INTRODUCTION This Privacy Notice (“Privacy Notice”) describes the Personal Information that Evolus Australia Pty Ltd’s (ABN 76 663 925 166) having its registered address at Suite 2, Level 25, 100 Miller Street, North Sydney NSW 2060 (hereinafter, “Evolus”, “us” or “we”) collects and how we manage it.

PERSONAL INFORMATION AND HOW WE USE IT “Personal Information” is information or an opinion about an identified individual, or an individual who is reasonably identifiable. We will collect Personal Information whenever we interact with you in any manner. We collect Personal Information in a number of ways including, via our website, by telephone, and by e-mail. We also collect Personal Information from third parties including specialist data companies in our sector, publicly available resources of information, and marketing partners.
We collect your personal information so that we can: (a) provide you with products and services, and manage our relationship with you; (b) contact you, for example, to respond to your queries or complaints, or if we need to tell you something important; (c) comply with our legal obligations and assist government and law enforcement agencies or regulators; or (d) identify and tell you about other products or services that we think may be of interest to you. If you do not provide us with your personal information, we may not be able to provide you with our services, communicate with you or respond to your enquiries. You do not have to provide us with Personal Information. However, if you do not, we may not be able to provide specific services or perform contractual obligations.
If you give us the authority to collect Personal Information relating to another individual, including adverse event data, you confirm that you have the authority to share that data for its use in line with this Privacy Notice. HOW WE USE PERSONAL INFORMATION We disclose Personal Information as follows:

• To our related Evolus companies for the purposes described in this Privacy Notice.
• To our third-party service providers, who can use the data in several ways including for market research purposes.
• To specialist data companies in the healthcare sector involved in maintaining the accuracy of such data.
• To other companies with which we collaborate in co-development, dissemination and/or marketing of products or services.
• To comply with regulatory or legal requirements.
• where we are otherwise permitted by law to disclose the information.
• To any third-party legal successor in connection with preparing, completing, and implementing any sale of some or all of our assets, a merger, or reorganization, including by means of bankruptcy, which may occur.

DISCLOSURES OF TRANSFER OF VALUE An Evolus company in the country of your professional practice may make public disclosures of the transfers of value that you receive from any Evolus company in accordance with the EFPIA Transparency Code of Conduct and/or applicable local law.

YOUR RIGHTS Every user is entitled to the following:

• The right to access – You have the right to request copies of your Personal Information.
• The right to rectification – You have the right to request that we correct or amend inaccurate or incomplete information.
• The right to erasure – You have the right to request that we delete your Personal Information, under certain conditions.
• The right to restrict processing – You have the right to request that we restrict the processing of your Personal Information, under certain conditions.
• The right to object to processing – You have the right to object to our processing of your Personal Information, under certain conditions.
• The right to data portability – You have the right to request we transfer the data that we have collected to another organization, or directly to you, under certain conditions.

If you would like to exercise any of these rights, please contact us using the details in the Contact Us section below.
Please note that we will need to retain some aspects of your Personal Information for record-keeping purposes and/or to complete any transactions.

COOKIES AND OTHER TRACKING TECHNOLOGIES Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. When you visit our websites, we may collect information from you automatically through cookies or similar technology.
We and third parties with whom we partner (including Google Analytics) may use cookies, web beacons, tracking pixels, web bugs, scripts, tags, and other similar technology (collectively, “Cookies”) to record information about your activities on the Website and on third-party websites that you visit. Some Cookies remain on your device until you delete them; others are stored only during an individual session. You may set your device settings to attempt to reject Cookies but doing so may affect the functionality of the Website.

ONLINE TRACKING AND YOUR CHOICES As discussed above, because we and our third-party service providers automatically collect Services usage information through the use of Cookies (including as described in the “Information that is Automatically Collected” section above, and otherwise in this Policy), your selection of the “Do Not Track” option provided by your browser may not have any effect on our collection of automatically collected information. One way to attempt to “opt out” of the collection of any information through Cookies and some (but not all) other tracking technology is to actively manage the settings on your browser to delete and disable Cookies and other tracking/recording tools. However, getting a “Do Not Track” signal to work as you might want is difficult and may not be possible. Using browsers as an example, not all tracking technologies can be controlled by browsers; unique aspects of your browser might be recognizable even if you disable a tracking technology; not all settings will necessarily last or be effective; even if a setting is effective for one purpose, data still may be collected for another; and even if one website observes a “Do Not Track” signal, that website usually will not be able to control other websites. Additionally, if you select a “Do Not Track” option or disable Cookies on your device, certain Services may become unavailable or may not function properly. We do not control the use of Cookies by third parties. You can set your browser not to accept cookies, and the above website tells you how to remove cookies from your browser. However, in a few cases, some of our website features may not function as a result.

PRIVACY POLICIES OF OTHER WEBSITES Our website contains links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.

DATA SECURITY Keeping secure personal information that we collect is of great concern to us. While we have mechanisms in place to safeguard your personal information once we receive it, no storage or transmission of data can be guaranteed to be 100% secure. When you provide Personal Information to us, you do so at your own risk.

RETENTION PERIOD We will retain your Personal Information for as long as needed or permitted in line with this Privacy Notice. We determine the length of retention periods by considering a number of factors including: how long we have had an ongoing relationship with you and whether there is a legal or regulatory obligation concerning retention of the Personal Information.

CROSS BORDER TRANSFERS The data we collect through the Site will be stored and processed in any country where we have facilities or in which we engage service providers, including in the United States of America, the United Kingdom and Europe.
For transfers of Personal Information to countries outside of your country, we will put in place, in line with applicable legal requirements, appropriate safeguards to ensure that your Personal Information gets the same protection as it does in Australia. These measures may include (i) entering into contractual clauses to protect your Personal Information and/or (ii) relying on your consent (where permitted by law).

DATA OF CHILDREN The Services are intended for users over the age of 18 and are not directed towards children. We do not knowingly collect Personal Information from children. If you become aware that a child has provided us with Personal Information without parental consent, please contact us using the contact information at the bottom of this Policy, and we will take steps to remove the information.
If you are providing us with Personal Information of Children, you confirm that you have the demonstrable authority to do so.

UPDATES This Privacy Notice was last updated on the 10th June 2024.

CONTACT US If you have questions about this Privacy Notice, or if you would like to request to exercise any individual rights, please contact us at privacy@evolus.com. In all communications to us, please include the email address used for registration (if applicable), the website address, mobile application, or the specific program to which you provided Personal Data, and a detailed explanation of your request. If you would like to delete, amend, or correct your Personal Data and are contacting us by email, please put “Deletion Request” or “Amendment/Correction Request” in the subject line of the email. We will respond to all reasonable requests in a timely manner, and we may need to further confirm your identity in order to process certain requests.

MAKING A COMPLAINT You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe your privacy rights have been infringed.
Contact details for the OAIC are available on their website: www.oaic.gov.au.