MILAN LASER PRIVACY POLICY

1. Updating This Privacy Policy

We may modify this Privacy Policy from time to time in which case we will update the "Last Revised" date at the top of this Privacy Policy. If we make material changes to the way in which we use information we collect, we will use reasonable efforts to notify you (such as by emailing you at the last email address you provided us, by posting notice of such changes on the Services, or by other means consistent with applicable law). If you do not agree to any updates to this Privacy Policy, please do not access or continue to use the Services.

2. Company's Collection and Use of Personal Information

When you access or use the Services, we collect certain categories of personal information about you from a variety of sources.

Information You Provide to Us

Some features of the Services may require you to directly enter certain personal information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing certain of our Services. Personal information that you may provide to us includes:

• Basic contact details: full name, address, phone number, and email. We collect basic contact details to communicate with you, provide you with Services, and market to you.
• Health-related information, such as the body part you would like to be treated, the condition of your skin, and any health conditions present. We collect health-related information as minimally required to provide you with the Services.
• Payment information: credit or debit card information and billing address. We use a third-party payment processor to collect payment information to process your payment and provide you with Services you have requested.
• Any other information you choose to include in communications with us, for example, when sending a message through the Contact Us web form, chatting with us through chat features on our website, calling us, or submitting opinions or reviews about our Services.

Information We Collect Automatically

We also automatically collect certain information about your interaction with the Services ("Usage Data"). To do this, we may use cookies and other technologies ("Tracking Technologies"). Usage Data may include:

• Unique device identifier
• Device type, such as your phone, computer, or tablet
• IP address
• Browser type
• Date and time stamps, such as the date and time you first accessed the Services
• Operating system
• Log data
• Precise and/or approximate location
• Pages visited and time spent on the website
• Clickstream data, search queries, and referring URLs
• Other information regarding your interaction with the Services, such as clicks, scrolls, and form entries

We use the information we collect automatically to, among other things, tailor features and content to you. See Section 4, Cookies and Other Tracking Technologies, below for more information.

Information We Collect From Other Sources

We may obtain the information identified below from outside sources. Any information we receive from outside sources will be treated in accordance with this Privacy Policy. We are not responsible or liable for the accuracy of the information provided to us by third parties and are not responsible for any third party's policies or practices. See Section 6, Third-Party Website and Links, below for more information.

• Analytics data we receive from analytics providers such as Google Analytics
• Demographic information
• Information we receive from consumer marketing databases or other data enrichment companies, which we use to better customize advertising and marketing to you.

In addition to the foregoing, we may use any of the above information to comply with any applicable legal obligations, to enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others.

3. How the Company Discloses Your Information

In certain circumstances, we may disclose your information to third parties for purposes consistent with this Privacy Policy. Such circumstances may include:

• With vendors or other service providers, such as
  • Payment processors
  • Marketing and data analytics vendors
  • Cloud storage providers
  • IT service management vendors
  • Email marketing services vendors
  • Chatbot tool vendors
  • Security vendors
• With our affiliates or otherwise within our corporate group
• With third parties for marketing purposes
• To comply with applicable law or any obligations thereunder, including cooperation with law enforcement, judicial orders, and regulatory inquiries
• In connection with an asset sale, merger, bankruptcy, or other business transaction
• To enforce any applicable terms of service and ensure the safety and security of the Company and/or its users
• With professional advisors, such as auditors, law firms, or accounting firms

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

4. Cookies and Other Tracking Technologies

Do Not Track Signals

Your browser settings may allow you to transmit a "Do Not Track" signal when you visit various websites. Like many websites, our website is not designed to respond to "Do Not Track" signals received from browsers. To learn more about "Do Not Track" signals, you can visit http://www.allaboutdnt.com/.

Tracking Technologies

Most browsers accept cookies automatically, but you may be able to control the way in which your devices permit the use of Tracking Technologies. If you so choose, you may block or delete our cookies from your browser; however, blocking or deleting cookies may cause some of the Services, including any portal features and general functionality, to work incorrectly.

We also use Google Analytics, which is a web analytics tool that helps us understand how users engage with the Services. Like many services, Google Analytics uses first-party cookies to track user interactions, as in our case, where they are used to collect information about how users use our site. This information is used to compile reports and to help us improve the Services. The reports disclose website trends without identifying individual visitors. You can opt out of Google Analytics without affecting how you visit our site – for more information on opting out of being tracked by Google Analytics across all websites you use, visit this Google page: https://tools.google.com/dlpage/gaoptout.

If you have questions regarding the specific information about you that we process or retain, as well as your choices regarding our collection and use practices, please contact us using the information listed below.

5. Social Features

Certain features of the Services permit you to initiate interactions between the Services and third-party services or platforms, such as social networks ("Social Features"). Social Features include features that allow you to click and access our pages on certain third-party platforms, such as Facebook and Twitter, and from there to "like" or "share" our content on those platforms. Use of Social Features may entail a third party's collection and/or use of your data. If you use Social Features or similar third-party services, information you post or otherwise make accessible may be publicly displayed by the third-party service you are using. Both the Company and the third party may have access to information about you and your use of both the Services and the third-party service. For more information on third-party websites and platforms, see Section 6 below.

6. Third-Party Websites and Links

We may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of these sites, including the accuracy, completeness, or reliability of information found on these sites. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms (such as Facebook or X) may also be viewable by other users of the Services and/or users of those third-party online platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

7. Children's Privacy

Children under the age of 18 are not permitted to use the Services, and we do not seek or knowingly collect any personal information about children under 13 years of age. If we become aware that we have unknowingly collected information about a child under 13 years of age, we will make commercially reasonable efforts to delete such information from our database. If you are the parent or guardian of a child under 13 years of age who has provided us with their personal information, you may contact us using the below information to request that it be deleted.

8. Data Security and Retention

Please be aware that, despite our reasonable efforts to protect your information, no security measures are perfect or impenetrable, and we cannot guarantee "perfect security." Any information you send to us electronically, while using the Services or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us.

We retain your information for as long as is reasonably necessary for the purposes specified in this Privacy Policy. When determining the length of time to retain your information, we consider various criteria, including whether we need the information to continue to provide you the Services, resolve a dispute, enforce our contractual agreements, prevent harm, promote safety, security and integrity, or protect ourselves, including our rights, property or products.

9. California Residents

This section applies to you only if you are a California resident ("resident" or "residents"). For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under the California Consumer Privacy Act ("CCPA").

Processing of Personal Information

In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information [and sensitive personal information (denoted by *)] about residents:

The specific business or commercial purposes for which we collect your personal information and the categories of sources from which we collect your personal information are described in Section 2 above, Collection and Use of Personal Information. We only use and disclose sensitive personal information for the purposes specified in the CCPA. The criteria we use to determine how long to retain your personal information is described in Section 8 above, Data Security and Retention.

We disclosed personal information over the preceding 12 months for the following business or commercial purposes:

• to communicate with you, provide you with products and services, to market to you, etc.
• to maintain and secure your account with us
• to process your payment, to provide you with products or services you have requested

Selling and/or Sharing of Personal Information

We do not have actual knowledge that we "sell" or "share" (as those terms are defined under the CCPA) personal information of residents under 16 years of age. Further, we do not "sell" personal information, nor have we done so in the preceding 12 months.

In the preceding 12 months, we shared the following categories of personal information [and sensitive personal information (denoted by *)] about residents:

Your California Privacy Rights

As a California resident, you may have the rights listed below in relation to personal information that we have collected about you. However, these rights are not absolute, and certain exceptions applies. In certain cases, we may decline your request as permitted by law.

• Right to Know. You have a right to request the following information about our collection, use and disclosure of your personal information:
  • categories of personal information we have collected, disclosed for a business purpose, or shared;
  • categories of sources from which we collected personal information;
  • the business or commercial purposes for collecting and/or sharing personal information;
  • categories of third parties to whom the personal information was disclosed for a business purpose, or shared; and
  • specific pieces of personal information we have collected.
• Right to Delete. You have a right to request that we delete personal information we maintain about you.
• Right to Correct. You have a right to request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sharing. You have a right to direct us not to share your personal information. To exercise this right, please email privacy@milanlaser.com. For information on how we process opt-out preference signals, see Section 4 above, Cookies and Other Tracking Technologies.
• [Right to Limit Use and Disclosure of Sensitive Personal Information. You have a right to direct us to limit our use and/or disclosure of sensitive personal information to only what is necessary to perform the Services or provide the goods reasonably expected by an average resident. To exercise this right, please use the following email: privacy@milanlaser.com to Limit the Use of My Sensitive Personal Information.]

You may exercise any of these rights by contacting us using the information provided below. We will not discriminate against you for exercising any of these rights. We may need to collect information from you to verify your identity, such as your email address, government issued ID or date of birth, before providing a substantive response to the request. You may designate, in writing or through a power of attorney document, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us.

10. Residents of Other U.S. States

If you are a California resident, please see the section above, California Residents, for information on your rights in relation to information that we have collected about you. If you are a resident of another U.S. state, depending on the state you live in, you may have some or all of the rights listed below in relation to information that we have collected about you. However, these rights are not absolute, and certain exceptions apply. In certain cases, we may decline your request as permitted by law, including in the event you reside in a state that does not currently grant you these rights.

• Right to Access. You may have a right to request that we confirm whether we process information about you and give you access to that information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another business without impediment.
• Right to Correct. You have the right to request that we correct inaccurate personal information that we maintain about you.
• Right to Delete. You have the right to request that we delete the personal data we have collected about you.
• Right to Object to Targeted Advertising, Profiling, or Selling. You have the right to opt-out of the processing of your personal information for the purposes of targeted advertising, the sale of your personal information, and/or the profiling of your personal information in furtherance of decisions that produce legal or similarly significant effects (as all such terms and concepts are defined under applicable law). For information on how we process opt-out preference signals, see Section 4 above, Cookies and Other Tracking Technologies.

We will not discriminate against you for exercising any of these rights. We may need to collect information from you to verify your identity, such as [your email address, government issued ID or date of birth,] before providing a substantive response to the request. Depending on your location, you may designate, in writing or through a power of attorney document, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us.

In addition, you may have the right to appeal our decision regarding a request related to these rights by contacting us using the information provided below. When you submit a request or launch an appeal, we will limit our collection of your information to only what is necessary to securely fulfil your request or process your appeal. We will not require you or your authorized agent to pay a fee for the verification of your request or appeal.

Exercising Your Privacy Rights

To exercise your data rights under applicable law, please contact us using one of the following methods:

Email: You may email us at privacy@milanlaser.com.

Phone: You may call us at 1‑833‑667‑2967.

Website: You may visit our privacy page to exercise rights through our website.

To appeal our decision regarding a request related to these rights, you may email us at privacy@milanlaser.com.

11. How to Contact Us

Should you have any questions about our privacy practices or this Privacy Policy, please email us at privacy@milanlaser.com or contact us at 1‑833‑667‑2967