APPLICANT AND CANDIDATE PRIVACY NOTICE

Version Date: October 1, 2023

Introduction

This Applicant and Candidate Privacy Notice (“Notice”) describes how ZO Skin Health, Inc. and its affiliates (“ZO,” “us,” “our,” or “we”) collect, use, store, or otherwise process personal information (e.g., information that can be used to reasonably identify you) about job applicants and/or candidates (collectively, “applicants,” “you,” “your”), including when you access or use our careers websites; to whom we disclose it; and your rights with regard to your personal information.

We may update this Notice at any time. We may also provide you additional privacy notices regarding our collection, use or disclosure of information. Please read this Notice and any other privacy notices fully and carefully.

This Notice:

• Does not cover your use of ZO’s products or services as a consumer. When you interact with us as a consumer, the Privacy Policy on our website(s) will apply.
• Does not cover any third-party websites and apps that you may use, including those to which we link on our website. You should review the terms and policies for third-party websites and apps before using them.
• Does not form part of any potential employment contract with you.
• Does not apply to data about employees and other personnel. If we hire you during the recruitment process, the processing of your personal information from that point on will be governed by our Employee Privacy Notice. In case of a conflict between this Notice and the Employee Privacy Notice, the latter shall prevail.

This Notice contains the following sections:

1. Collection of Personal Information
2. Use of Personal Information
3. Disclosure of Personal Information
4. Retention of Personal Information
5. Your Rights and Choices
6. Security
7. Cross-Border Transfers
8. Changes to This Notice
9. Contact Us
10. Supplemental Notice for California Residents

1. Collection of Personal Information

We collect personal information about you from you and other sources. The type of information we have or will have about you may depend on the role you have applied for and other factors.

Personal Information We Collect from You. Subject to applicable law, we may collect the following categories of personal information from you through the application and recruitment process:

• Identifiers and contact information, such as your name, date of birth, email address, mailing address, phone number, Social Security Number, work and personal references and contact details, , and other similar contact data; and, if provided an offer, government identification such as your passport or driver’s license, and identifiers related to your citizenship documents, immigration status, and work eligibility.
• Demographic information, such as your gender, and military service. Some of this information may relate to or describe legally protected classifications under applicable law.
• Professional or employment-related information, such as your resume, Curriculum Vitae, work history, professional background and, where applicable and allowed by applicable law, information associated with social media platforms (e.g., social media handle) or professional networking sites (e.g., LinkedIn profile), criminal records, and other information revealed during background screenings.
• Educational information. This includes your educational history, academic degrees, and qualifications, certifications, and skills.
• Sensitive personal information, such as race and ethnic origin, and health and medical information, including disability status.
• Audio or visual information, such as call recording, security footage from our offices and facilities (e.g., closed-circuit television (“CCTV”) footage). CCTV, which captures images and video footage, is primarily used to monitor office entry/exit points, elevator lobbies, rooms housing valuable equipment (e.g., server rooms), and other select areas that contain highly sensitive assets or are associated with a high risk for theft.
• Internet and electronic network, and device activity and device information and related identifiers, such as information about your use of our network while you are on our premises, including IP address and device identifiers and attributes.
• Other Information that you voluntarily submit to us in connection with your application for employment, including that which you provide via webform, email, during an interview, or as part of other forms of assessment.

You are not required to provide any of the information above. However, if you decline to provide some information, you may be unable to apply for a job with us.

Personal Information We Collect from Other Sources. Subject to applicable law, we may collect personal information about you from other sources, such as:

• Third-Party Sources. Examples of third-party sources include employment screening agencies, background check agencies, recruiting agencies, service providers, former employers and/or schools and educational institutions, publicly available information on websites or social media (e.g., when applying through LinkedIn, where relevant for recruitment purposes and allowed by applicable law), and others where they are legally allowed to disclose your personal information to us. For example, if you register to be contacted by prospective employers on another website, the website may provide your personal information to us.
• Individuals Who Refer You. Other individuals may give us your personal information. For example, if a friend thinks you may be interested in a job at ZO, they may give us your contact details and resume.
• Combining Personal Information from Different Sources. We may combine the personal information we receive from various sources with personal information we collect from you and use it as described in this Notice.

1. Use of Personal Information

Subject to applicable law, we may use your personal information for our business purposes, which include, where applicable:

• Engaging in the recruitment process, including communicating with you, interviewing, and selecting and hiring new personnel.
• HR management and administration, including determining compensation, scheduling, IT and informational security purposes, fraud prevention, and conducting internal analyses and audits.
• Security operations, including detecting security incidents, debugging and repairing errors, and preventing unauthorized access to our computer and electronic communications systems and preventing malicious software distribution; monitoring and controlling access to company premises and locations (including through use of CCTV); and safeguarding ZO computer and electronic communications systems, hardware and software.
• Legal compliance, such as complying with applicable laws, and responding to and cooperating with legal or regulatory requests and investigations.
• Exercising our legal rights, including seeking legal advice from our external lawyers or in connection with litigation with a third party.
• Safeguarding ZO and the services, including the protection of ZO, our workforce, users, partners, and others.
• Other lawful purposes of which we notify you and, if legally required, for which we obtain your consent; or other purposes for which you request us to use your information.

Aggregation/De-Identification. We may aggregate or de-identify the information we collect to limit or prevent identification of any particular individual to help with goals like research and recruiting. Once such information has been aggregated and/or de-identified such that it is no longer considered personal information under applicable data protection law, this Notice does not apply.

Legal Basis for Processing Your Personal Information. If applicable law requires a legal basis for processing, our legal basis for collecting and using the personal information described in this Notice will depend on the type of personal information concerned and the specific context in which we collect or use it. Depending on the jurisdiction in which you live, there may be other applicable legal bases for processing your personal information that are not listed here.

We normally collect or use personal information from you or others where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms (e.g., to communicate with you, to evaluate your application, to manage our recruitment processes efficiently and fairly), or where applicable, where we have obtained your consent. In certain situations, we may have a legal obligation to collect or retain personal information (e.g., to comply with applicable employment and works council laws and regulations) or need the personal information to protect your vital interests or those of another person.

When we process sensitive personal information about you, we will make sure that one or more of the legal bases for processing sensitive personal information, as referenced above, applies. For instance, these include processing which is necessary for the purpose of satisfying our obligations in relation to employment law, processing related to data about you that you have made public and processing which is necessary for the purpose of establishing, making, or defending legal claims.

If you have questions about or need further information concerning the legal bases on which we process your personal information, please contact us using the contact details provided in Section 9 of this Notice.

1. Disclosure of Personal Information

Subject to applicable law, we may disclose personal information in the following circumstances (where applicable):

• Internally. Your personal information may be disclosed to personnel involved in the recruiting and hiring processes, Human Resources, or third-party administrators for recruitment or other legitimate business purposes.
• Vendors. We may disclose your personal information to vendors in connection with the provision of services including, but not limited to, the following: recruitment, talent acquisition and administration, technology services, background checks, where allowed by applicable law, and employment history checks.
• Affiliates. We may disclose your personal information to affiliates under common ownership or control of ZO for purposes of recruiting or evaluating job applicants, resource planning, and talent and recruitment as well as other legitimate business purposes such as Human Resources administration and general business management and operations.
• Recruitment Agencies. We may disclose your personal information to recruitment agencies with whom you provided your personal information or make your personal information publicly accessible to recruitment agencies.
• Your Employer or Organization or Reference Checks. When you apply for a position at ZO, we may be required to disclose personal information when we contact your previous or current employer to verify your employment history or your references.
• Public or Government Authorities. We may disclose your personal information as we deem necessary or appropriate to comply with applicable laws, regulations, or contracts, or to respond to a court order, administrative, or judicial process, such as a subpoena, government audit, or search warrant.
• Exercising Legal Rights; Protection. We may disclose certain personal information to seek legal advice from our external lawyers, in response to violations of our policies or agreements, in connection with litigation with a third party, or as we otherwise deem necessary or appropriate to exercise our legal rights. We also may disclose your information as we deem necessary or appropriate to protect the rights or safety of ZO, you, our employees, or others.
• Corporate Transactions. We may disclose or transfer your personal information to relevant third parties in the event of, or as part of the due diligence for, any proposed or actual reorganization, sale, merger, consolidation, joint venture, assignment, transfer, or other disposition of all or part of our business, assets, or stock (including in connection with any bankruptcy or similar proceeding).
• Consent. We may disclose your personal information in other ways if you have asked us to do so or have given consent.

1. Retention of Personal Information

We keep your personal information for no longer than we deem necessary to fulfil the purposes for which it is processed. The length of time for which we retain personal information depends on the purposes for which we collected and use it and/or as required to comply with applicable laws and data handling standards. In determining how long to retain information, we consider the amount, nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the personal information, the purposes for which we process the personal information and whether we can achieve those purposes in other ways, the applicable legal requirements, and our legitimate interests.

1. Your Rights and Choices

Subject to applicable laws and depending on your jurisdiction of residence, you may have the right to make certain requests of us regarding the personal information we process about you, including the following.

• Access: You may request to access your personal information, including a copy of it, confirmation that we are processing it, information about the categories of personal information we process about you, and the reason we will or have collected such information.
• Correction: You may request that we correct personal information about you that is inaccurate, incomplete, or outdated.
• Deletion: In certain situations, you may request that we delete or erase certain personal information.
• Objection/Restriction: You may object to or request that we restrict the use of your personal information in certain situations.
• Portability: You may request that we provide your personal information in a machine-readable format or port it to another entity, if technically feasible.
• Withdrawing Consent: Where we rely on your consent as the basis for processing your personal information, you have the right to withdraw consent at any time. This will not affect the lawfulness of processing prior to the withdrawal of your consent.

In addition, you have a right to raise complaints with your local data protection authority regarding our handling of your personal information. We encourage you to first contact us with any complaints or concerns.

Exceptions to Your Rights. There are certain exceptions to the above rights. For instance, we may deny a request to delete personal information if it is reasonably necessary for us or our vendors to retain this information to provide a service that you have requested or to comply with law or to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity or prosecute those responsible for that activity.

Exercising Your Rights. If you wish to exercise your rights, please contact us via email at hr@zoskinhealth.com. We will require you to provide certain information for identity verification purposes. You may also authorize an agent to make a request to us on your behalf, and we will verify the identity of your agent or authorized legal representative by either seeking confirmation from you or documents that establish the agent’s authorization to act on your behalf.

Your Choices.

• Communications From Us. Throughout the recruitment process, we may, subject to applicable law, communicate with you about your application, scheduling interviews, and other matters related to processing your application (“transactional emails”). We may also send you emails about new open positions and matters related to ZO that are not strictly about the application(s) you submitted (“non-transactional emails”). If you wish to opt out of these non-transactional emails, you may log into your online profile in ZO’s Career Portal and request that your information be deleted. Please click the opt out or unsubscribe link in the email. You may receive one email to confirm yPur opt out/deletion decision.

• Accessing and Editing Your Information. Depending on the website through which you apply to an open position, you may be able to access, download, copy, correct/update, or delete personal information in your application. If you have already submitted the application to us, you may also need to contact us to edit, delete, or otherwise change information in the submitted application.

1. Security

We have implemented appropriate technical, physical, and organizational measures to protect your personal information from misuse or accidental, unlawful, or unauthorized destruction, loss, alteration, disclosure, acquisition, or access as well as all other forms of unlawful processing. No security measures are perfect, however, we cannot absolutely guarantee the security of your information. When you transmit any personal information over the Internet or other communication networks, you do so at your own risk.

1. Cross-Border Transfers

We are based in the United States, and recipients of personal information disclosed as described in this Notice may be located in the United States and elsewhere, including in locations where privacy laws may not provide the same protections as the laws of the country where you live. Subject to applicable law, your personal information may be transferred outside the jurisdiction where you live. We take appropriate measures to protect your information when we transfer it to another jurisdiction, including, where applicable, use of the Standard Contractual Clauses to facilitate transfers out of the European Economic Area (“EEA”) and United Kingdom (“UK”). For more information on our transfer mechanisms, please contact us as set forth below.

1. Changes to This Notice

We may change this Notice from time to time, in our sole discretion. We will post any changes to this Notice on this page. Each version of this Notice is identified at the top of the page by its version date.

1. Contact Us

For questions or complaints regarding our use of your personal information or this Notice, please contact us at hr@zoskinhealth.com or mail us at 9685 Research Drive, Irvine, California 92618, USA.

For job applicants in the EEA or UK, the ZO entity to which you applied for a job is the data controller of your personal information, but questions or complaints may still be directed to hr@zoskinhealth.com.

1. Supplemental Notice for California[NH1] Residents

If you reside in the state of California, the following terms apply to you and supplement the rest of this Notice. To the extent that there is any conflict between the language in this section and the provisions above, the language in this section shall prevail.

Personal Information Collection, Purposes, Disclosures, and Retention. We collect the categories of personal information specified in Section 1 above from the sources specified in Section 1 above. We use these categories of personal information for the purposes specified in Section 2 above and disclose such information to the types of entities listed in Section 3 above. We retain personal information as specified in Section 4 above.

As discussed above, the purposes for which we process information (as well as the other factors listed above) may impact the personal information we collect, to whom we disclose the information, and how long we retain the information in any given situation.

Collection of Sensitive Personal Information. In addition to the information listed in Section 1 above, we may collect legally protected classification information, such as race, sex/gender, gender identity/expression, marital status, military service, ethnicity, and criminal history. In addition to the sensitive personal information listed in Section 1, California treats sexual orientation, philosophical beliefs, and certain government identification numbers as “sensitive personal information.”

Use of Sensitive Personal Information. We do not use or disclose sensitive personal information other than for purposes for which you cannot opt out under California law. We use sensitive personal information as we deem necessary to conduct our relationship with you, in the following ways:

• Social Security number, passport information, driver’s license, or state ID card for background check (if applicable to position) and employment eligibility verification.
• Health information, which may include disability status, to provide reasonable interview accommodations and for assessing ability to perform essential functions.
• Religious/philosophical beliefs to provide reasonable interview accommodations and assessing ability to perform essential functions.
• Racial/ethnic origin, sexual orientation, and/or disability status for equal opportunity and diversity and inclusion purposes and compliance with applicable law or to exercise rights thereunder.

“Sales” and “Sharing,” as defined under California law. California law places certain obligations on businesses that “sell” personal information to third parties or “share” personal information with third parties for “cross-context behavioral advertising” as those terms are defined under the California Consumer Privacy Act (“CCPA”). We do not “sell” or “share” the personal information covered by this Notice and have not done so in the twelve months prior to the effective date of this Notice.

Your Privacy Rights. In addition to the rights listed above, you have the right to request that we provide you with the categories of personal information we have or will collect about you, categories of sources of such personal information, and categories of third parties to whom we disclose personal information. You also have the right not to be discriminated against (as provided for in California law) for exercising your rights. Before responding to a request, we may ask you for information needed to verify your identity. If we are unable to verify you through this method, we will have the right, but not the obligation, to request additional information from you.