Privacy Policy - HIPAA

SmileDirectClub, LLC (“SmileDirectClub” or “we” or “our”) respects your privacy and is committed to protecting it through our compliance with this policy.

This Privacy Policy (“Privacy Policy”) describes the types of information we may collect from you or that you may provide when you visit the website www.smiledirectclub.com (our “Site”), use our SmileDirectClub mobile application (our “Application”), or respond to SmileDirectClub communications that may include “calls to action;” and our practices for collecting, using, maintaining, storing, protecting, and disclosing that information.

This policy applies to information we collect:

• from you or your legal guardian on or through our Site or Application;
• from or on behalf of your licensed dentist, orthodontist or other medical provider or her/his staff;
• in email, text, and other electronic messages between you and our Site or Application;
• in certain third party applications you have specifically consented to use, whose terms of service or privacy policy(ies) you have agreed to separately; • through printed documents, records, and materials; and
• when you interact with our advertising, marketing, and applications on third-party websites and services, if those applications or advertising include links to this policy.
• through a certain third party application (“modal”), with which you agree to share limited personal information so that SmileDirectClub may assist you with SmileDirectClub account set-up and send marketing emails to you.

It does not apply to information we collect:

• offline or through any other means, including on any other website operated by SmileDirectClub or any third-party; or
• through most third party website or application, including through any application or content (including advertising or marketing) that may link to or be accessible from or on the Site or in the Application.

Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, you are not permitted to use our Site or Application. By accessing or using our Site or Application, you agree to the terms and conditions of this Privacy Policy. This Privacy Policy may change from time to time. Your continued use of our Site or Application after we make changes shall constitute your acceptance of those changes, so please check this Privacy Policy periodically for updates.

Children Under the Age of 18

Our Application and Site are not intended for children under the age of 18 and children under the age of 18 are not permitted to use our Site. We will remove any information provided by a child under the age of 18 if we become aware of it. Parents and legal guardians are welcome to provide information on behalf of children under 18.

We may provide our goods and services to children 12 years of age or older, and parents or guardians of children 12 or older are welcome to use our Site and Application to order and use our goods and services on their children’s behalf, including by entering their children’s information on our Site or in our Application. However, our Site and Application are not intended to be directly used by children under 18 years of age. No one under age 18 may provide any information to or on the Site or in the Application. We do not knowingly collect personal information directly from children under 18. If you are under 18, please ask your parent or guardian to access and use the Site or Application for you, and please do not use, or provide any information on our Site, Application, or on or through any of their features, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received personal information directly from a child under 18 without verification of parental or guardian consent, we will delete that information. If you believe we might have received any information from a child under 18, please contact us at .

Information We Collect About You and How We Collect

It We collect different types of information about you, including information that may directly identify you or be used to identify you, information that is about you but individually does not personally identify you, and information that we combine with our other users. This includes information that we collect directly from you or through automated collection technologies.

This also includes information collected using a modal only after you agree to such access. The Google modal does not create a SmileDirectClub account, but shares limited Google account information (e.g., first and last name, email address and locality) with SmileDirectClub so that SmileDirectClub may assist you in creating a SmileDirectClub account and send marketing emails to you.

Generally

We collect several types of personal information from and about users of our Application and Site, specifically information:

• by which you may be personally identified, such as name; home, shipping, and postal address; e-mail address; home and mobile telephone number; credit card, debit card, or other payment information (solely for payment purposes); date of birth; social security number; your medical history and name(s) of your medical and dental providers; and other information about your past, present or future physical or mental health condition or the provision of health or dental care;
• that is about you but individually does not identify you, such as statistical and other communication data and the resources that you access and use on the Site and in the Applications; and/or
• about your internet connection and the equipment you use to access our Site and Application and usage details.

We collect this information:

• directly from you when you provide it to us;
• automatically as you navigate through the Site or use the Application. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies; and
• From third parties, for example, your health and dental providers and our business partners.

Information You Provide to Us

The information and data we collect on or through our Site and Application are:

• information that you provide by filling in forms on our Site and Application. This includes information provided at the time of registering to use our Site or Application, subscribing to our service, posting material, or requesting further services. We may also ask you for information when you enter a contest or promotion sponsored by us, or during a study you consent to participate in, and when you report a problem with our Site or Application;
• records and copies of your correspondence (including email addresses), if you contact us;
• your responses to surveys that we might ask you to complete for research purposes; and
• details of transactions you carry out through our Application and Site and of the fulfillment of your orders. You may be required to provide financial information before placing an order through our Site or our Application.

The personal information we collect from you is collected with your consent and required for us to provide you with our products and services and to facilitate communication between you and your licensed dental provider. You may withdraw your consent at any time by terminating your membership with us; however, we may no longer be able to provide you with our goods and services if you do.

You also may provide information to be published or displayed (hereinafter, “posted”) on public areas of the Site and Application or transmitted to other users of the Site or third parties (collectively, “User Contributions”). Your User Contributions are posted on and transmitted to others at your own risk. Although we limit access to certain pages, please be aware that no security measures are perfect or impenetrable. Additionally, we cannot control the actions of other users of the Site or Application with whom you may choose to share your User Contributions. Therefore, we cannot and do not guarantee that your User Contributions will not be viewed by unauthorized persons.

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with our Application and Site, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, such as:

• details of your visits to our Site or use of our Application, such as traffic data, location data, logs, referring/exit pages, date and time of your visit to our Site or use of our Application, error information, clickstream data, and other communication data and the resources that you access and use on the Site or in the Application; and
• information about your computer and internet connection, such as your IP address, operating system, and browser type.

The information we collect automatically may include personal information or we may maintain it or associate it with personal information we collect in other ways or receive from third parties. It helps us to improve our Site and Application and to deliver a better and more personalized service by enabling us to:

• estimate our audience size and usage patterns;
• store information about your preferences, allowing us to customize our Site and Application according to your individual interests;
• speed up your searches; and
• recognize you when you return to our Site or Application.

Details about the automated data collection technologies and the specific cookies that we use can be found in our Cookie Policy.

Health Information

We may process some personal information considered sensitive when necessary to carry out our obligations to you.

Some personal information processed by SmileDirectClub may be considered sensitive, including personal information concerning your health. SmileDirectClub processes this information only to the extent necessary to carry out its obligations to your licensed dental care provider and you, and to provide your licensed dental provider and you with our goods and services.

How We Use Your Information

We use your personal information for various purposes described below, including to:

• provide our Application and Site to you;
• provide you with information you request from us;
• enforce our rights arising from contracts;
• notify you about changes; and
• provide you with notices about your account.

We use information that we collect or receive about you or that you provide to us, including any personal information:

• to present our Site and Application and their contents to you;
• to provide your licensed dental provider and you with information, products, or services that your provider or you request from us;
• to fulfill any other lawful purpose for which you provide it;
• to provide you with notices about your membership, including expiration and renewal notices;
• to carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection;
• to notify you about changes to our Site or Application or any products or services we offer or provide though them;
• to allow you to participate in interactive features on our Site and Application;
• in any other way we may describe when you provide the information; and
• for any other purpose with your consent.

We may also use your information to contact you through about and/or to promote and market our own goods and services that may be of interest to you. With your consent, we may also use your information to contact you through push notifications and text and voice messages about and/or to promote and market these goods and services. If you wish to opt-out of such emails, you may do so by clicking the unsubscribe link in emails that we send you. You may also unsubscribe or change your choice regarding email, voice, and text communications by sending a written request to Customer Care C/O SmileDirectClub, LLC, 414 Union Street, 8th Floor, Nashville, TN 37219, or emailing us at , or calling us at (800) 848-7566.The treatment you receive from your licensed dental provider is not conditioned on your consent to receive promotional and/or marketing communications.

Disclosure of Your Information

We do not share, sell, or otherwise disclose your personal information for purposes other than those outlined in this Privacy Policy. We disclose your personal information to a few third parties, including:

• Your licensed dental provider;
• our subsidiaries and affiliates;
• our third-party service providers, subcontractors, and business associates we use to support our business, including those that use street address and zip code data for legislative district mapping, which is used for contacting legislators when required for business purposes;
• to any company we might merge with or acquire, or that buys us, or in the event of change in structure of our company of any form;
• to comply with our legal obligations;
• to enforce our rights; and
• with your consent.

We do not share, sell, or otherwise disclose your personal information for purposes other than those outlined in this Privacy Policy. However, we may disclose without restriction aggregated information about our users and information that does not identify any individual.

We may disclose personal information that we collect or that you provide as described in this privacy policy:

• to your dental care provider;
• to our subsidiaries and affiliates;
• to contractors, service providers, subcontractors, and business associates, and other third parties we use to support our business;
• to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of SmileDirectClub, LLC’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by SmileDirectClub, LLC about our Site’s and Application’s users is among the assets transferred;
• to fulfill the purpose for which you provide it;
• for any other purpose disclosed by us when you provide the information; or
• with your consent.

We may also disclose your personal information:

• to comply with any court order, law, or legal process, including to respond to any government or regulatory request;
• to enforce or apply our Terms of Use, our Application’s End User License Agreement, and other agreements, including for billing and collection purposes; and
• if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of you, your licensed provider and/or her/his staff, SmileDirectClub, LLC, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

Choices About How We Use and Disclose Your Information

We offer you choices on how you can opt out of our use of tracking technology, disclosure of your personal information for third-parties to market or advertise to you, our marketing or advertising to you, and other targeted marketing and advertising.

We do not control the collection and use of your information collected by third parties. When possible, these organizations are under contractual obligations (including through the use of Business Associate Agreements) to maintain appropriate safeguards and protections, to use this data only for providing the services to us, and to maintain this information strictly confidential. These third parties may, however, aggregate the information they collect with information from their other customers for their own purposes.

In addition, we strive to provide you with choices regarding the personal information you provide to us. We will only use your contact information to promote or market our own products and services through push notifications and text and voice messages with your express consent. If you wish to consent to such use, you can check the relevant box located on the form on which we collect your personal information or otherwise seek such consent. If you wish to change your choice, you may do so at any time by logging into the Site or Application and adjusting your user preferences in your account profile by checking or unchecking the relevant boxes or by sending a written request to Customer Care C/O SmileDirectClub, LLC, 414 Union Street, 8th Floor, Nashville, TN 37219, or emailing us at , or calling us at (800) 848-7566. We may also use your contact information to promote or market our products and services through email. If we have sent you a marketing or promotional email, you may click the unsubscribe link to be omitted from future email distributions. This opt out does not apply to information provided to SmileDirectClub as a result of a product purchase, your membership, product service experience or other transactions. Your aligner therapy treatment is not conditioned on your consent to receive marketing or promotional communications.

Accessing and Updating Your Personal Information

You may access and update your personal information at any time.

You can review and change your personal information by logging into the Site or Application and visiting your account profile page. You may also notify us through the Contact Information (located in section 13 of this Privacy Policy) of any changes or errors in any personal information we have about you to ensure that it is complete, accurate, and as current as possible. We may not be able to accommodate your request if we believe it would violate any law or legal requirement or cause the information to be incorrect.

Your California Privacy Rights

California Consumer Privacy Act (CCPA)

While this Privacy Policy comprehensively describes how SmileDirectClub and uses personal information about you, the CCPA provides some California residents the opportunity to exercise specific rights relating to data transparency, outlined below.

Right to Know

At your request, SmileDirectClub will inform you of the categories of personal information we collect about you and the purposes for which those categories of personal information are used for the 12-month period preceding your request, including the following:

• The categories of personal information we have collected about you;
• The categories of sources from which your personal information is collected;
• The business or commercial purpose for collecting or selling your personal information;
• The categories of third parties with whom we share your personal information; and
• The specific pieces of personal information we have collected about you.

Right to Delete

You also have the right to request that SmileDirectClub deletes any personal information about you that we have collected from you. SmileDirectClub will respond to a verifiable request from you to delete your data, except in circumstances where it is necessary for us to maintain your personal information in order to:

• Complete the transaction for which your personal information was collected, provide a good or service requested by you or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between us and you;
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity;
• Debug our systems to identify and repair errors that impair existing intended functionality;
• Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law;
• Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code;
• If you have provided informed consent, engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research;
• To enable solely internal uses that are reasonably aligned with your expectations your relationship with us; or
• Comply with a legal obligation.

To submit a requests under your right to know and right to delete, you must email . You may also contact us by sending a written request to Customer Care C/O SmileDirectClub, LLC, 414 Union Street, 8th Floor, Nashville, TN 37219, or calling us at (800) 848-7566. From the time SmileDirectClub verifies the request, we will respond within 45 days, and if additional time is needed, we will communicate extensions with you.

Other Rights

You have the right not to be discriminated against for exercising any of the rights listed above.

SmileDirectClub does not disclose personal information to third parties for their own direct marketing purposes.

Under 18: California Eraser Law

Request If you use our Site or Application when you are under the age of 18, you may request that we remove your User Contributions under certain circumstances. We do not advertise or market any goods and services that are identified as being inappropriate for children under the age of 18.

California law permits minors under the age of 18 to request the removal of her/his User Contributions, subject to certain exceptions.

If you are under the age of 18 and living in California, you may contact us by sending a written request to Customer Care C/O SmileDirectClub, LLC, 414 Union Street, 8th Floor, Nashville, TN 37219, or emailing us at , or calling us at (800) 848-7566 (if you contact us in writing, via email, please use the subject “California Eraser Law Request”). We may not remove your User Contributions that we are required to retain under any federal or state law, or that have been provided to a third party. While we will do our best to remove a minor’s information upon a valid request, we cannot ensure the complete or comprehensive removal of your User Contributions from our Site or Application, or any information that has been republished, copied, downloaded, or reposted by any third party, and we cannot guarantee that any such information may not be accessible to users of the Internet in the future. We do not advertise or market any of the products or services identified in California Business and Professionals Code Section 22580(i) to users who we have actual knowledge are under 18 years of age.

Do Not Track Signals

We may use automated data collection technologies to track you across websites. We currently do not honor do-not-track signals that may be sent by some browsers.

We also may use automated data collection technologies to collect information about your online activities over time and across third-party websites or other online services (behavioral tracking). Some web browsers permit you to broadcast a signal to websites and online services indicating a preference that they “do not track” your online activities. At this time, we do not honor such signals and we do not modify what information we collect or how we use that information based upon whether such a signal is broadcast or received by us.

Data Security

Information transmitted over the Internet is not completely secure, but we do our best to protect your personal information. You can help protect your personal information and other information by keeping your password to our Application and Site confidential.

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. All information you provide to us is stored on our secure servers behind firewalls. Any payment transactions and health information will be encrypted when being communicated between us and you.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Site or the Application, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We urge you to be careful about giving out information on the Site or in Application like message boards and other areas where you may post photographs, videos or other content. The information you share in public areas may be viewed by any user of the Site or Application.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to or from our Application or Site. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Site, the Application, or the operating system of your computer or mobile device.

Changes to Our Privacy Policy

We will post any changes to our Privacy Policy on our Site or in the Application. If we make material changes to our Privacy Policy, we may notify you of such changes through your contact information and invite you to review (and accept, if necessary) the changes.

We may change this Privacy Policy at any time. It is our policy to post any changes we make to our Privacy Policy on this page with a notice that the Privacy Policy has been updated on the Site’s or Application’s home page/screen. If we make material changes to how we treat our users’ personal information, we will provide notification through a notice on the Site’s or Application’s home page/screen. The date this Privacy Policy was last revised is identified at the bottom of the page. You are responsible for periodically visiting our Site or the Application and this Privacy Policy to check for any changes.

Contact Information

You may contact us through the contact information below. If you have any questions, concerns, complaints or suggestions regarding our Privacy Policy, have any requests related to your personal information, or otherwise need to contact us, you may do so at: SmileDirectClub414 Union Street 8th Floor Nashville, TN 37219, (800) 848-7566.