer access to systems containing personal information
• Automated vulnerability scanning on a regular basis; third-party penetration testing conducted periodically as the Platform scales and resources permit
• Web Application Firewall and intrusion detection capabilities through our cloud infrastructure provider
• Access-controlled storage environment for photographs and biometric data, logically separated from other personal information

10.2 Organizational Safeguards

• Privacy and security awareness for all DermaSci personnel with access to personal information
• Confidentiality obligations in employment and contractor agreements
• Designated Privacy Officer responsible for overseeing compliance with this Policy
• Periodic review of privacy and security practices, with the frequency and scope of review calibrated to the growth and risk profile of the Platform
• Documented incident response plan, reviewed and updated as the Platform grows

10.3 Breach Notification

In the event of a breach of security safeguards involving personal information that poses a real risk of significant harm to affected individuals, DermaSci will:

• notify the Office of the Privacy Commissioner of Canada as required under the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 (“PIPEDA”) and Breach of Security Safeguards Regulations, SOR/2018-64;
• notify the Commission d’accès à l’information (CAI) within 72 hours of becoming aware of the breach, as required under Québec Law 25;
• notify the relevant supervisory authority under the GDPR within 72 hours where EU/EEA residents are affected;
• notify affected individuals without undue delay and in accordance with applicable law; and
• maintain a register of all privacy breaches, including those that do not trigger notification obligations.

11. Artificial Intelligence and Automated Decision-Making

11.1 How Our AI Works

The DermaSci AI Assessment Engine analyzes your submitted photographs and questionnaire responses to generate personalized treatment and clinic-matching recommendations. The AI model uses pattern recognition, computer vision, and machine-learning techniques trained on dermatological and aesthetic treatment data to identify skin characteristics and match them with evidence-based treatment options.

11.2 Nature of AI Outputs: Important Limitations

*AI-GENERATED RECOMMENDATIONS ARE NOT MEDICAL ADVICE. The outputs of the DermaSci AI Assessment Engine are informational recommendations intended to help you navigate available aesthetic and skincare treatments and connect you with qualified providers. They do not constitute a medical diagnosis, clinical assessment, or professional medical opinion. DermaSci’s AI is not a licensed health professional. Always consult a qualified healthcare professional for medical concerns.*

11.3 Human Review

DermaSci’s AI Assessment Engine generates recommendations algorithmically. Clinic-matching recommendations that result in a referral are not individually reviewed by a DermaSci employee before delivery. However, Clinic Partners receiving referrals are licensed aesthetic professionals who will independently assess your suitability for any recommended treatment.

11.4 Your Rights Regarding Automated Processing

To the extent that our AI processing constitutes solely automated decision-making that produces a legal or similarly significant effect on you:

• EU/EEA residents have the right under GDPR Article 22 to object to such processing, request human review, and receive an explanation of the logic applied.
• Québec residents have the right under Law 25 to be informed of automated decisions and to request that a human review any recommendation that significantly affects them.
• All users may contact our Privacy Officer to request information about how a specific recommendation was generated.

11.5 AI Model Accuracy and Bias

DermaSci conducts ongoing evaluation of the accuracy, fairness, and potential biases of its AI Assessment Engine across different skin tones, ethnicities, ages, and genders. We are committed to improving representativeness and reducing discriminatory outputs. If you believe a recommendation was inaccurate or unfair, please report this through our feedback mechanism or by contacting privacy@dermasci.com.

11.6 AI Training Data

Our AI models are trained using datasets that may include:

• Publicly available dermatological image databases
• Commercially licensed medical and aesthetic image datasets
• Internally generated synthetic or de-identified data

We do not use individual user photographs or health data submitted through the Platform to train AI models without your separate explicit consent. If we wish to use your data for training purposes, we will contact you with a clear, standalone consent request.

12. Your Privacy Rights

12.1 Rights Available to All Users

Subject to applicable law and certain exceptions, you have the right to:

12.2 How to Exercise Your Rights

To exercise any of the rights above, please submit a written request to our Privacy Officer by:

• Email: privacy@dermasci.com
• Mail: Privacy Officer, DermaSci Corporation, \[ADDRESS\], Ontario, Canada

We will respond to your request within:

• 30 calendar days under PIPEDA (with a possible 30-day extension upon notice);
• 30 calendar days under Québec Law 25;
• 1 calendar month under the GDPR (with possible extension for complex requests);
• 45 calendar days under the California Consumer Privacy Act (CCPA/CPRA);
• 20 business days under Brazil’s Lei Geral de Proteção de Dados (LGPD).

We do not charge a fee for exercising your rights unless requests are manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable administrative fee or decline to act, with written reasons.

12.3 Identity Verification

We are required to verify your identity before processing any request to access, correct, or delete your personal information. This protects your information from unauthorized access. We may ask you to provide identifying information sufficient to match your request to your account, and will not retain verification information beyond what is necessary for this purpose.

13. Withdrawing Consent

Where processing of your personal information is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

The consequences of withdrawing consent vary depending on the type of consent withdrawn:

To withdraw consent, please contact privacy@dermasci.com or use the consent management tools available in your account settings.

14. Cookies and Tracking Technologies

14.1 Types of Cookies We Use

14.2 Managing Cookies

You can manage your cookie preferences through:

• our cookie consent manager presented when you first visit the Platform;
• your browser settings, which allow you to block or delete cookies; and
• your device settings for mobile identifiers.

Please note that disabling certain cookies may affect the functionality of the Platform.

14.3 Do Not Track

Our Platform currently does not respond to “Do Not Track” signals from browsers. Where applicable law requires us to honour such signals (e.g., under the California Consumer Privacy Act), we will update this section accordingly.

15. Biometric Data: Specific Disclosures

*This section provides disclosures required under applicable biometric privacy laws, including the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 et seq.; the Texas Capture or Use of Biometric Identifier Act, Tex. Bus. & Com. Code § 503.001; GDPR Article 9; and Quebec Law 25\.*

15.1 What Biometric Data We Collect

If you upload a photograph of your face for skin assessment, our AI Assessment Engine may derive biometric identifiers including facial geometry measurements and structural characteristics of your skin. This information is derived from your photograph as part of the assessment process and may constitute “biometric information” under applicable state and provincial laws.

15.2 Purpose and Use

Biometric data is collected and used exclusively for the purpose of generating personalized skin assessment recommendations. It is not used for identity verification, authentication, marketing, or any other purpose.

15.3 Retention and Destruction

Biometric data is subject to its own independent retention schedule, separate from and shorter than the retention period that applies to the underlying photograph. Even where a photograph is retained for longitudinal assessment purposes under Section 9, any biometric data derived from that photograph will be permanently and irreversibly destroyed on the following schedule, whichever event occurs first:

• within three (3) years of the date of collection; or
• within one (1) year of your last interaction with the Platform.

This schedule is fixed by applicable biometric privacy law, including the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/15(a), and cannot be extended. Your photograph may remain in our system after biometric data has been destroyed. You may request earlier deletion of biometric data at any time by contacting privacy@dermasci.com.

15.4 No Sale of Biometric Data

DermaSci does not sell, lease, trade, or otherwise profit from biometric data. Biometric data is not shared with Clinic Partners or any other third party except our data hosting and AI infrastructure providers, who process it on our behalf under written agreements prohibiting independent use or disclosure.

15.5 Illinois Residents (BIPA)

If you are an Illinois resident, you have the right to:

• receive a written policy establishing a retention schedule and destruction guidelines for biometric data;
• be informed in writing of the specific purpose and length of time for which biometric data is collected, stored, and used; and
• provide written consent before your biometric data is collected or disclosed.

This Privacy Policy, together with our Biometric Data Consent Form, constitutes our written policy for purposes of BIPA. Your explicit consent to biometric data collection is obtained through the separate consent process prior to your first photograph upload.

16. Children’s Privacy

THE PLATFORM IS NOT DIRECTED TO AND MUST NOT BE USED BY INDIVIDUALS UNDER THE AGE OF 18\. We do not knowingly collect personal information from anyone under 18 years of age.

If we become aware that we have inadvertently collected personal information from a person under 18, we will:

• delete such information from our systems as soon as reasonably practicable;
• close any account opened by or on behalf of a minor; and
• notify the Privacy Officer for review and documentation.

If you believe we may have collected information from or about a minor, please contact us immediately at privacy@dermasci.com. We comply with the Children’s Online Privacy Protection Act (COPPA), 15 USC § 6501, to the extent it applies to our operations.

17. Third-Party Links and Services

The Platform may contain links to third-party websites, applications, or services operated by Clinic Partners or other third parties. This Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through our Platform. DermaSci is not responsible for the privacy practices of third parties.

18. Additional Disclosures for Canadian Residents: PIPEDA and Québec Law 25

18.1 PIPEDA Compliance

DermaSci’s personal information practices are governed by the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 (“PIPEDA”) and substantially follow the 10 Fair Information Principles set out in Schedule 1 of PIPEDA. Our Privacy Officer oversees compliance with PIPEDA and is responsible for receiving and responding to complaints.

You may direct complaints to the Office of the Privacy Commissioner of Canada:

• Website: www.priv.gc.ca
• Telephone: 1-800-282-1376

18.2 Ontario \-- PHIPA and Regulated Health Professional Disclosure

DermaSci is not a "health information custodian" as defined under Ontario's Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A ("PHIPA"). DermaSci does not provide health care, and its primary function is technology-based commercial referral matchmaking, not the provision of health services. Accordingly, PHIPA's custodian obligations do not apply to DermaSci's own handling of personal information through the Platform.

However, Clinic Partners who receive personal health information through the Platform may themselves be health information custodians subject to PHIPA. Whether a Clinic Partner is a custodian depends on the services it performs and the nature of any regulated health professional's involvement \-- not on the label the clinic uses to describe itself. The following framework applies:

Each Clinic Partner is responsible for self-assessing its regulatory status and ensuring its own compliance with applicable health information legislation. DermaSci’s agreements with Clinic Partners require them to:

• disclose their custodian status to DermaSci at registration and notify DermaSci of any material change to that status;
• comply with all obligations of a health information custodian, where applicable, in respect of personal health information received through the Platform;
• where required by applicable law, enter into an appropriate data processing or agent agreement with DermaSci before receiving patient personal health information; and
• notify DermaSci of any breach or privacy incident involving patient data received through the Platform, within a reasonable time of becoming aware of it.

DermaSci bears no responsibility for a Clinic Partner's failure to disclose its custodian status or to comply with PHIPA or equivalent legislation. Client/Patient Users with concerns about how a specific Clinic Partner is handling their health information should contact that clinic's Privacy Officer directly, or lodge a complaint with the Information and Privacy Commissioner of Ontario at www.ipc.on.ca or 1-800-387-0073.

18.3 Québec Law 25 Supplement

For individuals whose personal information is subject to Québec’s Act respecting the protection of personal information in the private sector, CQLR c P-39.1, as amended by An Act to modernize legislative provisions as regards the protection of personal information, SQ 2021, c 25 (“Law 25”), the following additional rights and obligations apply:

• Right to Data Portability: You may request that personal information collected from you be communicated to you in a structured, commonly used technological format.
• Right to De-indexation: You may request that your personal information be de-indexed from any results produced by our Platform or AI engine.
• Privacy by Default: Our Platform is designed with privacy-protective default settings. Collection is limited to what is necessary for the stated purposes.
• Privacy Impact Assessments: A PIA is conducted before any cross-border transfer of personal information, as required by section 17 of Law 25\.
• Complaints, Commission d’accès à l’information: You may file a complaint with the CAI at www.cai.quebec or by telephone at 1-888-528-7741.

19. Additional Disclosures for California Residents: CCPA/CPRA

*This section applies to California residents and supplements the rest of this Policy. It is provided pursuant to the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 (“CCPA/CPRA”).*

19.1 Categories of Personal Information Collected

In the preceding 12 months, DermaSci has collected the following categories of personal information from California residents:

• Identifiers (name, email address, IP address)
• Personal information described in California Civil Code § 1798.80 (address, medical information)
• Characteristics of protected classifications (age, gender, voluntary)
• Internet or electronic network activity information (usage data, cookies)
• Geolocation data
• Sensory data (audio, visual, or similar, photographs)
• Sensitive Personal Information: health/medical information, biometric information

19.2 California Consumer Rights

California residents have the right to:

• Know: request disclosure of the categories and specific pieces of personal information we have collected, the categories of sources, our business or commercial purpose for collecting it, and categories of third parties with whom we share it.
• Delete: request deletion of personal information we hold about you, subject to certain exceptions.
• Correct: request correction of inaccurate personal information.
• Opt-Out of Sale or Sharing: DermaSci does not sell your personal information. We do not share personal information for cross-context behavioural advertising without your consent.
• Limit Use of Sensitive Personal Information: request that we limit our use of your sensitive personal information to what is reasonably necessary.
• Non-Discrimination: You will not be discriminated against for exercising your CCPA/CPRA rights.

19.3 Shine the Light

California Civil Code § 1798.83 (“Shine the Light”) permits California residents to request information about third parties to whom we have disclosed personal information for their own direct marketing purposes. DermaSci does not share personal information with third parties for their own direct marketing purposes.

20. Additional Disclosures for EU/EEA Residents: GDPR

*This section applies to individuals located in the European Union or European Economic Area and supplements the rest of this Policy. It is provided pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”).*

20.1 Data Controller

DermaSci Corporation is the data controller of personal information collected through the Platform from EU/EEA residents during the collection and AI assessment phases of the Service. DermaSci independently determines the purposes and means of that processing and is accordingly the data controller under GDPR Article 4(7) for those activities.

Clinic Partners who receive referral information are independent data controllers in respect of their use of that information following delivery of a referral. DermaSci and a receiving Clinic Partner may, in respect of the referral transaction itself, be joint controllers under GDPR Article 26 to the extent they jointly determine the purposes of the data sharing. DermaSci's agreements with Clinic Partners address the allocation of responsibilities between the parties in that context.

Where EU/EEA resident personal data is transferred to Clinic Partners located outside the EU/EEA, such transfers are subject to appropriate transfer mechanisms under GDPR Chapter V, including Standard Contractual Clauses where applicable. Our contact details are set out in Section 24\.

20.2 Special Category Data

Photographs used for AI analysis and biometric data derived from them constitute “special category data” under GDPR Article 9\. DermaSci processes such data only with your explicit consent (Article 9(2)(a)) obtained through our separate consent form, and where necessary to protect your vital interests (Article 9(2)(c)). We have completed a Data Protection Impact Assessment (DPIA) for this processing activity.

20.3 International Transfers

Transfers of personal data from the EU/EEA to Canada are made pursuant to the European Commission’s adequacy decision for Canada under PIPEDA (Commission Decision 2002/2/EC). Transfers to other third countries (including the United States) are made pursuant to Standard Contractual Clauses (SCCs) adopted under Commission Implementing Decision (EU) 2021/914, supplemented by technical measures as appropriate following a Transfer Impact Assessment.

20.4 GDPR Rights

In addition to the rights described in Section 12, EU/EEA residents have the right to:

• lodge a complaint with their national supervisory authority (a list is available at edpb.europa.eu); and
• object at any time to processing based on legitimate interests under GDPR Article 6(1)(f), on grounds relating to their particular situation.

20.5 EU Representative

As we expand operations into the EU, DermaSci will appoint an EU Representative as required under GDPR Article 27\. Details of our EU Representative will be published at www.dermasci.com/legal/eu-rep once appointed. [Note: Appoint your EU Representative before launching EU-facing operations.]

21. Additional Disclosures for Mexico Residents: LFPDPPP

This section applies to individuals whose personal information is collected or processed in Mexico, and supplements the rest of this Policy pursuant to the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, “LFPDPPP”), published in the Official Gazette of the Federation on July 5, 2010, and its Regulations.

21.1 Aviso de Privacidad (Privacy Notice)

This Policy constitutes DermaSci’s Aviso de Privacidad (Privacy Notice) for purposes of the LFPDPPP. It sets out the identity and domicile of the data controller (DermaSci Corporation), the personal data collected, the purposes of processing, and the mechanisms for exercising ARCO rights.

21.2 ARCO Rights

Mexican residents have the rights of Acceso (Access), Rectificación (Rectification), Cancelación (Cancellation), and Oposición (Opposition), collectively, “ARCO rights”. To exercise these rights, contact privacy@dermasci.com. We will respond within 20 business days.

21.3 Sensitive Data

Health information and biometric data constitute “datos personales sensibles” under the LFPDPPP. We collect and process such data only with your express written consent, which will be obtained through our separate consent form.

22. Additional Disclosures for Brazil Residents: LGPD

This section applies to individuals whose personal information is processed in Brazil, and supplements the rest of this Policy pursuant to the Lei Geral de Proteção de Dados Pessoais, Law No. 13,709/2018 (“LGPD”).

Brazilian residents have rights under the LGPD including the right to: confirm the existence of processing; access data; correct incomplete, inaccurate, or outdated data; anonymize, block, or delete unnecessary or excessive data; port data; obtain information about entities with which data has been shared; be informed of the possibility of denying consent and the consequences; revoke consent; and lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at www.gov.br/anpd.

Health data constitutes “dados sensíveis” under LGPD Article 5(II) and is processed only on the basis of your specific consent (LGPD Article 11(I)).

23. Changes to This Privacy Policy

DermaSci may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other reasons. When we make material changes, we will:

• update the “Last Revised” date at the top of this Policy;
• provide prominent notice through the Platform (e.g., a banner or notification) or by email to your registered address; and
• where required by law (including under Québec Law 25), obtain fresh consent for any new processing purposes.

Your continued use of the Platform after any revised Policy becomes effective constitutes your acceptance of the changes, except where applicable law requires your affirmative consent to the revised terms.

We maintain an archive of previous versions of this Policy, which is available upon request from privacy@dermasci.com.

24. Contact Information and Complaints

24.1 Privacy Officer

DermaSci has designated a Privacy Officer who is responsible for overseeing compliance with this Policy and applicable privacy laws. You may contact our Privacy Officer with any questions, concerns, or requests:

24.2 Regulatory Authorities

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant privacy regulatory authority:

This Privacy Policy has been reviewed and approved on behalf of DermaSci Corporation.

Nancy Eliott, Privacy Officer

DermaSci Corporation

Nancy Eliott, Chief Executive Officer

DermaSci Corporation