CONSUMER HEALTH DATA PRIVACY POLICY

Effective Date: April 15, 2026

Smile Brands Inc. 675 Anton Blvd, Suite 500 Costa Mesa, CA 92626

This Consumer Health Data Privacy Policy (“Health Data Policy”) describes how Smile Brands Inc. (“Smile Brands,” “we,” “us,” “our”) and our affiliated dental practices in Washington State (a list of which can be viewed at smilebrands.com/smile-brands-locations) collect, use, share, and protect consumer health data in compliance with the Washington My Health My Data Act, RCW Chapter 19.373 (“MHMDA”). This Health Data Policy applies to Washington consumers, defined as Washington residents and individuals whose consumer health data is collected in Washington.

This Health Data Policy is separate from, and in addition to, our U.S. Privacy Policy available at smilebrands.com/privacy. Where a conflict exists between this Health Data Policy and the U.S. Privacy Policy with respect to consumer health data governed by the MHMDA, this Health Data Policy controls.

1. WHAT IS CONSUMER HEALTH DATA

Under Washington law, “consumer health data” is personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. Because our websites relate to dental health care services, certain information we collect when you visit our Sites may constitute consumer health data, including:

• Identifiers associated with your visit to a dental practice website, such as your IP address, cookie ID, or device identifier, when linked to the dental health care context of your visit
• Information you provide when scheduling or requesting a dental appointment, including your name, contact information, and reason for your visit
• Information about the dental services you are seeking or have received
• Call tracking data, such as a dynamically assigned phone number, the marketing source that directed you to our Site, and information about calls you place to our dental practices through a tracked number
• General location information derived from your IP address indicating your proximity to a dental practice
• Any information we use to associate or identify you with the health-related data described above

2. HOW WE COLLECT CONSUMER HEALTH DATA

We collect consumer health data from the following categories of sources:

Directly from you. We collect consumer health data when you provide it to us through our websites, including when you fill out appointment request forms, use online chat features, contact us by phone or email, or submit patient intake forms.

Through tracking technologies on our websites. Our Sites may use cookies, pixels, and call tracking scripts that collect session-level data such as your IP address, device information, pages visited, and referring marketing source. Our Sites use dynamic phone number insertion technology, which replaces the displayed phone number with a unique tracking number assigned to your browsing session so that we can attribute calls to the marketing campaign that directed you to the Site.

For Washington consumers, we will not deploy tracking technologies that collect consumer health data, including call tracking scripts, unless you have first provided affirmative opt-in consent through our consent management tool.

From our service providers. Service providers that operate on our behalf, such as our call tracking provider and website analytics tools, may collect consumer health data at our direction and pursuant to our instructions.

From our affiliated dental practices. Our affiliated dental offices may provide us with information about you in connection with the dental services you have received or requested.

3. PURPOSES FOR COLLECTION

We collect consumer health data for the following purposes:

• Scheduling and managing dental appointments
• Providing and coordinating dental services through our affiliated practices
• Responding to your inquiries and providing customer service
• Measuring the effectiveness of our marketing campaigns through internal call attribution and campaign performance analysis
• Improving our websites, services, and patient experience
• Communicating with you about your dental care, including appointment reminders
• Processing insurance claims and payments
• Complying with legal obligations, including record-keeping requirements
• Detecting and preventing fraud, security incidents, and illegal activity

We will not collect consumer health data for purposes beyond those disclosed in this Health Data Policy without first disclosing the additional purpose and obtaining your affirmative consent.

4. HOW WE SHARE CONSUMER HEALTH DATA

We may share consumer health data with the following categories of entities, and only with your separate, affirmative consent for such sharing or to the extent necessary to provide a product or service you have requested:

Service Providers (Processors). We share consumer health data with service providers that process data on our behalf pursuant to written contracts that limit their use of the data to the services they provide to us. These service providers include:

• Our call tracking and analytics provider, which processes call attribution data on our behalf to measure the effectiveness of our marketing campaigns. This provider operates under a Business Associate Agreement and a written service provider agreement that prohibits it from using your data for any purpose other than providing call tracking services to us.
• Website hosting and technology providers that maintain and operate our Sites
• Customer relationship management and appointment scheduling platforms
• Payment processing providers

When we share consumer health data with a service provider in a manner consistent with the purpose for which it was collected and disclosed to you, that disclosure is not considered “sharing” under the MHMDA.

Affiliated Dental Practices. We may share consumer health data with our affiliated dental offices to coordinate and provide the dental services you have requested.

Third-Party Analytics and Advertising Partners. With your separate and distinct consent, we may share de-identified call tracking and session data with third-party analytics partners (such as Google) to measure marketing campaign performance. We de-identify this data before sharing by removing or masking direct identifiers. If you do not consent, or if you withdraw your consent, no consumer health data will be shared with these third parties.

Government Authorities. We may disclose consumer health data to government authorities as required by law, court order, subpoena, or other legal process.

We do not sell consumer health data. If we ever intend to sell consumer health data, we will first obtain a valid written authorization from you that meets the requirements of RCW 19.373.070.

5. HOW WE OBTAIN YOUR CONSENT

We obtain your consent before collecting or sharing your consumer health data. Our consent process meets the following requirements under Washington law:

• Affirmative opt-in. Consent requires a clear, affirmative act on your part. We do not treat silence, inaction, or closing a consent banner as consent. You must take an affirmative step, such as clicking an “Accept” or “I Consent” button in our consent management tool, to provide consent.
• Specific and informed. Before you provide consent, we will clearly disclose the categories of consumer health data we intend to collect, the purpose of the collection, the categories of entities with whom we may share the data, and how you can withdraw your consent.
• Separate consent for sharing. If we intend to share your consumer health data with third parties (beyond our service providers acting on our behalf), we will obtain a separate and distinct consent for that sharing.
• Voluntary. We will not condition the provision of dental services on your consent to the collection or sharing of consumer health data for marketing or analytics purposes.
• No deceptive designs. Our consent interfaces provide symmetrical choices and do not use deceptive designs, dark patterns, or manipulative language to influence your decision.

Call tracking technology. For Washington consumers, our call tracking script (dynamic phone number insertion) will not fire on our Sites until you have provided affirmative consent through our consent management tool. If you do not consent, no tracking number will be assigned to your session and no session-level data will be collected by our call tracking service provider.

6. YOUR RIGHTS

Under the MHMDA, you have the following rights with respect to your consumer health data:

Right to Confirm and Access. You may confirm whether we are collecting, sharing, or selling consumer health data about you. You may access your consumer health data, including a list of all third parties and affiliates with whom we have shared or sold your consumer health data and an active email address or other online mechanism you may use to contact those third parties.

Right to Withdraw Consent. You may withdraw your consent from our collection and sharing of your consumer health data at any time. You may withdraw consent by:

• Updating your preferences in our consent management tool on the Site
• Contacting us at privacy@smilebrands.com
• Calling us at (855) 992-7223

Upon receiving your withdrawal request, we will cease collecting and sharing your consumer health data within 15 days.

Right to Deletion. You may request that we delete your consumer health data. Upon receiving and verifying your deletion request, we will:

• Delete your consumer health data from our records, including archived and backup systems (deletion from backup systems may take up to six months)
• Notify all affiliates, processors, contractors, and third parties with whom we have shared your consumer health data, who are also required to honor your deletion request

How to Submit a Request. You may exercise any of the rights described above by:

• Emailing us at privacy@smilebrands.com
• Calling us at (855) 992-7223
• Submitting a request online at smilebrands.com/your-privacy-choices

We will respond to your request within 45 days. If we need additional time due to the complexity or number of requests, we will notify you within the initial 45-day period and may extend the response period by an additional 45 days.

We will not require you to create a new account to exercise your rights but may require you to use an existing account. We may ask you to provide information reasonably necessary to verify your identity before fulfilling your request.

Right to Appeal. If we decline to take action on your request, you may appeal our decision. To submit an appeal, contact us at privacy@smilebrands.com with the subject line “MHMDA Appeal.” We will respond to your appeal in writing within 45 days, including a written explanation of the reasons for our decision. If your appeal is denied, you may contact the Washington State Attorney General to submit a complaint at www.atg.wa.gov/file-complaint.

No Discrimination. We will not discriminate against you for exercising any of the rights provided in this Health Data Policy or under the MHMDA.

7. DATA SECURITY

We restrict access to consumer health data to employees, processors, and contractors who need access to fulfill the purposes for which you provided consent or to provide a product or service you have requested. We maintain administrative, technical, and physical security practices designed to protect the confidentiality, integrity, and accessibility of your consumer health data appropriate to the volume and nature of the data we hold.

8. GEOFENCING

We do not implement geofences around any entity that provides in-person health care services for the purpose of identifying or tracking consumers seeking health care services, collecting consumer health data, or sending notifications, messages, or advertisements related to consumer health data or health care services.

9. PROCESSORS

Our service providers that process consumer health data on our behalf do so only pursuant to binding written contracts that set forth processing instructions and limit the actions the service provider may take with respect to your consumer health data. If a service provider processes your consumer health data outside the scope of its contract with us, that service provider becomes a regulated entity under Washington law and is independently subject to the requirements of the MHMDA.

10. CHANGES TO THIS HEALTH DATA POLICY

We may update this Health Data Policy from time to time. When we make changes, we will update the “Effective Date” at the top of this page. We will not collect, use, or share additional categories of consumer health data or use consumer health data for additional purposes not disclosed in this Health Data Policy without first disclosing those changes and obtaining your affirmative consent.

11. CONTACT US

If you have questions about this Health Data Policy or wish to exercise your rights, please contact us:

Email: privacy@smilebrands.com
Phone: (855) 992-7223
Mail: Smile Brands Inc., Attn: Privacy, 675 Anton Blvd, Suite 500, Costa Mesa, CA 92626
Online: smilebrands.com/your-privacy-choices