WORTHWELL LLC PRIVACY POLICY

Last Updated: 31 October 2024

WorthWell LLC and its affiliates (“WorthWell, we, us, or our”) respects your privacy and values the relationship we have with you. This Privacy Policy describes the types of personal information we collect, how we use the information, with whom we share it, and the choices available regarding our use of the information. We also describe how to contact us about our privacy practices.This Privacy Policy (together with our Terms of Service and any other policies referenced in this Privacy Policy) applies to the personal information collected on worthwellwomen.com or on our other Internet-based offerings (collectively and individually, the “Site”), on online stores that sell WorthWell beauty products, and from our personnel. Unless otherwise indicated at the time that you provide your personal information, any personal information collected at third-party retail locations is not provided to us and is not subject to this Privacy Policy. By continuing to use our Site, you accept the terms of this Privacy Policy and our Terms of Service.If you are a California resident, our privacy practices comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, the “CCPA”). An explanation of your rights under the CCPA can be found in Section 11.If you are a resident of the European Economic Area (“EEA”) or the United Kingdom (“UK”), this Privacy Policy also outlines additional policies applicable to our collection and processing of your Personal Information, which can be found in Section 12. Non-EEA countries do not have the same data protection laws as the United Kingdom, Switzerland and EEA. We will, however, take steps to ensure that any transfer of Personal Information will be secure and complies with applicable data protection laws. As our services evolve and we determine to use your Personal Information collected in other ways, we may from time to time amend this Privacy Policy. The effective date appears at the end of this Privacy Policy. We encourage you to check our Site frequently to review the current Privacy Policy in effect and any changes that may have been made to it.

1. Information We Collect

We collect personal information that you enter on our Site or volunteer to us when you contact us. You can choose not to provide certain information, but then you might not be able to take advantage of some of our features.For purposes of this Privacy Policy, “Personal Information” means information (whether stored electronically or in paper based filing systems) relating to a living individual who can be identified from that data (or from that data and other information in our possession). This can include your name, email address, phone number, birthdate, and other technical information which is described further in this Privacy Policy.WorthWell collects only that Personal Information that is relevant for the purposes for which the data is requested. You can visit our Site without telling us who you are or revealing any Personal Information.If you visit the Site or are a WorthWell customer, we may collect or may have collected the following categories of Personal Information about you. In some cases, the information we collect may fall within more than one category.

Contact information and personal identifiers, such as your name, address, email address, telephone number, and username or social media handle.Device identifiers, such as information about your device like your MAC address, IP address, or other online identifiers.Demographic information, such as your age, sex, and gender (some of which may be protected by applicable law).Commercial information, such as the products or services you have purchased, returned or considered, and your product preferences.Payment information, such as your method of payment and payment card information (including payment card number, expiration date, delivery address and billing address).Online or network activity information, such as information about your visit to the Site, including the full Uniform Resource Locators (URL), clickstream to, through and from our Site (including date and time), pages on our Site you viewed; page response times, download errors, duration of page visits, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page, and log file information, which includes, but may not be limited to, your browser type and version, operating system and platform, webpages you visit, and other electronic network activity.Geolocation information, such as information that can help identify your physical location (like your GPS coordinates or the approximate location of your mobile device).Health and medical information, such as digestive, hormone, physiological, psychological, and sleep concerns, diagnoses, medical reports and history.User Content, such as your communications with us and any other content you provide (including photographs and images, videos, reviews, articles, survey or quiz responses, and comments).Inferences drawn from or created based on any of the information identified above.

We also collect Personal Information from contractors, and individuals working for our vendors and business partners. WorthWell collects that Personal Information in the course of our business dealings from you or your employer in connection with the services you provide to WorthWell, or when you apply to provide such services. When you or the company you work for interacts with WorthWell, we collect the following types of Personal Information:

Contact information and personal identifiers, such as your name, address, email address, telephone number, driver’s license number, passport number, and any other information you provide relating to your work or to you personally. Financial information, such as bank account information.Professional information, such as your CV, resume, and employment history. Education information, such as your educational background and grades.Demographic information, such as your age, sex, gender, national origin, and citizenship status (some of which may be protected by applicable law).

2. How We Collect Information

If you visit the Site or are a WorthWell customer, we may collect or may have collected Personal Information about you from various sources. The categories of sources from which we may collect Personal Information are:

Directly from you, such as when you make a purchase on our website, contact us with a question or complaint, create an account on our website, respond to a survey or quiz, or sign-up to receive marketing communications.Cookies and automatic collection methods. When you visit our website or use one of our mobile applications, and when you open or click on emails we send you, we (and third parties we work with) may automatically collect information from your browser or device using technologies such as cookies, web beacons, pixel tags, and similar technologies. Cookies are small text files that websites send to your computer or other Internet-connected device to uniquely identify your browser or to store information or settings in your browser. Web beacons or pixel tags are small images which are embedded into our website or emails that provide us with information about your browser or device, or whether you open or click on the emails we send you. These technologies enable us, or the third parties who place such technologies, to collect information such as device identifiers and online or other network activity information.From social media platforms/networks, such as Facebook, TikTok, Instagram, YouTube, and Pinterest. For example, we may obtain your information from a social media platform or network if you interact with us on social media or choose to log-in to our website using your social media credentials.

If you are providing services to WorthWell, or applying to provide such services, we may collect or may have collected Personal Information about you from various sources. The categories of sources from which we may collect Personal Information are:

Directly from you, such as when you apply to provide services, or when you otherwise communicate with us.

3. What Do We Do With Your Information?

If you visit the Site or are a WorthWell customer, We may use or may have used the Personal Information we have about you:

To provide products and services to you, such as fulfilling orders and processing payments, creating, servicing and/or maintaining your account, assisting with product selection and replenishment, and managing current or past purchases. To communicate with you, including to respond to your inquiries or complaints, and to help you place an order.To administer your participation in special events, contests, sweepstakes, surveys, and promotions.For marketing and advertising, such as to send you marketing and advertising materials via postal mail, text message or email, and to show you advertisements for products and/or services tailored to your interests on social media and other websites.For analytics purposes, such as to: understand how you use our website and mobile applications; understand your preferred method of purchasing with us; determine what browser and devices you use to visit our website; and to evaluate and improve our products, services, advertisements, website and mobile applications. To operate and improve our business, including to provide quality assurance, conduct research and development to develop new products and services, and perform accounting, auditing and other internal business functions.For legal and security purposes, such as to detect, prevent, and prosecute harmful, fraudulent, or illegal activity, loss prevention, identify and repair bugs on our website or mobile applications, and to comply with applicable legal requirements, relevant industry standards and our policies.We also may use or may have used the information in other ways for which we provide specific notice at the time of collection.

If you are providing services to WorthWell, or applying to provide such services, we may use or may have used the Personal Information we have about you:

To communicate with you in connection with the services you or your company provide to us. To operate and improve our business, including to respond to job applications. To fulfill our contractual and business obligations, and ensure that you fulfill your obligations. To confirm you have the ability and resources to provide services to us, which may include making inquiries about your financial status and business experience, as well as your past commercial practices.For the purpose of determining whether you can carry out the essential job duties of your position and/or determining whether to hire an applicant or promote you.For legal and security purposes, such as to detect, prevent, and prosecute harmful, fraudulent, or illegal activity, and to comply with applicable legal requirements, relevant industry standards and our policies. To analyze and improve our business processes, including to assist us with improving our application and recruitment processes and other human resources-related objectives.We also may use or may have used the information in other ways for which we provide specific notice at the time of collection.

4. Information we Disclose

We may disclose or may have disclosed your Personal Information to:

Service providers. We may transfer Personal Information to service providers who perform services on our behalf based on our instructions. We do not authorize these service providers to use or disclose Personal Information except as necessary to perform services on our behalf or comply with legal requirements. Examples of these service providers include entities that process credit card payments, fulfill orders, and that provide website and application functionality, hosting, analytics, advertising and marketing services.Parties to a corporate transaction. We also reserve the right to transfer Personal Information we have about you in the event we sell or transfer all or a portion of our business or assets (including in the event of a merger, acquisition, joint venture, reorganization, divestiture, dissolution, or liquidation).Advertising Companies. We work with third party advertising companies (such as advertising networks) to serve advertisements on our behalf. For additional information, see the Cookies, Targeted Advertising & Analytics section.Other third parties. In addition, we may disclose personal information about you (i) if we are required to do so by law or legal process, (ii) to law enforcement authorities or other government officials, (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity, (iv) when disclosure of your personal information is otherwise required or permitted by law, or (v) with your consent.

5. Your Rights and Choices

ACCESSING, UPDATING, AND MODIFYING PERSONAL INFORMATION

Subject to applicable law, you may have the right to request access to and receive details about the personal information we maintain about you, update and correct inaccuracies in your personal information, and have the personal information deleted, as appropriate. These rights may be limited in some circumstances by local law. We may take reasonable steps to verify your identity before granting access or making corrections. You may request to access, change, or delete your personal information by emailing us at [email protected]. EMAIL OPT-OUT

You can opt-out of receiving marketing communications by email by following the instructions within the emails you receive from us or by emailing us at [email protected]. Please note that if you opt-out from email communications, we may still send you transactional or operational emails. Examples of transactional or operational emails include, purchase or shipping confirmations, password resets, profile updates or other account related messages.TEXT MESSAGE OPT-OUT

You can opt-out of receiving text messages from us by replying STOP to the text message you receive from us or making a request by emailing us at [email protected]. Please note that this will only opt you out of the specific text messaging program associated with that number.

6. Cookies, Targeted Advertising and Analytics

COOKIES

Cookies are small text files that websites send to your computer or other Internet-connected device to uniquely identify your browser or to store information or settings in your browser. We use different types of cookies on our website, including performance cookies, functional cookies and targeting cookies.We use the following types of cookies in our website:Strictly Necessary Cookies: These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.Performance Cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our Site. They help us to know which pages are the most and least popular and see how visitors move around the Site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.Functional Cookies: These cookies enable the website to provide enhanced functionality and personalization. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly. You can block our use of cookies through settings in your browser. Because these settings are different in different browsers, we recommend that you visit All About Cookies at https://allaboutcookies.org/, where you can find comprehensive information on cookie management and blocking for a wide variety of browsers.TARGETED ADVERTISING

We may work with third party advertising companies (such as advertising networks) to serve advertisements for us. These advertising companies may use cookies and other technologies to collect device identifiers, online or network activity information, commercial information, or inferences, such as information about the websites you visit over time and the advertisements you click on, in order to deliver advertisements that are targeted to you. You can opt-out of this form of targeted advertising from the companies we work with by changing your cookie settings. Please note that even if you opt-out of this form of targeted advertising, you may still see ads from us, but the ads will not be targeted based on behavioral information about you. To learn more about this type of advertising in general, visit the Digital Advertising Alliance at https://youradchoices.com/ or the Network Advertising Initiative at https://optout.networkadvertising.org/. We also work with third-party platforms, including platforms operated by social networks, such as Google, and Facebook, to show you advertisements or measure the effectiveness of our advertisements. We may convert your email address, telephone number, or other information into a unique value and have these third-party platforms match this unique value with a user on their platform or with other data they may have. This matching enables us to deliver advertisements to you and others on these platforms. You also can request that we refrain from using your personal information in this way by emailing us at [email protected]. DO NOT TRACK AND ADVERTISING ACROSS DIFFERENT WEBSITES

We currently do not change our tracking practices in response to “do-not-track” signals or other similar mechanisms. Third parties that have content or services on our website, such as a social feature, an analytics service, or an advertising network partner, may obtain information about your browsing or usage habits. These third parties do not change their tracking practices in response to “do-not-track” signals from your web browser and we do not obligate these parties to honor “do-not-track” signals. To learn more about browser tracking signals and “Do Not Track,” please visit https://allaboutdnt.com/

ANALYTICS SERVICES

We may use analytics services, such as Google Analytics, on our website, our social media pages, or our mobile applications to help us evaluate and analyze how visitors use these platforms. For specific details on how Google collects and uses information on our website, social media pages, or mobile applications, please visit: HOW GOOGLE USES DATA.

INTERNATIONAL TRANSFERS

We may transfer the personal information we have about you to countries other than the country in which the information was originally collected, and your personal information may be processed and stored outside of your country of residence. Those countries may not have the same data protection laws as your country of residence, and your personal information will be subject to applicable foreign laws. When we transfer your information to other countries, we will protect that information in the manner described in this Privacy Policy.

7. Children’s Privacy

Our Site is not intended for or directed to children under the age of sixteen and we do not knowingly collect personal information from children under the age of sixteen on the website. If we become aware that a child under the age of sixteen has provided us with Personal Information, we will delete the information from our records.

8. Our Storage of Your Personal Information

WorthWell uses reasonable and appropriate measures to protect your Personal Information from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into due account the risks involved in processing the Personal Information and the nature of the Personal Information we collect.We will keep your Personal Information for as long as we need it, or as otherwise prescribed by law, for the purposes set out above. This period will vary depending on your interactions with us. We may also keep a record of correspondence with you (for example if you have made a complaint about our products or services) for as long as is necessary for us to defend a legal claim.

9. Links to Other Websites

Our website may provide links to other websites for your convenience and information. These websites may operate independently from us. Linked websites may have their own privacy notices or policies, which we strongly suggest you review if you visit any linked websites. To the extent any linked websites you visit are not owned or controlled by us, we are not responsible for the websites’ content, any use of the websites, or the privacy practices of the websites.

10. Updates to Our Privacy Policy

This Privacy Policy may be updated periodically and without prior notice to you to reflect changes in our personal information practices. We will post a prominent notice on our website to notify you of any significant changes to our privacy practices and indicate at the top of the Privacy Policy when it was most recently updated.

11. Additional Rights and Disclosures for California Residents

The CCPA affords California consumers the rights with respect to their Personal Information set forth in this section.(A) Your Rights With Respect to Your Personal Information

Subject to certain exceptions, you have the following rights with respect to your Personal Information:

To request that WorthWell disclose what Personal Information it has collected, used, or disclosed, over the 12-month period preceding WorthWell's receipt of such a request;To request that WorthWell disclose whether any of your Personal Information was sold or shared with third parties, to whom such information was sold or shared, and the business purpose for selling or sharing the Personal Information;To request to opt out of our sale or sharing of your Personal Information;To request that any inaccurate or incomplete Personal Information maintained by WorthWell be corrected or supplemented; andTo request deletion of your Personal Information maintained by WorthWell.

All of these rights are subject to certain conditions and exemptions. For example, WorthWell will not be obligated to delete your Personal Information if we need to retain it to protect ourselves in the event of a legal claim.(B) Right to Non-Discrimination for the Exercise of a Consumer's Privacy RightsWe will not deny you any goods or services, or charge you a different price, level or quality of goods or services because you exercise any of your rights under the CCPA; however, we may not be able to provide the goods or services if you refuse to provide us the Personal Information that is necessary for us to provide the goods or services, or if you ask us to delete your Personal Information.(C) Right to Limit Use of Sensitive InformationIn some cases, you have the right to limit the use or disclosure of your health information, which constitutes sensitive personal information under the CCPA. We do not engage in uses or disclosures of “sensitive personal information” that would trigger the right to limit use or disclosure of sensitive personal information under applicable law.(D) Right to Opt-Out from Sales or Sharing of Personal InformationFrom time to time, we may use or disclose your Personal Information in a way that is deemed a “sale” or “sharing” under the CCPA to provide relevant product recommendations and deliver marketing messages and personalized offers through select companies (e.g. analytics, advertising, and technology companies).

California residents have the right to opt out of sales and sharing of Personal Information. If you wish to opt out of our sharing of the limited data that is gathered when you visit our websites and other web-based services for purposes of targeted digital advertising, you may do so by emailing us at [email protected].

You may also opt-out of “sales” and “sharing” of your personal information through the use of an opt-out preference signal. If our website detects that your browser is transmitting an opt-out preference signal, such as the “global privacy control”—or GPC— signal, we will opt that browser out of cookies on our website that result in a “sale” or “sharing” of your personal information. Please note, if you come to our website from a different device or a different browser on the same device, you will need to opt out, or use an opt-out preference signal, for that browser and/or device as well.

In the past 12 months, we have sold or shared the following Personal Information to the following categories of third parties:Personal Information CategoryCategories of Third PartiesPersonal and device identifiersAdtech partners or vendors, social networks, technology vendors, analytics providersCommercial informationAdtech partners or vendors, social networks, technology vendors, analytics providersOnline or network activity informationAdtech partners or vendors, social networks, technology vendors, analytics providersInferencesAdtech partners or vendors, social networks, technology vendors, analytics providers

(E) Financial Incentives

We provide discounts and financial incentives to individuals that enroll in our loyalty program or provide their contact information to us for marketing purposes.

For participants in our financial incentive programs, the value of the Personal Information you provide is reasonably related to the value of the financial rewards provided to you. The value of Personal Information will vary for each participant depending on several factors, including but not limited to your purchases from WorthWell, the administrative and technical expenses associated with maintaining your participation in our financial incentive program, and the extent to which you take advantage of the program’s offerings and discounts.

Participation in our loyalty program is voluntary, as is providing us with your contact information in exchange for a discount or other incentive. After joining any of our financial incentive programs, including our loyalty program, if you wish to opt out of the program or wish to opt out of the sale of your personal information to support the program, you can contact our customer contact center by email at [email protected] for assistance. We will not discriminate against you for exercising your rights under the CCPA.

(F) Submitting a CCPA Data Request

To submit a request to WorthWell regarding your Personal Information as described in this section, you may do so by submitting by emailing us at [email protected] is required to verify the identity of the individual requesting access to a consumer’s data or requesting deletion of a consumer’s data. To verify your identity, we will rely upon information we have previously collected about you, such as phone calls received from a known phone number or emails received from a known email. We will also rely upon our personal relationship with our clients to verify the identity of a requester.If you submit a request and you are not a WorthWell client (which may be the case if you requested information through our website to our “contact us” number but did not become a customer or employee), then we will verify your identity by confirmation using the information we collected, such as phone number of email address.(G) Authorized Agent

You may designate an authorized agent to exercise a CCPA right on your behalf. If you use an authorized agent to exercise your rights under the CCPA, we will need the following proof that you have authorized the agent to act on your behalf:

Written proof that you have authorized the agent to act on your behalf, and separately verify your identity as described above; orProof that the authorized agent holds a power of attorney to act on your behalf pursuant to California Probate Code §§ 4000-4465.

(H) Do Not Track Disclosure

Privacy regulations in the United States, such as the laws of California and Delaware, require a company to indicate whether it honors your browser’s “Do Not Track” settings concerning targeted advertising. We adhere to the standards set out in this Privacy Policy and do not monitor or respond to Do Not Track browser requests.

12. Additional Policies and Disclosures for Residents of EEA, UK and Switzerland

In addition to the other policies described in this Privacy Policy, residents of the EEA, the UK and Switzerland have the following additional rights and protections as required by the European Union General Data Privacy Regulation (“GDPR”), and UK and Swiss data protection laws. The additional rights and protections set forth in this section of this Policy apply only to residents of the EEA, the UK and Switzerland. For ease of reference, when we refer to GDPR in this section, we are referring to the UK and Swiss data protection laws, as well as the GDPR. For the purposes of this the GDPR, WorthWell is a “Controller” which means WorthWell determines the purposes for which, and the manner in which, any Personal Information is Processed and used in its business.

(A) Definitions

The following additional definitions apply to this section of our Privacy Policy:

“Processor” means any Person Processing Personal Information.

“Person” means a natural person, corporation, association, organization, partnership, or other legal entity.

“Process” or “Processing” is any activity that involves use of the Personal Information. It includes, without limitation, obtaining, recording or holding the Personal Information, or carrying out any operation or set of operations on the Personal Information including organizing, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transferring Personal Information to third parties.

(B) The legal basis for Processing your Personal Information

In order to comply with the GDPR, we are required to set out the legal basis for the Processing of your Personal Information. The legal basis for Processing your Personal Information will be one of the following:

our own legitimate business interests, or the legitimate business interests of our third party partners, promoters, affiliates, distributors, suppliers, vendors, and subcontractors, such as, for example, providing direct marketing to our customers of our products and services that we think would be of interest, permitting prospective employees to search and apply for job opportunities, handling inquiries from our promoters, affiliates, distributors, vendors, and customers, or other instances where we have carried out a legitimate interests assessment and have established an existing legitimate interest;the performance of a contract that we have in place with you;your consent, where appropriate; orcompliance with our legal obligations, including to meet national security or law enforcement requirements.

(C) Where we store your Personal Information

The data that we collect from you is stored on our servers or on servers provided by cloud service providers. By submitting your Personal Information, you agree to this transfer, storing, and Processing. We will take all reasonably necessary steps to ensure that your data is treated securely and in accordance with this Privacy Policy.

The transmission of information via the Internet is not completely secure. Although we take reasonable steps to protect your Personal Information, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access.

(D) Addendum to how long we store your Personal Information

In some cases, there is a legal requirement to keep Personal Information for a minimum period of time. Except in those circumstances, we do not keep your Personal Information for any longer than is necessary for the purposes for which the Personal Information was collected or for which it is to be further Processed.

(E) Your rights with respect to your Personal Information

Subject to certain exceptions, you have the following rights with respect to your Personal Information:To receive or access a copy of the Personal Information that we hold about you;To request that any inaccurate or incomplete Personal Information be corrected or supplemented;To have your Personal Information erased, unless we have a legitimate reason to retain the Personal Information (such as if we are required to do so for legal reasons); andTo ask us not to Process your Personal Information for a particular purpose, including for marketing.

All of these rights are subject to certain conditions and exemptions. For example, WorthWell will not be obligated to erase your Personal Information if we need to retain it to protect ourselves in the event of a legal claim.

To exercise any of these rights, please submit a written request to us using the contact information set forth in Section 13. WorthWell reserves the right to charge a fee in dealing with such a request as permitted by applicable law and regulations. You may also opt out of receiving additional marketing information by using the unsubscribe feature in any marketing email we send you.

13. Contacting us

This Site is owned and operated by WorthWell. If you have any questions or suggestions with respect to this Privacy Policy or our privacy practices, please e-mail us at [email protected].

CCPA-Specific Requests

Please submit CCPA-specific data requests through the procedures set forth in Section 11.GDPR/UK/Swiss-Specific Requests

For residents of the EEA, the UK or Switzerland, please e-mail us at [email protected].