Health Data Privacy Policy | Orasis Pharmaceuticals

Effective date: September 30, 2026

Last updated: September 30, 2026

This Health Data Privacy Policy (“Policy”) describes how Orasis Pharmaceuticals, Inc. (“Orasis,” “we,” “us,” or “our”) processes “Consumer Health Data” or “Regulated Health Information” as that term is defined under applicable state law (collectively “Health Data”), about consumers who reside in the states of Nevada, Washington, New York, Connecticut, and any other applicable U.S. jurisdiction in connection with all Orasis operations as well as websites, mobile applications, and digital services where this Policy is linked or posted (“Services”). Please carefully read this Policy as it contains important information concerning your Health Data and how we use it.

This Policy describes how we process Health Data about you. This Policy does not apply to: (i) Protected Health Information (“PHI”) governed by the Health Insurance Portability and Accountability Act (“HIPAA”), such as when PHI about you is processed in the context of any patient assistance or related offerings that we may sponsor; (ii) health information that is used to engage in public or peer-reviewed scientific, historical, or statistical research that adheres to all other applicable ethics and privacy laws; or (iii) personal information, which is governed by our Privacy Policy.

This Policy supplements our Privacy Policy. If this Policy and our Privacy Policy conflict with respect to Health Data, this Policy controls.

Health Data does not include other data that does not meet the definition of “Consumer Health Data” or “Regulated Health Information” under applicable law, such as aggregate or deidentified data. To the extent that we process deidentified data, we will maintain and use the data in deidentified form and will not attempt to reidentify the data unless permitted by applicable law. Deidentified data that is reidentified and otherwise qualifies as Health Data is subject to this Policy.

We collect the following categories of Health Data:

Individual health conditions, treatment, diseases, or diagnoses;
Use or purchase of prescribed medications;
Information that could identify your attempt to seek health care services or prescription products, including your usage data when you interact with certain health-related content on Services;
Bodily functions, vital signs, symptoms, or measurements;
Payment information that relates to your health (such as insurance details); and
Any other health-related information that you voluntarily disclose to us, including through any interactive tools or otherwise through the Services.

We collect Health Data from the following categories of sources:

Directly from you when you share it with us through the Services, including through any interactive tools;
Directly from you, your caregiver, or a third party within the context of our responsibilities under the Federal Food, Drug, & Cosmetic Act, such as adverse event and product complaint reporting; and
Through our service providers, and through advertising, social media, and analytics partners such as Meta, Google, TikTok, Microsoft Advertising (Bing), and programmatic advertising partners such as StackAdapt, that support the Services. This may include the use of cookies, pixels, web beacons, and similar technologies to collect information about your interactions with the Services, where you have consented to their use.

We collect, use, and disclose Health Data for the following business purposes:

To provide, operate, maintain, and protect our Services;
To analyze and improve our Services, including developing new products or services (in accordance applicable privacy law);
To identify potential clinical research opportunities and to facilitate and conduct research for potential publication;
To communicate with you, respond to your inquiries, and send you information by email, postal mail, telephone, text message, or other means, including promotional content about our products and services;
To enhance and help us better understand your browsing experience, needs, and preferences and provide consistent, personalized services and experiences in our Services;
To advertise and market our products and Services, and to measure, report on, and improve the performance of our advertising, for example whether people who saw or clicked our advertisements later visited our websites, used our eye doctor finder, signed up for updates, or started a telehealth visit, or completed checkout for a telehealth visit, where you have consented to this use;
To protect the security or integrity of the Services;
To protect us, our users, and the public, and comply with applicable law, regulation, or legal process, including to validate user information for fraud and risk detection purposes, resolve disputes and protect the rights of users and third parties, respond to claims and legal process (such as subpoenas and court orders), fulfill our reporting obligations, and monitor and enforce compliance with our contracts, and otherwise detect, prevent, or stop any activity that may be illegal, unethical, or legally actionable; and
To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Health Data held by us about our customers is among the assets transferred.

We disclose some or all of the above categories of Consumer Health Data for the purposes described above with the following third parties and affiliates:

As legally required in relevant legal proceedings and otherwise to the extent required or explicitly permitted by applicable law, including cooperating with law enforcement investigations and requests;
To clinical research organizations, researchers, and healthcare institutions we collaborate with for research activities, in compliance with applicable law;
Service providers that support the Services, such as providers of data hosting and analytics services, IT and security vendors, communications and customer service providers, and product fulfilment and delivery providers;
Independent licensed healthcare providers, and the telehealth platforms and medical groups they practice through, when you request a telehealth visit through the Services, so that they can evaluate your request and provide care. If your provider prescribes a medication, your provider sends the prescription to a pharmacy, as with any other prescription, under the provider's own privacy practices;
Payment processors, to process payments you make through the Services;
Advertising, social media, and analytics partners, such as Meta, Google, TikTok, Microsoft Advertising (Bing), and programmatic advertising partners such as StackAdapt, where you have consented. We limit what we disclose to them to identifiers (such as cookie and device identifiers) and information about your visits to and actions on our websites, such as the pages you viewed, using our eye doctor finder, signing up for updates, starting a telehealth visit, and completing checkout for a telehealth visit. We disclose that you completed checkout only if you separately agree to it at checkout. We never disclose to them your answers to the telehealth intake questionnaire or any other health question, your symptoms or medical history, any clinical decision, or whether you were prescribed a medication;
Professional advisors, such as attorneys, consultants, or accountants;
Third parties within the context of a merger or similar business transaction; and
Other third parties at your direction.

Consent to Collection and Sharing

Where required by applicable law, we will obtain your consent before we collect your Health Data and, separately, before we share your Health Data with third parties for purposes other than providing the Services you request, including before we share it with advertising partners. We ask for your consent to advertising cookies and similar technologies through the cookie banner on our websites. You may change your choice at any time through the “Cookie Settings” link on our websites or by contacting us as described below. Declining or withdrawing consent does not affect your ability to use the Services, including requesting a telehealth visit. We ask for your consent to share that you completed checkout for a telehealth visit separately, through an optional choice at checkout that is not required to complete your purchase.

Your Privacy Rights

Depending on your place of residency, you may have some or all of the following rights regarding your Health Data, subject to applicable law and certain exceptions:

Right to Confirm and Access: If you ask us, we will confirm whether we are collecting, sharing, or selling your Health Data. You may request that we provide you with a copy of the Health Data that we maintain about you. At your request, we will provide a list of all third parties and affiliates with whom we have shared or sold your Health Data, and an active email address or other online mechanism you may use to contact them. Please note that we do not “sell” Health Data as that term is defined under applicable law.
Right to Correct: If your Health Data that we maintain is inaccurate and you would like us to correct it, you may request that we make changes to it.
Right to Withdraw Consent: Where we have relied on your consent or authorization for certain processing of your Health Data, you may withdraw that consent or authorization at any time. You may withdraw consent to advertising cookies and similar technologies at any time through the “Cookie Settings” link on our websites.
Right to Delete: You may request that we delete the Health Data we maintain about you. If you request deletion, we will also notify the service providers and third parties with whom we have shared your Health Data of your request, as required by applicable law.
Right to Appeal: If we deny your request to exercise any of the above rights, you may request to appeal this decision. If we deny your appeal, you may contact the Attorney General in your state of residence.

To exercise any of the above rights, you or your authorized agent may do so by following the instructions in “Contact Us” below. To process your request, we may ask you to verify your identity by confirming your name, e-mail address, phone number, or other identifiable information that we have in our records, such as your most recent interaction with us, if applicable.

Washington Residents: Geofencing

If you are a Washington resident, we do not implement a virtual boundary (geofence) within 2,000 feet of any facility that provides in-person health care services to identify or track you, collect Health Data from you, or send you notifications, messages, or advertisements.

Updates to this Policy

We may update this Policy from time to time and notify you in accordance with law, which may include email or other notice posted to the Services. Any changes to this Policy will become effective when we notify you of the changes. Your use of the Services following any such updates will constitute your acceptance of such updates.

Contact Us

If you have any questions, comments, or concerns about our processing activities, or would like to request to exercise any of the above privacy rights, please email us at info@orasis-pharma.com or write to us at Orasis Pharmaceuticals, Inc. 101 Marketside Avenue, Suite 404-324, Ponte Vedra, FL 32081.