PRIVACY POLICY

Supplement Technology Inc, a Delaware corporation with its principal place of business in Boulder, Colorado, USA ("Personally," "we," "us," or "our"), provides personalized dietary supplement products and related services directly to consumers. Personally is a subsidiary of Supplement Technology Limited, a company incorporated in England and Wales. Supplement Technology Limited does not provide products or services to consumers and assumes no customer-facing obligations. All products, services, and customer relationships are provided exclusively by Supplement Technology Inc, which is the party responsible for your personal information. Your information is stored in the United States; certain connected-device data is processed by our integration partner outside the United States before being delivered to our U.S. systems, as described in Sections 9 and 11.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, complete our health questionnaire, use our mobile applications (including the Personally Apple Health companion app), or purchase our personalized supplement products.

Where we operate. Our products and services are offered only in the U.S. states listed as "Available States" in our Terms of Service (Section 2.1); that list is also shown during checkout and may change over time. We do not knowingly market to, sell to, or collect personal information from consumers outside those states in connection with a purchase. We do not currently operate in every U.S. state — for example, we do not offer our services in California, Connecticut, Maryland, Nevada, or Washington at this time. References in this policy to your rights under specific state laws apply to residents of the states where those laws are in force and apply to us.

How your formulation is generated. Your personalized supplement formulation is produced by a rules-based, deterministic software engine. The same inputs always produce the same formulation. We do not use machine learning, model training, artificial-intelligence profiling, or any external "large language model" or hosted AI service to generate your recommendation, and your health information is not used to train or improve any AI model. Your formulation is generated by automated means; a human does not review each individual formulation before it ships, although the clinical rules and dosage thresholds behind the engine are governed by our medical team.

Important notice. We do not provide medical advice, diagnosis, or treatment, and our products are not intended to diagnose, treat, cure, or prevent any disease. The health information you provide is used solely to personalize your supplement formulation based on your stated goals and preferences.

By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy. Privacy disputes are governed by the dispute resolution provisions in our Terms of Service.

• Identity Information : full name, date of birth, gender.
• Contact Information : email address, telephone number, postal address (billing and shipping).
• Account Information : username and password, account and communication preferences.
• Payment Information : payment card details (processed by our payment processor, Stripe; we do not store complete card numbers), billing address, and transaction history.

To create your personalized supplement formulation, we collect health-related information through our questionnaire and, where you choose to provide it, from connected devices and applications (see Section 9). We collect this information only after you have given your affirmative, opt-in consent, and we use it solely to create and adjust your formulation and to provide the services you request.

• Lifestyle data : diet and nutrition habits, exercise frequency and type, sleep patterns, stress levels, alcohol and caffeine consumption, smoking status.
• Health history : current medications and supplements, known allergies and sensitivities, medical conditions you disclose, and (optionally) family health history.
• Biometric data : height and weight, and other biomarkers you choose to share.
• Health goals : wellness objectives and areas of concern (for example: metabolic, cardiovascular, cognitive, mood, immune, hormonal, joint health, longevity).

We do not currently collect blood or laboratory marker data, and no feature for submitting blood work is available at this time. If we introduce blood-marker collection in the future, we will update this policy and obtain your consent before collecting that information.

This information constitutes "sensitive data" (or "sensitive personal information") under the comprehensive consumer privacy laws of the states where we operate — including, for example, the Colorado Privacy Act, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act, and the Virginia Consumer Data Protection Act — and health information under the Texas Medical Privacy Act. We process it only with your consent and only for the purposes described here.

When you access our website or applications, we automatically collect:

• Device information : device type and operating system, browser type and version, and unique device identifiers.
• Usage information : pages visited and time spent, features used, referring URLs, and clickstream data. On quiz and account sessions we may also record UTM and click identifiers used to understand how you reached us.
• IP address and general location : your IP address and the general geographic region (country, region, city) derived from it.

When you provide a shipping or billing address, we convert that address into geographic coordinates (latitude and longitude) using a third-party geocoding service (Google Places) so that we can validate the address, calculate tax, and confirm eligibility for delivery in the states we serve. These coordinates are derived from the address you give us. We do not collect GPS location from your device, we do not infer precise location from your IP address, and we do not use geofencing to identify or track you based on your proximity to any location, including healthcare facilities.

See Section 5 for details on cookies and tracking technologies and how you can control them.

• Product personalization : analyzing your questionnaire responses and health data, and generating and monthly-adjusting your personalized supplement formulation using our deterministic engine.
• Order fulfillment : processing and shipping your subscription orders, managing your account and subscription preferences, and providing customer support.
• Communication : sending order confirmations, shipping notifications, and the monthly Pre-Manufacturing Notice required by our Terms of Service; responding to your inquiries; and sending service-related announcements.

• Marketing communications : promotional emails, educational content, and offers. You may opt out at any time using the unsubscribe link in any email or by contacting us. We do not use your health information — or any attribute derived from your health information — to target, segment, or personalize marketing. See Section 4.4.
• Product improvement : de-identified and aggregated analysis to improve our engine and services. We do not use identifiable health information for marketing analytics.

We rely on your affirmative, opt-in consent to collect and process your health information, and we obtain that consent before collection. We process other personal information as necessary to perform our contract with you, to comply with law, and for limited legitimate purposes such as fraud prevention and security. You may withdraw your consent at any time (see Sections 8 and 14); withdrawal does not affect processing carried out before withdrawal.

We share information with third-party service providers who process it on our behalf, under contracts that require them to protect it and to use it only to provide services to us:

• Manufacturing : our Boulder, Colorado facility receives only the information needed to produce and ship your formulation (formulation specifications and shipping address).
• Payment processing : Stripe processes payments; we do not store complete card details.
• Order and shipment processing : Stripe processes payment and subscription data; ShipStation processes order and shipment data on our behalf for fulfillment; account data is stored in our own systems.
• Shipping carriers : receive name and address for delivery only.
• Technology providers : cloud hosting and database providers (Supabase), and email/communications providers.
• Connected-device integration : if you connect a wearable or Apple Health, our integration partner Terra collects and processes that data and delivers it to us (see Section 9).

Where a service provider may access health-related information, we require contractual protections that impose confidentiality obligations and restrict use of the data to the services provided to us.

We may disclose information to comply with law, respond to lawful requests from public authorities, comply with court orders or legal process, enforce our Terms of Service, or protect the rights, safety, or property of Personally, our users, or others.

In a merger, acquisition, financing, or sale of assets, information may be transferred as part of the transaction. We will notify you of any such change and of any choices you may have.

• We do not sell your personal information : for money or other valuable consideration.
• We do not share your personal information for "targeted advertising" or "cross-context behavioral advertising" as those terms are defined under applicable state law.
• We do not disclose your health information to any third party for that party's own marketing, advertising, or data-brokering purposes.

For residents of states where these rights apply (including Colorado, Texas, Oregon, Virginia, and the other states where we operate): in the preceding twelve months we have not sold personal information and have not processed it for targeted advertising as defined under applicable state law

• Strictly necessary : required for the site to function (session management, cart, security). These cannot be disabled.
• Functional : remember your settings and preferences.
• Analytics : help us understand how our services are used.
• Marketing : used, only with your consent, to measure and personalize advertising on other platforms.

Before any non-essential cookie or tracking technology (including analytics and marketing pixels) is set or activated, we present a consent banner and preference center that let you accept or reject each category. We do not fire analytics or marketing tracking technologies on our health questionnaire or account check-in pages, and we do not enable non-essential tracking until you have consented. You can change your choices at any time through the preference center (linked in our website footer) or your browser settings.

We honor the Global Privacy Control (GPC) signal and browser "Do Not Track" signals as an opt-out of sale/targeted advertising where required by law.

We retain information only as long as necessary for the purposes described in this policy, unless a longer period is required by law or requested by you:

Upon request or at the end of the applicable period, we securely delete or de-identify your information unless retention is required by law.

Regardless of where you live, you may:

• Access a copy of the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Delete your personal information, subject to legal retention requirements;
• Withdraw consent to the processing of your health information; and
• Opt out of marketing communications at any time.

If you are a resident of a U.S. state that has a comprehensive consumer data privacy law granting these rights — which, among the states we serve, currently includes Colorado, Delaware, Indiana, Iowa, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia — you have the following rights under your state's law:

• Right to confirm and access the personal data we process about you;
• Right to correct inaccuracies;
• Right to delete personal data you provided or we obtained;
• Right to a portable copy of your data in a usable format;
• Right to opt out of the sale of personal data, targeted advertising, and profiling with legal or similarly significant effects (as noted above, we do not sell data or conduct targeted advertising);
• Right to opt-in consent before we process your sensitive/health data — which we always obtain; and
• Right to appeal a denial of a privacy request.

Residents of Oregon and Minnesota may also request a list of the specific third parties (not just categories) to which we have disclosed personal data. We honor verifiable requests submitted as described in Section 14, and we will respond to your appeal in writing.

If you are a Texas resident, you have rights under the Texas Medical Privacy Act (Texas Health and Safety Code Chapter 181) regarding your health information. We will not disclose your health information without your authorization except as permitted by law, and you may request access to and correction of your health information, receive notice of our privacy practices, and file a complaint.

We will not deny services, charge different prices, or provide a different level of service because you exercised a privacy right.

We are a dietary supplement manufacturer, not a healthcare provider, health plan, or healthcare clearinghouse. We are not a HIPAA covered entity or business associate, and nothing in this policy is a HIPAA Notice of Privacy Practices. Because the information you share is sensitive, we have voluntarily adopted enhanced protections:

• Minimum necessary : we access, use, and disclose only the health information needed for the purpose at hand.
• Access controls : health data is accessible only to personnel who need it for their role, with authentication and activity logging.
• Segregation from marketing : your health information, and any attribute derived from it, is walled off from our marketing and advertising tools and vendors.
• Vendor safeguards : service providers with any access to health information are contractually bound to confidentiality and use limitations.
• Consent-first : we collect health information only after your opt-in consent, and you may withdraw it at any time.

Our services can, if you choose, use information from a wearable device or a connected health application to help personalize your formulation. Connection is optional and requires your explicit authorization; we collect this data only if you connect a device or app, and only the categories you authorize. If you do not connect a device, no connected-device data is collected.

Our integration partner (Terra). Connected-device data is collected and processed on our behalf by Terra (Terra Enabling Developers Ltd), which normalizes it and delivers it to our systems in the United States. Terra acts as our service provider and processor under a Data Processing Addendum; for certain device-connection steps Terra may act as an independent controller. Terra maintains SOC 2 Type II and ISO 27001 certifications and engages its own service providers; a current list of Terra's sub-processors is available from us on request.

• Wearable integrations (Garmin, Oura, Google, and others) : If you connect a wearable or connected account, we receive activity, sleep, heart, and body-related measurements through Terra to personalize your formulation.
• Apple Health : Following App Store approval of our Apple Health companion app, if you grant permission we read the health and activity categories you approve from Apple Health; these are delivered to us through Terra in the same way. Apple Health data is governed by a separate Apple Health App Privacy Notice, which controls in the event of any conflict for that data.

Where this data is processed.Terra's primary processing facilities are in the United Kingdom, so your connected-device data may be processed in the United Kingdom and the United States. These transfers are made under the European Standard Contractual Clauses and the UK International Data Transfer Addendum (see Section 11).

Deletion. When you disconnect a device or delete your account, we promptly delete the connected-device data held in our systems and instruct Terra to delete its copy; under our agreement, Terra deletes its copy within 90 days of our request, except where retention is required by law.

Use limits. We use connected-device data only to personalize your formulation. It is never used for advertising or marketing, is never sold, and is never shared with any third party for that party's own advertising, marketing, or data-mining purposes.

We implement reasonable and appropriate administrative, physical, and technical safeguards, including:

• TLS/SSL encryption in transit and AES-256 encryption at rest;
• multi-factor authentication and role-based access controls;
• automatic session timeout, audit logging, and monitoring;
• regular security assessments and patching; and
• employee confidentiality agreements and training.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Breach notification. If a breach affects your personal information, we will notify affected individuals and the relevant authorities as required by applicable state law and the FTC Health Breach Notification Rule, and will describe the nature of the incident, the data involved, and the steps we are taking.

Your personal information is stored in the United States. Our primary database is hosted in U.S. regions.

The one exception is connected-device data: if you connect a wearable or Apple Health, that data is processed by our integration partner Terra, whose primary processing facilities are in the United Kingdom, before it is delivered to our systems in the United States (see Section 9). These transfers are protected by the European Standard Contractual Clauses and the UK International Data Transfer Addendum. Apart from this connected-device processing, we do not transfer consumer personal information outside the United States.

Our services are for adults only. You must be at least 18 years old to use our services. We do not knowingly collect personal information from anyone under 18, and our product enforces this age requirement at sign-up and in the formulation engine. If you believe a person under 18 has provided us information, contact us and we will delete it.

Our website may link to third-party sites we do not control. We are not responsible for their privacy practices and encourage you to read their policies.

To exercise any right, or to withdraw consent, contact us:

• Email : [email protected]
• Post : Privacy Officer, Supplement Technology Inc, 4699 Nautilus Crt, Unit 504, Boulder, CO 80301
• Website : submit a request through your account settings.

Verification To protect your information, we will verify your identity (for example, by confirming your account email and an order or account identifier) before acting on a request. Authorized agents may submit requests with proof of authorization. Response times: we respond within the period required by your state's law (generally 45 days, extendable once where permitted), and we will tell you if we need more time. If we deny a request, you may appeal by replying to our decision or contacting the Privacy Officer.

We may update this policy to reflect changes in our practices or the law. We will update the "Last Updated" date and, for material changes, provide notice by email or a prominent website notice, and obtain your consent where required.

Privacy Officer — Supplement Technology Inc
Email: [email protected]
Phone: (720) 350 0429
Address: 4699 Nautilus Crt, Unit 504, Boulder, CO 80301

Complaints. If you are not satisfied with our response, you may contact your state's Attorney General or consumer-protection authority — for example, the Colorado Attorney General (coag.gov), the Office of the Texas Attorney General (texasattorneygeneral.gov), the Oregon Department of Justice (doj.oregon.gov), or the Virginia Attorney General (oag.state.va.us). You may also contact the U.S. Federal Trade Commission (ftc.gov).

Categories of personal data we collect: identifiers (name, email, address, IP, device IDs); account records; protected characteristics (age, gender); commercial/transaction information; internet and device activity; address-derived location; and sensitive data consisting of health information (lifestyle, health history, biometric measurements, health goals) and, if you connect them, wearable/connected-app health measurements.

Sources: directly from you; automatically from your use of our services; and, if you connect them, from your wearable device or connected health app.

Purposes: to provide and personalize our supplement products and services, fulfill orders, communicate with you, maintain security, and comply with law.

Sensitive data: processed only with your opt-in consent, solely to personalize your formulation.

Sale / targeted advertising / profiling: we do not sell personal data, do not process it for targeted advertising, and do not conduct profiling that produces legal or similarly significant effects.

Retention: as described in Section 6.

Your rights and how to exercise them: as described in Sections 7 and 14, including the right to appeal.