ZipHealth Consumer Health Data Privacy Policy

Last modified: July 7, 2026

1. INTRODUCTION AND SCOPE

ZipHealth Services Inc., doing business as ZipHealth ("ZipHealth," "Company," "we," "us," or "our"), is committed to protecting the privacy of your health-related information. This Consumer Health Data Privacy Policy (this "CHDPP") describes how we collect, use, share, and protect "Consumer Health Data" as that term is defined under the Washington My Health My Data Act (RCW Chapter 19.373), the Nevada Consumer Health Data Privacy Law (Nevada SB 370), and any other applicable state consumer health data laws now in effect or enacted in the future (collectively, "Consumer Health Data Laws").

This CHDPP supplements our general Privacy Policy, available at ziphealth.co/privacy. Where any provision of this CHDPP conflicts with the general Privacy Policy regarding Consumer Health Data, this CHDPP controls.

ZipHealth operates a digital health platform that facilitates access to prescription treatments for a range of health conditions through licensed healthcare providers and pharmacy partners. The Services are provided through our websites located at https://www.ziphealth.co/ and https://www.dermatica.com/ (collectively, the "Site"), mobile applications, and related platforms.

This CHDPP does not apply to "Protected Health Information" as defined under the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), to the extent such information is collected, used, or disclosed by a HIPAA-covered entity or business associate in accordance with HIPAA. Information you provide through the Services is not considered "protected health information" under HIPAA, and HIPAA does not apply to your transactions or communications with ZipHealth.

We may update this CHDPP from time to time to reflect changes in our practices or applicable law. When we make changes, we will update the "Last modified" date at the top of this CHDPP and post the revised version on our Site. Material changes affecting how we collect, use, or share previously collected Consumer Health Data will take effect only after we provide notice and, where required by applicable Consumer Health Data Laws, obtain your Consent.

2. DEFINITIONS

As used in this CHDPP, the following terms have the meanings set forth below:

"Consumer Health Data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. This includes, but is not limited to, information relating to health conditions, diagnoses, treatments, medications, bodily functions, vital signs, symptoms, biometric data, genetic data, precise location information that could reasonably indicate an attempt to acquire or receive health services or supplies, reproductive or sexual health information, gender-affirming care information, and any data derived or extrapolated from non-health information and used to associate or identify a consumer with health-related data.

"Consent" means a clear, affirmative act signifying your freely given, specific, informed, and unambiguous agreement to the collection, use, or sharing of your Consumer Health Data. Consent is not obtained through a general terms-of-service acceptance, hovering over or closing a notification, or any mechanism that could be construed as obtaining agreement through inaction.

"Sale" means the exchange of Consumer Health Data for monetary or other valuable consideration. Sale does not include: (a) disclosure to a processor that processes data on our behalf pursuant to a written contract; (b) disclosure to a third party as reasonably necessary to provide a product or service you requested; or (c) disclosures made at your direction.

"Services" means all products, services, and features made available by ZipHealth through the Site, any associated mobile applications, and any related platforms, including online consultations, health questionnaires, prescription facilitation, medication fulfillment and delivery, clinical support, and progress tracking tools.

"Site" means our websites at https://www.ziphealth.co/ and https://www.dermatica.com/ and any associated mobile applications.

3. CONSUMER HEALTH DATA WE COLLECT

Through the operation of our Services, we may collect the following categories of Consumer Health Data:

• Health Conditions, Diagnoses, and Medical History: Information about your current and past health conditions, including conditions disclosed during intake or clinical consultations, such as conditions related to sexual health, weight management, dermatological concerns, migraines, and other conditions addressed by the Services.
• Treatment and Medication Information: Information relating to prescriptions issued through the Services, including medication name, dosage, refill history, adherence patterns, treatment dates, and Provider clinical notes regarding your treatment plan.
• Bodily Functions, Vital Signs, Symptoms, and Measurements: Weight, height, body mass index (BMI), blood pressure, heart rate, and self-reported symptoms or physical responses to treatment.
• Progress Tracking Data: Weight measurements recorded over time, progress photographs (if submitted), treatment milestone data, and related self-reported information collected through our tracking features.
• Health Questionnaire Responses: Information you provide through online health intake forms, including responses about medical history, current medications, allergies, lifestyle habits, and treatment goals.
• Sex Life and Sexual Orientation Information: Where relevant to your requested treatment, we may collect information about your sex life and sexual orientation. We treat this information as Sensitive Personal Information and do not share it with advertising networks for targeted advertising.
• Diagnostic Testing: Results of laboratory tests, blood work, or other diagnostic assessments submitted to or facilitated through the Services.
• Prescription and Pharmacy Data: Prescription details transmitted to or received from Pharmacy partners, including medication dispensed, quantity, fulfillment status, and shipping information linked to your treatment.
• Biometric Data: Biometric identifiers collected through the Services, such as data derived from progress photographs or photographs from government-issued identification documents submitted for identity verification.
• Precise Location Information: Location data that could reasonably indicate you are seeking or receiving health services, including data derived from your IP address, device GPS (if enabled), device settings, or shipping address when linked to your use of the Services.
• Inferred or Derived Health Data: Health-related information derived or inferred from non-health information, such as inferences about your health status drawn from browsing behavior on the Site, engagement with treatment content, or purchasing patterns.

This data may be collected directly through your interactions with the Services, through your use of the Site (including automatically collected information such as IP addresses, device identifiers, and advertising identifiers), or when you seek healthcare services through our platform. Consumer Health Data may be combined with other personal information you provide or that we collect.

4. PURPOSES FOR COLLECTING AND USING CONSUMER HEALTH DATA

We may use your Consumer Health Data for the following purposes:

• To provide, administer, and improve the Services, including creating and managing your account, facilitating consultations, processing prescriptions, and coordinating medication delivery.
• To determine your clinical eligibility for treatment and transmit your health information to your Provider for clinical review, diagnosis, and prescribing decisions.
• To facilitate the fulfillment and delivery of your prescription medication through our licensed Pharmacy partners and shipping carriers.
• To process payments, manage your subscription, and maintain billing records.
• To provide ongoing clinical care and support, including monitoring your treatment progress and conducting follow-up assessments.
• To communicate with you about your account, treatment, prescriptions, and shipments.
• To respond to your inquiries and provide customer support.
• To send you surveys, program updates, and promotional communications, where permitted by applicable law and with your Consent where required. We do not use or share your health or medical information, sex life or sexual orientation information, or other Sensitive Personal Information with advertising networks or marketing platforms for targeted advertising.
• To conduct analytics, market research, product development, and quality improvement.
• To detect, prevent, and investigate fraud, unauthorized access, security incidents, and illegal activity.
• To comply with applicable laws, regulations, and legal processes, respond to lawful requests from public authorities, enforce our Terms of Use, and protect the rights, property, and safety of ZipHealth, our users, and the public.
• To aggregate or de-identify data for research, analytics, and business purposes.
• In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to applicable law.

We will obtain your Consent before collecting or using your Consumer Health Data unless the collection or use is necessary to provide a product or service you have requested, or is otherwise permitted by applicable Consumer Health Data Laws.

5. SOURCES OF CONSUMER HEALTH DATA

We may collect Consumer Health Data from the following sources:

Directly from You. We collect Consumer Health Data that you provide through account registration, health intake questionnaires, clinical consultations, progress tracking submissions, customer support interactions, and any other information you submit through the Site or Services.

From Your Devices. We collect information automatically through cookies, pixel tags, device identifiers, IP addresses, and similar tracking technologies when you access or interact with the Site. This may include browsing activity, engagement with health-related content, and other data from which Consumer Health Data may be derived or inferred.

From Healthcare Providers. We receive Consumer Health Data from the licensed physicians and clinical staff within the ZipHealth Provider Group who provide consultations and prescribe treatments through our platform, including clinical notes, diagnoses, and prescribing decisions.

From Pharmacy Partners. We receive information from our licensed Pharmacy partners regarding prescription fulfillment, dispensing, and delivery status.

From Service Providers Acting on Our Behalf. We may receive Consumer Health Data from third-party service providers that perform functions on our behalf, such as payment processors, analytics providers, and technology platforms. A current list of our sub-processors is set forth in Schedule A to our general Privacy Policy.

6. SHARING CONSUMER HEALTH DATA

We may share your Consumer Health Data with the following categories of recipients:

Healthcare Providers. We share your health questionnaire responses, medical profile, and other relevant information with the licensed Providers in the ZipHealth Provider Group to facilitate clinical assessment and treatment.

Pharmacies, E-Prescribing Partners, and Fulfillment Partners. We share information necessary for prescription transmission, dispensing, packaging, and delivery with our licensed Pharmacy partners, shipping carriers, and our e-prescribing technology provider, DoseSpot, LLC. DoseSpot processes this information solely to facilitate prescription transmission under contractual obligations to protect your information.

Affiliates. We may share Consumer Health Data with our parent company, HeliosX Holdings Limited, and MedExpress Enterprises Limited (each with a registered address at Unit H, Ashbourne Drive, Leamington Spa, England, CV31 3SS), and their affiliated entities, including affiliated brands such as MedExpress, Dermatica, and Levity, for purposes described in this CHDPP.

Service Providers and Processors. We engage third-party service providers who perform functions on our behalf pursuant to written contracts. These providers receive only the information necessary to perform their services and are contractually obligated to protect it. A current list of our sub-processors is set forth in Schedule A to our general Privacy Policy.

Professional Advisors. We may share Consumer Health Data with legal counsel, accountants, auditors, and other professional advisors as necessary for business operations.

Parties You Direct. We may share Consumer Health Data with third parties at your direction or with your Consent.

Legal and Safety Disclosures. We may disclose Consumer Health Data when reasonably necessary to comply with applicable law, enforce our Terms of Use, detect or prevent fraud, support auditing functions, or protect the rights, property, or safety of ZipHealth, our users, or the public.

Business Transfers. In the event of a merger, acquisition, reorganization, or sale of assets, Consumer Health Data may be transferred as part of that transaction, subject to applicable law and, where required, prior notice.

We do not sell your Consumer Health Data. If we ever seek to sell Consumer Health Data, we will first obtain a separate, valid authorization from you as required by applicable law, including a clear description of the data to be sold, the purpose of the Sale, the identity of the purchaser, and an explanation of how you may revoke your authorization.

7. TARGETED ADVERTISING AND CONSUMER HEALTH DATA

We do not use or share your Consumer Health Data with third-party advertising networks or marketing platforms for targeted advertising. We do not permit third-party advertising trackers to collect your Consumer Health Data on the Site or through the Services.

Your communications with your Provider, your medical records, your prescribed medications, and any information concerning your sex life or sexual orientation are never disclosed to advertising networks, data brokers, or marketing pixels.

We may share identifiers, internet activity, and inferred interests that do not constitute Consumer Health Data with advertising partners to deliver advertisements promoting ZipHealth on other websites and services, as described in our general Privacy Policy available at ziphealth.co/privacy. These disclosures involve only non-health information and are subject to the terms and opt-out mechanisms set forth in the general Privacy Policy and in Section 11 of this CHDPP.

8. CONSENT

Under applicable Consumer Health Data Laws, we are required to obtain your affirmative consent before collecting or sharing your Consumer Health Data, except where the collection or sharing is necessary to provide a product or service you have requested.

When consent is required, we will present a clear, specific, and conspicuous consent request that describes: (a) the Consumer Health Data to be collected or shared; (b) the purpose for the collection or sharing; and (c) the categories of third parties with whom the data may be shared. You may provide consent through an affirmative opt-in mechanism on the Site. Consent is not obtained through a general terms-of-service acceptance, hovering over or closing a notification, or any mechanism that could be construed as a means of obtaining agreement through inaction.

You may withdraw your consent at any time by contacting us at help@ziphealth.co or by using the opt-out mechanisms described in Section 11 of this CHDPP. We will cease the applicable processing within 15 days of receiving your withdrawal request. Withdrawing consent will not affect the lawfulness of any processing that occurred before the withdrawal.

If you withdraw consent, we may be unable to provide some or all of the Services. Before any reduction or termination of Services resulting from your withdrawal, we will inform you of the specific consequences.

9. YOUR RIGHTS AND CHOICES

Under applicable Consumer Health Data Laws (including the Washington My Health My Data Act and Nevada SB 370), you may have the following rights regarding your Consumer Health Data:

• Right to Confirm and Access: You have the right to confirm whether we are collecting or sharing your Consumer Health Data and to access the Consumer Health Data we hold about you.
• Right to Deletion: You have the right to request that we delete your Consumer Health Data. Upon receiving a verified deletion request, we will delete your Consumer Health Data and direct any processors or affiliates with whom we have shared your data to delete it as well, except to the extent retention is required or permitted by applicable law. We will respond to deletion requests within 30 days.
• Right to Withdraw Consent: You have the right to withdraw your previously provided consent to the collection, use, or sharing of your Consumer Health Data. We will cease the applicable processing within 15 days of receiving your withdrawal request.
• Right to a List of Third Parties: You have the right to request a list of the specific third parties and affiliates with whom we have shared your Consumer Health Data.
• Right to Appeal: If we deny your request, you may submit an appeal by contacting us at help@ziphealth.co within a reasonable timeframe following our denial. If we deny your appeal, you may have the right to file a complaint with the Attorney General of your state.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your rights under applicable Consumer Health Data Laws.

How to Exercise Your Rights: To exercise any right described above, please contact us at help@ziphealth.co, help@dermatica.com (for Dermatica inquiries), by mail at ZipHealth Services Inc., Attn: Privacy Team, 1876 Doctor Andres Way STE 83, Delray Beach, FL 33445, or by telephone at (888) 971-6741. Please include your full name, email address, mailing address associated with your use of the Services, and a clear description of the right you wish to exercise.

Verification: To protect your privacy and security, we will verify your identity before processing your request by matching the information you provide against information we already have on file. We may request additional information if needed to confirm your identity. If we are unable to verify your identity, we will inform you and will not process the request. We will never ask you for your password or full financial account information during the verification process.

Authorized Agents: For requests submitted by an authorized agent, we will require proof of written authorization from you (or a valid power of attorney) and will independently verify your identity.

10. DATA RETENTION

We retain your Consumer Health Data for as long as reasonably necessary to fulfill the purposes described in this CHDPP, maintain your account, and comply with our legal and regulatory obligations. Specific retention periods depend on the nature of the data, the purposes for which it was collected, and applicable legal requirements, including prescription and medical record retention obligations under state and federal law.

Our general retention periods for key categories are as follows:

These periods may vary where applicable law requires a longer retention period. When Consumer Health Data is no longer needed for any of the purposes described in this CHDPP and no legal obligation requires its continued retention, we will securely delete or de-identify it in accordance with our data retention policies and applicable law.

11. MARKETING, TRACKING, AND OPT-OUT

We may use cookies, pixel tags, advertising identifiers, and similar tracking technologies on the Site that could result in the collection of Consumer Health Data, including information about your engagement with health-related content or your use of the Services. As stated in Section 7, we do not use or share your Consumer Health Data with third-party advertising networks or marketing platforms for targeted advertising.

You may opt out of the collection of Consumer Health Data through tracking technologies by:

• Adjusting your preferences through our cookie preference center, accessible via the "Cookie Policy" link on the Site.
• Configuring your browser or device settings to block or delete cookies and limit ad tracking.
• Enabling a recognized opt-out preference signal (such as the Global Privacy Control) in your browser. We honor GPC signals as valid opt-out requests under applicable Consumer Health Data Laws.

To opt out of marketing communications that may involve Consumer Health Data, you may unsubscribe from emails by following the instructions in any marketing email, reply STOP to any marketing text message, or contact us at help@ziphealth.co.

Opting out of marketing and tracking will not affect transactional communications about your account, treatment, prescriptions, or shipments.

12. GEOLOCATION DATA

We may collect location information, including location data derived from your IP address, device settings, and your shipping address when linked to your use of the Services. We may use geolocation data to confirm that you are located in a state where the Services are available, to facilitate medication delivery, and for fraud prevention purposes.

In compliance with applicable Consumer Health Data Laws, we do not use geofencing technology to identify or track consumers who are located within 2,000 feet of a facility that provides healthcare services (or within 1,750 feet where that threshold applies under applicable state law). We do not collect Consumer Health Data through geofencing around healthcare facilities, and we do not use geolocation data to identify consumers seeking specific health services at physical locations.

13. DATA SECURITY

We implement commercially reasonable administrative, technical, and physical safeguards designed to protect Consumer Health Data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit and at rest.
• Access controls limiting Consumer Health Data access to authorized personnel and processors with a legitimate need.
• Regular security assessments and vulnerability testing.
• Employee training on data privacy and security obligations.

No system of data transmission or storage is completely secure. While we strive to protect your Consumer Health Data, we cannot guarantee absolute security and are not responsible for the actions of third parties who may gain unauthorized access despite our safeguards.

14. HOW TO CONTACT US

If you have questions about this CHDPP, our Consumer Health Data practices, or wish to exercise any of your rights under applicable Consumer Health Data Laws, please contact us using the information below:

When contacting us, please include your full name, the email address associated with your account, and a clear description of your question or the right you wish to exercise so that we can respond promptly.

Privacy Policy