Policy

Consumer Health Data Privacy Policy

Last updated: August 25, 2026

This Consumer Health Data Privacy Policy supplements the FABER Privacy Policy and applies to "consumer health data" as defined by applicable state laws, including the Washington My Health My Data Act and Nevada Senate Bill 370, to the extent those laws apply to you and to FABER (operated by Sandfox Logic Inc.). If there is a conflict between this policy and the Privacy Policy with respect to consumer health data, this policy controls.

Health information that is protected health information governed by HIPAA, or that is otherwise held by the Medical Group or Pharmacies as part of your medical record, is governed by the Medical Group's Notice of Privacy Practices rather than this policy.

Consumer Health Data We Collect

Depending on how you use our Services, we may collect the following categories of consumer health data:

• Information about your health conditions, symptoms, diagnoses, medications, and treatments, including the answers you provide in a medical intake questionnaire.
• Bodily characteristics you provide, such as height and weight, and photographs you submit for clinical review.
• Information about your purchase of, or interest in, health-related products and services, including the treatments you browse, add to your cart, or buy.
• Measurements or inferences derived from the information above.
• Identifying information connected to any of the above, such as your name, contact details, account information, and device identifiers.

We do not collect precise geolocation data, and we do not use biometric identifiers to identify you.

Sources of Consumer Health Data

We collect consumer health data directly from you (for example, when you complete an intake questionnaire or make a purchase), automatically when you use the Services (for example, through cookies and similar technologies described in our Privacy Policy), and from the Medical Group and Pharmacies in connection with coordinating your care and orders.

Why We Collect and Use Consumer Health Data

• To provide the products and services you request, including routing your intake to the Medical Group for clinical review and coordinating fulfillment with the Pharmacies.
• To communicate with you about your orders, clinical review, and care coordination.
• To provide customer support.
• To secure the Services and prevent fraud.
• To comply with our legal obligations.

We do not sell consumer health data. We never disclose your intake answers, clinical communications, diagnoses, or prescription details to advertising platforms. Advertising and analytics tools on our site may receive information about your site activity (such as pages viewed and purchases) for our own advertising and measurement, as described in the "Health Information and Advertising" section of our Privacy Policy; where applicable law requires your consent before such data is collected or shared, we obtain it first. We do not process consumer health data for purposes beyond those described in this policy without your consent where consent is required by applicable law.

Sharing of Consumer Health Data

We share consumer health data only with:

• The Medical Group (independent, US-licensed clinicians affiliated with Arora Health & Aesthetics, LLC), for clinical evaluation and treatment.
• Licensed US pharmacies, for prescription fulfillment and shipping.
• Service providers and processors that act on our behalf under contracts restricting their use of your data, such as hosting, payment processing, intake infrastructure, and customer support tools.
• Legal authorities or other parties where required to comply with applicable law or valid legal process, or to protect the rights and safety of our customers, the public, or FABER.

A list of the categories of third parties and affiliates with whom we share consumer health data is set out above. We do not share consumer health data with advertising networks or data brokers.

Your Rights

Depending on your state of residence, you have the right to:

• Confirm and access. Confirm whether we collect, share, or sell consumer health data about you, and access that data, including a list of the third parties with whom we have shared it.
• Withdraw consent. Withdraw any consent you have provided for the collection or sharing of your consumer health data, with effect for future processing.
• Delete. Request that we delete your consumer health data. Note that deleting your health data may make it impossible for us to provide the Services to you, and that medical records held by the Medical Group are subject to separate legal retention requirements.
• Appeal. Appeal our refusal to act on a request.
• Non-discrimination. Exercise these rights without being discriminated against.

Exercising Your Rights

To exercise any of these rights, email us at [email protected] with the subject line "Consumer Health Data Request," or write to us at FABER (Sandfox Logic Inc.), Attn: Privacy, 169 Madison Avenue, Suite 33248, New York, NY 10016. We may ask you to verify your identity using information we already hold about you before acting on a request. An authorized agent may submit a request on your behalf with proof of authorization, as permitted by applicable law.

We will respond within the time required by applicable law. If we decline your request, we will explain why and how to appeal. If your appeal is denied, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint, the Nevada Attorney General, or your own state's attorney general, as applicable.

Changes to This Policy

We may update this policy from time to time. We will post the revised policy on this page and update the "Last updated" date, and we will provide notice and obtain consent for material changes where applicable law requires it.

Contact

FABER (operated by Sandfox Logic Inc.)
Attn: Privacy
169 Madison Avenue, Suite 33248
New York, NY 10016, US
[email protected]