Consumer Health Data Privacy Notice

This Notice supplements Enzo’s Privacy Policy and applies to consumer health data governed by Washington, Nevada, and similar U.S. laws. Enzo provides custom-clothing and tailoring services, not health-care services.

This Notice does not apply to employment or applicant information, which is addressed in the applicable workforce or applicant privacy notice.

1 Consumer health data we collect

Depending on how you interact with us, we may collect these limited categories:

• Functional accommodation information. A practical request you voluntarily provide so we can serve you, such as a seated fitting, physical access assistance, communication accommodation, garment-fastening or construction adjustment, or another functional modification. A request may reveal or suggest a disability, mobility limitation, sensory need, or health-related circumstance.

• Information linked to an accommodation request. Your name, contact details, customer or order number, appointment or showroom information, relevant communications, and records showing how the request was handled.

• Consumer-rights records. Information submitted to exercise rights concerning consumer health data, including information reasonably necessary to authenticate, document our response, or process an appeal.

We collect ordinary garment measurements, fit observations, photographs, and preferences to design, make, alter, and deliver clothing. We do not use them to diagnose, identify, predict, or infer a health condition. To the extent applicable law nevertheless treats a measurement, fit note, photograph, or related record as consumer health data, this Notice applies.

We do not intentionally collect or create consumer health data concerning diagnoses, medical treatment, prescribed medications, genetic characteristics, reproductive or sexual health, gender-affirming health care, or precise location associated with obtaining health care. We do not use photographs or imagery to create biometric identifiers or infer health status.

Please provide only the practical adjustment or accommodation you need. You do not need to provide a diagnosis or unrelated medical detail.

2 Sources

We may obtain consumer health data from:

• you directly;

• a person assisting you or acting at your direction, such as a caregiver, family member, or authorized agent;

• our personnel when they document a request during an appointment, fitting, purchase, or support interaction; and

• service providers processing a request for us through customer-service, appointment, order-management, or privacy-request systems.

We do not purchase consumer health data from data brokers, advertising networks, social-media platforms, or commercial data sellers.

3 Why and how we use it

We process consumer health data only as reasonably necessary to:

• understand, provide, and document a requested product, service, adjustment, or accommodation;

• coordinate appointments, fittings, garment construction, alterations, fulfillment, delivery, and support;

• communicate with you about the request;

• maintain accurate customer, order, accommodation, and service records;

• authenticate and respond to rights requests and appeals;

• protect customers, personnel, systems, and records against fraud, misuse, or security threats; and

• comply with law or establish, exercise, or defend legal claims where permitted.

Processing may include receiving the request, associating it with the relevant customer, appointment, or order, communicating a practical instruction to personnel or an authorized processor, carrying out the service, restricting access, retaining the record for an appropriate period, and securely deleting or deidentifying it when no longer needed.

We do not collect, use, or sell personal information for the purpose of training large language models. We do not authorize providers to use personal information we supply to train large language models.

We do not use consumer health data for targeted or cross-context behavioral advertising, marketing segmentation, automated profiling, eligibility decisions, health-status inference, or training, fine-tuning, or evaluating any AI model. Customer fitting photos are not processed or analyzed with AI. No consent-based exception to these model-training restrictions is offered.

4 Sharing and other disclosures

The categories we may disclose are limited to functional accommodation instructions and identifiers or order information reasonably necessary to carry out the request.

Processors and service providers

We may provide limited consumer health data to processors acting for us, such as providers of customer relationship, order-management, appointment, customer-support, communications, cloud hosting, document storage, cybersecurity, IT, tailoring, alteration, production, or fulfillment services when a practical instruction is necessary for the requested product or service.

Processors may act only under a binding contract that establishes documented instructions, limits permitted processing, requires appropriate safeguards, and requires assistance with consumer-rights obligations.

Enzo Group affiliates

Enzo Custom Florida Inc. and the commonly controlled Enzo Group entities use shared customer systems. Functional-accommodation notes are restricted to the clothier and tailor serving you and program administrators who need the information to arrange the requested service. Other personnel cannot access them. If those restrictions cannot be maintained in the shared CRM, we arrange the accommodation through a minimal restricted workflow and do not store the health-revealing note there. Information is made available to an affiliate only when necessary for the requested service or another specifically permitted purpose. Affiliates that may receive relevant instructions when they provide that service are Enzo Custom Florida Inc., Enzo Custom Beverly Hills Inc., Enzo Custom Boca Raton Inc., Enzo Custom Boston Inc., Enzo Custom Charlotte Inc., Enzo Custom Clothiers Chicago Inc., Enzo Custom Clothiers D.C. Inc., Enzo Custom Clothiers Philadelphia Inc., Enzo Custom Dallas Inc., Enzo Custom Greenwich Inc., Enzo Custom Houston Inc., Enzo Custom Miami Inc., Enzo Custom Nashville Inc., Enzo Custom Palo Alto Inc., Enzo Custom Short Hills Inc, Enzo Custom SoHo Inc., Enzo Custom Williamsburg Inc., Enzo Sartori Inc., Custom Clothing Solutions Inc., Sanpari Tailors Boston Inc, Sanpari Tailors DC Inc, Sanpari Tailors Philadelphia Inc., and Sanpari Tailors SoHo Inc. The legal-entity schedule and business or contact addresses are in Appendix A of the Privacy Policy; that schedule is not a list of open showrooms. We do not use accommodation information for advertising, profiling, or health inference.

Other third parties

We do not routinely share consumer health data with third parties. We may make a limited disclosure to a government authority, court, professional adviser, or similar recipient only when law requires or expressly permits it and after appropriate review.

We do not knowingly permit a third party to collect consumer health data over time and across different websites or online services when you use our Services.

5 Consent and requested services

We may collect or disclose consumer health data without separate consent only to the extent necessary to provide a product or service you requested and as permitted by law.

When consent is required, we will request a freely given, specific, informed, voluntary, unambiguous, affirmative opt-in before collection. If consent is required to share, the request will be separate and distinct from consent to collect.

We will not collect, use, or share an additional category, use the data for an additional purpose, or share it with a newly identified third party or affiliate unless we first provide the disclosure and obtain consent required by law. You may withdraw consent and request that we cease future collection or sharing. Withdrawal does not affect prior lawful processing.

6 No sale

Enzo Custom does not sell or offer to sell consumer health data and does not request authorization to sell it. We do not condition a product or service on authorizing such a sale.

7 Geofencing

We do not use a geofence around a hospital, clinic, pharmacy, reproductive or sexual health facility, gender-affirming care provider, or another location providing in-person health-care services or products to identify or track a person seeking health care, collect consumer health data, or send a health-related notification, message, or advertisement.

8 Security access and retention

We limit the information we record to the practical adjustment you request, and personnel, contractors, and processors may use it only to provide the requested service or another disclosed and permitted purpose.

We maintain administrative, technical, and physical safeguards designed to protect confidentiality, integrity, and availability. These include access controls, contractual restrictions, workforce instructions, and security practices appropriate to the limited volume and nature of the information.

We delete consumer health data when no longer reasonably needed to provide the requested accommodation or resolve its specific service issue, subject to applicable rights and legal requirements. We do not automatically retain an accommodation narrative for the full life of an order archive. A documented legal requirement or active-dispute hold may preserve only relevant information with restricted access and periodic review, ending when that basis ends. Covered fitting photos follow the shorter purpose-based period and ordinarily no more than 12 months from each capture; later interactions do not restart that period. Identifiable inactive profile or measurement records are deleted or irreversibly deidentified after 3 years without a purchase, appointment, or direct service contact. Passive marketing engagement does not restart that period. An applicable consumer-health deletion request may require earlier deletion from active and backup systems as described below.

9 Your consumer health data rights

Subject to applicable law, you may request to:

• Confirm and access: confirm whether we collect, share, or sell consumer health data and access it;

• Obtain a recipient list: receive the third parties and affiliates with whom we shared or sold it, with contact information where required;

• Withdraw consent and stop processing: withdraw consent and ask us to cease future collection, sharing, or sale;

• Delete: delete consumer health data and notify applicable affiliates, processors, contractors, and recipients;

• Correct: correct inaccurate consumer health data;

• Appeal: appeal a refusal to act; and

• Avoid discrimination: exercise these rights without unlawful discrimination.

We do not sell consumer health data, so a request to stop a sale will be treated as confirmation of our existing practice.

10 How to exercise rights

• Privacy Request Form

• [email protected]

• 888-622-3696

• Enzo Custom, Attn: Privacy, 501 E Las Olas Blvd., Suite 300, Fort Lauderdale, FL 33301

Identify the request as a Consumer Health Data Request. To appeal, identify it as a Consumer Health Data Appeal and include enough information to locate the original request.

You do not need a new account. We may use commercially reasonable methods to authenticate identity and authority. If we cannot authenticate, we may ask for reasonably necessary information. An authorized agent may act where law permits, subject to verification of authority and, where appropriate, direct confirmation.

Requests are generally free. Law may permit a reasonable fee or refusal for manifestly unfounded, excessive, or repetitive requests; we bear the burden of supporting that determination.

We respond without undue delay and generally within 45 days after receiving a request. Where permitted, we may extend once by up to 45 days and will notify you during the initial period with the reason.

For an authenticated Nevada deletion request, deletion from active records and networks will be completed within 30 days as required by Nevada law. For Washington consumers, deletion from archived or backup systems may be delayed only as necessary and for no more than six months after authentication. Nevada law may permit deletion from an archived or backup system to be delayed, when necessary, for up to two years. During an allowed backup delay, the data will not return to active use except as necessary for restoration and completion of deletion.

If we decline to act, we will explain our decision and how to appeal. We decide an appeal within 45 days. If denied, we provide a method for contacting the appropriate state attorney general.

11 Children

Our Services are not directed to children under 13, and we do not knowingly collect consumer health data from children under 13 through our online Services. If we learn we collected it without required authorization, we will take appropriate steps to delete it.

A parent, legal guardian, or legally authorized representative may exercise rights for a minor where law permits or requires.

12 Changes to this Notice

We update the Last Updated date when this Notice changes and provide notice of a material change through our website and, when appropriate, another direct communication method.

Before materially different collection, use, or sharing, or adding a category, purpose, third party, or affiliate requiring consent, we provide the applicable disclosure and obtain affirmative consent. A current link to this Notice will be displayed prominently on our homepage and relevant collection pages.

13 Contact us

Enzo Custom Florida Inc. d/b/a Enzo Custom Attn: Privacy 501 E Las Olas Blvd., Suite 300 Fort Lauderdale, FL 33301 [email protected] 888-622-3696