4Ever Young

My Health My Data Privacy Policy

Washington State Supplement | Effective Date: May 12, 2026

This notice supplements our general Privacy Policy and addresses the rights of Washington state residents under the Washington My Health My Data Act ("MHMD Act," RCW Chapter 70.372), effective March 31, 2024. It applies specifically to personal data that qualifies as "consumer health data" under Washington law.

"4Ever Young" is the consumer-facing brand operated by 4Ever HoldCo LLC (the "Platform"), 5458 Town Center Road, Suite 19, Boca Raton, FL 33486. Clinical services accessed through the Platform are provided by the following affiliated professional medical entities, collectively the "Practice": (a) Arora Health and Aesthetics HUB, P.A. (Florida); (b) Arora Health of CA, PC; (c) Arora Health of NJ, PC; (d) Arora Health of NY, PC; and (e) Arora Health of KS, PC. The Practice is the HIPAA-covered entity for clinical encounters. The Platform supports the Practice under a written Business Associate Agreement. References in this Policy to the "Practice," "your provider," or "affiliated professional entities" mean the Practice and the independent licensed providers operating through it. For data protection purposes under Washington law, both the Platform and the Practice may process consumer health data subject to the MHMD Act.

What Is Consumer Health Data

Washington law defines "consumer health data" broadly to include any personal information that identifies or is reasonably linkable to a consumer and relates to their health status, condition, treatment, or health-related behaviors — including data that is derived or inferred from non-health data. Because of this broad definition, much of the information we collect in the course of providing clinical services may qualify as consumer health data.

Examples of consumer health data we may collect include:

• Individual health conditions, treatment, diseases, diagnoses, symptoms, medications, lab results, prescriptions, and medical history collected in connection with services such as hormone therapy (HRT/TRT), GLP-1 and other weight management programs, peptides, IV therapy, aesthetics, and longevity/regenerative medicine (RCW 70.372.010(8)(a)-(c)).
• Biometric data and any inferences drawn from health-related information about you (RCW 70.372.010(8)(d)-(e)).
• Bodily functions, vital signs, and other measurements you submit through intake forms, photos, or wearable integrations (RCW 70.372.010(8)(g)).
• Diagnoses or diagnostic testing, treatment, or medication that is reasonably linkable to you (RCW 70.372.010(8)(h)).
• Reproductive or sexual health information and gender-affirming care information, to the extent collected (RCW 70.372.010(8)(i)-(j)).
• Precise location information that could reasonably indicate an attempt to acquire or receive health services or supplies (RCW 70.372.010(8)(m)).
• Information you submit through quizzes, landing pages, intake forms, or product inquiries that could be used to infer a health condition or interest in a particular treatment, including information collected before you create an account.
• Any data identified by Washington statute, regulation, or attorney general guidance from time to time as "consumer health data."

Geofencing Prohibition

We do not implement or use geofencing technology to identify, track, or collect consumer health data from individuals entering a facility that provides in-person health care services, including but not limited to hospitals, clinics, pharmacies, or mental health facilities, as prohibited under RCW 70.372.060.

How We Collect Consumer Health Data

We collect consumer health data primarily through information you provide directly when creating an account, completing clinical intake forms, taking pre-screening quizzes, scheduling consultations, or otherwise interacting with our platform.

We do not allow third-party advertising or analytics cookies, pixels, tags, or similar technologies that would collect consumer health data from any page that reveals or could reasonably reveal health-related information about an identifiable individual — including condition or service-line landing pages (for example, GLP-1, hormone therapy, peptide pages), intake forms, quizzes, scheduling pages, checkout pages, and the patient portal. On non-health pages, non-essential cookies are blocked until you affirmatively consent through our cookie consent banner. We do not collect consumer health data through cookies, pixels, or similar technologies without your affirmative, prior consent.

We honor Global Privacy Control (GPC) and other recognized universal opt-out signals as a valid request to opt out of the sale or sharing of personal information.

How We Use Consumer Health Data

We use consumer health data to coordinate and deliver the healthcare services you request, including facilitating provider consultations, processing prescriptions, and managing your clinical records. We may also use it for quality improvement, regulatory compliance, and fraud prevention.

We will not use consumer health data for purposes beyond those disclosed in this notice or our Privacy Policy without first obtaining your affirmative consent.

How We Share Consumer Health Data

We share consumer health data only to the extent necessary to deliver the services you request or as otherwise permitted or required by law. We require your affirmative consent before (i) collecting your consumer health data, (ii) sharing it with third parties beyond what is necessary to provide the Services, and (iii) any sale of such data.

We do not sell consumer health data. We do not share consumer health data for targeted advertising purposes. When we share consumer health data with service providers, we do so under written data sharing agreements that prohibit those parties from using your data for any purpose other than performing services on our behalf.

Sale of Consumer Health Data and Valid Authorization. We do not sell your consumer health data. If we ever determine that any contemplated transfer of consumer health data would meet the definition of a "sale" under RCW 70.372.010(20), we will not effect that transfer without first obtaining your separately signed valid authorization that satisfies all of the requirements of RCW 70.372.110, including a clear description of the data being sold, the recipient, the purpose, the right to revoke at any time, the prohibition on bundling with other consents, and the one-year expiration of the authorization.

Categories of parties with whom we may share consumer health data, and the purpose for each:

• Licensed independent healthcare providers and the affiliated medical group operating through the Practice — for the purpose of evaluating, treating, and coordinating your care.
• Independent pharmacies, including state-licensed 503A compounding pharmacies and FDA-registered 503B outsourcing facilities, and independent reference laboratories — for the purpose of fulfilling prescriptions issued by your provider and conducting laboratory testing your provider has ordered.
• Affiliated professional entities operating within our clinical infrastructure network where data access is required for clinical operations.
• Government authorities or law enforcement when required by valid legal process, applicable law, or to prevent serious harm.
• Successor entities in the event of a merger, acquisition, or business transfer, subject to applicable notification requirements.
• Technology, hosting, payment-processing, customer-support, security, and other service providers performing functions on our behalf under written agreements that prohibit them from using your data for their own purposes — for the purpose of operating the Services.

Your Rights Under the MHMD Act

Washington state residents have the following rights with respect to their consumer health data, subject to certain exceptions:

• Right to access: Request a list of all third parties with whom we have shared your consumer health data and a copy of the data itself.
• Right to deletion: Request deletion of your consumer health data from our systems and from those of our service providers.
• Right to withdraw consent: Withdraw consent to the collection, use, or sharing of your consumer health data at any time.
• Right to confirm: Confirm whether we are collecting or sharing your consumer health data.

Note: Certain rights may be subject to exceptions where retention or use is required by law, including applicable medical record retention obligations.

How to Exercise Your Rights

To exercise any of your rights under the MHMD Act, email us at telehealth@fyinstitute.com. Include your full name, email address, and a clear description of the right you wish to exercise. We will respond within 45 days, with a possible 45-day extension where reasonably necessary.

To opt out of data collection through Google Analytics, install the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout.

Appeals and Complaints

If we deny your rights request, you may appeal by emailing telehealth@fyinstitute.com with the subject line "MHMD Appeal," including your original request and reason for appeal. We will respond within 45 days.

If your appeal is unsuccessful, you may file a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

Where to Find This Policy. This Washington My Health My Data Privacy Policy is published as a distinct document and is accessible from a separately labeled "My Health My Data" link in the website footer of each of our website, as required by the MHMD Act.