Health Data Privacy Policy
Effective date: November 2025 Last updated: November 2025 This Health Data Privacy Policy (“Policy”) describes how Orasis Pharmaceuticals, Inc. (“Orasis,” “we,” “us,” or “our”) processes “Consumer Health Data” or “Regulated Health Information” as that term is defined under applicable state law (collectively “Health Data”), about consumers who reside in the states of Nevada, Washington, New York, and any other applicable U.S. jurisdiction in connection with all Orasis operations as well as websites, mobile applications, and digital services where this Policy is linked or posted (“Services”). Please carefully read this Policy as it contains important information concerning your Health Data and how we use it. This Policy describes how we process Health Data about you. This Policy does not apply to: (i) Protected Health Information (“PHI”) governed by the Health Insurance Portability and Accountability Act (“HIPAA”), such as when PHI about you is processed in the context of any patient assistance or related offerings that we may sponsor; (ii) health information that is used to engage in public or peer-reviewed scientific, historical, or statistical research that adheres to all other applicable ethics and privacy laws; or (iii) personal information, which is governed by our Privacy Policy. Health Data does not include other data that does not meet the definition of “Consumer Health Data” or “Regulated Health Information” under applicable law, such as aggregate or deidentified data. To the extent that we process deidentified data, we will maintain and use the data in deidentified form and will not attempt to reidentify the data unless permitted by applicable law. Deidentified data that is reidentified and otherwise qualifies as Health Data is subject to this Policy. We collect the following categories of Health Data:
- Individual health conditions, treatment, diseases, or diagnoses;
- Use or purchase of prescribed medications;
- Information that could identify your attempt to seek health care services or prescription products, including your usage data when you interact with certain health-related content on Services;
- Bodily functions, vital signs, symptoms, or measurements;
- Payment information that relates to your health (such as insurance details); and
- Any other health-related information that you voluntarily disclose to us, including through any interactive tools or otherwise through the Services.