Consumer Health Data Privacy Policy

Scope

This Health Data Policy applies to Consumer Health Data that MatchMyDentist collects from or about consumers where applicable consumer-health-data law applies.

“Consumer Health Data” generally means personal information that identifies or can reasonably be linked to a consumer and identifies the consumer’s past, present, or future physical or mental health status, healthcare, treatment, condition, diagnosis, medication, health-related behavior, or other information treated as Consumer Health Data under applicable law.

Information may be Consumer Health Data even when it is not Protected Health Information (“PHI”) under HIPAA.

Where information is PHI governed by HIPAA, HIPAA and any applicable Business Associate Agreement may govern that information instead of or in addition to state consumer-health-data law.

Consumer Health Data We Collect

Depending on how you use MatchMyDentist, we may collect Consumer Health Data including:

• dental concerns;
• dental symptoms or problems you describe;
• Patient-reported treatment interests;
• dental history;
• time since your last dental visit;
• dental anxiety, fears, triggers, or prior experiences;
• comfort and sedation preferences;
• treatment goals;
• information about what has prevented or delayed you from seeking dental care;
• communication preferences relating to dental care;
• scheduling and treatment-readiness information;
• dental insurance or self-pay information;
• budget and financial-preference information relating to dental care;
• free-text descriptions of your dental situation;
• Provider preferences relating to your dental experience;
• information concerning a Provider Introduction or Match; and
• other health-related information you voluntarily provide through the Platform.

We may also derive or infer limited information from the information you provide when reasonably necessary to operate the matching process.

MatchMyDentist does not diagnose you or independently determine what dental treatment you require.

Sources of Consumer Health Data

We collect Consumer Health Data primarily:

• directly from you when you complete a Patient Profile or questionnaire;
• from your communications with MatchMyDentist;
• from your use of Platform features;
• from your decisions concerning Provider Introductions and Matches; and
• from participating Providers where necessary to operate the Platform or provide Services you request.

We may also receive information from service providers acting on our behalf where necessary to operate the Services.

Why We Collect and Use Consumer Health Data

We may collect and use Consumer Health Data to:

• create your Patient Profile;
• understand the dental concerns, preferences, and circumstances you choose to share;
• operate the Platform’s matching and routing process;
• compare selected Patient Profile information with participating Provider Profile information and applicable Platform criteria;
• identify a participating Provider for review;
• provide applicable Patient Profile information to that Provider;
• allow the Provider to decide whether to send you an Introduction;
• allow you to review a Provider Profile and personalized Introduction;
• establish a Match when you accept a Provider’s Introduction;
• facilitate the exchange of contact information after a Match;
• communicate with you about your Profile, Introduction, or Match;
• provide customer support;
• maintain Platform security and prevent fraud or misuse;
• comply with legal obligations;
• investigate complaints or security incidents;
• enforce our agreements and policies; and
• operate, maintain, analyze, and improve the Services where permitted by law.

Not every Patient Profile response is necessarily used as a matching criterion.

Matching and Inferences

MatchMyDentist may use software, algorithms, automated processing, and other technology to compare selected Patient Profile information with participating Provider Profile information and applicable Platform criteria.

These criteria may include information concerning:

• geography;
• Patient-reported treatment interests;
• Provider clinical focus;
• PPO or self-pay status;
• scheduling availability;
• Patient readiness;
• anxiety and comfort preferences;
• communication preferences;
• practice characteristics;
• financial-access capabilities;
• Platform capacity; and
• other applicable criteria.

Patient budget information may be provided to a Provider as part of the Patient Profile so the Provider understands the Patient’s reported financial circumstances before deciding whether to respond.

Patient budget bands are not used to rank Providers according to the economic value of a Patient.

MatchMyDentist does not use the matching process to make a dental diagnosis or determine what treatment is clinically appropriate.

Consumer Health Data We Share

6.1 Participating Providers

Before a Match, MatchMyDentist may share applicable Patient Profile information with a participating Provider so that Provider can independently decide whether to send an Introduction.

This may include Consumer Health Data such as:

• dental concerns;
• Patient-reported treatment interests;
• dental history;
• anxiety and comfort concerns;
• insurance or self-pay information;
• budget information;
• scheduling and readiness information;
• communication preferences;
• general location or distance information; and
• the Patient’s written story.

Before a Match, the Provider reviewing the Patient Profile does not receive the Patient’s first name, last name, phone number, or email address.

If the Provider sends an Introduction, the Patient may review the Provider’s identity, Provider Profile, practice information, and Introduction.

If the Patient accepts that Introduction, a Match occurs and MatchMyDentist may disclose applicable Patient contact information and Patient Profile information to that Provider so the parties may communicate directly.

6.2 Service Providers and Processors

We may disclose Consumer Health Data to service providers or processors that help us operate the Services, including providers of:

• hosting and cloud infrastructure;
• database services;
• authentication;
• security and fraud prevention;
• communications;
• customer support;
• technical operations;
• analytics used to operate or improve the Services; and
• automated or AI-enabled functionality.

These entities may process Consumer Health Data only as reasonably necessary to provide services to MatchMyDentist and subject to applicable contractual and legal requirements.

6.3 Legal and Safety Disclosures

We may disclose Consumer Health Data where permitted or required by law, including where reasonably necessary to:

• comply with legal process;
• respond to lawful governmental or regulatory requests;
• protect a consumer or another person from harm;
• investigate fraud, security incidents, or unlawful conduct;
• protect our legal rights;
• enforce our agreements; or
• establish, exercise, or defend legal claims.

6.4 Business Transactions

Consumer Health Data may be transferred as part of a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, subject to applicable law and any consent requirements that apply.

Categories of Entities With Whom Consumer Health Data May Be Shared

Depending on your use of the Services, categories of recipients may include:

• participating dental Providers;
• cloud and hosting providers;
• database and infrastructure providers;
• security and authentication providers;
• communications providers;
• customer-support providers;
• technology and AI service providers;
• professional advisers where legally appropriate;
• governmental or regulatory authorities where legally required; and
• parties involved in an applicable corporate transaction.

We do not sell Consumer Health Data.

No Sale or Unrelated Advertising

MatchMyDentist does not sell Consumer Health Data.

We do not use Consumer Health Data from Patient Profiles for unrelated third-party behavioral advertising.

Participating Providers pay MatchMyDentist for Platform Membership and access. Provider payment does not constitute payment for ownership of your Consumer Health Data and does not permit a Provider to purchase preferential ranking for you.

Consent

Where applicable law requires consent before MatchMyDentist collects, uses, or shares Consumer Health Data, we will request consent as required.

Consent to collect Consumer Health Data is separate from any consent that applicable law may require for sharing Consumer Health Data.

You may withdraw consent to future collection or sharing where applicable law provides that right.

Withdrawal does not necessarily affect processing that occurred lawfully before withdrawal and may prevent us from continuing to provide Services that require the Consumer Health Data involved.

Your Consumer Health Data Rights

Depending on your state and applicable law, you may have the right to:

• confirm whether MatchMyDentist collects, shares, or sells your Consumer Health Data;
• access Consumer Health Data concerning you;
• obtain a copy of Consumer Health Data;
• obtain information concerning categories of Consumer Health Data collected;
• obtain information concerning sources of Consumer Health Data;
• obtain information concerning categories of entities with whom Consumer Health Data has been shared;
• correct inaccurate Consumer Health Data;
• request deletion of Consumer Health Data;
• withdraw consent to future collection or sharing;
• opt out of any sale where applicable;
• appeal a denial of a Consumer Health Data request; and
• exercise other rights provided by applicable law.

These rights may be subject to legal exceptions and verification requirements.

Deletion Requests

You may request deletion of Consumer Health Data by contacting us as described below.

Where required by applicable law, we will take reasonable steps to delete covered Consumer Health Data from our records and communicate applicable deletion requests to processors, affiliates, or other third parties where required.

Deletion rights may be subject to exceptions permitted by law, including information reasonably necessary to:

• comply with law;
• establish, exercise, or defend legal claims;
• prevent or investigate fraud or security incidents;
• maintain required transaction or consent records; or
• perform other legally permitted functions.

Information already received and independently maintained by a dental Provider may be subject to that Provider’s own legal and professional recordkeeping obligations.

How to Exercise Your Rights

To exercise an applicable Consumer Health Data right, contact:

privacy@matchmydentist.com

Please include sufficient information for us to understand your request.

We may take reasonable steps to verify your identity before fulfilling a request.

Where applicable law permits use of an authorized agent, we may request information reasonably necessary to verify the agent’s authority.

Appeals

If we deny or decline to take action on a Consumer Health Data request and applicable law provides a right to appeal, you may appeal by emailing:

privacy@matchmydentist.com

Please state that you are submitting a Consumer Health Data Privacy Appeal and identify the request being appealed.

We will respond within the period required by applicable law.

If an appeal is denied, we will provide information concerning any additional complaint rights required by applicable law.

Security

MatchMyDentist maintains administrative, technical, physical, and organizational safeguards designed to protect Consumer Health Data against unauthorized access, use, disclosure, alteration, loss, or destruction.

No information system can be guaranteed to be completely secure.

If a breach or security incident involving Consumer Health Data occurs, MatchMyDentist will take actions required by applicable law, including notification where required.

Retention

We retain Consumer Health Data for as long as reasonably necessary to provide the Services, operate the Platform, maintain required records, comply with legal obligations, prevent fraud or misuse, resolve disputes, enforce agreements, and protect the security and integrity of the Services.

Different categories of Consumer Health Data may be retained for different periods.

When Consumer Health Data is no longer reasonably necessary, we may delete, anonymize, or aggregate it, subject to applicable legal obligations and permitted exceptions.

Employer and Benefits-Broker Programs

If you access MatchMyDentist through an employer or benefits-broker program, your use of MatchMyDentist remains separate from your employer’s or broker’s administration of the program.

MatchMyDentist does not provide an employer or benefits broker with your individual:

• Patient Profile;
• dental concerns;
• treatment interests;
• anxiety information;
• budget information;
• Provider selection;
• Match details; or
• other individual Consumer Health Data merely because you used the program.

Employers and brokers may receive aggregate, de-identified, or otherwise legally permitted program-level information.

Changes to This Policy

We may update this Health Data Policy from time to time.

If we make material changes, we will update the Effective Date and provide notice as required by applicable law.

Where applicable law requires additional consent before a materially different collection, use, or sharing of Consumer Health Data, we will obtain that consent as required.

Contact Information

Email: privacy@matchmydentist.com

MatchMyDentist Inc. is a Delaware corporation.