Phothera (Daavlin Distributing Co. d/b/a Phothera) Consumer Health Data Privacy Policy

Effective Date: October 1, 2026

This Consumer Health Data Privacy Policy describes how Phothera collects, uses, shares, and protects “consumer health data” as that term is defined under state consumer health data laws, including the Washington My Health My Data Act, Nevada SB 370, and the consumer health data provisions of other applicable state privacy laws. It applies to residents of those states and to consumer health data collected through Phothera.com, our customer service and device support channels, product registration and refill processes, surveys, and other communications with us.

This policy supplements, and does not replace, our general Privacy Policy. Where this policy and the general Privacy Policy conflict with respect to consumer health data, this policy controls.

Phothera is a health care provider covered by the Health Insurance Portability and Accountability Act (“HIPAA”) with respect to the products and services we provide to patients, including when we bill health plans for those products. Protected health information we collect, use, or disclose in that capacity, such as information used to fulfill a prescription, provide device support, or obtain payment, is governed by HIPAA and our Notice of Privacy Practices, available on our website, and not by this policy. This policy applies to consumer health data that is not protected health information.

What Consumer Health Data Means

Consumer health data is personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. For Phothera, this generally includes information indicating that you use or are considering phototherapy treatment, information about the skin or other conditions for which treatment is sought, and information about your treatment activity and outcomes.

Categories of Consumer Health Data We Collect

We collect the following categories of consumer health data:

Health conditions and diagnoses you tell us about, including skin and other conditions for which phototherapy is prescribed or considered
Treatment and therapy information, including prescribed treatment protocols, treatment sessions, dosage or exposure settings, and treatment outcomes or experiences you report to us
Product and device information linked to your treatment, including product registration details, serial numbers, device usage and service history, and refill or unlock code requests
Healthcare provider relationship information, including the identity of your prescribing or treating provider and the practice associated with your treatment
Communications about your treatment, including customer service inquiries, technical support requests, survey responses, and appointment or treatment-related messages
Contact and identifying information when it is linked to any of the above, including your name, email address, telephone number, and mailing address
Inferences drawn from the above that identify or are reasonably linkable to your health status

We do not intentionally collect precise geolocation data that could reasonably indicate an attempt to acquire or receive health services or supplies.

Sources of Consumer Health Data

We collect consumer health data from the following categories of sources:

Directly from you, through forms, product registration, refill requests, email, telephone calls, chat tools, surveys, and other communications
From your healthcare provider or their practice, where the provider submits a prescription, order, or support request on your behalf
From our service providers and processors that operate our websites, customer relationship management systems, communication tools, and support systems on our behalf

Purposes for Collecting and Using Consumer Health Data

We collect and use consumer health data only for the following purposes:

To supply, register, activate, and support phototherapy devices and related products
To process and fulfill refill requests and issue refill unlock codes
To provide technical support, troubleshooting, warranty service, and repairs
To respond to your inquiries and communicate with you or your healthcare provider about your treatment
To send treatment-related, appointment, or device support communications you have requested
To verify prescriptions and confirm eligibility for products that require a prescription
To conduct product safety monitoring, complaint handling, and adverse event reporting required by law
To improve the safety, quality, and performance of our products, in a de-identified or aggregated form wherever practicable
To comply with legal, regulatory, and recordkeeping obligations, and to establish, exercise, or defend legal claims
With your separate consent, to send you educational and promotional communications about phototherapy and Phothera products, which may be tailored using the consumer health data you provide

We do not use consumer health data for targeted advertising, for cross-context behavioral advertising, or to profile you in furtherance of decisions that produce legal or similarly significant effects.

Sharing of Consumer Health Data

We share the categories of consumer health data described above with the following categories of third parties, and only to the extent necessary for the purposes stated in this policy:

Processors and service providers that host our websites and databases, operate our customer relationship management and support systems, deliver email and SMS communications, administer surveys, and provide security monitoring, in each case under a written contract limiting them to processing on our behalf
Healthcare providers and their practices, where sharing is necessary to support your prescribed treatment
Shipping and logistics providers, to the extent necessary to deliver products to you
Professional advisors, including legal counsel and auditors, under duties of confidentiality
Regulators and government authorities, where disclosure is required by law or necessary for mandatory safety or adverse event reporting
An acquirer or successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to the protections in this policy

Third Parties and Affiliates

In addition to the categories described above, we may share consumer health data with:

Healthcare providers (including specialty pharmacies)
Authorized/legal representatives, family members, and caregivers
Third parties that help administer, manage, and analyze our programs and services
Payment processors, financial institutions, and others as needed to complete transactions and for authentication, security, and fraud prevention
Third parties who deliver our communications, such as the postal service and couriers
Service providers that deliver email communications and provide data analytics services on our behalf, under written contracts limiting them to processing on our behalf
Third parties who assist with our information technology and security programs
Third parties as reasonably necessary to facilitate a merger, sale, joint venture or collaboration, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings)
Legal and regulatory bodies and other third parties as required by law

We do not share consumer health data with advertising networks, data brokers, or social media platforms, and we do not permit advertising technologies to collect consumer health data through our Services.

We Do Not Sell Consumer Health Data

We do not sell consumer health data, and we do not exchange consumer health data for monetary or other valuable consideration. We will not sell your consumer health data unless you have first signed a valid authorization that meets the requirements of applicable law. Any such authorization would be separate from this policy and from any consent to collect or share, would describe the specific data and recipient involved, would be valid for no more than one year, and could be revoked by you at any time.

Consent and Withdrawal of Consent

We collect consumer health data only after you have given consent, or where the collection is necessary to provide a product or service that you have requested from us. We obtain your consent separately from any other terms, and we do not condition the provision of a product or service on your consent to collection or sharing that is not necessary to provide it.

We obtain a separate consent before sharing consumer health data, other than sharing with processors acting on our behalf and sharing that is necessary to provide a product or service you have requested.

You may withdraw your consent to the collection or sharing of your consumer health data at any time by contacting us using the details below. Withdrawal takes effect prospectively and does not affect processing carried out before we received your request. If you withdraw consent that is necessary for us to supply or support your device, we may not be able to continue providing that product or service, and we will tell you if that is the case.

Your Rights Regarding Consumer Health Data

Subject to applicable law, you have the right to:

Confirm whether we are collecting, sharing, or selling your consumer health data, and to access that data
Obtain a list of all third parties and affiliates with which we have shared or to which we have sold your consumer health data, together with contact information for each
Withdraw your consent to the collection or sharing of your consumer health data
Delete your consumer health data, including copies held by our processors and, where required by law, by third parties with which we have shared it
Appeal a decision by us to decline to act on your request

We will not discriminate or retaliate against you for exercising any of these rights.

Limits on Deletion

We may retain a limited record of a deletion request and the minimum information necessary to honor it, and we may retain information where retention is required by law, including product safety, adverse event, and recordkeeping obligations. Where an exception applies, we will delete everything we are permitted to delete and will tell you why any remaining information was retained.

How to Exercise Your Rights

Submit a request by email to [email protected] with the subject line “Consumer Health Data Request,” or by mail to Phothera, Attn: Privacy Officer, 205 W. Bement St., Bryan, OH 43506 USA.

We will confirm receipt of your request and respond within 45 days. Where reasonably necessary, we may extend that period by an additional 45 days and will notify you of the extension and the reason for it within the initial 45-day period. Responses are provided free of charge, subject to the limits applicable law allows for repeated or excessive requests.

We may take reasonable steps to verify your identity before acting on a request, using information already in our records. You may designate an authorized agent to submit a request on your behalf; we may require written proof of the agent’s authority and may require you to verify your identity directly with us.

Appeals

If we decline to act on your request, we will tell you why and explain how to appeal. To appeal, reply to our decision or write to [email protected] with the subject line “Consumer Health Data Appeal.” We will respond to your appeal in writing within 45 days and will explain the basis for our decision. If your appeal is denied, you may submit a complaint to the Washington State Attorney General, the Nevada Attorney General, or the attorney general or supervisory authority for your state.

Data Retention

We retain consumer health data only as long as reasonably necessary for the purposes described in this policy. As a general matter, we retain treatment and device support records for 30 years to meet product safety and regulatory recordkeeping obligations and customer service and support communications for 3 years after the inquiry is closed. When consumer health data is no longer required, we securely delete or de-identify it.

Security and Access Controls

We maintain administrative, technical, and physical safeguards designed to protect consumer health data against unauthorized access, disclosure, alteration, and destruction. Access to consumer health data is restricted to those employees, contractors, and processors who need it to perform the purposes described in this policy, is governed by role-based access controls, and is subject to confidentiality obligations and privacy training. Our contracts with processors require them to maintain equivalent safeguards, to process consumer health data only on our instructions, and to delete or return it at the end of the engagement.

No method of transmission or storage can be guaranteed to be completely secure. If we become aware of a security incident affecting consumer health data, we will notify affected individuals and regulators as required by applicable law.

Children

Our Services are not directed to children under 13 years of age, and we do not knowingly collect consumer health data from children under 13. Where a device is prescribed for a minor, we collect consumer health data from the parent, legal guardian, or prescribing provider and treat it in accordance with this policy.

Changes to This Policy

We may update this policy from time to time. We will post the updated policy with a revised Effective Date and will not apply material changes to previously collected consumer health data without first obtaining your consent where required by applicable law.

Contact Us

Questions about this policy or about our handling of consumer health data may be directed to:

Phothera
Privacy Officer/Data Protection Officer
205 W. Bement St.
Bryan, OH 43506 USA
Email: [email protected]
Phone number: 800-338-5045