Consumer Health Data Privacy Notice

CONSUMER HEALTH DATA PRIVACY NOTICE

Aspen Aesthetics, LLC, dba Fifty 410 Health

Effective Date: September 2026  |  Last Updated: September 8, 2026

This Notice supplements our Privacy Policy and is provided under the Washington My Health My Data Act (RCW 19.373), the Nevada consumer health data law (NRS 603A.400 et seq.), and the consumer health data provisions of the Connecticut Data Privacy Act. It is published separately, as those laws require.

Who This Notice Covers

Under Washington's My Health My Data Act, a consumer includes a Washington resident or an individual whose consumer health data is collected in Washington, acting in an individual or household capacity. You do not have to live in Washington to qualify under the second category. This Notice also describes protections for Nevada and Connecticut residents to the extent their respective laws apply.

The rights and obligations described here apply only where the relevant law covers the individual, entity, information, and processing involved, and remain subject to that law's exclusions and exemptions. Washington's definition of consumer does not include an individual acting in an employment context.

TO THE EXTENT AN APPLICABLE STATE LAW EXEMPTS PROTECTED HEALTH INFORMATION GOVERNED BY HIPAA, THAT INFORMATION IS HANDLED UNDER HIPAA AND THE APPLICABLE PROVIDER OR PHARMACY NOTICE OF PRIVACY PRACTICES. THIS NOTICE APPLIES TO CONSUMER HEALTH DATA THAT REMAINS WITHIN THE SCOPE OF THE APPLICABLE STATE LAW.

For the Practice's clinical privacy practices, see its HIPAA Notice of Privacy Practices.

1. CATEGORIES OF CONSUMER HEALTH DATA WE COLLECT

• Individual health conditions, treatments, diseases, symptoms, and diagnoses
• Medications, prescriptions, dosage, and refill activity
• Bodily functions, vital signs, measurements, weight, and BMI
• Efforts to seek health care services, including intake submissions and consultation scheduling
• Information that identifies you as seeking weight management, hair care, hormone care, or other compounded medication treatments
• Data that can be used to infer any of the above, including inferences derived from your interactions with the Services

2. SOURCES OF CONSUMER HEALTH DATA

Directly from you; from the licensed Providers and pharmacies who treat you and fill your prescriptions; from laboratory partners; from our patient intake and portal platform; and from your interactions with our website.

3. PURPOSES FOR COLLECTION AND USE

To provide and coordinate the Services you request; to enable clinical evaluation and prescribing by a licensed Provider; to arrange dispensing, shipping, and refills; to bill and process payments; to communicate with you about your care; to monitor safety and adverse events; to improve the Services; to prevent fraud and diversion; and to comply with law.

How We Process Consumer Health Data

We may collect, record, organize, store, retrieve, review, transmit, and delete consumer health data as reasonably necessary for the purposes above. Automated systems may route information to the appropriate Provider, pharmacy, laboratory, payment processor, or service provider, but clinical decisions are made by a licensed Provider exercising independent medical judgment.

4. THIRD PARTIES AND AFFILIATES WITH WHOM WE SHARE CONSUMER HEALTH DATA

Depending on the Services you request, the categories shared may include contact and identity information; care-seeking and intake information; health history, symptoms, measurements, and treatment preferences; prescription, medication, and refill information; laboratory information; billing and payment-status information; fulfillment and shipping information; communications; and technical or security information. We limit each disclosure to the categories reasonably necessary for the recipient's role.

We share consumer health data with the following categories of recipients:

• Independently licensed Providers and professional entities that evaluate and treat you
• Compounding and dispensing pharmacies that fill and ship your prescriptions
• Laboratory partners that perform ordered testing
• Our patient intake, electronic health record, and patient portal platform
• Cloud hosting and infrastructure providers
• Payment and financing processors
• Shipping and logistics providers
• Customer support, email, and text messaging platforms

Specific affiliates: Fifty 410 does not currently share consumer health data with a corporate affiliate, as that term is defined by these state consumer health laws. Independent Providers, pharmacies, laboratories, and service providers are treated as third parties rather than affiliates for purposes of this Notice.

To request the named third parties within any category above, and an active contact for each, email Hello@fifty410.legal and we will provide the current list.

We do not permit a third party to collect consumer health data through our Services over time and across unrelated websites or online services for targeted advertising. We do not deploy third-party analytics or advertising pixels on this website.

5. WE DO NOT SELL CONSUMER HEALTH DATA

WE DO NOT SELL CONSUMER HEALTH DATA. WE WILL NOT SELL CONSUMER HEALTH DATA WITHOUT FIRST OBTAINING YOUR VALID, WRITTEN AUTHORIZATION THAT MEETS THE REQUIREMENTS OF APPLICABLE LAW.

6. NO GEOFENCING

We do not use geofencing technology within 2,000 feet of any in-person health care facility to identify or track consumers seeking health care services, collect consumer health data, or send notifications, messages, or advertisements related to consumer health data or health care services.

7. YOUR RIGHTS REGARDING CONSUMER HEALTH DATA

You have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data, and to access that data, including a list of all third parties and affiliates with whom we have shared it and an active email or contact for each;
• Withdraw consent to the collection and sharing of your consumer health data;
• Review and correct consumer health data we maintain about you, subject to applicable identity-verification, medical-record, and legal requirements; and
• Delete your consumer health data. Upon a valid deletion request, we will delete the data from all of our records, including archived and backup systems, and will notify all affiliates, processors, contractors, and other third parties with which we have shared the data of the deletion request.

Deletion limits. We may retain consumer health data where retention is required by federal or state law, including medical and pharmacy record retention requirements. Where we cannot delete, we will tell you which data we retained and the legal basis.

Deletion from archived or backup systems may be delayed where applicable law allows, including for up to six months under Washington law. During that period, the data will not be restored to an active system except as permitted by law.

Consent

Where consent is required, the request will describe the categories of consumer health data involved, the purpose, and how the data will be used. A request for consent to share consumer health data will be presented separately from a request to collect it, and consent will not be bundled into general Terms of Service.

8. HOW TO EXERCISE THESE RIGHTS

Email Hello@fifty410.legal, or write to Privacy Officer, Aspen Aesthetics, LLC dba Fifty 410 Health, 1630 W Prosper Trail, Suite 620, Prosper, Texas 75078.

We will respond within 45 days, with one 45-day extension where reasonably necessary. Requests are free for up to two per twelve-month period. If we deny your request, you may appeal to Hello@fifty410.legal with the subject “Consumer Health Data Appeal”; we will respond within 45 days and, if the appeal is denied, provide instructions for contacting your state Attorney General.

Consumers protected by Washington's My Health My Data Act may also file a complaint with the Washington State Attorney General at atg.wa.gov/file-complaint.

9. MATERIAL CHANGES TO THIS NOTICE

If we make a material change affecting consumer health data already collected, we will post the revised Notice and provide additional notice through an appropriate direct channel, such as email or the patient portal, before the change takes effect where required. We will obtain affirmative consent before collecting, using, or sharing additional categories of consumer health data, or using data for a materially different purpose, when applicable law requires consent.