OPTICARE PRIVACY POLICY

Introduction

Opticare Solutions LLC ("Opticare," "Company," "we" or "us") is committed to protecting your privacy. The following policy ("Privacy Policy") describes our practices for collecting, using, maintaining, and disclosing information that we collect from you or that you provide to us when you visit our website (our "Site"), use our application ("App"), use our application programming interfaces ("APIs") or use any other products and services made available by us (collectively with the Site, the "Services").

Opticare provides a proprietary, physician-ordered, patient-delivered non-prescription product recommendation and commerce platform that integrates with electronic health record ("EHR") environments to enable personalized, evidence-based product recommendations, patient engagement, and associated e-commerce fulfillment capabilities (the "Opticare System" and, collectively with related services, the "Services"). Opticare provides an end-to-end physician-ordered, patient-delivered non-prescription product commerce platform, including transaction processing, fulfillment coordination, customer support, reporting, and revenue-share administration, each as governed by applicable service levels, limitations, and other terms.

Some features of our Services—including our online checkout/cart experience—may be hosted or powered by third-party ecommerce providers (for example, Shopify). When you use those features, your information may be collected and processed both by Opticare and by those providers as described in this Privacy Policy and, where applicable, the providers' own privacy policies.

We ask that you read this Privacy Policy carefully to understand our policies and practices regarding your information and how we will treat it. The use of information collected through our Services will be limited to the purposes described under this Privacy Policy and our Terms of Service (or other relevant customer contracts). By accessing or using the Services, you agree to this Privacy Policy. Please be aware that if you are using the Services on behalf of an entity, you are agreeing to this Privacy Policy for that entity and are representing to us that you have the authority to do so (in which case "you" will refer to that entity). If you do not agree with our policies and practices, your choice is not to use the Services.

This Privacy Policy may change from time to time. If we make any changes, we will post the changes on this page and indicate at the top of this page the date the policy was last revised. We will also notify you of any material changes either through a pop-up notice, email or through other reasonable means. Any such changes are effective immediately when we post them, and apply to all access to and use of the Services thereafter. Your continued use of the Services after the date any such changes become effective constitutes your acceptance of the new policy.

Information We Collect and How We Collect Information

Information You Provide

We may collect information you provide directly via the Services. We may ask you for some or all of the following types of information when you register with our Services, submit comments and other content, order products, or directly contact us with questions or feedback:

Your name
Your telephone number
Your address (including shipping and billing address where applicable)
Your email address
National Provider Identifier (NPI) (for healthcare provider users)
State professional licenses (for healthcare provider users)
Driver's license, passport, or other identification (if needed for verification, fraud prevention, or compliance)

The information you provide may include Personal Information. "Personal Information" is information that identifies you personally (whether alone or in combination).

Purchases / Orders (including Shopify checkout). If you purchase products or services through our Services (including through a Shopify-hosted checkout), you may be required to provide information needed to process your order, such as contact details, shipping and billing details, and transaction details. Payment information (such as your credit card or bank account number) is collected and processed by third-party payment processors and/or ecommerce platform providers (for example, Shopify and/or its payment processing partners). Opticare does not collect or store full payment card numbers. We may, however, receive or have access to certain purchase-related information, such as items purchased, order status, shipping details, payment method type, and payment confirmation details.

Information We Automatically Collect

We may also collect certain information automatically when you visit the Services, including:

Your browser type and operating system
Your Internet Protocol (IP) address, which is the number automatically assigned to your computer whenever you access the Internet and that can sometimes be used to derive your general geographic area
Geolocation information (typically approximate location derived from IP address; we do not require precise geolocation for general use of the Site)
Other unique identifiers, including mobile device identification numbers
Sites you visited before and after visiting the Services
Pages you view and links you click on within the Services
Information collected through cookies, web beacons, and other analytics technologies
Information about your interactions with e-mail messages, such as the links clicked on and whether the messages were opened or forwarded
Standard server log information

We collect the above information in a variety of ways, including by using "pixel tags," "web beacons," and "cookies."

Cookies are small bits of information that are stored by your computer's browser. You can decide if and how your computer will accept a cookie by configuring your preferences or options in your browser. However, if you choose to reject cookies, you may not be able to use certain online products, services or features on the Services.

Pixel tags are very small images or small pieces of data embedded in images, also known as "web beacons" or "clear GIFs," that can recognize cookies, the time and date a page is viewed, a description of the page where the pixel tag is placed, and similar information from your computer or device.

Third-Party Information Collection

We may allow third parties to place and read their own cookies, web beacons, and other technologies to collect information through the Services. For example, our third-party service providers may use these technologies to collect information (i) that helps us with traffic measurement, research, and analytics, and (ii) that may be used to measure marketing effectiveness and serve advertisements on our Services and across the Internet.

The information collected and stored by third parties remains subject to their policies and practices. We do not control these third parties' tracking technologies or how they may be used.

We may use the services of third-party vendors, who may collect your information, including website analytics, form submission tools, hosting providers, ecommerce platforms, payment processors, fraud-prevention services, and shipping/fulfillment providers. You can review the privacy policies of those vendors on their websites.

How We Use Your Information

We may use information that we collect about you or that you provide to us, including Personal Information, to measure usage of the Services, to analyze the effectiveness of our Services, to conduct research, to improve and enhance functionality of the Services, to provide support for the Services and respond to requests and inquiries, to provide you with notices, such as updates or changes that we may make to the Services, and to market and advertise the Services, including through promotional e-mail messages, directly or in partnership with other parties, and by displaying our advertisements on other websites that you visit or use.

We may also use this information to personalize your experience and to present information and content that may be relevant to you based on your interactions with the Services. Notwithstanding the foregoing, we do not use Protected Health Information ("PHI") for targeted advertising purposes.

Order processing and fulfillment. We may use your information to process and fulfill orders, provide customer support, communicate about transactions, handle returns or issues, and coordinate delivery and fulfillment with vendors and service providers.

We may from time to time aggregate information in certain data analysis, reports, or other interpretations of trends for internal purposes. We may also share aggregated information externally in a manner that does not identify individuals. We do not sell de-identified data.

Choices About How We Collect, Use and Disclose Your Information

We strive to provide you with choices regarding our collection, use and disclosure of the information you provide to us. The mechanisms listed below aim to provide you with control over such collection, use and disclosure:

Marketing Communications. If you do not want us to send you marketing or promotional communications, you can opt-out by clicking the "unsubscribe" link in any such promotional emails, checking the relevant box located on the form on which we collect your data or emailing us at support@mandatamd.com.

Cookies. You have the option to accept or disable cookies at any time through your browser. You may refuse to accept browser cookies by activating the appropriate setting on your browser. If you choose to disable your cookies, your user experience may be limited.

Google Analytics. If we use Google Analytics, you can opt out of tracking by Google Analytics by using Google's Ads Settings or going to https://tools.google.com/dlpage/gaoptout/. You may also opt out of Google marketing products, but please note that this does not opt you out of being served generic ads.

Third-Party Advertising. If you are interested in more information about tailored advertising and your choices to prevent third parties from delivering tailored web advertisements, you may visit: http://www.networkadvertising.org/choices/ or http://www.aboutads.info/choices/. These opt-out tools are provided by third parties. We do not control or operate these tools or the choices that advertisers and others provide through these tools.

Disclosure of Your Information

We want you to understand when and with whom we may share the information we collect. We may disclose information that we collect through the Services with third parties as follows:

Service Providers. We may share your information with our agents and service providers that perform certain functions or services on our behalf, such as to host the Services, manage databases, host a store or other e-commerce platform, process payments, coordinate fulfillment and delivery, perform analyses, provide fraud prevention, or conduct surveys. For example, we may use Shopify to host and operate the checkout experience and support order processing, and we may use third-party payment processors and shipping/fulfillment providers to complete transactions and deliver products.

Other Parties When Required By Law or as Necessary to Protect the Services. We may disclose your information to third parties in order to protect the legal rights, safety, and security of Opticare and the users of our Services; enforce our Terms of Service; prevent fraud; and comply with or respond to law enforcement or a legal process or a request for cooperation by a government or other entity, whether or not legally required.

In Connection With a Transfer of Assets. If we sell all or part of our business, or make a sale or transfer of assets, or are otherwise involved in a merger or business transfer, or in the event of bankruptcy, we may transfer your information to one or more third parties as part of that transaction.

Other Parties With Your Consent. We may share information about you with other third parties when you consent to such sharing.

Aggregate Information. We may disclose to third parties information that does not describe or identify individual users, such as aggregate website usage data or demographic reports.

You will be notified via email and/or a prominent notice on our Site of any change in ownership or uses of your Personal Information, as well as any choices you may have regarding your Personal Information.

Relationship with Shopify / Checkout

Our checkout and ecommerce experience may be hosted by Shopify. Shopify collects and processes personal information about your access to and use of the checkout experience in order to provide and improve its services, including processing payments, preventing fraud, supporting customer support tools, and enabling order fulfillment.

Information you submit during checkout will be transmitted to and processed by Shopify and may also be shared with payment processors, fraud-prevention providers, and shipping/fulfillment providers as necessary to complete your purchase. Shopify and its service providers may process information in countries other than where you reside.

To learn more about how Shopify uses personal information, you can review Shopify's consumer privacy information on its website.

Social Networking Services

The Services may allow you to post information to various third-party services or platforms, such as social networking services. You acknowledge that if you choose to use this feature, your friends, followers and subscribers on these third-party services or platforms will be able to view such activity. If you choose to access or make use of third-party social networking services, we may receive information about you that you have made available to those social networking services, including information about your contacts on those social networking services. The use of the information by such social networking websites will be governed by their privacy policies, and we do not control their use of the shared data.

Links to Third-Party Sites and Services

The Services may contain links to other websites or online services that are operated and maintained by third parties and that are not under the control of or maintained by Opticare. Such links do not constitute an endorsement by Opticare of those other websites, the content displayed therein, or the persons or entities associated therewith. This Privacy Policy does not apply to this third-party content. We encourage you to review the privacy policies of these third-party websites or services.

Do Not Track Signals

Third parties may keep track of your browsing activities across third party websites. Certain web browsers enable users to activate a "Do Not Track" signal but we do not currently respond to the "Do Not Track" signal or other similar mechanisms.

Data Retention

We strive to keep your information only as long as we need it for legitimate business purposes and as permitted by applicable legal requirements. If you close your account, we may retain certain data for analytical purposes and recordkeeping integrity, as well as to prevent fraud, enforce our Terms of Use, take actions we deem necessary to protect the integrity of our Services or our users, or take other actions otherwise permitted by law. In addition, if certain information has already been provided to third parties as described in this Privacy Policy, retention of that information will be subject to those third parties' policies.

You acknowledge that Opticare may establish general practices and limits concerning use of the Services, including without limitation the maximum period of time that data or other content will be retained by the Services and the maximum storage space that will be allotted on Opticare's systems on your behalf. You further acknowledge that Opticare reserves the right to change these general practices and limits at any time, in its sole discretion. We will endeavor to give you notice of any such change where required by applicable law.

Accessing and Correcting Your Information

If you wish to access, update, correct or delete any Personal Information in our possession that you have previously submitted via the Services, you may log into your account and make updates (if applicable). If you wish to make changes not available through your account settings, please contact us at joe@mandatamd.com.

Security

We take reasonable steps to protect the Personal Information provided to us from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no Internet or e-mail transmission is ever fully secure or error free. In particular, e-mail sent to or from the Services may not be secure. Therefore, you should take special care in deciding what information you send to us via e-mail. Please keep this in mind when disclosing any Personal Information to us via the Internet.

In the event that personal information is compromised as a breach of security, Opticare will promptly notify our customers as required under applicable law.

Notice to California Residents

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a calendar year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please send an email to support@mandatamd.com.

If you are under 18 years of age, reside in California, and have a registered account with the Site, you have the right to request removal of unwanted data that you publicly post on the Site. To request removal of such data, please contact us using the contact information provided and include the email address associated with your account and a statement that you reside in California. We will make sure that the data is not publicly displayed on the Site, but please be aware that the data may not be completely or comprehensively removed from our systems.

To request any other changes or information about our collection, use or disclosure of your information, please email us at support@mandatamd.com.

Children Under the Age of 13

Our Services are intended for users who are 13 years of age and older. If you are under the age of 13, you are not permitted to submit any Personal Information to us. If you believe we might have any information from or about a child under 13, please contact us at joe@mandatamd.com.

International Users

Please note that the Services are directed towards users who reside in the United States. By using the Services, you consent to the collection, storage, processing, and transfer of your information in and to the United States, or other countries and territories, pursuant to the laws of the United States. Some of these countries may not offer the same level of privacy protection as your own.

Health Information Practices Notice (HIPAA-Style Notice)

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

We believe your health information is personal. We keep records of the services that you receive through workflows enabled by the Opticare System. We are committed to keeping your health information private, and we are required by law to respect your confidentiality in situations where Opticare is acting as a business associate and receives Protected Health Information ("PHI") on behalf of a covered entity.

This notice applies to health information that identifies you and is received by Opticare in connection with provider-authorized workflows through the Services. This information may consist of paper, digital or electronic records and could also include photographs, videos and other electronic transmissions or recordings that are created during use of the Services. We are legally required to keep your health information private, to notify you of our legal responsibilities and privacy practices that relate to your health information, and to notify the applicable covered entity if there is a breach of your unsecured health information. We are also legally required to follow the terms of this notice currently in effect, to the extent applicable.

1. CAREGIVERS

Doctors and other caregivers who are not employed by Opticare may exchange information about you with Opticare and/or your healthcare provider's systems in connection with provider-authorized workflows. In connection with health care services that these health care practitioners provide to you outside of Opticare, they may also give you their own privacy notices that describe their office practices.

These doctors and caregivers may share your health information with each other for reasons of treatment, payment, and health care operations as described below.

2. HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION

When you participate in provider-authorized workflows enabled by the Services, we may use your health information within Opticare, and disclose your health information outside of Opticare for the reasons described in this Notice. The following categories describe some of the ways that we will use and disclose your health information.

Treatment. We may use and disclose your health information to health care professionals or other third parties to support, coordinate and manage the delivery of health-related services (e.g., enabling provider-authorized non-prescription product recommendations and facilitating fulfillment workflows). Your healthcare provider may disclose health information about you to support the provider's recommendation and related communications.

Payment. We may use and disclose your health information so that items and services enabled through the Services can be billed and paid for by you, your insurance company, or another third party, where applicable. We may disclose your health information to a friend or family member who helps pay for your care if you authorize such disclosure or as permitted by law.

Health Care Operations. We may use your health information and disclose it outside Opticare for our health care operations. These uses and disclosures help us operate Opticare to maintain and improve service quality and reliability. We may remove information that identifies you so people outside our organization can study data without knowing who you are. Opticare does not sell de-identified data.

Contacting You. We may use and disclose health information to reach you about provider-authorized recommendations, order status, fulfillment communications, and other matters related to the Services. We may contact you by mail, telephone, text message or email. For example, we may leave voice messages at the telephone number you provide us with, and we may respond to your email address.

Text Messages Sent on Behalf of Healthcare Providers

Opticare may send text messages to patients on behalf of healthcare providers or health systems in connection with provider-authorized recommendations, care coordination, order fulfillment, and related healthcare operational communications facilitated through the Services.

Opticare sends such messages in reliance on patient consent obtained and documented by the applicable healthcare provider or health system, as permitted by applicable law and the parties' contractual arrangements. Opticare acts solely as a service provider in transmitting these communications.

These communications are not marketing or promotional messages and are limited to messages necessary to support treatment, healthcare operations, or fulfillment of provider-authorized recommendations.

Patients may opt out of receiving text messages at any time by replying STOP to any message.

Reply HELP for assistance or contact joe@mandatamd.com.

Message and data rates may apply. Message frequency varies.

Carriers are not liable for delayed or undelivered messages.

Opticare will honor opt-out requests and suppress future messages except where a one-time confirmation message is required by law.

Health-Related Services

We may use and disclose health information about you to send you communications related to provider-authorized recommendations and fulfillment services available through Opticare. You have the right to choose not to receive certain communications, where applicable, and we will tell you how to cancel them; however, certain service and fulfillment communications are necessary to provide the Services.

Legal Matters

We will disclose health information about you outside Opticare when required to do so by federal, state, or local law, or by court process. We may disclose health information about you for public health reasons. We may release health information to help control the spread of disease or to notify a person whose health or safety may be threatened. We may disclose health information to a health oversight agency for activities authorized by law, such as for audits, investigations, inspections, and licensure. We will disclose health information about you when required to do so by law. If federal, state or local law within your jurisdiction offers you additional protections against improper use or disclosure of PHI, we will follow such laws to the extent they apply.

3. AUTHORIZATIONS FOR OTHER USES AND DISCLOSURES

As described above, we will use your health information and disclose it outside Opticare for treatment, payment, health care operations, and when required or permitted by law. We will not use or disclose your health information for other reasons without your written authorization. These kinds of uses and disclosures of your health information will be made only with your written authorization. You may revoke the authorization in writing at any time, but we cannot take back any uses or disclosures of your health information already made with your authorization.

4. YOUR RIGHTS REGARDING HEALTH INFORMATION

Right to Accounting

You may request an accounting, which is a listing of the entities or persons (other than yourself) to whom we have disclosed your health information without your written authorization. The accounting would not include disclosures for treatment, payment, health care operations, and certain other disclosures exempted by law. Your request for an accounting of disclosures must be in writing, signed, and dated. It must identify the time period of the disclosures and the records about which you are requesting the accounting. We will not list disclosures made earlier than six (6) years before your request. Your request should indicate the form in which you want the list (for example, on paper or electronically). You must submit your written request to our Privacy Officer, email: support@mandatamd.com, address: 2275 Swallow Hill Road, Suite 503, Pittsburgh, PA 15243. We will respond to you within 60 days. We will give you the first listing within any 12-month period free of charge, but we will charge you for all other accountings requested within the same 12 months.

Right to Amend

If you feel that health information we have about you is incorrect or incomplete, you have the right to ask us to amend your records. Your request for an amendment must be in writing, signed, and dated. It must specify the records you wish to amend, and give the reason for your request. You must address your request to our Privacy Officer, email: support@mandatamd.com, address: 2275 Swallow Hill Road, Suite 503, Pittsburgh, PA 15243. We will respond to you within 60 days. We may deny your request; if we do, we will tell you why and explain your options.

Right to Inspect and Obtain Copy

You have the right to inspect and obtain a copy of your completed records as permitted by law. Your request to inspect or obtain a copy of the records must be submitted in writing, signed and dated, to our Privacy Officer, email: support@mandatamd.com, address: 2275 Swallow Hill Road, Suite 503, Pittsburgh, PA 15243. We may charge a fee for processing your request. If we deny your request, you may appeal the denial in writing to our Privacy Officer.

Right to Request Restrictions

You have the right to ask us to restrict the uses or disclosures we make of your health information for treatment, payment, or health care operations, but we do not have to agree. You also may ask us to limit the health information that we use or disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend. Again, we do not have to agree. A request for a restriction must be signed and dated. The request should also describe the information you want restricted, specify whether you want to limit the use or the disclosure of the information or both, and tell us who should not receive the restricted information. You must submit your request in writing to our Privacy Officer, email: support@mandatamd.com, address: 2275 Swallow Hill Road, Suite 503, Pittsburgh, PA 15243. We will tell you if we agree with your request or not. If we do agree, we will comply with your request unless the information is needed to provide you with emergency treatment. However, if you pay out of pocket and in full for a health care item or service, and you ask us to restrict the disclosures we make to a health plan of your health information relating solely to that item or service, we will agree to the extent the disclosure is for the purpose of carrying out payment or health care operations and the disclosure is not required by law.

Right to Request Confidential Communications

You have the right to request that we communicate with you about your health in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. Your request for confidential communications must be in writing, signed, and dated. It must specify how or where you wish to be contacted. You need not tell us the reason for your request, and we will not ask. You must send your written request to our Privacy Officer, email: support@mandatamd.com, address: 2275 Swallow Hill Road, Suite 503, Pittsburgh, PA 15243. We will accommodate all reasonable requests.

Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy. You may obtain a paper copy of this Notice by contacting our Privacy Officer, email: support@mandatamd.com, address: 2275 Swallow Hill Road, Suite 503, Pittsburgh, PA 15243.

COMPLAINTS

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the Secretary of the U.S. Department of Health and Human Services. To file a complaint with us, you must submit your complaint in writing to the Privacy Officer, email: support@mandatamd.com, address: 2275 Swallow Hill Road, Suite 503, Pittsburgh, PA 15243. You will not be penalized for filing a complaint.

CHANGES TO THIS NOTICE

We may change this Notice at any time. Any change in the Notice could apply to medical information we already have about you, as well as any information we receive in the future. We will post a copy of the current Notice on our website. The effective date of the Notice is shown at the top of this page.

Contact Information

If you have any questions about this Privacy Policy, please contact us at support@mandatamd.com.