Arcutis Biotherapeutics

1. The Categories of Consumer Health Data Collected

We collect the following categories of Consumer Health Data from Consumers:

• Individual health conditions, treatment, diseases, or diagnosis
• Social, psychological, behavioral, and medical interventions
• Health-related surgeries or procedures
• Use or purchase of prescribed medication
• Bodily functions, vital signs, symptoms, or measurements of health information
• Diagnoses or diagnostic testing, treatment, or medication
• Reproductive or sexual health information
• Biometric data
• Precise location information that could reasonably indicate a consumer’s attempt to acquire or receive health services or supplies
• Data that identifies a consumer seeking health care services
• Any inferences of the above categories of health data derived or extrapolated from non-health information

2. How Consumer Health Data Will be Used

We use the categories of Consumer Health Data listed in Section 1 for the following purposes:

• Respond to your questions and communicate with consumers
• Operate, manage, and maintain our business and maintain records
• Provide, develop, improve, repair, and maintain our products and Services
• Analyze and better understand consumers’ needs, preferences, and interests and conduct internal business analysis and research
• Advertise and promote our products and services, including by contacting consumers regarding products, services, and topics that may be of interest to them
• Engage with current and prospective advertisers, advocacy organizations, service providers, and third parties
• Undertake quality and safety assurance measures and conduct risk and security controls and monitoring
• Detect and prevent fraud and perform identity verification
• Perform accounting, audit, and other internal functions, such as internal investigations
• Comply with law, legal process, and internal policies
• Exercise and defend legal claims
• For any other purpose you may agree to at or before the time the Consumer Health Data is collected

3. Categories of Sources from Which We Collect Consumer Health Data

We collect these categories of Consumer Health Data directly from consumers, from cookies and other tracking technologies, from our Service Providers and third parties when they disclose Consumer Health Data to us, and from public databases and social media.

4. The Categories of Consumer Health Data that we Share

We share all of the categories of Consumer Health Data that we collect, as disclosed above in Section 1.

5. Third Parties and Affiliates with Whom We Share Consumer Health Data

We share your Consumer Health Data with the following Third Parties:

• Third-party marketing and advertising partners
• Other third parties with your consent or at your direction
• Other third parties to protect our rights, defend or pursue a legal claim, or investigate or prosecute illegal activities
• Government or judicial authorities to comply with a subpoena, court order, governmental inquiry, legal process, legal obligation, or to protect the rights, property, or safety of other users or the public
• Successor entity or purchaser upon a merger, consolidation, or other corporate reorganization in which we participate, a sale of all or a portion of our assets, or pursuant to a financing arrangement. In this situation, we will seek assurances that the successor entity or purchaser will process Consumer Health Data collected by us in accordance with this notice.

We share your Consumer Health Data with the following Affiliates:

• Arcutis Canada, Inc.
• Ducentis BioTherapeutics Ltd.

6. How to Exercise Your Rights with Respect to Your Consumer Health Data

To exercise your rights with respect to your Consumer Health Data, depending on your state of residence, you may contact us at any time by clicking here or through any of the following methods:

• Calling us at our Privacy Rights toll-free number: 844‑4ARCUTIS
• Sending us an email at privacy@arcutis.com
• Mailing your request to:

Arcutis Biotherapeutics, Inc.

Attn: Privacy Officer

3027 Townsgate Road, Suite 300

Westlake Village, CA 91361

Supplement to Consumer Health Data Privacy Policy for Nevada Consumers

This Supplement applies to Nevada Consumers for purposes of providing additional disclosures required by Nevada’s Consumer Health Data privacy law. Terms used herein that are defined terms under Nevada’s Consumer Health Data privacy law shall have the meanings afforded to them therein.

A. Purposes & Manner of Processing. We Collect, use, Process, and Share Consumer Health Data for the purposes and in the manners described in our Consumer Health Data Privacy Policy, which also provides additional disclosures relevant to Nevada Consumers.

B. Review & Revision of Consumer Health Data. If You would like to review and/or revise Your Consumer Health Data, You may submit a request to us via the methods listed in our Consumer Health Data Privacy Policy. We will respond to Your requests to exercise Your rights in accordance with applicable law, but in any case, no later than 45 days after receiving Your request. We may extend this period up to 45 days only where doing so is permitted under applicable law.

C. Changes to this Supplement. We will notify You before making any changes to our privacy practices with respect to Your Consumer Health Data by posting an updated notice on this page, with an updated effective date.

D. Third Party Collection of Consumer Health Data. Please note that some Third Parties may collect Consumer Health Data about You over time and across different websites or online services You may visit.

Effective Date: September 30, 2024