Consumer Health Data Privacy Policy

Last updated: November 6, 2026

This Consumer Health Data Privacy Policy explains how Erno Laszlo, Inc. collects, uses and discloses consumer health data in connection with ernolaszlo.com and related skincare assistance where the Washington My Health My Data Act, Nevada consumer health data law or other applicable consumer health data law applies. Consumer health data has the meaning given by applicable law and can include information or inferences reasonably linked to an individual that identify physical or mental health status. Not every skincare preference or purchase is consumer health data.

Categories and purposes

When you choose to use a skincare questionnaire, Skin Clock or related assistance, we collect the responses and information you provide about skin characteristics, concerns, sensitivity, discomfort or reactions, routine experiences and other relevant details. We derive skin profiles, Skin Clock results, care priorities and recommendations from those responses. Previous Skin Clock information you choose to record and notes you submit for assistance can also be included.

Where these records identify your health status, the associated email address, attempt identifier or other information linking them to you is also handled as consumer health data. Responses and results can be recorded during the questionnaire before an email is supplied.

We use this data to provide the assessment and recommendations you request; save and retrieve results when you ask us to; associate information with your customer profile for that requested service; respond to skincare questions; and operate and protect those services. We collect or share data as necessary to provide a product or service you request to the extent permitted by applicable law, or obtain the required consent. Other collection or sharing requiring consent is subject to a separate choice. A general marketing subscription is not consent to every use of consumer health data.

Sources

Our sources are you, through questionnaire answers and communications; your interactions with the requested skincare tool; and the results and inferences generated from those answers. Providers operating those services process the information on our behalf.

Disclosures and recipients

The categories of consumer health data made available to processors are the relevant responses, results, recommendations, submitted notes and associated contact or session identifiers needed to provide the requested service. Processor categories are questionnaire hosting and database providers, customer profile and communication providers, and providers assisting with the skincare inquiry. These include Supabase for the questionnaire database and Klaviyo for relevant saved profiles and communications. Processors are authorized to process the data for the contracted service subject to applicable restrictions.

We do not sell consumer health data or disclose questionnaire answers, health-related results or assistance notes to advertising partners for targeted advertising. We do not share consumer health data with affiliates for their independent use. If you specifically direct a disclosure to another recipient, we explain it and obtain any consent required by applicable law before making that disclosure. Disclosures required or permitted by law are subject to applicable statutory exceptions.

Your rights

Subject to applicable law, you may confirm whether we collect, share or sell consumer health data; access that data; obtain information about recipients, including a list of third parties and affiliates to whom it was shared or sold and a contact method where required; withdraw consent to collection or sharing; and request deletion. We extend required deletion instructions to relevant processors and recipients and handle backup deletion in accordance with applicable law.

You may also send a written request to Erno Laszlo, Inc., Attn: Privacy Requests, 122 West 26th Street, Suite 800, New York, NY 10001, United States. Email advisor@ernolaszlo.com or call 1-888-352-7956 and describe your request. We may take proportionate steps to verify your identity for access or deletion. We respond within the applicable statutory period, generally 45 days where the Washington law applies, with notice of any permitted extension. Withdrawal may mean we cannot continue the optional service requiring that information. You can still browse and shop without using a skincare assessment.

If we decline a request and you have a right to appeal, reply to our decision or email advisor@ernolaszlo.com with "Consumer Health Data Appeal" in the subject line. We provide the appeal decision within the applicable period, including within 45 days for Washington appeals. If an appeal is denied, you may contact the Washington Attorney General, the Nevada Attorney General or the appropriate regulator. We will not unlawfully discriminate against you for exercising these rights.