Consumer Health Data Policy

Effective September 2, 2025

Particle Aesthetic Science Ltd.’s (“Particle,” “our,” “we,” or “us”) Privacy Policy describes how Particle handles your personal information generally. Certain U.S. state laws require specific disclosures regarding consumer health data. This Consumer Health Data Policy (“Policy”) supplements our Privacy Policy and describes how we collect, use, and share your consumer health data.

This Policy does not apply to protected health information as defined by the Health Insurance Portability and Accountability Act (“HIPAA”) as Particle is not subject to HIPAA.

Consumer Health Data We Collect

“Consumer health data” is personal information that identifies your past, present, or future physical or mental health status. Particle collects consumer health data only in specific circumstances related to adverse reactions to our products, from the following sources:

Directly from you, when you voluntarily report an adverse reaction through our reaction survey or customer service channels (including by emailing us at [email protected]).

Particle collects the following consumer health data only if you experience an adverse reaction and choose to report it:

Required Information:

Contact and identification information: Your name, email address, mailing address, and phone number
Product usage information: Date you started using our product, which specific product was used, when you stopped using the product, whether the product was restarted and if so, at what dosage.
Reaction details: Description of the reaction you experienced, whether the reaction subsided when product use was stopped
Medical consultation information: Whether you saw a medical professional (e.g., a dermatologist), whether any testing was performed
Visual documentation: Photos of the reaction effects, if you choose to provide them

Optional Information:

Demographic information: Sex at birth, gender, weight, race
Medical history: Relevant medical history that may relate to the reaction

We do not collect consumer health data for any other purposes or through any other means.

Our Use of Consumer Health Data

We use your consumer health data only for the following purposes:

Product safety and improvement: to investigate adverse reactions, improve product formulations, and enhance product safety.
Regulatory compliance: to comply with FDA adverse event reporting requirements and other regulatory obligations in applicable jurisdictions regarding product safety
Customer support: to assist you with your specific adverse reaction and provide appropriate follow-up care recommendations
Legal Protection: to comply with the law, respond to legal process, protect our rights and property, and protect the health and safety of others

We do NOT use consumer health data for:

Marketing or promotional purposes
Targeted advertising
Creating consumer profiles for commercial purposes
Any purpose other than those listed above

How We Share Consumer Health Data

We may share your consumer health data only in the following limited circumstances:

With regulatory authorities: this includes with the U.S. Food and Drug Administration, Health Canada, European Medicines Agency (EMA), and other applicable regulatory bodies when required or requested to report adverse events or comply with product safety regulations in any jurisdiction where our products are sold.
With service providers: in cases where such service providers assist us in processing adverse reaction reports, but only to the extent necessary and under strict confidentiality agreements.
With law enforcement or government agencies: where required by law, court order, or to protect health and safety in emergency situations.
With potential purchasers: including in connection with or during negotiation of any reorganization, merger, acquisition, financing, or sale of all or a portion of our assets. We cannot promise that an acquiring party or the merged entity will have the same privacy practices or treat your information the same as described in this Policy.

Wed not “sell” consumer health data as defined in applicable law, nor do we allow third parties to collect consumer health data through our website or Services for their own purposes.

Security of Consumer Health Data

We implement appropriate technical and organizational safeguards to protect your consumer health data against unauthorized access, disclosure, alteration, and destruction. These measures include:

Encryption of consumer health data in transit and at rest
Access controls limiting employee access on a need-to-know basis
Regular security assessments and updates
Secure data storage and transmission protocols

Your Rights Regarding Consumer Health Data

You have the following rights regarding your consumer health data:

Right to Deletion: You may request that we delete your consumer health data, including from backup systems, subject to legal requirements to retain certain safety information.
Right to Withdraw Consent: You may withdraw your consent for our collection and use of your consumer health data at any time.
Right to Appeal: If we deny your request, you have the right to appeal our decision.

How to Exercise Your Rights

To exercise these rights, please contact us at [email protected]. We will respond to your request within a reasonable period of time. If we deny your request, you may appeal by emailing us again at [email protected] within 10 days of our denial.

Consent Requirements

Collection: We will only collect your consumer health data with your affirmative, voluntary consent, which we obtain when you choose to submit an adverse reaction report.
Sharing: We require separate, specific consent before sharing your consumer health data with any third parties, except as required by law or regulation.
Sale: We do not sell consumer health data under any circumstances.

Prohibited Practices

We do not and will not:

Discriminate against you for exercising your rights under this Policy
Collect consumer health data beyond what is necessary for adverse reaction reporting
Use consumer health data for marketing or advertising purposes

Data Retention

We retain consumer health data only as long as necessary for:

Product safety monitoring and improvement
Regulatory compliance requirements (including FDA adverse event reporting obligations and similar requirements in other jurisdictions)
Legal obligations

Consumer health data submitted to regulatory authorities may be retained by those agencies according to their own retention policies. When we are permitted to anonymize data for regulatory reporting purposes, we may choose to do so to enhance privacy protection while meeting our safety obligations.

When no longer needed for the purposes above, we securely delete or anonymize consumer health data in accordance with our data retention schedule.

Processors and Third Parties

Any third-party processors who handle consumer health data on our behalf are contractually required to:

Process data only as instructed by Particle
Implement appropriate security measures
Not use the data for their own purposes
Assist us in responding to consumer requests
Delete or return data upon termination of services

Changes to this Policy

We will update this Policy when necessary to reflect changes in our practices or applicable law. When we post changes, we will revise the “Effective Date” at the top of this Policy.

How to Contact Us

For questions about this Consumer Health Data Policy or our privacy practices, contact us at [email protected]