Privacy Notice
Last Updated: August 19, 2026
This Privacy Notice (“Privacy Notice”) explains how ZO Skin Health, Inc. and ZO Skin Health EMEA, S.L.U., together with their affiliated entities, collect, use, and disclose personal data. For marketing-related processing activities, ZO Skin Health, Inc. and ZO Skin Health EMEA, S.L.U. act as joint controllers (“ZO”, “our”, or “we”). For other processing activities, the specific ZO entity acting as a data controller for your personal data is identified in the section below titled “Data Controller Contact Details.”
This Privacy Notice applies to individuals (“users”, “you”, or “your”) located in the United Kingdom (“UK”), European Economic Area (“EEA”), or Switzerland, who visit a ZO website in those regions (the “Site”), create an account, interact with us offline, and/or make purchases through the Site or other sites or services that link to this Privacy Notice (collectively, the “Services”).
We encourage you to read this Privacy Notice carefully to understand how we handle your personal data. This Privacy Notice explains how we collect, process, and may disclose your personal data as set forth below. Where we rely on your consent for specific processing activities, we will obtain it separately. If you have any questions regarding this Privacy Notice or our privacy practices, please email us at privacy@zoskinhealth.com. If you visit our Site, please also refer to our Terms of Use.
As used in this Privacy Notice, “personal data” means any information relating to an identified or identifiable natural person, as defined under applicable data protection law, including any information that we collect, use, store, share, or transfer in either physical or electronic form.
DATA CONTROLLER CONTACT DETAILS
For marketing related activities described in this Privacy Notice, ZO Skin Health, Inc. and ZO Skin Health EMEA, S.L.U. jointly determine the purposes and essential means of processing your personal data and therefore act as joint controllers under applicable data protection laws. You may exercise your rights against either of the Joint Controller using the contact details below or by emailing privacy@zoskinhealth.com.
ZO Skin Health, Inc: 9685 Research Drive, Irvine, California 92618, USA.
ZO Skin Health EMEA, S.L.U.: Rambla Canaletes 140, 6⁰, 08002 Barcelona, Spain.
In addition, for other activities, the following local ZO entities act as separate, independent data controllers for users located in the UK, the EEA, or Switzerland.
Benelux: ZO Skin Health Benelux B.V., a company registered in the Netherlands and located at Frisselsteinstraat 8, 5461 AD Veghel, Netherlands.
France: ZO Skin Health France SAS, a company registered in France and located at 6 Rue Cambacérès, 75008 Paris, France.
Nordics: ZO Skin Health AS, a company registered in Norway and located at Løkkeåsveien 3, 1337 Sandvika, Norway.
United Kingdom: ZO Skin Health Limited, a company registered in the United Kingdom and located at 20 Eastbourne Terrace, London, W2 6LG, United Kingdom.
Spain: ZO Skin Health EMEA, S.L.U., a company registered in Spain and located at Rambla Canaletes 140, 6⁰, 08002 Barcelona, Spain.
Italy: ZOSH Italy S.R.L., a company registered in Italy and located at Viale Cassala 57, 20143 Milan, Italy.
Switzerland: ZO Skin Health Switzerland GmbH, a company registered in Switzerland with a registered office c/o Treforma AG, Grabenstrasse 25, 6340 Baar, Switzerland.
PERSONAL DATA WE COLLECT
ZO may collect personal data from the following sources:
Directly from you. For example, when you create an account, make a purchase, input information into a form on our Site, email us, or engage with us on social media.
Automatically through cookies and other tracking technologies. For example, via cookies and tracking technologies on our Site or in our email communications (see “Cookies and Other Tracking Technologies” for more information).
From other sources. For example, from vendors, partners, and social media platforms.
We may collect the following categories of personal data depending on how you interact with us.
- Contact Information, such as name, mailing address, telephone number, and email address.
- Account and Profile Information, such as physician characteristics or description, account credentials (username and encrypted password), and profile pictures when you choose to interact with us on social media.
- Commercial Information, such as products considered and other browsing tendencies.
- Internet or Other Electronic Network Activity Information, such as products considered or other purchasing tendencies, browsing history, search history, IP address, keystrokes and scrolls, device identifiers, information regarding online interactions, including interactions over time across the internet, the Site, and advertisements, approximate location data.
- Geolocation Data, including approximate location based on your device IP address or interaction with the Authorized Finder tool.
- Sensory Data, including audio recordings of customer care calls.
- Inferences about your preferences and interactions with our Services.
- Profile Information, such as age range and information about your skincare needs.
- Contents of Communications, including any information you choose to share with us when you communicate with us via email, webform, chat, telephone, or otherwise
HOW WE USE THE PERSONAL DATA WE COLLECT
We use the personal data described above for the purposes specified at the time of collection or as follows:
- To improve our understanding of your interests and concerns,
- To provide you with a smooth and efficient customer experience, and
- For security, analytics, and marketing purposes.
For the purposes discussed in this Privacy Notice, we may combine the personal data that we collect through the Services with information that we receive from other sources, both online and offline, and use such combined information in accordance with this Privacy Notice.
We may aggregate or anonymize any information we collect so that such information is no longer reasonably capable of being associated with you and use such information for any purpose.
Legal Basis for Processing
In accordance with applicable data protection regulations, we only process your personal data when we have a legal basis to do so, such as:
- Where use of your personal data is necessary to fulfill our obligations under a contract or commitment to you, such as processing your orders, managing your account, delivering products and services, and providing customer support.
- Where use of your personal data furthers our legitimate interests or the legitimate interests of others, such as improving and securing our Services, conducting analytics, detecting and preventing fraud, administering our professional network of ZO Authorized Partners, and personalizing your experience. In each case, we have assessed that these interests are not overridden by your rights and freedoms.
- Where we use your personal data to comply with applicable legal obligations, such as tax, accounting, and regulatory reporting requirements, and responding to lawful requests from public authorities.
- Where you have consented to our processing of your personal data for a particular purpose, such as receiving marketing communications or the use of non-essential cookies. You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal, by contacting us at privacy@zoskinhealth.com or by using the specific opt-out mechanisms described in this Privacy Notice.
SYSTEM MIGRATION TO NEW ECOMMERCE, CRM AND FINANCE SYSTEMS
We have migrated existing customer and clinic information from our legacy ecommerce and CRM tools into new systems operated by ZO and its service providers (including, for example, ecommerce platforms such as Salesforce Commerce Cloud, CRM tools such as Klaviyo, and enterprise resource planning tools such as NetSuite). This migration was carried out so that we can continue to perform the activities described in this Privacy Notice (such as processing your orders, managing your account, handling clinic relationships, providing customer service, and sending you marketing communications where permitted) using more modern and efficient tools.
The purposes and legal bases for processing your personal data did not change as a result of this migration. Where we rely on your consent (for example, for certain marketing or cookies), we have continued to honor your existing choices, and you can withdraw your consent at any time as described in this Privacy Notice.
We have applied the principles of data minimization and storage limitation and implemented appropriate technical and organizational security measures, such as encryption, access controls, testing in staging environments, and logging of data transfers and deletions.
Where these systems involve the transfer of personal data outside the UK, the EEA, or Switzerland, we rely on the safeguards described in the section “International Data Transfers” (such as the European Commission’s Standard Contractual Clauses) and, where required, have carried out transfer risk assessments.
Your data protection rights (including rights of access, rectification, erasure, restriction, objection, and data portability) apply to personal data held in both our legacy and new systems. You can exercise these rights at any time by contacting us as set out in the “Contact Us” section below.
WITH WHOM WE SHARE YOUR PERSONAL DATA
We may disclose your personal data to:
Subsidiaries and Affiliates. We may share your personal data with our subsidiaries and affiliates.
Service Providers. We may disclose your personal data to vendors that perform certain services on our behalf, such as processing orders, processing credit card payments, delivering products and services, providing customer service and marketing assistance, performing business and sales analysis, supporting our website functionality, and supporting other features and promotions offered through our Site (“Service Providers”). We will only provide these Service Providers with the personal data that they need to provide such services, and Service Providers are not permitted to share or use such personal data for other purposes.
ZO Authorized Partners. When purchasing products on our Site, you may choose one of the many ZO Authorized Partners in your region before completing your purchase. When selecting a ZO Authorized Partner in checkout, we will disclose certain personal data (such as your name, contact details, and relevant order information) to your selected ZO Authorized Partner so that they can provide local advice and support, including contacting you regarding skincare consultations. If you do not select a ZO Authorized Partner, we may automatically assign the nearest ZO Authorized Partner based on your shipping address during checkout, on the basis of our legitimate interest in managing our professional network and ensuring local support for your order. That ZO Authorized Partner will receive your aforementioned personal data for order attribution purposes, to help manage our professional network, and to contact you regarding consultations where you are a new customer not yet associated with a ZO clinic. Once your personal data has been disclosed to a ZO Authorized Partner, that partner acts as an independent data controller and is responsible for its own processing of your personal data in accordance with applicable data protection law and its own privacy notice. You may contact us at privacy@zoskinhealth.com to request that no ZO Authorized Partner be automatically assigned to your order.
Business Partners. From time to time, we may offer promotions, sweepstakes, or third-party offerings on our Site. If you make purchases or engage in these services and/or products offered through our Site or our Services, we may disclose personal data to the businesses with which we partner to offer you those products, services, promotions, contests, and/or sweepstakes. When you elect to engage in a particular merchant’s offer or program, we will require your consent to provide your email address and other information to that merchant.
Other Users of the Services. We may provide areas on the Services where you can communicate with others, upload content, and post comments or reviews. If you choose to share information in this way, you share such information with all individuals capable of viewing it. For example, if you post a comment on a publicly viewable area of the Services, you choose to share the information you post with the public. We encourage you to exercise discretion and caution with respect to sharing your information.
Business Transfers. We may disclose your personal data in connection with a merger, acquisition, reorganization, assignment, sale of assets, or other corporate transactions, or in the event of bankruptcy.
Legal Obligations. ZO may disclose your personal data in good faith in response to a subpoena, court order, or other legal process from law enforcement or other government agency; to establish or exercise our legal rights; to defend against legal claims; or as otherwise required by law. In such cases, we may raise or waive any legal objection or right available to us, in our sole discretion.
COOKIES AND OTHER TRACKING TECHNOLOGIES
A cookie is a small data file that is stored by your browser on your device. We use cookies to deliver a better experience, for example, remembering your preferences.
Other examples of why we use cookies include:
- To learn about how you interact with our Site
- To detect and prevent fraud
- To conduct analytics activities
- To improve our Services
- To facilitate interest-based advertising
The cookies we use can be categorized as follows:
Strictly Necessary Cookies. These cookies are necessary for the Site to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the Site will not then work. These cookies do not store any personal data.
Performance Cookies. These cookies allow us to count visits and traffic sources so we can measure and improve the performance of the Site. They help us to know which pages are the most and least popular and see how visitors move around the Site. All the information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies, we will not know when you have visited the Site and will not be able to monitor its performance.
Functional Cookies. These cookies enable the Site to provide enhanced functionality and personalization. They may be set up by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these Services may not function properly.
Targeting Cookies. These cookies may be set through our Site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They are based on uniquely identifying your browser and internet device, which may constitute personal data under applicable data protection law. If you do not allow these cookies, you will experience less targeted advertising.
You can find more information about the individual cookies we use and the purposes for which we use them in the
Please note that the following third parties may also use cookies, over which we have no control. These third parties may include, for example, advertising networks and providers of external services like web traffic analysis services. To deactivate the use of third-party advertising cookies, you may visit the consumer page for the services below. These third-party cookies are likely to be analytical cookies or performance cookies or targeting cookies:
Demandware e-Commerce
OneTrust
Google Analytics
Predictive Intelligence
Microsoft Bing Ads
Commerce Cloud
Stripe
B2B CommerceMeta
Digioh
Klaviyo
You can choose which category of cookies we can set by clicking on the buttons provided on our . You can also choose to “Reject All” cookies in the cookie banner. If you use your browser’s method of blocking or removing cookies, some, but not all, types of cookies may be deleted and/or blocked. If you delete or block cookies, some functionality on our Site may not work properly.
Modifying your mobile device or browser settings may have different results depending on the type of device or browser you are using and the version of the device operating system you are running. Opting out of tailored advertising does not prevent you from seeing advertising online; instead, the ads you see are less likely to be customized to your interests.
In addition to cookies, we may use other types of tracking technologies in connection with our Services.
Analytics. We may use third-party web analytics services (such as those of Google Analytics) on our Services to collect and analyze usage information through cookies and similar tools; engage in auditing, research, or reporting; assist with fraud prevention; and provide certain features to you. To prevent Google Analytics from using your information for analytics, you may install the Google Analytics Opt-out Browser Add-on by clicking here.
We may integrate the analytics services we use with advertising services that are made available by our analytics providers. For example, we integrate Google Analytics with the following Google advertising features:
- Remarketing with Google Analytics
- Cross Device Remarketing & Reporting
- Google Analytics Demographics and Interest Reporting
- Google Display Network Impression Reporting
To opt-out of Google Analytics for display advertising or customize Google display network ads, visit the Google Ads Settings page. Please note that these opt-outs apply per device, so you will have to opt-out for each device through which you access our Services.
If you receive email from us, we may use certain analytics tools, such as tracking pixels, to capture data such as when you open our message or click on any links or banners our email contains. This data allows us to gauge the effectiveness of our communications and marketing campaigns.
Session Replay Technology. We may use session recording and replay technology to observe your mouse movements, scrolling, and clicks on our Site. We use these tracking tools on the basis of our legitimate interest in providing support, conducting analytics, and understanding how visitors engage with our Site. Form inputs containing payment details or passwords are masked and not captured. This information is often collected and processed by our Service Providers who we have engaged to analyze this information on our behalf.
Online Advertising. For more information about tailored advertising and how you can generally control the cookies being placed on your device to deliver tailored advertising, please visit the Network Advertising Initiative’s Consumer Opt-Out link, or the Digital Advertising Alliance’s Consumer Opt-Out link or Your Online Choices to opt out of receiving tailored advertising from companies that participate in those programs.
THIRD PARTY WEBSITES
The Services may link to third-party websites. We do not control, recommend, or endorse such websites. We are not responsible for and make no representations about such websites or their content, services, or practices. This Privacy Notice does not govern any third-party websites. Thus, we encourage you to review the privacy policies of any third-party websites you choose to visit to understand how those websites collect, use, and share your personal data.
INTERNATIONAL TRANSFERS
The personal data that we collect from you may be transferred to, and stored at, a destination outside the UK, the EEA, or Switzerland. It may also be processed by personnel operating outside these jurisdictions who work for us or for one of our suppliers. Such personnel may be involved in activities including, but not limited to, fulfilling your order, processing your payment details, and providing support services.
Where we transfer your personal data outside the UK, the EEA, or Switzerland, we take appropriate steps to ensure that your data is treated securely and in accordance with applicable data protection laws. These safeguards may include the use of standard contractual clauses approved by the European Commission, the UK International Data Transfer Agreement or Addendum, or equivalent safeguards recognized under the Swiss Federal Act on Data Protection (FADP). For transfers from Switzerland, we ensure compliance with the requirements of the FADP and any guidance issued by the Federal Data Protection and Information Commissioner (FDPIC), including reliance on the European Commission's adequacy decisions as recognized by Switzerland where applicable. We will ensure that any such transfer is subject to an adequate level of protection consistent with your rights and freedoms.
DATA SECURITY
ZO maintains appropriate security measures (including physical, electronic, and procedural measures) to help safeguard your personal data. However, we cannot guarantee the security of such personal data because no security measures are perfect. We are not responsible for third-party circumvention of any of our privacy settings or security measures.
You can also take steps to safeguard your personal data. If you create an account on our Site, you will be required to select a password which should be kept confidential and be of appropriate complexity. You should also limit access to your devices and accounts to avoid unwanted access to your personal data. For example, you should always log out of your account after using it on a shared devic
DATA RETENTION
We will retain your personal data only for as long as is reasonably necessary to fulfill the purposes for which it was collected, as outlined in this Privacy Notice, or as required to comply with legal, regulatory, tax, accounting, or reporting obligations. In general, we apply the following retention criteria: (a) account and profile information is retained for the duration of your account and for up to three years following account closure or your last interaction with us; (b) transaction and order records are retained for seven years to comply with applicable tax and accounting obligations; (c) marketing preferences and consent records are retained for as long as they remain relevant to demonstrate compliance with applicable law; and (d) cookies and similar tracking data are retained in accordance with the retention periods set out in our. Where processing is based on your consent, we will cease processing and delete the relevant personal data upon withdrawal of your consent, unless continued retention is required by law.
In accordance with our internal retention policies and applicable legal requirements, we may delete or anonymize records containing personal data when they are no longer necessary for the purposes for which they were collected. We are not obligated to retain your personal data indefinitely and disclaim any liability arising from or related to the deletion of such data in accordance with applicable laws and our retention practices.
YOUR RIGHTS
Subject to certain exemptions, and in some cases dependent upon the processing activity we are undertaking, you have certain rights in relation to your personal data. We may ask you for additional information to confirm your identity and for security purposes, before disclosing the personal data requested to you. We reserve the right to charge a fee where permitted by law if your request is manifestly unfounded or excessive.
You can exercise your rights through any reasonable means, including by completing our request form at privacy@zoskinhealth.com. Subject to legal and other permissible considerations, we will make every reasonable effort to honor your request promptly or inform you if we require further information in order to fulfill your request in compliance with applicable law. We will respond to your request in the language required by applicable law.
We may not always be able to fully address your request, if, for example, it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.
Right to Access Personal Data
You have a right to request that we provide you with a copy of your personal data that we hold and you have the right to be informed of: (a) the source of your personal data; (b) the purposes, legal basis, and methods of processing; (c) the data controller’s identity; and (d) the entities or categories of entities to whom your personal data may be transferred.
Right to Rectify or Erase Personal Data
You have a right to request that we rectify inaccurate personal data. We may seek to verify the accuracy of the personal data before rectifying it. You can also request that we erase your personal data in limited circumstances where:
- It is no longer needed for the purposes for which it was collected.
- You have withdrawn your consent (where the processing was based on consent), and where there is no other legal ground for the processing.
- Following a successful right to object (see right to object).
- It has been processed unlawfully.
- To comply with a legal obligation to which ZO is subject.
We are not required to comply with your request to erase personal data if the processing of your personal data is necessary for compliance with a legal obligation; for the establishment, exercise or defense of legal claims; or for the performance of a contract.
Right to Restrict the Processing of Your Personal Data
You can ask us to restrict your personal data, where:
- Its accuracy is contested, to allow us to verify its accuracy
- The processing is unlawful, but you do not want it erased
- It is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise, or defend legal claims
- You have exercised the right to object, and verification of overriding grounds is pending
We can continue to use your personal data following a request for restriction where we have your consent; to establish, exercise, or defend legal claims; or to protect the rights of another natural or legal person.
Right to Transfer Your Personal Data
You can ask us to provide your personal data to you in a structured, commonly used, machine-readable format, or you can ask to have it transferred directly to another data controller, where the processing is based on your consent or on the performance of a contract with you; and the processing is carried out by automated means.
Right to Object to the Processing of Your Personal Data
You can object to any processing of your personal data which has our legitimate interests as its legal basis, if you believe your fundamental rights and freedoms outweigh our legitimate interests. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms.
Right to Object to How We Use Your Personal Data for Direct Marketing Purposes
You can request that we change the way we contact you for marketing purposes.
Right to Obtain a Copy of Personal Data Safeguards Used for Transfers Outside Your Jurisdiction
You can ask to obtain a copy of, or reference to, the safeguards under which your personal data is transferred outside of the UK or EEA. We may redact data transfer agreements to protect commercial terms.
Right to Lodge a Complaint with Your Local Supervisory Authority
If you have concerns about our use of your personal data, you have a right to make a complaint to the data protection regulator in your country. Relevant supervisory authorities for the jurisdictions in which we operate include: the Information Commissioner's Office (ICO) in the United Kingdom; the Autoriteit Persoonsgegevens (AP) in the Netherlands; the Commission Nationale de l'Informatique et des Libertés (CNIL) in France; the Datatilsynet in Norway; the Agencia Española de Protección de Datos (AEPD) in Spain; the Garante per la protezione dei dati personali in Italy; and the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland.
________________________________________
YOUR CHOICES
We provide several ways for you to exercise control over how we use personal data about you and how we communicate with you as described below.
Marketing Emails. Consistent with your choices and in compliance with applicable law, we may send you marketing and promotional emails. You may opt out of these emails by (a) by clicking unsubscribe at the bottom of our marketing emails, or (b) by writing to us at privacy@zoskinhealth.com. We will promptly process your opt-out request. You will still receive transactional communications from us.
Social Media. To control the personal data you share with us when you follow us, like our posts, or otherwise interact with us on social media, you can adjust your social media account settings related to how your personal data is shared.
CHILDREN
Our Services are not directed to or intended for children. We do not knowingly collect personal data from children without permission from a parent or legal guardian. In the UK, EEA, and Switzerland, the minimum age at which a child may provide consent to the processing of their personal data varies by jurisdiction (for example, 13 in the UK and Norway, 14 in Italy and Spain, 15 in France, and 16 in the Netherlands). We do not knowingly process personal data of children below the applicable age of digital consent without verifiable parental consent.
You must be at least 18 years old to provide us with your personal data and 18 years old to engage in transactions on the Site. By engaging in transactions with us, you affirm that you are at least 18 years old and are fully able to enter into and be legally bound by such transactions.
CHANGES TO THIS PRIVACY NOTICE
We will occasionally update this Privacy Notice. When we post changes to this Privacy Notice, we will revise the “Last Updated” date at the top of this Privacy Notice and, if applicable, notify you as required by applicable law. Please note, we may change information on the Site and/or this Privacy Notice at any time, and any such changes will be effective upon posting. We recommend that you check our Site from time to time to inform yourself of any changes in this Privacy Notice.
CONTACT US
If you have any questions or concerns about how we process and use your personal data or would like to exercise any of your privacy rights, you may contact us at the following details:
By email to privacy@zoskinhealth.com
By phone at 1 (888) 893-1375
By mail to 9685 Research Drive
Irvine, CA 92618
USA