Aesthetix Activate Security Controls Attestation

Version 2026.11.1. Published at aesthetixcrm.com/activate-attestation. Incorporated by reference into each Aesthetix Activate Order Form.

Aesthetix CRM LLC, 2541 N Pleasantburg Dr, Ste 338, Greenville, South Carolina 29609

Security Controls Attestation (HIPAA-Aligned): Aesthetix Activate Environment

The information below is complete and accurate to the best of my knowledge as of the Attestation Date. Aesthetix CRM LLC (“BA”) makes this attestation to each Covered Entity that enrolls in Aesthetix Activate, regarding the security program and controls applicable to Protected Health Information (“PHI”) processed through Activate. Capitalized terms have the meanings given in the Aesthetix Activate Business Associate Agreement Addendum (the “Addendum”).

1. The BA has sufficient physical, technical, and administrative controls on the privacy and security of PHI (as defined under 45 CFR 164) and other Personally Identifiable Information processed through Activate;

2. The BA delivers Activate through Data Infrastructure Providers (CorralData, Inc. and its downstream data pipeline provider Fivetran, Inc., together with the hosting, content delivery, and model subcontractors disclosed at aesthetixcrm.com/sub-processors) and maintains a Business Associate Agreement with CorralData, which in turn maintains Business Associate Agreements with its downstream subcontractors;

3. The Activate environment and all stored PHI, including backups, are hosted in data centers in the United States, with remote support access by authorized personnel under the contractual safeguards described in Section 4(c) of the Addendum. Encryption at rest (AES-256 or equivalent) and encryption in transit (TLS 1.2 or higher), logical segregation of each Covered Entity’s data, role-based access control with multi-factor authentication for administrative access, and access logging are provided through the Data Infrastructure Provider stack, and an independent security assessment of that stack (SOC 2 Type I, then Type II) will be obtained upon issuance and renewed annually thereafter;

4. Extraction from a Covered Entity’s EMR system is limited to the Activate Data Set described in the Addendum, and PHI in the Activate environment is not used to train or improve any artificial intelligence or machine learning model for the benefit of any party other than the Covered Entity;

5. Each Covered Entity is responsible for enabling multi-factor authentication on the external email provider used for login and account recovery for all users with access to PHI, and for administering user access to Activate dashboards and reports;

6. The individual signing this Attestation on behalf of the BA is the Chief Executive Officer or another individual of similar seniority.

This Attestation describes controls as of the Attestation Date. It is not a substitute for, and does not pass through, any Data Infrastructure Provider’s own audit report, which remains subject to that provider’s confidentiality terms. The BA will publish a revised version when a material control changes.

Name: William E. Dunn

Title: Chief Executive Officer, Aesthetix CRM LLC

Signature: Signed by electronic signature. The signed copy is linked above.

Attestation Date: November 12, 2026