RepeatMD Privacy Policy

Last Updated: September 16, 2026

RepeatMD, Inc. ("RepeatMD," "we," "our," or "us") provides business software and patient shopping and rewards experiences. This Privacy Policy explains how we handle personal information across the following services (collectively, the "Services"). The information we collect depends on the service you use.

Service / Who uses it and what this Policy covers

• Corporate and marketing websites: Visitors, prospective business customers, business contacts, and applicants using repeatmd.com, www.repeatmd.com, associated RepeatMD-operated subdomains such as info.repeatmd.com, and our linked forms, demonstrations, events, and communications. These activities support RepeatMD's own business relationships.

• Provider administration: Practices and their authorized staff using admin.repeatmd.app, other RepeatMD-operated administration portals that link to this Policy, and business onboarding, verification, billing, and support services.

• Patient apps and websites: Patients and shoppers using myrepeat.com, www.myrepeat.com, repeatmd.app and applicable Provider subdomains, Patient Rewards and Provider-branded mobile apps, and storefronts or websites on Provider custom domains that RepeatMD operates and that link to this Policy. These services support shopping, rewards, memberships, and related features.

This Policy also covers other RepeatMD-operated services that expressly link to it. It covers only the RepeatMD-operated portions of a website or application. A practice's independently operated website, clinical systems, and third-party services have their own policies. Additional feature-specific notices apply where presented; the separate Ageless assessment experience is addressed in Section 9.

Our role. Medical practices, aesthetic and wellness businesses, and other organizations use RepeatMD to serve their patients and customers (each, a "Provider"). For information processed on a Provider's instructions, we act as its service provider or processor. RepeatMD also determines how information is used for its own corporate relationships, business administration, and other activities described in this Policy. Our role depends on the activity. A Provider's own privacy notice governs its independent handling of your information, including clinical records it maintains and any applicable HIPAA or provincial health-information obligations.

Visiting our marketing website does not enroll you in a Provider's patient program. Provider business-verification information is distinct from patient shopping activity. The privacy choices for website cookies, business marketing, and patient shopping are described separately below.

Using the Services acknowledges this Policy; it does not replace any affirmative consent required by law.

1. Information We Collect

We collect several types of information from and about users of the Services. As used in this Privacy Policy, "Personal Information" means information that identifies, relates to, describes, or is reasonably capable of being associated with a particular individual. Information that has been de-identified or aggregated so it cannot reasonably be linked to an individual, and publicly available information, are excluded only to the extent applicable law provides.

Depending on how you use the Services, the Personal Information we collect may include the following categories:

• Identifiers, such as your name, email address, phone number, date of birth, account identifiers, device identifiers, and IP address;

• Characteristics such as gender, age, or date of birth;

• Business, professional, and verification information, such as your organization, role, business contact details, registration and tax identifiers, supporting business documents, and verification results; and employment and education information you provide when applying for a role;

• Approximate location inferred from network information and device location, which may be precise, when you permit a location-enabled feature;

• Commercial information, such as products, memberships, packages, and treatments you purchase or interact with in the catalog; items you add to your cart; rewards you earn or redeem; RepeatCash and gift card balances and transactions; and purchase and transaction history — including transaction records your Provider shares with us from its practice-management, electronic medical record ("EMR"), or point-of-sale systems (see "Information We Receive from Providers" below);

• Health and wellness information, such as health-related responses to assessments, surveys, or questionnaires, and AI-generated assessment results such as skin analyses and treatment recommendations. Catalog purchases, searches, and expressions of interest may also constitute health information depending on what they reveal about you and applicable law (see "Consumer Health Data" in Section 8);

• Biometric information, such as facial photographs and face-derived data you choose to submit for AI-powered aesthetic assessments — collected only with your consent (see "Biometric Information" in Section 9);

• Audio and electronic information, such as your support communications, chat interactions, and recordings or transcripts where a recording feature is offered with any notice or consent required by law;

• Internet or other electronic network activity, such as your interactions with the Services, app usage events, session data, and device and connection information;

• Inferences, such as shopping preferences derived from catalog interactions and purchases to personalize shopping recommendations, and assessment results derived from information you submit for an assessment. These uses are subject to the separate purposes and choices described in this Privacy Policy; and

• Sensitive Personal Information, including the health-related, biometric, and precise-location information described above to the extent it meets the definition under applicable law. We obtain consent where required and use this information only for the disclosed purposes and as permitted by law. Ordinary cosmetic-shopping activity is not automatically treated as medical information, but its classification depends on its context and what it reveals about an individual.

Information You Provide to Us

You provide information directly to us when you create an account, complete your profile, make a purchase, take an assessment, respond to a survey, participate in a referral program, or contact us for support. This information may include:

Patient account and profile information. We collect information you provide to register, verify your account, and maintain your profile, such as your mobile number, name, email address, date of birth, optional demographic information, and Provider or location preferences. The patient application uses phone verification for sign-in.

Business inquiries and website forms. When you request a demonstration, pricing, information, or resources, subscribe to communications, register for an event, or contact our business team, we collect the contact details, organization or practice information, professional role, and other information you provide through those interactions. We use that information to respond, arrange meetings, provide requested materials, and manage our business relationship and permitted communications.

Provider administration and business verification. We collect business and administrator contact information, account credentials or authentication information, roles and permissions, billing details, and administrative activity. To onboard and verify a practice, we and our verification providers may collect its legal name, address, business registration information, business tax identification number (ordinarily an EIN for a corporation), supporting business documents, representative contact information, and verification results. Information about a corporation is personal information only to the extent it identifies or relates to an individual.

We use verification providers, such as Persona, to collect and check business information. We may prefill information already supplied to us and receive submitted fields and verification results. Relevant information may also be processed by our business onboarding and operations providers to complete onboarding and administer the business relationship. The verification flow explains any additional information required for the applicable check. We do not include business-verification information in patient shopping-recommendation activity records.

Employment inquiries. If you submit a job application or recruiting inquiry through the Services, we process the contact information, resume, employment and education history, and other information you choose to provide to evaluate and respond to your application. Additional applicant or employment notices may apply. A third-party recruiting site may also provide its own privacy notice.

Purchase and checkout information. When you purchase memberships, packages, treatments, or gift cards, we collect order details and any address information you provide. Payments are processed by payment processors such as Stripe, as described in Section 3; we do not collect or store your full payment card number.

Assessment and consultation information. If you choose to take an aesthetic or wellness assessment, we collect your responses and, with your consent, facial photographs used to generate your results.

Communications. The contents of your messages with us, including support chats and conversations with AI advisor features.

Referral information. If you participate in a Provider's refer-a-friend program, we collect the information needed to run it. If you refer a friend, your name may be shown to the person you referred, and you will be able to see the status of your referrals. Please only refer people who would want to hear from your Provider.

Information We Receive from Providers and Their Systems

Where your Provider has connected its practice-management, EMR, booking, or point-of-sale system to the Services, we may receive information from that system so that your purchases, memberships, and visits are reflected in your rewards account. This may include your name, email address, phone number, date of birth, membership and package status, and transaction records such as invoices, line items, amounts, taxes, and payment status. We use this information to operate the Services on your Provider's behalf — for example, to award the rewards you have earned. We may also sync information back to your Provider's system (for example, purchases you make through the Services) so your Provider has an accurate record.

We may also receive information about you from Providers directly (for example, when a Provider enrolls its existing clients in its rewards program), and from service providers that help us verify and enrich contact information. We may combine information we receive from these sources with information we already have about you.

Information We Collect Automatically

As you navigate through and interact with the Services, we automatically collect certain information about your device, browsing actions, and usage patterns, including traffic data, logs, pages and screens you view, features you use, and information about your device and internet connection (including your IP address, operating system, device model, and browser type).

The technologies and services we use for this collection include:

Product analytics and communications. We use analytics and engagement providers, such as Twilio Segment and Customer.io, to understand use of patient features and support account, in-app, email, and text communications. These providers may process account and contact information together with usage events. These functions are separate from the limited recommendation activity described below.

Search and shopping recommendations. We use search providers, such as Algolia, to return catalog results. As shopping-recommendation features become available, we may also use catalog clicks, recommendation clicks, cart additions, and completed purchases to evaluate search and train and improve recommendations. Subject to your choices and applicable law, these features may use shopping history to personalize the products, treatments, packages, and memberships shown to you. Shopping personalization is intended to reflect your shopping interests, rather than assess or diagnose your health. Recommendation models learn within the relevant Provider program, without using one Provider's customer activity to train another Provider's recommendations. Activity may be delivered through an analytics provider, such as Segment, to the recommendation provider. Section 5 describes the controls that apply when these optional features are offered.

Recommendation activity records include catalog item identifiers, event times, purchased quantities where applicable, search-attribution identifiers, and pseudonymous browser or account identifiers. These identifiers allow activity to be associated across interactions without including your name, email address, or phone number in the recommendation activity records sent to the recommendation provider. They are not anonymous information. We use cookies, local storage, or similar device storage to remember privacy preferences and, when permitted, these identifiers.

Our search provider also processes search requests, including the search terms and filters needed to return results, and technical request information. The optional recommendation activity records described here exclude assessment answers, clinical records, facial images, payment card details, business-verification information, and contact details. This limited recommendation data flow is separate from the other analytics and communications described in this Policy. The personalization setting and its effect are described in Section 5.

Performance monitoring and session replay. We use monitoring providers, such as Datadog, to diagnose errors, support users, and improve reliability. Monitoring may include device and session information, pages or screens displayed, interactions, errors, and recordings of a sample of sessions. We may associate this information with account identifiers and contact details to investigate a problem affecting a particular account.

Support tooling. Support providers process your communications and relevant account information when you contact us.

Attribution and app links. We use attribution and link-routing providers, such as AppsFlyer, in supported web and mobile experiences to measure referrals and installations and route links between a website and an app. These features may process referral links, browser or device information, and interaction events.

Cookies and similar technologies. We use cookies, local storage, and similar technologies for authentication, preferences, analytics, and the other functions described in this Policy. Our corporate and marketing websites use form, analytics, and cookie-preference tools, such as HubSpot and tag-management services. Available website choices can be revisited through Cookie Settings. Website cookie choices are separate from the patient shopping-personalization setting and marketing subscriptions.

Location-enabled features. If you allow access through your browser or device, a location feature may use your device location to suggest a nearby Provider location. In the patient guest-location feature, coordinates are used on your device to identify a suggested branch. Other experiences, including assessments, may submit location information as explained in their applicable notice. You can deny or withdraw device-location permission in browser or device settings.

Push notifications. If you enable push notifications in our mobile app, we collect a device push token so we can send them. You can turn push notifications off at any time in your device settings.

The patient shopping-recommendation features described here are intended to personalize experiences within the Services, rather than to target advertisements on other companies' websites or apps.

Tracking Choices; Opt-Out Preference Signals

You can set your browser or device to refuse some or all cookies, or to alert you when cookies are being sent; if you disable cookies, some parts of the Services may not function properly. Your device may also provide tracking and notification controls. Available controls depend on your browser, device and the feature.

We do not sell Personal Information or share it for cross-context behavioral advertising. We honor legally applicable opt-out preference signals, including Global Privacy Control ("GPC"). For optional patient shopping recommendations, a detected GPC signal also disables the covered activity collection and history-based personalization for that browser when those features are available. An account preference can apply within the relevant Provider program as explained in Section 5; a browser signal does not automatically change every other device. Our systems do not respond to the separate legacy browser "Do Not Track" signal.

2. How We Use Information

We use the information we collect to:

• Supply, operate, and improve the Services, process transactions and rewards on our platform, and personalize your experience;

• Operate and evaluate catalog search; use permitted clicks, cart additions, and completed purchases to train and improve shopping recommendation models; and, subject to your choices and applicable law, infer shopping preferences to personalize recommendations;

• Administer your Provider's rewards, membership, referral, and financing programs, including calculating, validating, and redeeming rewards and syncing your activity with your Provider's systems;

• Generate assessment results and recommendations you request, including AI-assisted analyses performed with your consent;

• Communicate with you, including account and transaction notices, rewards notifications, appointment- and membership-related messages, and — with your consent where required — marketing communications sent on our own behalf or on behalf of your Provider;

• Respond to business inquiries, arrange demonstrations and meetings, provide resources, verify and onboard practices, administer business accounts and billing, and evaluate employment inquiries or applications you submit;

• Provide customer support and respond to your requests;

• Perform statistical analysis and improve the functionality, security, and performance of the Services;

• Detect, prevent, and investigate fraud, misuse, and security incidents;

• Comply with our legal obligations, enforce our agreements, and protect our rights and the rights of others.

We collect and use Personal Information only as reasonably necessary to provide the Services you and your Provider request and for the purposes disclosed in this Privacy Policy. Shopping recommendations are suggestions; they do not determine your eligibility for credit, employment, or medical care. Separate verification or financing processes may have their own notices.

3. How We Disclose Information

RepeatMD does not sell your Personal Information, and we do not share it for cross-context behavioral advertising. We never sell health-related or biometric information. We disclose Personal Information only in the following circumstances:

Your Provider. We share your Personal Information with the Provider whose program you participate in so the Provider can operate its rewards, membership, and ecommerce programs; validate and redeem rewards; send you offers and communications; provide services to you; troubleshoot; and prevent fraud. Your relationship with your Provider is direct, and your Provider's use of your information is governed by its own privacy practices.

Service providers. We disclose relevant information to vendors that help us operate the Services, subject to applicable contractual and legal restrictions. Their functions include hosting and storage; authentication and security; payment and tax processing; business verification and onboarding; customer relationship management and business administration; messaging and support; website forms and scheduling; analytics, monitoring, session replay and attribution; search and recommendations; connected practice systems; and processing inputs for requested assessment or AI-assisted features.

Examples include Persona for business verification, Segment for analytics and event delivery, Algolia for search and recommendations, and Customer.io for engagement and business onboarding workflows. Names in this Policy are illustrative, not an exhaustive or permanent vendor list. Not every provider receives every category of information. Vendors processing information on our behalf are restricted to authorized processing under applicable contracts and law. A replacement provider performing the same disclosed function remains subject to these requirements. You may contact privacy@repeatmd.com for more information about the service providers relevant to your use of the Services. We provide additional notice or obtain consent when a change requires it under applicable law.

Payment processing. We use payment processors, such as Stripe, to process payments and subscriptions, facilitate payments to Providers, and help prevent payment fraud. These providers receive the payment, billing, and transaction information needed for those functions, including payment details you submit directly to them. Some processing is governed by their own privacy notices, including processing for their independent legal and fraud-prevention purposes. We do not store your full payment card number. Financing providers you choose are addressed below.

Services you choose independently. If you apply for financing or use another third-party service, that organization may process information for its own legal and business purposes under its own notice. Its role may differ from that of a vendor processing solely on our instructions.

Referral participants. If you are referred by a friend, we may show you the first name of the person who referred you; if you refer friends, you can see the status of the referrals you made.

Related companies. We may share Personal Information with our affiliates and related companies, who will use it consistent with this Privacy Policy.

Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, Personal Information may be transferred as part of that transaction, subject to this Privacy Policy's commitments.

Legal requirements. We may disclose information where required by law or where we reasonably believe disclosure is necessary to comply with legal process or government requests, to protect the rights, property, or safety of RepeatMD, Providers, patients, or others, or to prevent fraud, abuse, or security incidents.

Aggregated or de-identified data. We may create and use aggregated or de-identified information that cannot reasonably be used to identify you, and we commit to maintaining it in de-identified form and not attempting to re-identify it.

4. Rewards Programs — Notice of Financial Incentive

The Services power rewards and loyalty programs offered by your Provider. Because these programs provide benefits (such as points, RepeatCash, discounts, or perks) in connection with the collection of Personal Information, they may be considered a "financial incentive" or "bona fide loyalty program" under certain state privacy laws.

Material terms. Program benefits, earning rules, and redemption rules are set by your Provider and presented in the app when you enroll. The categories of Personal Information involved are identifiers, commercial information (purchases and reward activity), and program participation data.

Opt-in and withdrawal. Participation is voluntary. You opt in by creating an account and participating in your Provider's program, and you may withdraw at any time by deleting your account (see Section 6) or contacting us at privacy@repeatmd.com. Withdrawal may mean forfeiting unredeemed rewards, subject to your Provider's program terms.

Value of your data. We estimate in good faith that the value of the Personal Information collected in connection with the program is reasonably related to the value of the benefits provided to you, based on the expenses we and your Provider incur in providing those benefits.

Effect of privacy requests. If you request deletion of information needed to administer your rewards account, you may lose access to benefits that depend on that information, subject to applicable law. Turning off optional shopping personalization does not cancel your account, forfeit rewards, change program eligibility, or prevent purchases. You will not otherwise be discriminated against for exercising your privacy rights.

5. Your Choices and Opt-Outs

Personalized shopping — where available. Optional recommendation features and their controls may be introduced over time. When offered, the Privacy Choices page accessible from the patient app's privacy link and Account → Privacy Choices lets you enable or disable the covered shopping activity collection and history-based personalization. Guests can save a browser or device choice. A successfully saved signed-in preference applies within that Provider's program when we recognize the account. Manage preferences separately if you use multiple Provider programs. A browser refusal or GPC signal takes precedence over an enabled account preference for that browser.

When these features are offered, ordinary, nonsensitive shopping personalization may be enabled by default where permitted after we provide notice and an opportunity to opt out. In Quebec, behavioral shopping profiling remains disabled until you voluntarily enable it. We obtain affirmative consent wherever applicable law requires it. Enabling a feature by default is not treated as your express consent.

Turning this setting off stops new optional catalog activity from being collected for recommendation training and stops use of your shopping history to personalize the recommendations shown to you. You can still search, shop, participate in rewards programs, and see contextual recommendations, such as items related to the one you are viewing. Necessary transaction processing, fraud prevention, and other analytics described in this Policy continue as applicable; this setting is not an opt-out of every analytics or communications service.

Turning personalization off does not itself erase previously collected records or undo models already developed from permitted activity. We stop further consent-based processing when required and handle retention and deletion under applicable law. You may separately request deletion of related activity records and profiles as described in Sections 6 and 12. This setting does not change your email, text, or push-notification preferences.

Text messages. You may opt out by replying STOP or using another supported, reasonable method described in the message, or by contacting us. We honor requests within the time required by applicable law. Any service-related messages after an opt-out are limited to those we are legally permitted to send.

Email. You may opt out of marketing emails by clicking the "unsubscribe" link in any marketing email or by emailing us at privacy@repeatmd.com.

Push notifications. You can disable push notifications at any time in your device settings.

Cookies and analytics. See "Tracking Choices; Opt-Out Preference Signals" in Section 1. Website visitors can also use the Cookie Settings control where available. Changing website cookie preferences does not by itself change an account-level Patient Rewards personalization choice or marketing-message subscription.

Consent withdrawal. Where we process information based on your consent — including consumer health data and biometric information — you may withdraw that consent at any time in the app or by contacting us (see Sections 8 and 9).

Marketing choices are separate from account administration. We may still send legally permitted service communications, such as security alerts, receipts, or policy notices. Message and data rates may apply to text messages.

6. Your Privacy Rights

Controlling Your Personal Information

Patient account. You can update your profile in account settings and request account deletion through Account → Account Details → Delete Account or by contacting privacy@repeatmd.com. Account deletion applies to the relevant Provider program. We remove profile information or disassociate the account from that program and initiate cancellation of associated memberships. Information needed for your accounts with other Providers may remain. Transaction, rewards, fraud-prevention, and other records may be retained where legally permitted or required, as described in Section 12; closing an account does not automatically erase every associated record. A broader privacy deletion request is handled under applicable law, including applicable exceptions and required service-provider actions. Provider-held records are subject to the Provider's own obligations. Business administrators can contact us about their administrative account or organization's records.

Recommendation data and service-provider copies. Privacy requests may include shopping activity records and derived personalization profiles held on our behalf by providers such as Segment and Algolia. We review these requests under applicable law, including any permitted retention exceptions, and coordinate with relevant service providers where action is required. Processing a request may involve locating records using account or pseudonymous identifiers and additional steps beyond closing the account. For activity recorded before sign-in or on another browser, we may need additional information to locate the associated records. Turning off personalization does not automatically delete historical Segment events or other service-provider records. Separate deletion requests are handled under applicable law.

Email preferences. You can adjust your email preferences at any time using the unsubscribe link in our emails or by contacting us.

State Privacy Rights (United States)

Depending on your state of residence, you may have some or all of the following rights, subject to legal exceptions:

• To confirm whether we process your Personal Information and to access it;

• To obtain a portable copy of Personal Information you provided to us;

• To correct inaccurate Personal Information;

• To delete Personal Information;

• To opt out of targeted advertising, the "sale" of Personal Information, and profiling in furtherance of decisions that produce legal or similarly significant effects (where applicable to our activities);

• To withdraw consent where processing is based on consent;

• Not to receive discriminatory treatment for exercising your rights; and

• To appeal a refusal to act on your request. If we decline your request, we will explain how to appeal, and if your appeal is denied, you may contact your state Attorney General.

Residents of states with additional rights — including Minnesota's rights to question the result of profiling, obtain a list of the specific third parties to which Personal Information was disclosed, and have data reviewed by a human — may exercise those rights using the same contact methods.

To exercise any of these rights, email us at privacy@repeatmd.com or use the in-app tools described above. We will verify your request using information associated with your account (we will not require you to create a new account or provide government identification to exercise opt-out rights), and where you use an authorized agent, we may require reasonable proof of the agent's authority. We will respond within the time required by applicable law (generally 45 days, extendable where permitted).

7. Your California Privacy Rights

This section applies to California residents and supplements the sections above. It does not apply to information exempted by the California Consumer Privacy Act, as amended (the "CCPA").

The categories described in Section 1 may be collected depending on your relationship with us: identifiers and contact information; personal records and demographic characteristics; commercial information; professional, employment, education and business-verification information; location; health-related and biometric information; communications; internet or other electronic activity; and inferences. Sources, purposes, recipients and retention criteria are described in Sections 1–3 and 12. The same categories may be disclosed for the corresponding business purposes to the relevant service providers and other recipients described in Section 3. Sensitive Personal Information is identified in Section 1. These disclosures cover the preceding 12 months as applicable to the features and activities offered during that period; a planned feature does not imply that its data has already been collected.

California residents have the following rights:

Right to Know / Access. You may request the categories and specific pieces of Personal Information we have collected about you, the sources, the business purposes, and the categories of third parties to whom we disclosed it, including a portable copy.

Right to Correct. You may request that we correct inaccurate Personal Information.

Right to Delete. You may request deletion of Personal Information we collected from you, subject to statutory exceptions. You can also delete your account directly in the app (see Section 6).

No Sale or Sharing. We do not sell Personal Information and do not share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the Personal Information of consumers under 16 years of age. If our practices change, we will update this Policy and provide the required opt-out mechanisms first. Where an opt-out preference signal such as the GPC applies, we honor it as described in Section 1.

Limit Use of Sensitive Personal Information. Where the CCPA gives you the right to limit our use or disclosure of Sensitive Personal Information, you may exercise that right through the privacy controls we provide or by contacting privacy@repeatmd.com. Our shopping personalization controls are described in Section 5. We distinguish ordinary shopping preferences from information that qualifies as Sensitive Personal Information under applicable law. Consent to a separate health or biometric assessment does not, by itself, authorize use of its results for shopping personalization. If a use requires a specific limitation mechanism or separate consent, we provide that mechanism or obtain that consent before undertaking the use.

Right to Nondiscrimination. We will not discriminate against you for exercising your CCPA rights. Participation in rewards programs is governed by the Notice of Financial Incentive in Section 4.

Shine the Light. California's Shine the Light law (Cal. Civ. Code § 1798.83) permits California residents to request information about disclosure of Personal Information to third parties for their own direct marketing purposes. We do not disclose Personal Information to third parties for their own direct marketing purposes.

To exercise these rights, email privacy@repeatmd.com. We will verify your identity as described in Section 6, and you may use an authorized agent. If we decline to act on your request, you may appeal by replying to our response or contacting us at the same address.

8. Consumer Health Data (Washington, Nevada, and Similar Laws)

This section applies to information that qualifies as consumer health data under applicable law, including the Washington My Health My Data Act and Nevada's consumer health data law, where those laws apply to our processing. Ordinary cosmetic-shopping preferences are not automatically consumer health data. Where the information or its use meets a legal definition of consumer health data, the additional protections in this section apply.

Categories and sources. Depending on the features you use, covered information may include information identifying the treatments or services you purchase or seek; assessment responses, photographs, and results; related communications; and health-related inferences. We receive this information directly from you, from your interactions with the Services, from your Provider and its connected systems, and from service providers generating results at your request. Sections 1 and 9 explain these sources and categories in more detail.

Purposes. We use covered information to deliver services you request, operate your Provider's program, process transactions, generate requested assessment results, provide support, and comply with applicable obligations. If shopping activity qualifies as consumer health data, using it to develop recommendations or personalize shopping is subject to the consent and other requirements that apply to that data. We do not treat optional recommendation profiling as automatically necessary to complete a purchase.

Consent. We collect, use, or share consumer health data only with the consent required by applicable law or under an applicable legal exception, such as processing necessary to provide a product or service you request. Where required, consent to sharing is obtained separately from consent to collection. We obtain any required consent before optional processing begins. Consent to an assessment does not by itself authorize using its results for shopping recommendations, and acknowledgment of this Policy does not replace a required consent.

Disclosures. Depending on the service and your choices, the categories of covered information described above may be disclosed to your Provider and to contracted service providers supporting hosting and storage, connected practice systems, transactions, communications, support, and requested assessment features. Where lawfully permitted for shopping recommendations, limited catalog activity and pseudonymous identifiers may be processed by Segment and Algolia as described in Section 1. We apply the legal distinction between processors acting on our instructions and other recipients; the general vendor list in Section 3 does not mean every vendor receives every category of health data.

No sale. We do not sell consumer health data.

No geofencing. We do not use geofencing around health care facilities to identify, track, or send notifications or advertisements to consumers seeking health care services.

Your rights. Subject to applicable law, you have the right to confirm whether we collect, share, or sell consumer health data about you; to access it, including information about recipients; to withdraw consent; and to have it deleted. To exercise these rights, email privacy@repeatmd.com. We pass applicable deletion requests to relevant processors and other recipients as required by law. If we deny your request, you may appeal by replying to our response; if your appeal is unsuccessful, you may contact your state Attorney General.

9. Assessments and Biometric Information

If you choose an aesthetic or wellness assessment, its feature-specific privacy and consent notices explain the photographs, facial measurements, assessment responses, and results processed for that feature. Some facial or derived information may qualify as biometric information under applicable law. We obtain the consent required by law before collecting or processing it, and limit use and disclosure to the disclosed purposes.

The separate Ageless experience is governed by its Privacy Policy and the biometric notice presented in that experience. Those notices set out the applicable retention and destruction schedule, recipients, and withdrawal process. This shared Policy does not extend that schedule or authorize a new use of those inputs.

We do not sell biometric information. Consent to an assessment is separate from permission to use shopping activity for recommendations. Assessment responses, images, and biometric information are excluded from the shopping-recommendation activity records described in Section 1. Contact us or use the feature's stated process to withdraw consent or request deletion.

10. Additional State Rights Notes

Maryland residents. We collect Personal Information only as reasonably necessary to provide the Services you request, and we do not sell sensitive data (including consumer health data) or process Personal Information for targeted advertising.

Nevada residents (NRS 603A). Nevada law also allows residents to opt out of the "sale" of certain covered information. We do not sell covered information as defined under that law; you may nonetheless submit a verified opt-out request for any future sales by emailing privacy@repeatmd.com. Nevada consumer health data rights are described in Section 8.

Residents of other states may exercise applicable rights through the contact methods in Section 6.

11. Canadian Residents

If you reside in Canada, we collect, use, and disclose your Personal Information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25).

Consent. We obtain meaningful consent in the form required by applicable law. For ordinary, nonsensitive shopping personalization within your reasonable expectations, we may rely on implied consent where permitted, after explaining the information used, the purpose, the relevant service providers, and how to decline. We obtain express consent where required, including for sensitive information or uses outside your reasonable expectations. Acceptance of this Policy alone does not replace required express consent. Marketing messages are subject to the CASL rules below. You may withdraw consent at any time, subject to applicable legal restrictions. Withdrawing consent to optional shopping personalization does not prevent use of the underlying shopping or rewards services.

Cross-border transfers. Your Personal Information may be transferred to, stored, or processed in the United States and other jurisdictions where we or our service providers operate. While outside Canada (or outside Quebec), it is subject to the laws of those jurisdictions. We use contractual and technical safeguards designed to provide comparable protection, and we assess transfers as required by Quebec law.

Quebec residents. Our designated Person in Charge of the Protection of Personal Information can be reached at privacy@repeatmd.com. You have rights of access, rectification, de-indexing, and — for computerized Personal Information you provided — portability in a structured, commonly used technological format. We inform you when we use technology with identification, location, or profiling functions and explain how applicable optional functions can be activated. When optional behavioral shopping profiling is offered to Quebec residents, it remains disabled unless you voluntarily enable it through the available privacy controls. You can turn it off again at any time. Other technologies remain subject to the requirements applicable to them.

Commercial electronic messages (CASL). We send commercial electronic messages (email and text) only with your consent or as otherwise permitted by CASL. Each message identifies the sender and the Provider on whose behalf it is sent, includes contact information, and contains an unsubscribe mechanism that we honor within ten (10) business days.

Health information. Where your Provider is subject to provincial health information laws (such as Ontario's PHIPA), we act as its service provider/agent and use personal health information only as necessary to provide the Services to that Provider.

Complaints. You may contact us with any privacy concern at privacy@repeatmd.com. You also have the right to complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator (in Quebec, the Commission d'accès à l'information).

12. Data Retention

We retain Personal Information for as long as reasonably necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law. In general:

• Account and profile information is retained to operate the relevant account and handle permitted administrative and legal needs. Account closure and broader deletion requests are handled as described in Section 6;

• Transaction, rewards, and payment records are retained as needed for accounting, tax, audit, dispute resolution, fraud prevention, and applicable legal obligations. Account closure does not automatically de-identify those records;

• Consumer health data and assessment results are subject to their disclosed purposes, applicable feature-specific retention schedules, consent withdrawal, valid deletion requests, and legal obligations;

• Biometric information is retained as described in Section 9;

• Business inquiry, verification, administrative account, recruiting, communications, and support records are retained as reasonably needed for the relevant relationship, application, request, and applicable legal obligations. Any separate applicant or employment notice may provide additional retention information;

• Shopping activity, recommendation events, and derived preference profiles may be retained to operate and evaluate search, understand shopping preferences, measure performance over time, and develop and improve recommendations, subject to your choices and applicable law. The retention period depends on the continuing need for those purposes, the nature and relevance of the information, the service and provider involved, applicable provider retention periods, and legal obligations or valid privacy requests. We do not apply a single fixed retention period to every category of shopping or analytics data. Turning off personalization does not, by itself, erase historical records. We delete or de-identify information when no longer needed for a permitted purpose or when required by law. Pseudonymous records that remain linkable to a person, account, or device remain subject to applicable privacy protections.

• Other analytics and log data are retained for periods appropriate to their operational, security, measurement, and service-improvement purposes, taking account of applicable service-provider retention limits and legal requirements. Properly de-identified or aggregated information may be retained for longer periods where permitted by law.

13. Security

We maintain administrative, technical, and organizational safeguards designed to protect Personal Information, taking account of its nature and the risks of processing. No internet transmission or storage system is completely secure. You are responsible for safeguarding your account credentials and verification codes.

14. Age Requirement

The Services are intended for individuals aged 18 or older and are not directed to anyone under 18. If we learn that someone under 18 has provided Personal Information through the Services, we will take appropriate steps to address the account and delete the information as required by applicable law. Contact privacy@repeatmd.com if you believe a minor has provided information through the Services.

15. Exclusions; Links to Other Websites

Personal information included in feedback or suggestions is handled under this Policy.

The Services may contain links to third-party websites or services that we do not operate or control, including your Provider's own website, booking, and financing pages. This Privacy Policy applies only to the Services. We are not responsible for the privacy practices of third parties, and we encourage you to review their privacy policies.

16. Changes to This Privacy Policy

We may update this Policy as our practices or applicable law change. Substituting a service provider for the same disclosed purpose does not necessarily require a revision to this general Policy. We will update disclosures and provide notice or obtain consent when required, including for material changes in purposes, information collected, or disclosures. Separate legally or contractually required vendor notices continue to apply. We will update the Last Updated date when this Policy changes. Continued use does not replace any affirmative consent required by law.

17. Contacting Us

You may exercise the privacy rights described above, or ask questions about this Privacy Policy, by contacting us:

RepeatMD, Inc.

Email: privacy@repeatmd.com