PRIVACY NOTICE INTRODUCTION

This Privacy Notice “Privacy Notice” describes the Personal Data that the Evolus, Inc. and its subsidiaries and affiliates companies (hereinafter, “Evolus”, “us” or “we”) collect and how we manage it.

PERSONAL DATA

“Personal Data” is information that relates to an identified or identifiable individual. We will collect Personal Data whenever we interact with you in any manner. We also collect Personal Data from specialist data companies in our sector, publicly available resources of information, and marketing partners.

You do not have to provide us with Personal Data. But if you do not, we may not be able to provide specific services or perform contractual obligations.

If you give us the authority to collect Personal Data relating to another individual, including adverse event data, you confirm that you have the authority to share that data for its use in line with this Privacy Notice.

HOW WE USE PERSONAL DATA

We disclose Personal Data as follows:

• To other Evolus companies for the purposes described in this Privacy Notice.
• To our third-party service providers, who can use the data in several ways including for market research purposes.
• To specialist data companies in the healthcare sector involved in maintaining the accuracy of such data
• To other companies with which we collaborate with in co-development, dissemination and/or marketing of products or services.
• To comply with a regulatory or legal requirements
• To any third-party legal successor in connection with preparing, completing and implementing any sale of some or all of our assets, a merger or reorganization, including by means of bankruptcy, which may occur.

DISCLOSURES OF TRANSFER OF VALUE

An Evolus company in the country of your professional practice will make public disclosures of the transfers of value that you receive from any Evolus company in accordance with the EFPIA Transparency Code of Conduct and/or applicable local law.

YOUR RIGHTS

Every user is entitled to the following:

• The right to access – You have the right to request copies of your personal data.
• The right to rectification – You have the right to request that we correct or amend inaccurate or incomplete information.
• The right to erasure – You have the right to request that we delete your Personal Data, under certain conditions.
• The right to restrict processing – You have the right to request that we restrict the processing of your Personal Data, under certain conditions.
• The right to object to processing – You have the right to object to our processing of your personal data, under certain conditions.
• The right to data portability – You have the right to request we transfer the data that we have collected to another organization, or directly to you, under certain conditions.

If you would like to exercise any of these rights, please contact us using the details in the Contact Us section below.

Please note that we will need to retain some aspects of your Personal Data for record keeping purposes and/or to complete any transactions.

COOKIES AND OTHER TRACKING TECHNOLOGIES

Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. When you visit our websites, we may collect information from you automatically through cookies or similar technology

We and third parties with whom we partner (including Google Analytics) may use cookies, web beacons, tracking pixels, web bugs, scripts, tags, and other similar technology (collectively, “Cookies”) to record information about your activities on the Website and on third-party websites that you visit. Some Cookies remain on your device until you delete them; others are stored only during an individual session. You may set your device settings to attempt to reject Cookies but doing so may affect functionality of the Website.

ONLINE TRACKING AND YOUR CHOICES

As discussed above, because we and our third-party service providers automatically collect Services usage information through the use of Cookies (including as described in the “Information that is Automatically Collected” section above, and otherwise in this Policy), your selection of the “Do Not Track” option provided by your browser may not have any effect on our collection of automatically collected information. One way to attempt to “opt out” of the collection of any information through Cookies and some (but not all) other tracking technology is to actively manage the settings on your browser to delete and disable Cookies and other tracking/recording tools. However, getting a “Do Not Track” signal to work as you might want is difficult and may not be possible. Using browsers as an example, not all tracking technologies can be controlled by browsers; unique aspects of your browser might be recognizable even if you disable a tracking technology; not all settings will necessarily last or be effective; even if a setting is effective for one purpose data still may be collected for another; and even if one website observes a “Do Not Track” signal, that website usually will not be able to control other websites. Additionally, if you select a “Do Not Track” option or disable Cookies on your device, certain Services may become unavailable or may not function properly. We do not control the use of Cookies by third parties. You can set your browser not to accept cookies, and the above website tells you how to remove cookies from your browser. However, in a few cases, some of our website features may not function as a result.

PRIVACY POLICIES OF OTHER WEBSITES

Our website contains links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.

DATA SECURITY

Keeping secure personal information that we collect is of great concern to us. While we have mechanisms in place to safeguard your personal information once we receive it, no storage or transmission of data can be guaranteed to be 100% secure. When you provide Personal Data to us, you do so at your own risk.

RETENTION PERIOD

We will retain your Personal Data for as long as needed or permitted in line with this Privacy Notice. We determine the length retention periods by considering a number of factors including: how long we have had an ongoing relationship with you and whether there is a legal or regulatory obligation concerning retention of the Personal Data.

CROSS BORDER TRANSFERS

The data we collect through the Site will be stored and processed in any country where we have facilities or in which we engage service providers, including in the United States of America.

For transfers of Personal Data to countries not considered to have an adequate level of data protection by the European Commission, we will put in place, in line with applicable legal requirements, appropriate safeguards to ensure that your Personal Data gets the same protection as it does in the European Economic Area. These measures may include (i) entering into European Commission approved standard contractual clauses to protect your Personal Data and/or (ii) will rely on your consent (where permitted by law).

DATA OF CHILDREN

The Services are intended for users over the age of 18 and are not directed towards persons under 16. We do not knowingly collect Personal Data from persons under 16. If you become aware that a child has provided us with Personal Data without parental consent, please contact us at by using the contact information in the Privacy Questions section at the bottom of this Policy, and we will take steps to remove the information.

If you are providing us with Personal Data of individuals under the age of sixteen (16), you confirm that you have the demonstrable authority to do so.

UPDATES

This Privacy Notice was last updated on the 14th June 2022

CONTACT US

The company responsible for collection, use and disclosure of your Personal Data under this Privacy Notice is: Evolus, Inc. 520 Newport Center Dr., Suite 1200 Newport Beach, CA 92660 Attn: Privacy Office

If you have questions about this Privacy Notice, or if you would like to request to exercise any individual rights, please contact us at privacy@evolus.com.

MAKING A COMPLAINT

You may lodge a complaint with a data protection authority for your country or region or the location where the subject of your complaint took place. Please click here for the relevant contact information.