GlamOps Consumer Health Data Privacy Policy

Effective date: October 9, 2026 Last updated: October 14, 2026

1. What this policy covers

1.1. This Consumer Health Data Privacy Policy explains how GlamOps LLC ("GlamOps," "we," "us") handles consumer health data, meaning personal information that is linked or reasonably linkable to a person and that identifies their past, present or future physical or mental health status, as those terms are defined in Washington, Nevada and Connecticut law.

1.2. It supplements our main Privacy Policy at https://glamops.net/legal/privacy. If this policy conflicts with the Privacy Policy on consumer health data, this policy controls.

1.3. Terms such as "Business," "Client," "Team Member," "Booking Site" and "Client Portal" have the meanings in our Terms of Service at https://glamops.net/legal/terms. In short, a Business is an esthetician or other beauty-service business that uses GlamOps, and a Client is a person who books with that Business.

2. GlamOps's role: we process this data for Businesses

2.1. GlamOps processes consumer health data as a processor on behalf of Businesses. Each Business decides what to ask on its intake and consent forms, why, and what to do with the answers. GlamOps stores and handles that information only to provide the GlamOps service to that Business, following the Business's instructions and our written contract with the Business.

2.2. This means that the Business you book with is the "regulated entity" (Washington) or controller responsible for your consumer health data, including giving you notice, obtaining your consent, and responding to your requests. Each Business should make its own consumer health data privacy policy available to you.

2.3. GlamOps does not use consumer health data for its own purposes. In particular, GlamOps does not:

• sell consumer health data;
• share it with anyone for advertising or marketing;
• use it to target ads or to build profiles about you;
• combine it across different Businesses;
• use it to train AI models; or
• use geofencing (virtual boundaries around a physical location) to identify, track, collect data from, or send messages or ads to people near any health care provider or facility, or near any Business.

2.4. GlamOps does not knowingly collect consumer health data for its own account holders or for visitors to glamops.net.

3. Categories of consumer health data we process

When a Business uses GlamOps intake and consent forms, notes or photos, the following categories of consumer health data may be collected and processed, depending on what the Business asks:

GlamOps does not collect biometric data, genetic data or precise location data about Clients.

4. Sources of consumer health data

We receive consumer health data:

• directly from Clients, when they complete a Business's intake or consent form through a GlamOps Booking Site, Client Portal or link; and
• from Businesses, when the Business or its Team Members enter notes, upload photos or fill in forms on a Client's behalf.

5. Why we process consumer health data

We process consumer health data only to provide the GlamOps service to the Business, for these purposes:

1. to collect, store and display intake and consent forms so the Business can assess whether a service is appropriate and safe for the Client;
2. to let the Business keep treatment notes and photos about its Clients;
3. to record the Client's consents and any withdrawal of consent;
4. if the Business turns on and consents to Concierge, to answer the Business's questions about its own records (see Section 6.2); and
5. to keep the service secure, maintain backups, prevent fraud and abuse, and comply with law.

6. How consumer health data is shared

6.1. With the Business. Consumer health data a Client submits is made available to the Business the Client booked with and the Team Members that Business authorizes.

6.2. With our service providers (subprocessors). We share consumer health data only with service providers that help us run GlamOps, under written contracts that limit their use to providing services to us. The categories are:

The full list is on our Subprocessor List at https://glamops.net/legal/subprocessors.

6.3. For legal reasons. We may disclose consumer health data if required by law, such as in response to a valid subpoena or court order, and, where legally allowed, we will notify the affected Business first so it can respond.

6.4. Business transfers. If GlamOps is involved in a merger, acquisition or sale of assets, consumer health data may be transferred to the successor, which must continue to protect it under this policy and the law.

6.5. We never sell consumer health data. GlamOps does not sell consumer health data and does not allow its service providers to do so.

7. How long we keep consumer health data

We keep consumer health data for as long as the Business keeps it in its GlamOps account. If a Business deletes a Client's records or closes its account, we delete the related consumer health data from active systems within 30 days (after the 30-day export window, if the Business's account has ended), and from backups within 35 days. Consent and withdrawal records may be kept for 5 years to show that consent was obtained or withdrawn.

8. Your rights

8.1. Depending on where you live, you may have the right to:

1. confirm whether consumer health data about you is being collected, shared or sold, and access that data;
2. get a list of all third parties and affiliates with which your consumer health data has been shared or sold, and how to contact them;
3. withdraw consent to the collection and sharing of your consumer health data; and
4. delete your consumer health data, including from archives and backups, and have the deletion passed on to processors and third parties.

8.2. We will not discriminate against you for exercising these rights.

9. How to exercise your rights

9.1. Contact the Business first. Because GlamOps processes consumer health data on behalf of Businesses, please send your request to the Business you booked with. The Business is responsible for responding, and GlamOps will help it do so, including by locating, exporting, correcting or deleting your data.

9.2. If you contact GlamOps. You can also email admin@glamops.net with the subject "Consumer health data request". Please tell us which Business or Businesses you booked with. We will verify your request and forward it to the relevant Business, or, where the law requires us to act directly, act on it ourselves. We will tell you what we did.

9.3. Verification. We and the Business may need to confirm your identity before acting on a request, for example by sending a code to the email or phone number on your Client record.

9.4. Authorized agents. An authorized agent, parent or legal guardian may make a request on your behalf, as described in our Privacy Policy.

9.5. Appeals. If your request is declined, you can appeal as described in Section 18.5 of our Privacy Policy. Washington residents may contact the Washington State Attorney General, Nevada residents the Nevada Attorney General, and Connecticut residents the Connecticut Attorney General, if they have concerns.

10. Security

We protect consumer health data using the safeguards described in Section 15 of our Privacy Policy, including encryption in transit and at rest, access controls, database-level separation between Businesses, and private file storage with time-limited links. Access to consumer health data within GlamOps is limited to staff who need it to provide support or keep the service running, and is logged.

11. Changes

We will post any changes to this policy here with a new "Last updated" date. If we make a material change, such as a new purpose for processing or a new category of recipient, we will notify Businesses at least 30 days in advance, and we will not process previously collected consumer health data for a new purpose without any consent the law requires.

12. Contact

• Email: admin@glamops.net
• Mail: GlamOps LLC, Attn: Privacy, 11918 SE Division Street #2046, Portland, OR 97266