Last Revised: 01/28/24 Overview This Privacy Policy (“Policy”) is designed to help you understand the types of personal information we at Laser Eye Care of California, LLC, dba NVISION® and its affiliates (collectively “NVISION®”, “us”, “we”, or “our”) collect, how we use it, how and when it may be shared, and the rights and choices you have with respect to your personal information. It also explains how we communicate with you and how you can make requests or submit inquiries to use about your personal information. By accessing, visiting, or using our Services, you acknowledge this Policy, and to our Terms and Conditions  (the “Terms”). If you are not comfortable with any part of this Policy or with the Terms, please immediately discontinue access or use of our Services. We may provide additional “just-in-time” disclosures or additional information about our personal information collection, use and sharing practices. These notices may supplement this Policy, clarify our privacy practices in the circumstances described, or provide you with additional choices about how we process your personal information. Also, we may make changes to this Policy from time to time. We will notify you of any material changes to this Policy and will update the Last Revised date at the beginning of this Policy. We encourage you to look for updates and changes to this Policy when you access our Services. This Policy does not apply to the personal information we collect from employees, contractors, job applicants, owners, directors or officers of NVISION that are California residents. If you are an employee or a contractor of NVISION, or if you are applying for a job at NVISION, please refer to our Applicant/Employee CCPA Notice.

1. 1. Applicability and Scope

This Policy applies to all personal information that we collect during any written, electronic, and oral communications online when you: interact with our websites located at https://121lasik.com, and any other websites, pages, features or content we own or operate (collectively, the “Site(s)”); or interact with other products or services that direct you to this Policy (collectively, the “Service(s)”).

• • Personal Information We Collect

We may collect certain personal information about you and your use of our Services. The personal information that we collect depends on your interactions with us, and the choices you make. The definition of personal information depends on the applicable law based on your physical location when we collect your personal information. Only the definition that applies to your physical location will apply to you under this Policy. Information You Voluntarily Provide to Us. We, or service providers that assist us in providing, maintaining, and operating our Services, may collect the following types of personal information from you:

• • Newsletter Sign-ups. You may choose to provide us your contact details, such as your name, email address, telephone number, and areas of interest, if you wish to receive information about the products and services that we offer. We may use this information to send you the communications you requested, and other information we believe may be of interest to you

• • Customer Service. When you engage with our support team via email, online form, phone call or website chat widget, we may collect records, copies of your correspondence (including email addresses), chat history, and any additional information you choose to share with us.

• • Webinar/Event Registration. We may collect your name, company, position, telephone number and email address when you register to attend a webinar or event hosted by us. We may use this information to register you for the event and contact you about changes and updates regarding the event. We also may use the information to communicate with you about other events and topics that we believe may be of interest to you.

Information We Automatically Collect. To the extent permitted under the applicable law, we may collect certain types of information automatically, such as whenever you interact with the Sites or use the Services. We may collect the following types of information automatically from you:

• • Usage Data. When you browse our Sites, we automatically collect log data such as your web request, Internet Protocol (“IP”) address, browser type, domain names, referring and exit pages and URLs, pages viewed and the order of these page views, the date and time you access our servers, and other diagnostic data.

• • Device Information. When you use your desktop or mobile devices to access our Services, we may be able to identify your device’s unique device identifier, MAC address, operating system, and your mobile device’s advertising ID.

• • Location Information. When you use our Services, we may infer the generic physical location and geographic regions of your device from your Wi-Fi, Bluetooth and other device settings. For example, your IP address may indicate your general geographic region. You may choose not to share your location details with us by adjusting your mobile or desktop device’s location services settings. For instructions on changing the relevant settings, please contact your service provider or device manufacturer.

• • How We Use Your Information

We use your personal information as described in this Policy for business and commercial purposes, or as disclosed to you prior to such processing taking place. We may process your personal information:

• • To Provide Our Services. We will use your personal information to provide information or perform Services that you request, such as responding to your inquiries or providing information on the Ophthalmology or LASIK services you request.

• • To Provide You with Service-Related Communications. We will send you administrative related information to keep you updated about the Services. Such communications may include information about Privacy Policy updates, security updates, tips or other relevant Service-related information. Service-related communications are not promotional in nature. You are not able to unsubscribe from such communications, otherwise you may miss important developments relating to the Services.

• • To Maintain Legal and Regulatory Compliance. Our Services are subject to certain laws and regulations which may require us to process your personal information. For example, we process your personal information to fulfill our business obligations, ensure compliance with industry regulator’s standard and policies, to manage risk as required under applicable laws and regulations, or to respond to requests by judicial process or governmental agency.

• • To Enforce Compliance with Our Terms, Agreements and Policies. When you access or use our Services, you are bound to our Terms. We may process your personal information for compliance purposes, such as carrying out our obligations and enforcing our Terms or other legal rights, including those arising from any contracts entered into between you and us.

• • To Detect and Prevent Fraud and Security Risks. We may process your personal information to help monitor, prevent and detect fraud and abusive use of our Service, monitor and verify your identity so that unauthorized users do not gain access to your information, enhance system security, and combat spam, malware, malicious activities or other security risks.

• • To Provide Customer Support or Respond to You. We collect any information that you provide to us when you contact us. Without your personal information, we cannot respond to you or ensure your continued use and satisfaction of the Services.

• • To Provide Marketing Communication. We may collect your email address, phone number or other electronic addresses that you voluntarily provide to us when you subscribe to our marketing communications. We will occasionally send you information on products, services and promotions. When you no longer wish to receive these marketing messages from us, you can opt out at any time by using the “Unsubscribe” link that appears at the bottom of such messages and following instructions contained within, or emailing us at no-mktg@nvisioncenters.com.

• • To Research and Develop of Our Services. We may process your personal information and derive analytical and statistical data to better understand the way you use and interact with our Services. For instance, analyzing where, on which types of devices and how our Sites are used, how many visitors we receive, and where they click on the Sites. These types of information may help us improve our existing Services and to build new Services. Please see our Cookies and Other Similar Tracking Technologies section for more information.

• • To Personalize Your Experience. We may process your information to personalize your experience. By personalization, we enable you to interact with our Services more easily across platforms and devices.

• • To Facilitate Corporate Acquisitions, Mergers and Transactions. We may process any information regarding your account and your use of our Services as is necessary in the context of corporate acquisitions, mergers or other corporate transactions.

• • With Your Consent. For any other purpose disclosed to you prior to you providing us your personal information or which is reasonably necessary to provide the services or other related services requested, with your permission or upon your direction.

• • How We Disclose Your Personal Information

We share your personal information as needed to fulfill the purposes described in this Policy and as permitted by applicable law. We may disclose your personal information as described below.

• • With Our Service Providers. We may share your personal information with third-party service providers acting on our behalf to help us operate our Services. Service providers and vendors provide us with support services such as website hosting, inquiry and feedback management, analytics services, surveys and research services, and network maintenance. These third parties can only use your information in accordance with our written instructions and must comply with the information security protections we have put in place.

• • Within Our Corporate Organization. We may share your personal information within our organization, to provide you with the Services and take actions based on your request, such as our parent company, subsidiaries, and corporate affiliates, joint venturers, or other companies under common control with us. We may permit these entities to use your information for their own marketing purposes.

• • During Business Transaction or Other Asset Transfers. We may disclose and transfer information about you to buyers, service providers, advisors, potential transactional partners or other third parties in connection with the advisors, potential transactional partners or other third parties of a corporate transaction in which we are acquired by or merged with another company, or we sell, liquidate, or transfer all or a portion of our business or assets. By engaging with us or using our Services, you understand and acknowledge to our assignment or transfer of rights to your personal information.

• • For Legal Compliance & Safety. We may access, preserve, and disclose information about you if we believe doing so is required or appropriate to (1) comply with law enforcement requests and legal processes, such as a court order or subpoena; (2) comply with requests from auditors, examiners or other regulators; (3) exercise, establish or defend our legal rights; or (4) protect your, our, or others’ rights, property or safety.

• • With Our Business Partners. Subject to applicable law, we may share your personal information with our affiliated clinical business partners, such as for permitted marketing purposes, or for co-sponsored events based on your voluntary participation. To learn more about your choices and rights, please review the “Your Choices and Privacy Rights” section below.

• • With Your Consent. We may share your personal information for any other purpose disclosed to you prior to you providing us your personal information or which is reasonably necessary to provide the services or other related services requested, with your permission or upon your direction.

• • Cookies and Similar Tracking Technologies

We, and third parties on our behalf, use cookies and similar tracking technologies (collectively, “Tracking Technologies”) to collect personal information automatically as you interact with our Services, to help us customize your experience and better manage content on our Sites, including to:

• • Analyze our web traffic using analytics package.

• • Identify whether you already visited our careers websites.

• • Store information about your preferences.

• • To recognize when you return to our Services.

Cookies. When you visit our websites, we (or third-party data or ad networks we work with) may send one or more “cookies” to your computer or other devices. Cookies are alphanumeric identifiers stored on your computer through your web browser and are used by most websites to help personalize your web experience. Some cookies may facilitate additional site features for enhanced performance and functionality such as remembering preferences, analyzing usage for site optimization, allowing third parties to provide social sharing tools, and serving images or videos from third-party websites. Some features on our websites will not function if you do not allow cookies.

• • How We Protect Your Personal Information

We follow generally accepted standards to protect the personal information submitted to us, both during transmission and once it is received. We maintain our Services and all associated information with technical, administrative, and physical safeguards to protect against the loss, unauthorized access, destruction, misuse, modification and improper disclosure of your personal information. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. We cannot guarantee the security of our databases or the databases of the third parties with which we may share such information, nor can we guarantee that the information you supply will not be intercepted while being transmitted over the internet. If you feel that the security of any account you might have with us has been compromised, you should contact us immediately at no-mktg@nvisioncenters.com.

• • Retention of Your Personal Information

We will retain your information for as long as needed to provide you Services or for other purposes stated in this Policy. We will cease to retain your personal information or remove the means by which the personal information can be associated with you as soon as it is reasonable to assume that such retention no longer serves the purpose for which the personal information was collected and is no longer necessary for legal or business purposes. If you wish to cancel your account or request that we no longer use your information to provide you services, please contact us at no-mktg@nvisioncenters.com. Please note that, we may still retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

• • Your Choices and Privacy Rights

Your Choices We offer you certain choices about how we communicate with you and what information we collect from you.

• • Marketing Communications. When you no longer wish to receive these marketing emails or text messages from us, you can unsubscribe at any time by using the “Unsubscribe” link that appears at the bottom of such messages and following instructions contained within, or emailing us at no-mktg@nvisioncenters.com.

• • Managing Cookies. You have the right to decide whether to accept cookies. If you do not want us to deploy cookies in your browser, you may exercise your preference by modifying your web browser setting to either (1) refuse some or all cookies or (2) notify you and ask for your permission when a website tries to set a cookie. If you want to learn the correct way to modify your browser settings, please use the “Help,” “Tools” or “Edit” menu in your browser or review the instructions provided by the following browsers: Internet Explorer, Google Chrome, Mozilla Firefox, Safari Desktop, Safari Mobile; and Android browser. If you choose to disable cookies in your browser, you can still use our websites, although your ability to use some of the features may be affected.

• • Managing Analytics. We may use third-party service providers to monitor and analyze the use of our career website, such as Google Analytics.  Google Analytics is a web analytics service offered by Google LLC (“Google”) that tracks and reports website traffic. For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy?hl=en. Google Analytics Opt-out Browser Add-on provides visitors with the ability to prevent their data from being collected and used by Google Analytics, available at: https://tools.google.com/dlpage/gaoptout.

• • Managing Interest-Based Advertising. We and our third-party service providers may use interest advertising technologies when you interact with our Services. Many advertising companies that collect information for interest-based advertising are members of the Digital Advertising Alliance (DAA) or the Network Advertising Initiative (NAI), both of which maintain websites where people can opt-out of interest-based advertising from their members. To opt-out of website interest-based advertising provided by each organization’s respective participating companies, visit the DAA’s opt-out portal available at http://optout.aboutads.info/, or visit the NAI’s opt-out portal available at http://optout.networkadvertising.org/?c=1.

Your Privacy Rights Depending on applicable law where you reside or are located, you may be able to assert certain rights identified below with respect to your personal information. If any of the rights listed below are not provided to you under the law that governs the processing of your personal information, we have absolute discretion in providing you with those rights. Please refer to the “What Rights Apply” section to determine the rights you have in the jurisdiction you reside. Please note, your rights in relation to your personal information are not absolute. Depending upon the applicable law, access to your rights under the applicable law may be denied: (i) when denial of the request is required or authorized by law; (ii) when granting the request would have a negative impact on another’s privacy; (iii) to protect our rights and properties; (iv) where the request is frivolous or vexatious, or for other reasons.

• • Right to Know/Access. You may have the right to obtain a copy, or a list of categories of the personal information that we hold about you, as well as other supplementary information, such as the purposes of processing, and the entities to whom we disclose your personal information.

• • Right to Correct/Rectification. You may have the right to correct any of your personal information in our records and systems. You may request us to rectify, correct or update any of your personal information held by us that is inaccurate.

• • Right to Delete/Erasure. Under certain circumstances, you may have the right to request that we delete the personal information that we hold about you. This right is not absolute, and we may refuse your right to delete if it is reasonably necessary for us to provide a service requested by you; to perform a contract between us; to maintain functionality and ensure security of our systems; to enable solely expected internal uses of your personal information; to exercise a right provided by law; to comply with a legal obligation, or if there are compelling legitimate grounds for keeping your personal information.

• • Right to Portability. Under certain circumstances, you may have the right to receive personal information we hold about you in a structured, commonly used, and machine-readable format so that you can provide that personal information to another entity.

• • Right Against Discrimination. You have the right not to be discriminated against for exercising any of the rights described in this section. We will not discriminate against you for exercising your privacy rights.

• • Right to Object to Automated Decision-Making. You may have the right not to be subject to a decision that is based solely on automated processing (where a decision is taken about you using an electronic system without human involvement) which significantly impacts your rights. No decision will be made by us about you solely on the basis of automated decision making which has a significant impact on you.

To determine which rights you have, please refer to the table below that references the rights as described above. U.S. States not listed either do not have a law providing such rights, or it does not apply to our operations.

Jurisdiction	Applicable Rights
California Residents	(a) Right to Know/Access; (b) Right to Correct/Rectification; (c) Right to Delete/Erasure; (d) Right to Portability; (e) Right Against Discrimination; and (f) Right to Opt-Out of Automated Decision-making or Profiling (upon issuance of regulations by the California Privacy Protection Agency)

Submitting a Request to Exercise Your Privacy Rights To assert your privacy rights noted above, you may contact us at 1-866-204-3708, or email us at no-mktg@nvisioncenters.com. To protect your privacy, we must be able to verify your identity to confirm that the request came from you before we can process your request to exercise any of the privacy rights that you may be entitled to under the applicable law. We may contact you by phone or e-mail to verify your request. Depending on your request, we will ask for information such as your name, an e-mail address, or a phone number you have used with us. For certain requests, we may also ask you to provide details about the most recent purchase you made online. Please note California residents may do so up to twice per year per customer.  We may charge a reasonable fee for multiple requests in the same 12-month period, as permitted by law. Residents of California may designate an authorized agent to submit a request on your behalf to access or delete your personal information. To do so, you must: (1) provide that authorized agent written and signed permission to submit such request; and (2) verify your own identity directly with us. Please note, we may deny a request from an authorized agent that does not submit proof that they have been authorized by you to act on your behalf. Your Opt-Out Rights If you reside in California, you may have the right to opt-out of certain types of processing for your personal information.

• • Right to Opt Out of Sale.  You may have the right to opt-out of the sale of your personal information. We generally do not sell your personal information for profit, but may share your medical information with our affiliated clinical entities where you are interested in seeking services.  In addition, like many businesses, we use cookies, pixels, and similar technology on our Sites, and we share certain personal information, such as your IP address or device identifiers, to third-party advertisers in order to improve your user experience and to optimize our marketing activities. Under the broad definition of “sell” contained in some jurisdiction’s privacy laws, this could be considered a sale.

• • Right to Opt Out of Sharing for Targeted Advertising.  You may have the right to opt-out of the sharing of your personal information to third parties for behavioral or cross-contextual advertising purposes. Like many websites, we use cookies, pixels, and similar technology, and we share certain information, such as your IP address or device identifiers, to certain third-party advertisers in order to improve your user experience and to optimize our marketing activities. You have the right to direct us not to share or use your personal information for targeted advertising purposes.

To exercise your right to opt-out of sales and targeted advertising, please email us at no-mktg@nvisioncenters.com. Please note that you may still receive generalized ads after opting out of targeted advertising. You may also opt-out of sharing and sales by using an opt-out preference signal. The Global Privacy Control signal is currently the only opt-out preference signal we can recognize. You can visit the Global Privacy Control official site at https://globalprivacycontrol.org/#about to learn how to configure your device to send such signals. We will honor and process the opt-out preference signal in a frictionless manner. Please note that the opt-out choice will only apply to your use of our Sites through the current browser or device you are using and only so long as that browser’s cookies are not erased. You will need to submit a separate opt-out of sharing request on each device and browser you use to visit our Sites to completely opt-out using this method.

• • Children’s Information

Our Services are not directed to children under age 13, and we do not knowingly collect or process personal information from children under the age of 13. If you are a parent or guardian and any personal information collected from your child, or have that information modified or deleted, you may contact us at no-mktg@nvisioncenters.com. If we become aware that a child under 13 has provided us with personal information, we will terminate the user’s access to our Service and take steps to delete such information from our filesystems, unless we have a legal obligation to keep it.

1. 1. Third-Party Sites

Our Services may contain links to third-party sites. This Privacy Policy does not apply to those third-party sites. We recommend that you read the privacy policy of any other sites that you visit as we are not responsible for the privacy practices of those sites.

1. 1. California Consumer Privacy Notice

If you are a California resident, this section applies to you in addition to the rest of this Privacy Policy.  The California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”) requires us to disclose the following additional information related to our privacy practices. Categories of Personal Information Collected, Used, and Disclosed In the preceding 12 months, depending how you interact with our Services, we may have collect the following categories of personal information (as defined under Cal. Civ. Code  §1798.140(v)(1)):

• • Identifiers such as a name, address, unique personal identifier, email, phone number, your device’s IP address, software, and identification numbers associated with your devices;

• • Internet or other electronic information regarding you browsing history, search history, the webpage visited before you came to our Site, length of visit and number of page views, click-stream data, locale preferences, your mobile carrier, date and time stamps associated with transactions, and system configuration information;

• • Geolocation data, to the extent you have configured your device to permit us to collect such information;

• • Audio or Visual information, such as audio recordings of your voice to the extent you call us, as permitted under applicable law; and

• • Inferences drawn from any of the information listed above, such as your service preferences, characteristics, and behavior.

We generally do not collect protected classifications, biometric information, professional or employment-related information, or education-related information. For more information about the personal information we collect and how we collect it, please refer to Section 2 above. Purposes for Colleting and Using Categories of Personal Information We collect and use your personal information for the following business purposes:

• • Performing services, including responding in consultation inquiries, providing customer service, and verifying customer information;

• • Providing advertising and marketing services;

• • Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance;

• • Helping to ensure security and integrity;

• • Debugging to identify and repair errors that impair existing intended functionality;

• • Short-term, transient use, such as non-personalized advertising shown as part of your current interaction with us;

• • Undertaking internal research for technological development and demonstration; and

• • Undertaking activities to verify or maintain the quality or safety of a service controlled by us, and to improve, upgrade, or enhance the service that is controlled by us.

For more information about the purpose of collecting and using the categories of personal information listed above, please refer to Section 3 above. Sale or Share of Personal Information We may share or sell your identifiers, device information, and geolocation to advertising networks, and our business partners. To exercise your right to opt-out of sales and targeted advertising, please email us at no-mktg@nvisioncenters.com. Please note that you may still receive generalized ads after opting out of targeted advertising. You may also opt-out of sharing and sales by using an opt-out preference signal. The Global Privacy Control signal is currently the only opt-out preference signal we can recognize. You can visit the Global Privacy Control official site at https://globalprivacycontrol.org/#about to learn how to configure your device to send such signals. NVISION does not knowingly sell or share (for cross-context behavioral advertising) the personal information of consumers under 13 years of age. Retention of Personal Information We retain your information for as long as your account is active, as needed to provide you Services or for other purposes stated in this Policy, or as required or permitted by applicable law. For more information about the criteria for retaining personal information listed above, please refer to Section 7 above. Your Right to Limit Use of Sensitive Information If you are a California resident, to the extent your sensitive personal information (as that term is defined under the CCPA) is used to infer characteristic about you, you have the right to direct us to stop such processing of your sensitive personal information for such purposes. We do not process any sensitive personal information to infer characteristics about you without your consent. Shine the Light In addition to the CCPA, California’s “Shine the Light” law, Civil Code section 1798.83, requires certain businesses to respond to requests from California residents asking about the businesses’ practices related to disclosing personal information to third parties for the third parties’ direct marketing purposes. Alternately, such businesses may have in place a policy not to disclose personal information of customers to third parties for the third parties’ direct marketing purposes if a California customer has exercised an option to opt out of such information sharing. We have such a policy. If you want to opt out of any such sharing of your information, please contact us using the information below. Do Not Track Your browser may allow you to adjust your browser settings so that “do not track” requests are sent to the websites that you visit. However, since uniform standards for “DNT” signals have not been adopted, we do not disable tracking technology that may be active on the Sites in response to any “do not track” requests that we receive from your browser.

1. 1. Contact Us

We welcome your questions, comments and concerns about privacy. You may contact us by contact us at 1-866-204-3708, email us at no-mktg@nvisioncenters.com, or by postal mail at Laser Eye Care of California, LLC dba NVISION®, 75 Enterprise, Suite 200, Aliso Viejo, CA 92656.