Privacy Policy

Effective Date: January 1, 2026
Last Updated: March 12, 2026

Healthara Inc., together with its subsidiaries and affiliates (collectively, “Healthara,” “Company,” “us,” “we,” or “our”) is committed to protecting the privacy of Personal Data (i.e., information reasonably related to a specific individual). This Privacy Policy describes how we process Personal Data collected through our websites, social media accounts, mobile applications, and other online interactions and communications such as email (collectively, our “Digital Properties”); in-person events and purchases; and other online and offline interactions.

This Privacy Policy applies to information we collect about individual consumers, such as general website visitors, customers, and users of our Services (“Individuals”) as well as information we collect about the personnel of our business partners, including vendors and business customers, in business-to-business interactions (“Business Contacts”). However, this Privacy Policy does not apply to:

• Information about our current or former employees, applicants, and other individuals who interact with us for employment-related purposes; or

• Protected health information subject to the Health Insurance Portability and Accountability Act to the extent maintained by third-party healthcare providers or other regulated entities subject to separate privacy notices.

Whenever you interact with us on behalf of another individual or entity, such as if you upload another person’s information or refer another person to us, you must obtain their consent (or have the legal authority without consent) to share their Personal Data with us.

By accessing or using our Digital Properties or Services, you acknowledge that you have read and understand this Privacy Policy. If you do not agree with this Privacy Policy, do not use our Services.

Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy at any time. Any updated Privacy Policy will be effective when posted. Please check this Privacy Policy periodically for updates. If required by law, we will obtain your consent or contact you directly if there are material changes to this Privacy Policy.

We will not make retroactive changes that reduce your privacy rights unless we are legally required to do so. Your continued use of our Services after we make changes shall constitute your acceptance of those changes.

Healthara may provide you with notices, including those regarding changes to this Privacy Policy, using any reasonable means now known or hereafter developed, including by email, regular mail, SMS, MMS, text message, or postings on the Website, Platform, or other Digital Properties. You agree that you are deemed to have received any and all notices sent to the contact information you have provided or otherwise posted through the Services.

1. Sources of Personal Data

We collect Personal Data about you from the following sources:

Directly from you. We may collect Personal Data you provide to us directly, such as when you contact us through our Digital Properties, interact with us in person, sign up for offers or newsletters, communicate with us, place or customize orders, purchase a product or service, upload files or reports, sign up for an account, or otherwise use our Services.

Data collected automatically and through Cookies. We may automatically collect information or inferences about you, such as through cookies, pixels, tags, scripts, SDKs, session replay tools, and other technologies (collectively, “Cookies”), when you interact with our Digital Properties. This may include information about how you use and interact with our Digital Properties, information about your device, and internet usage information.

From third parties. We may collect Personal Data from third parties, such as service and content providers, our affiliated companies and subsidiaries, business partners, laboratory partners, wearable and digital health integration partners, analytics providers, payment processors, social media companies, and other parties who interact with us.

From publicly available sources. We may collect Personal Data about you from publicly available sources, such as public profiles and websites.

We may combine information that we receive from the various sources described in this Privacy Policy, including third-party sources, and use or disclose the combined information for the purposes identified below.

2. Types of Personal Data We Collect

We may collect the following types of Personal Data about you. Except as otherwise specified, we may collect this Personal Data from both Individuals and Business Contacts:

Identifiers, such as your name, email address, physical address, telephone number, business contact information, account identifiers, and device identifiers (e.g., cookie IDs and IP address).

Records about you, such as signatures; physical characteristics or a description of you; the content, timing, and method of communications you have with us, such as online chats (including our AI-powered chat and support interactions), calls, and emails; and information you share with or upload to our Digital Properties, such as reviews, comments, files, forms, reports, or messages.

Demographic information, such as age (including birthdates) and gender.

Commercial information, such as information related to your transactions; products or services purchased, obtained, or considered; subscription information; billing and payment records; or other purchasing or consuming histories or tendencies.

Biometric information, where applicable and if enabled by you or your device, such as biometric-related device inputs or scans.

Internet or other electronic network activity information, such as your browsing history, search history, preference information (including marketing and purchasing preferences), account settings (including any default preferences), and other information regarding your interactions with and use of the Digital Properties. For more information about Cookies, please see Section 6.

Non-precise geolocation data, such as your location as derived from your IP address.

Audio, electronic, visual, or other sensory information, such as photographs, uploaded images, recordings, or other content you submit.

Professional or employment-related information (for Business Contacts), such as job title, organization, professional licenses, credentials, affiliations, and other professional information.

Education information (for Business Contacts), where provided by you or otherwise lawfully obtained.

Inferences drawn from any of the information we collect about your preferences or behavior, including to assess the level of interest in our products and services based on frequency of visits and contact, determine your preferred frequency for receiving offers, or personalize your use of the Services.

Sensitive Personal Data, including the following where applicable and as permitted by law:

• Account log-in information

• Precise geolocation, such as location based on device GPS, where enabled by you

• Genetic data

• Biometric data processed for the purpose of uniquely identifying you

• Information about your health, including health records, uploaded medical documents, laboratory reports, biomarker results, health and fitness data from Apple Health, Apple Watch, Oura Ring, other fitness trackers and wearables, and similar integrations, if you choose to connect or upload them

• Information you provide about lifestyle, symptoms, supplements, recovery, wellness, and related health matters

For purposes of this Privacy Policy, we may refer to health-related, wearable-related, biomarker-related, and genetic-related information collectively as “Health Information” or “Healthcare Information” where appropriate.

3. Genetic Data and Sensitive Health Information

Healthara may offer products or services that allow you to upload, connect, submit, or authorize access to genetic data and other sensitive health information.

This information may include:

• Genetic test reports or raw DNA data files you upload

• Genetic results or reports received from a laboratory partner that you authorize us to access

• Biomarker results or similar wellness-related lab data, if and when made available through the Services

• Health records, medical documents, or wellness reports you upload

• Health and fitness information from connected devices or platforms

• Lifestyle and questionnaire data you choose to provide

Submission of genetic data and other sensitive health information is voluntary. If you choose not to provide such information, some features of the Services may not be available or may function in a limited way.

Consent to Genetic Data Processing

Genetic data is considered sensitive personal information. Healthara processes genetic data only with your explicit consent.

Where applicable, you will be asked to provide consent during checkout, activation, upload, or connection of genetic-related Services, including by confirming the following:

☐ I consent to Healthara accessing and analyzing my genetic data as described in the Privacy Policy.

By providing this consent, you authorize Healthara to access, store, process, analyze, and use your genetic data and related Health Information in order to provide personalized health insights, recommendations, protocols, product features, and related Services as described in this Privacy Policy.

You may withdraw your consent at any time by contacting us or through your account settings where available. Withdrawal of consent may limit or disable certain features of the Services.

4. How We Use Personal Data

We may use Personal Data for the following purposes:

To provide you or your company products and services, such as making our Digital Properties and other products and services available to you; registering, verifying, and maintaining your account with us; providing and delivering you the goods and services you request; providing customer service; processing or fulfilling orders and transactions (including processing payments); verifying customer information and eligibility for certain programs or benefits; communicating with you (including soliciting feedback or responding to requests, complaints, and inquiries); hosting informational webinars; and providing similar services or otherwise facilitating your relationship with us.

To provide personalized features and health-related insights, such as generating recommendations, protocols, educational content, summaries, wellness suggestions, or similar outputs based on the information you provide or connect, including genetic data, wearable data, biomarker data, lifestyle data, or questionnaire responses.

For our internal business purposes, such as day-to-day operation of our business; maintaining internal business records, such as accounting, document management, and similar activities; enforcing our policies and rules; management reporting; auditing; IT security and administration; and maintaining the safety, functionality, and integrity of our Digital Properties.

For our internal research and product improvement purposes, such as verifying or maintaining the quality or safety of our products or services; improving our products or services; designing new products and services; evaluating the effectiveness of our advertising or marketing efforts; debugging and repairing errors with our systems, networks, and equipment; and improving our automated systems, models, and personalization features in a manner consistent with this Privacy Policy and applicable law.

For legal, safety, or security reasons, such as complying with legal, reporting, and similar requirements; investigating and responding to claims against us, our personnel, and our customers; for the establishment, exercise, or defense of legal claims; protecting our, your, our customers’, and other third parties’ safety, property, or rights; detecting, preventing, and responding to security incidents and health and safety issues; and protecting against malicious, deceptive, fraudulent, or illegal activity.

In connection with a corporate transaction, such as if we acquire assets of another business, or sell or transfer all or a portion of our business or assets including through a sale in connection with bankruptcy and other forms of corporate change.

For marketing and targeted advertising, such as marketing our products or services or those of our affiliates, business partners, or other third parties. For example, we may use Personal Data we collect to personalize advertising to you; to analyze interactions with us or our Digital Properties; or to send you newsletters, surveys, questionnaires, promotions, or information about events or webinars. You can unsubscribe from our email marketing via the link in the email, by responding “STOP” to the text message where applicable, or by contacting us using the information in Section 10 below.

We may use anonymized, de-identified, or aggregated information for any purpose permitted by law.

We may de-identify your information and use, create, license, disclose, or otherwise process such de-identified information for any business or other purpose not prohibited by applicable law.

5. Artificial Intelligence Data Uses and Disclosures

In addition to the descriptions of how data is collected, used, and disclosed above, we may also collect, use, and disclose data for purposes involving our use of artificial intelligence (“AI”), such as:

Types of Personal Data AI May Process

In addition to the data types listed in Section 2 and depending on how you use our Digital Properties and the features you enable, we may also process the following Personal Data related to AI products and services:

• Messages and other inputs you submit, and files or images you upload

• Audio you choose to submit, and transcripts where available

• Health records, medical documents, laboratory reports, genetic reports, biomarker data, and other health information you choose to upload, input, or connect

• Health and fitness information from third-party sources you choose to connect, subject to your settings and permissions

• Questionnaire responses, preferences, goals, lifestyle inputs, and similar data you provide

How We Use Personal Data Related to AI Services

In addition to the uses described in Section 4, we may also use your Personal Data to provide AI-powered features, generate responses and recommendations, personalize wellness-related content, improve user experience, maintain safety and integrity, analyze usage, and improve our Services.

Healthara personnel, including support personnel and authorized reviewers, may access or review Personal Data to provide the Services, respond to requests, ensure safety, comply with law, monitor system quality, and improve service quality.

How We Disclose Personal Data Related to AI Services

In addition to the disclosures described in Section 6, we may also disclose your Personal Data to the following parties in relation to AI products and services:

• Service Providers, such as those that help us provide AI functionality and related services, including cloud hosting, infrastructure, safety, security, monitoring, storage, analytics, and similar support tools

• Third-party AI providers, such as those that help power an AI-assisted feature on our behalf

Where required by law, we will obtain your explicit permission before sharing Personal Data with third parties, including third-party AI providers.

Important Restriction on Genetic and Biological Data

Notwithstanding anything else in this Privacy Policy, Healthara does not permit third-party AI providers to use your genetic data, biological data, wearable-derived health data, uploaded medical records, or other sensitive health information submitted through the Services to train third-party general-purpose AI models.

Your Choices and Controls

You may choose what Personal Data to submit through our Digital Properties and which integrations to connect. You may revoke permissions or disable certain features through your device settings or within our Digital Properties, as applicable. If an AI-assisted feature requires consent, you may decline consent.

AI-generated outputs are intended for informational and wellness purposes only and are not medical advice, diagnosis, or treatment.

6. Cookies

Our Digital Properties and authorized third parties use Cookies to collect information about you, your device, and how you interact with our Digital Properties. This section contains additional information about:

• The types of Cookies we use and the purposes for which we use them

• The types of information we collect using these technologies

• How we disclose or make information available to others

• Choices you may have regarding these technologies

Types of Cookies

We and the third parties that we authorize may use:

Cookies, which are a type of technology that install a small amount of information on a user’s computer or other device when they visit our Digital Properties.

Pixels, web beacons, and tags, which are types of code or transparent graphics that contain a unique identifier. In addition to the uses described below, these technologies provide information about interactions with our Digital Properties, including communications such as email we may send to you, and help us customize our marketing activities.

Session replay tools, which record your interactions with our Digital Properties, such as how you move throughout our Digital Properties and engage with our webforms.

Embedded scripts and SDKs, which allow us to build and integrate custom experiences on our Digital Properties.

We may use both first-party Cookies, which are set by us, and third-party Cookies, which are set by other parties. Some of the Cookies we use may last solely for your browsing session and are deleted when you close your browser, while others are persistent and stored after you close your browser.

Purposes for Using These Technologies

We and authorized third parties use these technologies for purposes including:

• Personalization

• Improving performance

• Analytics

• Advertising

• Security

Information Collected

These Cookies collect data about you and your device, such as your IP address, location (both approximate and precise, where permitted), cookie ID, device ID, ad ID, operating system, device type, device settings, browser used, browser history, search history, pages viewed, search queries, login information, shopping cart information, information entered into webforms, and information about how you interact with our Digital Properties.

Disclosures of Your Information

We may disclose information to third parties or allow third parties to directly collect information using these Cookies on our Digital Properties, such as social media companies, advertising networks, analytics providers, security providers, and others that help us operate our business and Digital Properties.

Your Choices

You may be able to control how we use Cookies through browser settings, device settings, and other privacy mechanisms. Please be aware that if you disable the use of Cookies, the functionality of our Digital Properties may be negatively impacted, and certain areas or features may not display or work correctly.

We do not currently respond to Do Not Track browser signals or similar mechanisms unless and until a legally required standard applies.

7. How We Disclose Personal Data

We may disclose Personal Data to third parties, including the categories of recipients described below:

Affiliates and subsidiaries, including parent entities, corporate affiliates, subsidiaries, business units, and other companies that share common ownership.

Service providers that work on our behalf to provide the products and services you request or support our relationship with you, such as IT providers, internet service providers, data and web hosting providers, secure cloud storage providers, software service providers, email marketing providers, analytics providers, AI-related service providers, payment processors, and companies that provide business support services, financial administration, or event organization.

Professional consultants, such as accountants, lawyers, financial advisors, and audit firms.

Vendors necessary to complete transactions you request, such as payment processors, shipping companies, and logistics providers.

Laboratory, health data, and integration partners, including partners involved in receiving, processing, transmitting, or making available genetic data, biomarker information, wearable data, or other health-related information at your request or with your authorization.

Law enforcement, government agencies, and other recipients for legal, security, or safety purposes, such as when we share information to comply with law or legal requirements, to enforce or apply our Terms of Service and other agreements or policies, and to protect our, our customers’, or third parties’ safety, property, or rights.

Other entities in connection with a corporate transaction, such as if we acquire assets of another entity, or sell or transfer all or a portion of our business or assets including through a sale in connection with bankruptcy and other forms of corporate change.

Business partners that may use Personal Data for their own purposes, such as:

• Advertisers, ad platforms and networks, and social media platforms

• Third parties whose Cookies we use as described in Section 6

• Commercial data partners to whom we make information available for lawful marketing purposes

• Partners who work with us on promotional opportunities, including co-branded products and services

Where recipients use your Personal Data for their own purposes independently from us, we are not responsible for their privacy practices or personal data processing policies. You should consult the privacy notices of those third-party services for details on their practices.

The public, such as when you have an opportunity to make comments regarding us or our products that we may share with the public, including comments on our blog posts and reviews on our product pages. Any Personal Data in comments, reviews, or other content that you share in public areas of our Digital Properties may be read, collected, or used by other users or the public.

Entities to which you have consented to the disclosure.

We do not sell, share, or otherwise disclose your Personal Information for reasons other than those described in this Privacy Policy, except as permitted by applicable law.

8. Data Security and Data Retention

Although we maintain reasonable security safeguards, no security measures or communications over the Internet can be 100% secure, and we cannot guarantee the security of your information.

Healthara uses technical, administrative, and organizational safeguards designed to protect Personal Data, including sensitive health and genetic information. These measures may include:

• AES-256 encryption for data at rest

• TLS encryption for data in transit

• role-based or limited-access controls

• logging, monitoring, and access management

• storage in secure cloud infrastructure

• secure archival or cold storage environments, including encrypted S3-based storage where applicable

Genetic data, biological data, and other health-related data are subject to enhanced safeguards due to their sensitivity.

Your Personal Data will be retained as long as necessary to fulfill the purposes we have outlined above unless we are required to do otherwise by applicable law. This includes retaining your Personal Data to provide you with the products or services you have requested and interact with you; maintain our business relationship with you; improve our business over time; ensure the ongoing legality, safety, and security of our services and relationships; or otherwise in accordance with our internal retention procedures.

Once you have terminated your relationship with us, we may retain your Personal Data in our systems and records in order to ensure adequate fulfillment of surviving provisions in terminated contracts or for other legitimate business purposes, such as enabling easier future user onboarding, demonstrating our business practices and contractual obligations, complying with legal obligations, resolving disputes, preventing fraud, assisting with investigations, enforcing our agreements, and providing you with information about our products and services if permitted by law.

We reserve the right to retain and use information as necessary to provide our Services, fulfill our business operations, comply with our legal obligations, resolve disputes, and enforce our agreements, subject to applicable law.

9. Children’s Privacy

Our Digital Properties are intended for individuals 18 years of age and older. The Digital Properties are not directed at, marketed to, nor intended for, children under 18 years of age. As a general rule, we do not knowingly collect any information, including Personal Data, from children under 18 years of age.

If you believe that we have inadvertently collected Personal Data from a child under the age of 18, please contact us at the address in Section 10 below, and we will take prompt steps to delete the information.

10. Contact Information

If you have questions regarding this Privacy Policy, please contact us at:

william@healthara.ai

11. Your Rights

You can access, review, update, and change certain account information through our Services. If you have any questions about how to access other Personal Information, or if you would like to correct or delete any Personal Information we collect and maintain, please contact us at billing@healthara.ai. We will accommodate requests as required by law. Otherwise, we will retain a record of your request, and your Personal Information will be maintained in accordance with this Privacy Policy and our retention and deletion policies.

For residents of jurisdictions with applicable privacy rights, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, Washington, and other jurisdictions as applicable, you may have some or all of the following rights:

Right to Know

You may have the right to request that we disclose to you the Personal Information we have collected about you and additional information about our collection, use, disclosure, or sale or sharing of such Personal Information.

Right to Opt Out

You may have the right to opt out of the processing of your Personal Information for purposes of targeted advertising, the sale of Personal Information, or profiling, where applicable by law.

You may submit a request to opt out of the processing of your Healthcare Information by contacting us at billing@healthara.ai with the subject line “Healthcare Data Opt-Out.”

Consent and Opt-In for Processing Personal Information

Where required, we will request your explicit opt-in consent to process Personal Information. You may revoke this consent at any time by contacting us at billing@healthara.ai with the subject line “Personal Information Opt-Out.”

Rights to Access, Correction, Deletion, and Data Portability

You may have the right to:

1. confirm whether we are processing your Personal Information,

2. access that data,

3. correct inaccuracies,

4. delete your Personal Information, and

5. receive your Personal Information in a portable, technically feasible format.

Requests can be made by contacting us at billing@healthara.ai.

Rights Regarding Disclosure of Personal Information to Third Parties

You may request a list of the categories of third parties with whom we share your Personal Information by contacting us at billing@healthara.ai.

Right to Limitation

California residents may have the right to request restrictions on the processing of Personal Information as provided by law. To exercise this right, please contact us at billing@healthara.ai with the subject line “California Right to Limitation.”

Right to Non-Discrimination

We are committed to ensuring that you do not face discrimination for exercising any of your rights under applicable privacy laws. Unless permitted by law, we will not:

• deny you goods or services,

• charge you different prices or rates,

• provide you a different level or quality of goods or services, or

• suggest that you may receive a different price or rate or different level or quality of goods or services.

Responding to Your Requests

We will respond to your request to exercise applicable rights within the time period required by law. In some cases, we may require additional time as permitted by law, depending on the complexity and number of requests.

Verification of Rights Requests

To ensure secure handling of your data rights requests, we may require that requests be submitted from the email address associated with your account or that you provide information sufficient to verify your identity.

You may designate, in writing or through a power of attorney where required, an authorized agent to make requests on your behalf. Before accepting such a request from an agent, we may require the agent to provide proof that you authorized it to act on your behalf, and we may require you to verify your identity directly with us.

12. External Links

Our Digital Properties may contain links to external sites or other online services that we do not control, including those embedded in third-party advertisements or sponsor information. We are not responsible for the privacy practices or data collection policies of such third-party services. You should consult the privacy notices of those third-party services for details on their practices.

13. Jurisdiction and Cross-Border Transfer

We are located in the United States. We may store and process your Personal Information in any country where we have facilities or in which we engage service providers. By using the Services, you understand that your information may be transferred to countries outside of your country of residence, including the United States, which may have data protection rules that are different from those of your country.

14. Supplemental U.S. State Privacy Disclosures

California Shine the Light: If you are a California resident, you may opt out of sharing your Personal Data subject to California Civil Code §1798.83 with third parties for those third parties’ direct marketing purposes by emailing us at billing@healthara.ai.

California Eraser Law: Any California residents under the age of eighteen (18) who have posted content or information on our Digital Properties can request removal by emailing us at billing@healthara.ai, detailing where the content or information is posted, and attesting that you posted it. We will make reasonable, good faith efforts to remove the post from prospective public view or anonymize it so the minor cannot be individually identified to the extent required by applicable law. This removal process cannot ensure complete or comprehensive removal. For instance, third parties may have republished or archived content that we do not control.