Consumer Health Data Privacy

This Consumer Health Data Privacy Notice describes how Eros MD ("Company," "we," "us," or "our") collects, uses, shares, and protects Consumer Health Data under state consumer health data privacy laws. It is intended to satisfy disclosure obligations under the Washington My Health My Data Act (Wash. Rev. Code § 19.373), Nevada Senate Bill 370 (Nev. Rev. Stat. § 603A.400), and Connecticut Senate Bill 3 (Conn. Gen. Stat. § 42-515). It supplements, but does not replace, our Privacy Policy and applies in addition to HIPAA where applicable.

1. What Is Consumer Health Data?

Consumer Health Data means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. In the context of Eros MD, this includes:

• Individual health conditions, diagnoses, treatments, and prescriptions (including sexual health, hormone optimization, weight management, and hair restoration information)
• Medications, supplements, and dosing information
• Reproductive and sexual health information
• Gender-affirming care information
• Biometric data and lab results
• Provider-patient communications and consultation records
• Precise location data that could indicate an attempt to acquire or receive health services
• Information derived from any of the above (for example, inferences drawn from health-related browsing activity)

2. What Consumer Health Data We Collect

Eros MD collects Consumer Health Data in the following ways:

• Directly from you: when you complete an intake assessment, consult with a licensed physician, fill a prescription, or communicate with our clinical team
• From your providers: when a licensed Eros MD physician documents your evaluation, diagnosis, or treatment plan
• From licensed pharmacies: dispensing records, refill history, and shipment confirmations
• From laboratory partners: results of lab work ordered as part of your care
• From your device: limited technical data (IP address, device identifiers, browsing activity on erosmd.com) that may, in context, constitute Consumer Health Data

3. How We Use Your Consumer Health Data

We use Consumer Health Data only for purposes consistent with providing you safe, lawful telemedicine care, including:

• Evaluating whether a treatment is clinically appropriate for you
• Prescribing, filling, and shipping medications
• Monitoring your response to treatment and adjusting your protocol
• Coordinating care across our clinical team and dispensing pharmacies
• Complying with federal and state healthcare laws, including recordkeeping requirements
• Operating and improving our platform (using de-identified or aggregated data where feasible)
• Protecting against fraud, misuse, or unauthorized access
• Responding to your questions and processing your rights requests under this notice

We do not sell your Consumer Health Data. We do not use your Consumer Health Data for targeted advertising. We do not share your Consumer Health Data with data brokers.

4. When We Share Consumer Health Data

We share Consumer Health Data only in the following circumstances:

• With your treating physician and clinical team at Eros MD, including physicians licensed in your state
• With licensed pharmacies that dispense your prescriptions
• With laboratory partners that perform tests your provider orders
• With payment processors strictly as needed to process your payment (billing descriptors are neutral and do not identify the nature of your care)
• With service providers that help us operate the platform, bound by contract to use Consumer Health Data only to provide services to us and to maintain appropriate safeguards
• With you or your designated representative when you request or authorize the sharing
• As required by law, such as in response to a valid subpoena, court order, or reporting obligation

Each of the above categories receives only the minimum Consumer Health Data necessary to perform its function.

5. Your Rights

Depending on your state of residence, you have specific rights with respect to your Consumer Health Data:

Right to Know and Access

You have the right to confirm whether we are processing your Consumer Health Data and to access a copy of that data in a readable format.

Right to Delete

You have the right to request that we delete your Consumer Health Data. Deletion requests are subject to legal and clinical retention requirements (including state medical record retention rules, which generally require retention for at least seven years after the last date of service).

Right to Withdraw Consent

Where we process your Consumer Health Data based on your consent, you have the right to withdraw that consent at any time. Withdrawing consent may limit our ability to continue providing certain services.

Right Against Discrimination

We will not discriminate against you for exercising any right under this notice.

Right to Appeal

If we decline a rights request, you may appeal our decision using the contact information below. We will respond to appeals within the timeframe required by the applicable state law.

6. How to Exercise Your Rights

To exercise any of the rights above, contact us using one of the methods below. We will verify your identity before responding and will respond within 45 days (or the timeframe required by your state, whichever is shorter):

• Email: privacy@erosmd.com
• Mail: Eros MD, 30 N Gould St Ste R, Sheridan, WY 82801

You may also have an authorized agent submit a request on your behalf. If you use an agent, we may require written authorization and verification of your identity.

7. Consent for Sensitive Processing

Before we collect, use, or share certain categories of Consumer Health Data for purposes beyond providing you with care you have requested, we will obtain your affirmative consent. Examples include:

• Sharing Consumer Health Data with an entity that is not part of your care team
• Using Consumer Health Data for research purposes (we are not currently engaged in research activities involving Consumer Health Data)
• Any proposed sale of Consumer Health Data (which Eros MD does not engage in)

8. Data Security

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of Consumer Health Data, including encryption of data in transit and at rest, access controls, workforce training, and ongoing security monitoring. HIPAA's Security Rule standards apply to Protected Health Information handled in the course of providing care.

9. Data Retention

We retain Consumer Health Data for as long as necessary to provide you with care and to comply with applicable legal, clinical, tax, accounting, and regulatory requirements. Medical records are retained in accordance with state and federal retention requirements, typically a minimum of seven years after the last date of service.

10. Children

Our services are intended for adults aged 18 or older. We do not knowingly collect Consumer Health Data from minors. If you believe a minor has submitted Consumer Health Data to us, contact us and we will take appropriate steps to delete it.

11. State-Specific Notes

Washington (My Health My Data Act)

Washington residents have additional rights and protections regarding Consumer Health Data under Wash. Rev. Code § 19.373. These include the right to have specific Consumer Health Data deleted from all of our records and the records of our third-party service providers, subject to applicable exceptions.

Nevada (SB 370)

Nevada residents have specific rights regarding Consumer Health Data under Nev. Rev. Stat. § 603A.400, including the right to direct deletion and the right to opt out of the sale of Consumer Health Data. Eros MD does not sell Consumer Health Data.

Connecticut (SB 3)

Connecticut residents have rights regarding Consumer Health Data under Conn. Gen. Stat. § 42-515. These include specific requirements for consent to process Consumer Health Data and for geofencing around mental health and reproductive health facilities, which Eros MD does not engage in.

12. Changes to This Notice

We may update this Consumer Health Data Privacy Notice from time to time to reflect changes in law or our practices. The "Last updated" date at the top reflects the most recent revision. Material changes will be posted prominently on this page.

13. Contact

If you have questions about this notice or our handling of Consumer Health Data, contact us:

Eros MD
Attn: Privacy Officer
30 N Gould St Ste R
Sheridan, WY 82801
privacy@erosmd.com