YourEra Consumer Health Data Privacy Policy

Washington's My Health My Data Act and Nevada Senate Bill 370 require us to publish a separate policy addressing consumer health data. This is that policy. It applies if you are a resident of Washington or Nevada, or if we collect your information while you are in Washington.

This document covers consumer health data only. Our general privacy policy, which covers everything else, is at yourera.com/privacy.

1. How this policy relates to health care privacy law

Neither Your Era Management, L.L.C. nor Thryv Telehealth by Lavin, P.C. is subject to the federal health privacy law known as HIPAA. The laws described in this policy therefore govern your questionnaire answers, your photographs, your messages and the records of your care, without any federal exemption applying to them. The pharmacies that fill prescriptions may each be subject to HIPAA, and where we hold a pharmacy's records on its behalf those particular records are governed by that law instead. The practical outcome is the same in either case, because we do not share any of it with advertising, analytics or measurement companies.

2. What we mean by consumer health data

These laws define the term broadly. It covers any information linked to you that identifies your past, present or future physical or mental health, including information we infer rather than information you provide to us directly.

3. What consumer health data we collect, and why

We collect the following categories:

• Health conditions, symptoms, medical history and diagnoses you tell us about
• Measurements such as your height, weight and other figures you provide
• Medications you are taking, and medications prescribed to you through our service
• The care you receive through our service, and the records of it
• Photographs you upload for clinical review
• Messages between you and your care team
• The fact that you are seeking or receiving health care services from us, including which of our pages you looked at and what you purchased

We collect it for a single purpose, which is to provide the health care services you have requested. This includes providing your information to a licensed clinician for review, arranging and dispensing any prescription, dispatching it to you, communicating with you about your care, taking payment, maintaining the records the law requires us to maintain, and keeping our systems secure.

We do not use consumer health data to advertise to you, to build advertising audiences, or to measure advertising.

4. Where we get it

• Directly from you, when you fill in our questionnaire, upload a photograph, or send a message
• Automatically from your device when you use our site, which includes the pages you visit and your IP address
• From the clinicians who review your care and the pharmacies that fill and ship your prescription

5. What we share, and with whom

We share consumer health data with the following specific affiliates:

• Thryv Telehealth by Lavin, P.C., the medical practice whose clinicians review and provide your care
• Galleria Medical Pharmacy, LLC, a pharmacy that fills and ships prescriptions

We also share it with two independent pharmacies that are not affiliates of ours, Diversified Pharmacy, Inc., doing business as MediVera Compounding Pharmacy, LLC, and VitalRX, LLC, doing business as VialsRx, each of which fills and ships prescriptions.

We share it with the following categories of third parties, in each case only so that they can perform a service for us and only to the extent they need it:

• Technology and hosting providers that store and operate our systems
• The provider of the medical records system in which your records are held
• The provider of the customer record system in which your account and your order are managed
• Our payment processor
• Shipping and delivery companies
• Customer support and call center providers, including an outside company whose representatives speak with customers on our behalf
• Companies that send our emails and text messages
• Companies that help us understand how our site is used and make it work better, which operate only for our own internal purposes
• Fraud prevention and security providers
• Professional advisers, and courts, regulators or law enforcement where the law requires it

6. Your rights

Under these laws you have the right to:

• Confirm whether we are collecting, sharing or selling your consumer health data
• Get a list of all the third parties and affiliates with whom we have shared it, and contact details for each of them
• Withdraw your consent to our collection and sharing of it
• Have it deleted

To exercise any of these rights, please email privacy@yourera.com. We will verify your identity before acting, which ordinarily means confirming access to the email address associated with your account.

We will respond within 45 days. If we require longer we will explain why within that period and may take up to 45 further days. There is no charge. We will not degrade the service, charge a different price, or hold the request against you.

If you ask us to delete your consumer health data, we will delete it from our systems and instruct every affiliate and third party that received it to do the same. Where the law requires a clinician or a pharmacy to retain a medical or dispensing record for a set period, that record must be retained until the period ends, and we will tell you which records are affected.

If we decline a request, we will explain why and how to appeal. If we decline your appeal, you may submit a complaint to the Washington Attorney General at atg.wa.gov/file-complaint or the Nevada Attorney General at ag.nv.gov/Complaints/File_Complaint.

7. How to contact us

Your Era Management, L.L.C., 1331 Ochsner Blvd., Suite 200, Covington, Louisiana 70433. Email privacy@yourera.com.