Privacy Policy

Summary of Key Points

• We collect the information you give us when you create an account, place an order, subscribe, complete a wellness profile, contact support, or interact with our AI tools; information collected automatically from your device; and information from our payment, shipping, analytics, and advertising partners.
• Some of what you tell us relates to your health goals and wellness interests. We treat that information as consumer health data and give it heightened protection. Section 5 is our consumer health data notice.
• We do not sell your personal information for money. Certain uses of advertising and analytics technologies may qualify as a "sale" or "sharing" under some state privacy laws. You can opt out at any time. See Sections 9 and 11.
• We do not disclose consumer health data to advertising platforms and we do not use it to build advertising audiences. Section 5.4 explains precisely where we draw that line and what ordinary advertising data we do share.
• We configure the Services so that no functional, analytics, or advertising tracking technology is placed on your device before you have had a genuine opportunity to accept or decline it. See Section 8.
• You have rights to access, correct, delete, and port your information, to opt out of targeted advertising, and to appeal a denial. Section 11 explains how to exercise them.
• We honor the Global Privacy Control and other recognized opt-out preference signals.
• Our Services are not directed to children under 13, and we do not knowingly collect their personal information.
• Section 1.3 contains a binding individual arbitration agreement and a class action waiver that apply to disputes about this Privacy Policy and about our handling of personal information. It includes a right to opt out.

Contents

1 Who We Are and What This Policy Covers · 2 Personal Information We Collect · 3 Sources of Personal Information · 4 Sensitive Personal Information · 5 Consumer Health Data Notice · 6 How We Use Personal Information · 7 Legal Bases for Processing · 8 Cookies, Pixels, Session Recording, and Similar Technologies · 9 How We Disclose Personal Information · 10 Retention of Personal Information · 11 Your Privacy Rights and How to Exercise Them · 12 Opt-Out Preference Signals and Do Not Track · 13 Marketing Email and Text Message Communications · 14 Notice of Financial Incentive · 15 Artificial Intelligence Features and Automated Processing · 16 Children's Privacy · 17 Information Security · 18 International Data Transfers · 19 Third-Party Websites, Platforms, and Creators · 20 Job Applicants and Business Contacts · 21 Changes to This Privacy Policy · 22 How to Contact Us · Appendix A State-Specific Disclosures and Rights · Appendix B Categories of Personal Information Collected and Disclosed

1. Who We Are and What This Policy Covers

Truist Life Sciences LLC, a South Carolina limited liability company doing business as The Collection ("The Collection," "we," "us," or "our"), is the controller responsible for the personal information described in this Privacy Policy. We operate an education-first dietary supplement subscription program and the related website, member portal, and digital tools.

This Privacy Policy explains what personal information we collect, why we collect it, who we disclose it to, how long we keep it, and the choices and rights available to you. It applies to the Services identified in the table above. It does not apply to information handled by third parties whose services we link to or embed, which is governed by their own privacy notices.

Where we act as a service provider or processor on behalf of a business partner, that partner's privacy notice governs the information we process on its behalf.

If a specific United States state privacy law grants you rights or protections beyond those described in the main body of this Policy, the applicable provisions of Appendix A control for residents of that state.

1.1 Applicability

Not every privacy law described in this Policy applies to every business, and several apply only above thresholds tied to revenue or to the number of consumers whose data is processed. Where a law described here does not currently apply to us, we describe the corresponding practice or right because we have chosen to extend it as a matter of policy, not because we are conceding that the statute governs us. Extending a practice voluntarily is not an admission that any particular statute applies, and we reserve the right to rely on any applicable exemption, threshold, or exception. This reservation applies equally to the General Data Protection Regulation, the United Kingdom General Data Protection Regulation, and the Swiss Federal Act on Data Protection, which we describe in Section 7 as a matter of policy and not as a concession that any of them governs us. Nothing in this Policy is intended to create a contractual right or a private right of action that the underlying law does not itself provide, and nothing in it waives any exemption available to us.

1.2 Relationship to Our Terms and Conditions

This Privacy Policy is incorporated into our Terms and Conditions, available at thecollectionhealth.com/terms. Where you have accepted the Terms and Conditions, the provisions of those Terms, including the dispute resolution provisions in Section 20, apply to any dispute about this Privacy Policy or about our handling of personal information.

1.3 Dispute Resolution, Arbitration, and Class Action Waiver

THIS SECTION APPLIES TO EVERY USER OF THE SERVICES, WHETHER OR NOT YOU HAVE CREATED AN ACCOUNT, PLACED AN ORDER, OR ENROLLED IN A SUBSCRIPTION. IT REQUIRES MOST DISPUTES ABOUT THIS PRIVACY POLICY AND ABOUT OUR HANDLING OF PERSONAL INFORMATION TO BE RESOLVED BY INDIVIDUAL BINDING ARBITRATION RATHER THAN IN COURT. IT WAIVES YOUR RIGHT TO A JURY TRIAL AND YOUR RIGHT TO PARTICIPATE IN A CLASS, COLLECTIVE, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING. YOU MAY OPT OUT WITHIN THIRTY DAYS AS DESCRIBED BELOW, AND OPTING OUT WILL NOT AFFECT ANY OTHER ASPECT OF YOUR RELATIONSHIP WITH US.

This Section 1.3 stands on its own and does not depend on your acceptance of any other agreement. It applies to any dispute, claim, or controversy arising out of or relating to this Privacy Policy, to our collection, use, disclosure, or retention of personal information, or to any tracking technology operating on the Services, whether based in contract, tort, statute, or any other legal theory.

Informal resolution first. Before starting an arbitration or a court proceeding, the party raising the dispute must send a written Notice of Dispute to the other. You may send yours by email to legal@thecollectionhealth.com, which is sufficient on its own, or by mail to Legal Department, Truist Life Sciences LLC, 103 Tuscany Way, Greer, South Carolina 29650. A Notice is not invalid because it omits an item of information or uses a different format, so long as it identifies you and describes the dispute well enough for us to investigate it, and we will not assert any defect in the form of a Notice as a basis for dismissal. Both parties will negotiate in good faith for sixty days from receipt, during which any applicable limitations period is tolled.

Arbitration. If the dispute is not resolved informally, it will be resolved by final and binding individual arbitration administered by the American Arbitration Association under its Consumer Arbitration Rules then in effect, before a single neutral arbitrator, in Greenville County, South Carolina or in the county of your residence, at your election. This agreement is governed by the Federal Arbitration Act. The procedural terms, cost allocation, coordinated filing protocol, and exceptions set out in Sections 20.3 through 20.8 and 20.11 of our Terms and Conditions apply to arbitration under this Section 1.3 and are incorporated here in full.

Exceptions. Either party may bring an individual action in small claims court, may seek injunctive relief to prevent infringement of intellectual property or unauthorized access to the Services, and may report any matter to a government agency. Claims that applicable law provides may not be arbitrated are excluded.

Your right to opt out. You may opt out of this Section 1.3 by sending written notice within thirty days of the date you first used the Services after this Policy took effect, to Arbitration Opt-Out, Truist Life Sciences LLC, 103 Tuscany Way, Greer, South Carolina 29650, or by email to legal@thecollectionhealth.com with the subject line "Arbitration Opt-Out." Your notice must include your full name, an email address and postal address at which we can reach you, and a clear statement that you wish to opt out. If you opt out, disputes will be resolved in the state and federal courts located in Greenville County, South Carolina. An opt-out under Section 20.9 of our Terms and Conditions also operates as an opt-out under this Section.

2. Personal Information We Collect

The categories of personal information we collect depend on how you interact with us. We do not collect all of the following from every individual.

2.1 Information You Provide Directly

Account and identity information. Name, email address, telephone number, postal and billing addresses, username, password, and account preferences.

Order and transaction information. Products ordered, subscription tier and term, order history, delivery instructions, gift recipient details you supply, returns and refunds, and records of your consent to recurring billing.

Payment information. Payment card and billing details are collected and processed by our payment processors. We receive a tokenized reference, the card brand, the last four digits, and the expiration date. We do not store full payment card numbers on our systems.

Age verification information. Where the law of the state to which a Product is being shipped requires us to verify your age before completing a sale, we collect the information necessary to do so. We use it only for that purpose, we do not use it for marketing, advertising, or any other data collection purpose, and we retain it only for the period required to document compliance.

Wellness profile and product preference information. Information you choose to provide when you build a Personal Profile, complete a product questionnaire, use the Routine Builder, or select products, which may include your age range, biological sex, height and weight, activity level, training or athletic goals, sleep and energy patterns, dietary preferences and restrictions, allergen sensitivities, supplements you currently take, and wellness objectives. This information is subject to Section 5.

Communications and support information. The content of emails, text messages, chat sessions, contact form submissions, product reviews, survey responses, and customer service calls, together with associated metadata. Customer service calls may be recorded or monitored for quality and training purposes where permitted by law and, where required by law, only with notice to you and your consent.

AI tool inputs. The questions, prompts, and information you enter into the AI Supplement Advisor or other AI-assisted features, and the responses generated.

Promotional and partner information. Information you submit through giveaways, referral programs, ambassador or creator applications, and event registrations.

2.2 Information Collected Automatically

When you use the Services, we and our service providers automatically collect: IP address and derived approximate location (typically city or region level); device type, operating system, browser type and language, and screen configuration; unique device, cookie, and advertising identifiers; referring and exit pages; pages and products viewed; search terms entered on our site; clicks, scrolls, cursor movement, and form interaction data captured by analytics and session recording tools, subject to the field-masking commitments in Section 5.4; items added to or removed from a cart; date, time, and duration of visits; and email and text message engagement data such as opens, clicks, and delivery status.

2.3 Information We Do Not Intentionally Collect

We do not ask for and do not want to receive government identification numbers, financial account credentials, biometric identifiers, precise geolocation, medical records, diagnoses, prescription records, insurance information, or information regarding your genetic characteristics. Please do not submit this information to us through any channel, including free-text fields, review submissions, or AI tool prompts. If you do, we will delete it when we identify it, except where retention is required by law.

Adverse event reports are an exception. This Section does not apply to information you provide when reporting an adverse event. An adverse event report may necessarily include a description of symptoms, a diagnosis, or a list of medications you take. We collect that information because we are required to, we use it only to evaluate the event and, where legally required, to report it, and we retain it for the period required by 21 U.S.C. Section 379aa-1. We treat it as consumer health data under Section 5 and we do not use it for any marketing, advertising, or analytics purpose.

3. Sources of Personal Information

• Directly from you, when you create an account, place an order, subscribe, complete a profile, contact us, or otherwise interact with the Services.
• Automatically from your device, through cookies and similar technologies described in Section 8.
• From our service providers, including our e-commerce platform, hosting and content delivery providers, payment processors, fraud prevention services, age verification providers, order fulfillment and logistics partners, shipping carriers, email and text message platforms, analytics providers, and customer support tooling.
• From advertising and social media platforms, which may provide us with aggregate campaign measurement, audience insights, and, where you have interacted with our advertisements or profiles, limited identifiers.
• From marketing partners, creators, and affiliates, when you sign up through their content or a co-branded promotion and they are permitted to share your information with us.
• From publicly available sources, such as public social media content in which you have tagged or mentioned us.

4. Sensitive Personal Information

Several state privacy laws define a category of "sensitive personal information" or "sensitive data" that receives heightened protection. The only category of sensitive information we ordinarily collect is information concerning your health, wellness goals, and physical characteristics, which we collect solely because you have chosen to share it in order to receive product recommendations and education. We also collect account log-in credentials, which are treated as sensitive under California law.

Where the applicable state law requires opt-in consent before processing sensitive data, we obtain that consent before collection. We use sensitive personal information only for the purposes described in Section 6 and only as reasonably necessary to deliver the Services you have requested. When you ask us for a product suggestion or a routine, we necessarily draw conclusions from the goals and characteristics you have given us, because that is the service you have requested. We do not use sensitive personal information for targeted advertising, we do not use it for profiling in furtherance of decisions producing legal or similarly significant effects, we do not sell or share it, and we do not use it to infer characteristics unrelated to the product suggestions and educational content you have asked us for. You may ask us to limit our use of sensitive personal information at any time, and we will honor that request even where the law would not require it, though doing so will disable personalization features. See Section 11 and Appendix A.

5. Consumer Health Data Notice

Consumer Health Data Notice

This Section 5 is our consumer health data privacy notice for the purposes of the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law (SB 370), the Connecticut Data Privacy Act as amended, and any other law that regulates consumer health data. It is incorporated into this Privacy Policy and is also reachable through a separate, clearly labeled link on our homepage that takes you directly to this Section.

5.1 What We Treat as Consumer Health Data

We treat as consumer health data any personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. For us that means: the wellness profile information described in Section 2.1; the health goals, symptoms, conditions, or bodily functions you describe to our AI Supplement Advisor or to customer service; allergen and dietary restriction information; the information contained in an adverse event report; the contents of a completed order or an active subscription, together with any inference we draw from those contents about your health status; and any identifier, including a cookie identifier, device identifier, or IP address, that we have actually associated with information of that kind.

What this does not include. Viewing a general catalog page, category listing page, blog post, or educational article on our website, without more, does not by itself identify your health status, and we do not treat unauthenticated browsing of those pages as consumer health data. Where we do associate browsing activity with a wellness profile, an AI Advisor session, or a completed order, the resulting record is consumer health data and is handled under this Section 5.

5.2 How We Collect Consumer Health Data

We collect consumer health data directly from you when you enter it into a profile, questionnaire, AI tool, review, adverse event report, or support request, and we generate it from your completed orders and order history. We do not purchase consumer health data from data brokers and we do not obtain it from third parties for advertising purposes.

5.3 How We Use Consumer Health Data

• To generate personalized product suggestions, routines, and educational content you have requested.
• To fulfill and support your orders and subscription, including allergen-related customer service.
• To respond to your questions and provide customer support.
• To evaluate and improve the accuracy and safety of our educational tools, using de-identified or aggregated data wherever practicable.
• To comply with legal obligations, including any applicable adverse event reporting and record retention requirements under the Dietary Supplement and Nonprescription Drug Consumer Protection Act.

5.4 How We Share Consumer Health Data

We disclose consumer health data only to processors and service providers that are contractually bound to process it solely on our documented instructions, and only in the following categories: cloud hosting and data storage providers; order fulfillment and shipping providers, to the extent necessary to ship your products; customer support platform providers; the providers of our AI features; and professional advisors, where required. We may also disclose consumer health data where compelled by valid legal process, or to protect against imminent harm.

WE DO NOT SELL CONSUMER HEALTH DATA. WE DO NOT DISCLOSE CONSUMER HEALTH DATA TO ADVERTISING NETWORKS, SOCIAL MEDIA PLATFORMS, DATA BROKERS, OR ANY OTHER PARTY FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING OR TARGETED ADVERTISING. WE DO NOT USE CONSUMER HEALTH DATA TO BUILD OR ENRICH ADVERTISING AUDIENCES, CUSTOM AUDIENCES, OR LOOKALIKE AUDIENCES.

WE HAVE CONFIGURED THE SERVICES SO THAT ADVERTISING AND TARGETING TECHNOLOGIES DO NOT OPERATE ON THE PAGES WHERE CONSUMER HEALTH DATA IS ENTERED, INCLUDING PROFILE, QUESTIONNAIRE, ROUTINE BUILDER, AND AI ADVISOR PAGES.

ON THOSE PAGES WE ALSO DISABLE SESSION RECORDING AND REPLAY AND ANY OTHER TECHNOLOGY THAT CAPTURES THE CONTENT OF FORM FIELDS. WHERE ANY SUCH TECHNOLOGY OPERATES ELSEWHERE ON THE SERVICES, WE CONFIGURE IT TO MASK THE CONTENTS OF FORM FIELDS AT THE POINT OF CAPTURE, SO THAT THOSE CONTENTS ARE NEVER TRANSMITTED TO OR STORED BY THE VENDOR.

WE AUDIT THESE CONFIGURATIONS PERIODICALLY AND WE DOCUMENT EACH AUDIT.

If you believe an advertising, targeting, or session recording technology operated on a page where consumer health data is collected, tell us at privacy@thecollectionhealth.com and we will investigate and correct it, and we will tell you what we found.

5.5 What We Do Share, and How the Line Is Drawn

So that this notice cannot be read as broader than we can honor, we state plainly what advertising data we do share. On the general, unauthenticated pages of our website, such as the home page, blog and educational articles, and category listing pages, we use ordinary analytics and advertising technologies that receive page addresses, device and cookie identifiers, IP address, and general engagement events. On transactional pages we may transmit a conversion event confirming that a purchase occurred, together with its total value.

We do not transmit to any advertising or analytics recipient the contents of a wellness profile or questionnaire, the contents of an AI Advisor session, the contents of an adverse event report, the specific products or ingredients in an order, allergen or dietary restriction information, or any health goal, symptom, or condition you have described. We do not build advertising segments defined by a health condition, symptom, or health goal. Where we cannot deliver an advertising or measurement feature without transmitting information of that kind, we disable the feature rather than transmit it.

Where Appendix B indicates that a statutory category such as internet activity or commercial information is shared for cross-context behavioral advertising, that entry refers only to the general engagement and conversion data described in this Section 5.5. Appendix B is qualified by this Section, and this Section controls in the event of any inconsistency.

5.6 Your Consumer Health Data Rights

If you are a Washington or Nevada resident, or a resident of any other state with a consumer health data law, you have the right to confirm whether we are collecting, sharing, or selling your consumer health data; to access that data, including a list of all third parties and affiliates with whom we have shared it and an active contact for each; to withdraw consent to our collection and to our sharing of your consumer health data; and to have your consumer health data deleted.

Upon receiving a valid deletion request, we will delete your consumer health data from our records, including from archived and backup systems on the schedule described in Section 10, and we will notify all processors, affiliates, contractors, and third parties to which we have disclosed that data and instruct them to delete it, except that we will retain, and will not instruct any recipient to delete, information we are required by law to retain. That exception includes records relating to a serious adverse event report, which we must maintain for six years under 21 U.S.C. Section 379aa-1, and information we must retain to complete a transaction you requested, to comply with a legal obligation, to detect or investigate a security incident, or to establish, exercise, or defend a legal claim. Where an exception applies, we will tell you which one we relied on, we will delete everything the exception does not cover, and we will not use the retained information for any purpose other than the one that justified retaining it.

We will honor a request to withdraw consent within fifteen calendar days, and in every case within the period required by the law that applies to you. Exercising any of these rights will not cause us to discriminate against you, although we may be unable to continue providing the personalization features that depend on the data you have asked us to delete.

To exercise these rights, email privacy@thecollectionhealth.com with the subject line "Consumer Health Data Request," or use the submission methods in Section 11.4. We respond within forty-five calendar days, extendable once by an additional forty-five days where reasonably necessary, with notice to you.

6. How We Use Personal Information

We use personal information for the following purposes, and for no incompatible purpose without first providing notice and, where required, obtaining consent:

• To provide the Services. To create and maintain your account, authenticate you, process orders, manage your subscription, arrange shipment and delivery, process returns and refunds, and operate the Member Portal and its features.
• To verify your age where the law of the destination state requires it before a sale can be completed.
• To bill you. To process payments, charge recurring subscription fees you have authorized, retry failed payments, calculate applicable taxes, and manage chargebacks and disputes.
• To personalize. To generate the product suggestions, routines, and educational content that you have requested, based on information you have provided.
• To communicate with you. To send order confirmations, shipping notices, renewal, reminder and billing notices, service announcements, policy updates, and responses to your inquiries. These are transactional messages and are not marketing.
• To market. To send marketing emails and, where you have separately opted in, marketing text messages; to measure campaign performance; and to serve and measure advertising on third-party platforms, subject to the limits in Section 5.4.
• To improve our products and Services. To conduct analytics, run A/B tests, diagnose technical problems, understand how features are used, and develop new products and content. We use de-identified or aggregated information for these purposes wherever practicable.
• To maintain quality and safety. To respond to product quality inquiries, investigate complaints, issue recall and safety notices, and to receive, evaluate, and where legally required report serious adverse event reports.
• To protect against fraud and abuse. To verify identity, detect and prevent fraudulent orders and payment fraud, enforce our Terms and Conditions, protect the security and integrity of the Services, and protect our rights and the rights and safety of others.
• To comply with law. To satisfy tax, accounting, recordkeeping, consumer protection, and product regulatory obligations, to respond to lawful requests from government authorities, and to establish, exercise, or defend legal claims.

We do not use personal information for automated decision-making that produces legal or similarly significant effects concerning you. The product suggestions generated by our tools are educational recommendations only and have no legal or similarly significant effect.

7. Legal Bases for Processing (EEA, UK, and Switzerland)

Our Services are directed exclusively to residents of the United States, and we do not ship Products outside the United States. We describe the following as a matter of policy and subject to the reservation in Section 1.1. If you are located in the European Economic Area, the United Kingdom, or Switzerland and we process your personal data, we rely on the following legal bases: performance of a contract with you, for account creation, order fulfillment, subscription management, and customer support; our legitimate interests, for security, fraud prevention, analytics, product improvement, and direct marketing to existing customers, balanced against your rights and freedoms; your consent, for text message marketing, non-essential cookies, and the processing of health-related data, which you may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal; and compliance with a legal obligation, for tax, accounting, and regulatory recordkeeping.

8. Cookies, Pixels, Session Recording, and Similar Technologies

8.1 Technologies We Use

We and our service providers use cookies, web beacons, pixels, tags, software development kits, local storage, and session recording and replay technologies (collectively, "Tracking Technologies") on the Services. We use them in four categories:

8.2 Who Is Involved, What They Receive, and Your Consent

Service providers acting for us. Most Tracking Technologies on the Services are operated by service providers that process information solely on our documented instructions. Our contracts with them prohibit them from selling that information, from using it for their own purposes, from combining it with information they hold from any other source, and from disclosing it to anyone except to perform services for us. For the purposes of any law governing the recording, interception, or monitoring of communications, these providers act as our agents and as parties to your communications with us, and not as independent recipients.

Independent third parties. A separate and smaller set of technologies, limited to advertising platforms and social media networks, is operated by companies that act independently of us and that may use what they receive for their own purposes, including improving their services and delivering advertising. Those technologies fall within the "advertising and targeting" category in the table above. They are configured not to load unless and until you affirmatively accept that category, and not to load at all on the pages identified in Section 5.4.

Prior consent. We configure the Services so that no functional, analytics, or advertising Tracking Technology is placed on your device before you have had a genuine opportunity to accept or decline it. Only strictly necessary technologies are intended to operate before you make a choice. We review this configuration periodically. If you believe a Tracking Technology operated on your device before you were given that opportunity, tell us at privacy@thecollectionhealth.com and we will investigate and correct it.

BY ACCEPTING A CATEGORY IN OUR COOKIE BANNER OR PREFERENCE CENTER, YOU EXPRESSLY CONSENT TO THE OPERATION OF THE TRACKING TECHNOLOGIES IN THAT CATEGORY, AND TO THE PARTICIPATION OF THE PARTIES DESCRIBED ABOVE IN YOUR COMMUNICATIONS AND INTERACTIONS WITH THE SERVICES, INCLUDING THE RECORDING, CAPTURE, MONITORING, READING, TRANSMISSION, AND STORAGE OF THOSE COMMUNICATIONS AND INTERACTIONS IN REAL TIME. YOU MAY CHANGE YOUR CHOICES AT ANY TIME USING THE "COOKIE PREFERENCES" LINK IN THE FOOTER OF EVERY PAGE. IF YOU DECLINE, ONLY STRICTLY NECESSARY TECHNOLOGIES WILL OPERATE AND THE SERVICES WILL CONTINUE TO FUNCTION.

8.3 How to Exercise Choice

• Our preference center. Use the "Cookie Preferences" link in the footer of every page to set or change your choices at any time.
• Your browser. Most browsers allow you to block or delete cookies. Blocking strictly necessary cookies will prevent the Services from working.
• Opt-out preference signals. We honor the Global Privacy Control. See Section 12.
• Industry opt-outs. You may use the tools offered by the Digital Advertising Alliance at optout.aboutads.info and the Network Advertising Initiative at optout.networkadvertising.org, and the advertising settings offered by individual platforms.
• Mobile identifiers. Use the advertising identifier controls in your device operating system settings.

Opting out of advertising cookies does not stop advertising; it stops advertising that is targeted based on your activity. We do not deploy advertising, targeting, or session recording Tracking Technologies on pages where consumer health data is collected, as stated in Section 5.4.

9. How We Disclose Personal Information

9.1 Categories of Recipients

We disclose personal information to the following categories of recipients, in each case limited to what is reasonably necessary for the stated purpose:

• Service providers and processors, including our e-commerce and hosting platform, payment processors, fraud and chargeback prevention services, age verification providers, order fulfillment and warehousing partners, shipping carriers, email and text message service providers, customer support and helpdesk platforms, analytics and session recording providers, cloud storage providers, tax calculation services, review platforms, and the providers of our AI features. Each is bound by contract to use personal information only to perform services for us and is prohibited from retaining, using, or disclosing it for any other purpose.
• Advertising and analytics partners, for the purposes and subject to the limits described in Sections 5.4, 5.5, and 8.
• Professional advisors, including attorneys, accountants, auditors, and insurers, under duties of confidentiality.
• Corporate transaction counterparties. If we are involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or dissolution, personal information may be transferred or disclosed as a business asset, including during diligence under confidentiality obligations. We will seek to require the recipient to handle personal information consistently with this Privacy Policy, and where the recipient intends to apply a materially different policy to information already collected we will provide notice before that policy takes effect. In an insolvency, receivership, or bankruptcy proceeding, transfers are governed by the supervising court and by applicable law.
• Government authorities and other parties, where we believe in good faith that disclosure is necessary to comply with applicable law, subpoena, court order, or other valid legal process; to enforce our Terms and Conditions; to investigate suspected fraud or security incidents; or to protect the rights, property, or safety of The Collection, our customers, or the public. We evaluate every request for legal validity and scope, and we object to requests that are overbroad.
• At your direction, including when you ask us to ship to a third party, connect a third-party service, or post a public product review.

9.2 Sale and Sharing

We do not sell personal information in exchange for money. However, several state privacy laws define "sale" and "sharing" broadly enough to include the disclosure of online identifiers and browsing activity to advertising and analytics partners for cross-context behavioral advertising, even where no money changes hands. To the extent our use of advertising Tracking Technologies constitutes a sale or sharing under those definitions, we disclose it here and offer you the right to opt out. Use the "Your Privacy Choices" link in the footer of every page, enable the Global Privacy Control, or contact us as described in Section 11.4.

We have not sold or shared the personal information of any consumer we knew or had reason to believe was under 18 years of age, and we do not do so. We do not sell or share consumer health data or sensitive personal information under any circumstances.

Appendix B sets out, by statutory category, the personal information we have collected, the categories of sources, our business purposes, and the categories of third parties to whom it was disclosed in the preceding twelve months.

10. Retention of Personal Information

We retain each category of personal information only for as long as reasonably necessary for the purpose for which it was collected, and then delete or de-identify it. Where a longer period is required by tax, accounting, product safety, or other law, or is necessary to establish, exercise, or defend a legal claim, to investigate a security incident, or to comply with a litigation hold, we retain the information for that period and no longer. The periods in the table below are maximum retention ceilings rather than guaranteed storage terms. We may delete information sooner, and we may retain it longer only where one of the grounds just described applies.

Where more than one period in this table could apply to the same information, the shorter period controls, except where a longer period is required by law. When you close your account, we delete or de-identify your wellness profile and other consumer health data at closure rather than retaining it under the account records period.

Information residing in encrypted backup systems is overwritten on our regular backup cycle, which does not exceed 90 days from the date of the deletion request. During that interval the information is isolated from active processing.

11. Your Privacy Rights and How to Exercise Them

11.1 Rights Available to All Users

Regardless of where you live, we extend the following rights to every user of the Services as a matter of policy. Each right is subject to verification of your identity under Section 11.4 and to the exemptions, exceptions, and limitations that the corresponding state privacy statutes provide, which we apply uniformly whether or not that statute governs us. We may decline a request in whole or in part on any ground that the applicable statutory framework would permit, and we will tell you which ground we relied on and how to appeal.

• Right to know and access. To confirm whether we process personal information about you and to obtain a copy, including the categories collected, the sources, the purposes, the categories of recipients, and the specific pieces of information.
• Right to correct. To have inaccurate personal information corrected, taking into account the nature of the information and the purposes of processing.
• Right to delete. To have your personal information deleted, subject to the exceptions permitted by law, including where we must retain it to complete a transaction, comply with a legal obligation, detect security incidents, or exercise or defend a legal claim.
• Right to data portability. To receive a copy of your personal information in a portable and, to the extent technically feasible, readily usable format.
• Right to opt out of targeted advertising, sale, and sharing. Exercisable through the "Your Privacy Choices" link, the Global Privacy Control, or a direct request.
• Right to opt out of profiling in furtherance of decisions producing legal or similarly significant effects. We do not engage in this activity.
• Right to limit the use and disclosure of sensitive personal information. We already limit our use of sensitive personal information to what is necessary to provide the Services, as described in Section 4.
• Right to withdraw consent, at any time, where processing is based on consent.
• Right to non-discrimination. We will not deny you goods or services, charge you a different price, or provide you a different level or quality of service because you exercised a privacy right. We do not currently operate any financial incentive program. If we introduce one, any difference in price or service will be limited to that program, will be disclosed under Section 14 before you enroll, and will be reasonably related to the value of the data provided.
• Right to appeal. Described in Section 11.5.

11.2 Authorized Agents

You may use an authorized agent to submit a request on your behalf. We will require the agent to provide written permission signed by you, and we may require you to verify your own identity directly with us and to confirm that you granted the agent permission. An agent acting under a valid power of attorney need only provide proof of that power.

11.3 Requests Concerning Someone Else

A parent or legal guardian may submit a request on behalf of a minor child, and a person with legal authority may submit a request on behalf of an individual who cannot act for themselves, in each case upon proof of authority.

11.4 How to Submit a Request

• Web form: thecollectionhealth.com/privacy-request
• Email: privacy@thecollectionhealth.com
• Mail: Privacy Requests, Truist Life Sciences LLC, 103 Tuscany Way, Greer, South Carolina 29650
• Opt-out link: the "Your Privacy Choices" link in the footer of every page, which requires no account and no verification.

We will acknowledge receipt within ten business days and will respond substantively within forty-five calendar days. Where reasonably necessary, we may extend that period once by an additional forty-five days and will notify you of the extension and the reason for it within the initial period. Opt-out requests are honored within fifteen business days and no verification is required. Requests to withdraw consent to the processing of consumer health data are honored on the timeline in Section 5.6. We provide our response free of charge up to twice in any twelve-month period.

To protect you, we verify your identity before acting on a request to know, correct, delete, or port. We match the information you provide against information already in our records and, for a request seeking specific pieces of personal information, we apply a higher standard of certainty. We may ask you to confirm the request from the email address on your account. We will not create or retain information solely to verify you, and we will not use verification information for any other purpose. If we cannot verify you, we will tell you why.

11.5 Appeals

If we decline to act on your request, our response will explain why and will tell you how to appeal. To appeal, reply to our response or write to privacy@thecollectionhealth.com with the subject line "Privacy Appeal." We will review the appeal and inform you in writing of our decision and the reasons for it within forty-five days of receipt, extendable once by sixty days where reasonably necessary. If we deny the appeal, we will provide you an online mechanism or other method to contact your state attorney general to submit a complaint.

12. Opt-Out Preference Signals and Do Not Track

We have configured the Services to recognize and honor the Global Privacy Control and other opt-out preference signals that meet the technical specifications of applicable state law. When our systems receive such a signal from your browser or device, we treat it as a valid request to opt out of the sale and sharing of personal information and of targeted advertising for that browser or device, and, if you are logged in at the time, for your account. Because a browser signal is device-specific and is transmitted only when your browser or extension sends it, you should enable it on each browser and device you use. If you believe a signal was not honored, tell us at privacy@thecollectionhealth.com and we will investigate and correct it.

Web browsers may also offer a "Do Not Track" setting. There is no consensus industry or legal standard for how to respond to Do Not Track signals, and we do not respond to them. We do respond to the Global Privacy Control as described above.

13. Marketing Email and Text Message Communications

13.1 Email

We send marketing emails only where you have opted in or where permitted by law following a purchase. Every marketing email contains a functioning unsubscribe link and our valid physical postal address. We honor unsubscribe requests promptly and in all cases within ten business days. You may also unsubscribe by emailing support@thecollectionhealth.com.

Transactional messages are different. Order confirmations, shipping notices, billing, renewal and reminder notices, security alerts, product safety or recall notices, and responses to your inquiries are necessary to the service you have purchased. You cannot opt out of these while you hold an active account or subscription.

13.2 Text Messages

We send marketing text messages only to individuals who have given prior express written consent through a separate, unchecked opt-in that is not a condition of any purchase. Message and data rates may apply. Message frequency varies. Consent is not a condition of purchase.

You may revoke consent at any time by replying STOP, END, CANCEL, UNSUBSCRIBE, or QUIT to any message, and we will also honor a revocation communicated by any other reasonable means, including by email, through customer service, or in a reply using ordinary language that a reasonable person would understand to be a request to stop. We process revocations in real time where technically possible and in all cases within ten business days. We may send a single confirmation message acknowledging your opt-out, which will not contain marketing content. Reply HELP to any message, or contact support@thecollectionhealth.com, for assistance.

We do not send marketing text messages outside the hours of 8:00 a.m. to 9:00 p.m. in the recipient's local time zone, and we maintain internal and applicable do-not-call and do-not-text suppression lists. We retain records of your consent, including the date, time, method, and the exact disclosure presented to you. Where the law of your state imposes requirements beyond those described here, including the Florida Telephone Solicitation Act, the Washington Commercial Electronic Mail Act, and comparable statutes in other states, we comply with those requirements as well.

13.3 Postal Mail

We may send postal mail to customers. Email privacy@thecollectionhealth.com to opt out.

14. Notice of Financial Incentive

Some programs that offer a benefit in exchange for personal information may be treated as "financial incentives" under California law. Examples include a discount for enrolling in an email or text message program, a credit for participating in a referral program, and a benefit offered in exchange for submitting a product review.

We do not currently offer any financial incentive program. We do not offer a discount, credit, or other benefit in exchange for your enrollment in our marketing communications, and we do not offer any benefit in exchange for submitting a review.

If we launch a program of this kind, including the referral program contemplated by Section 10.3 of our Terms and Conditions, we will update this Section before the program opens and will provide, at or before the point of enrollment: a description of the program and the benefit offered; the material terms and any conditions; how to opt in and how to withdraw; and a good-faith estimate of the value to us of the personal information involved, together with the method we used to calculate it. Enrollment will always be affirmative and optional, and withdrawal will always be available without penalty.

Declining to participate in any such program will have no effect on the price or quality of any product or service you purchase from us.

15. Artificial Intelligence Features and Automated Processing

The Services include AI-assisted features, including the AI Supplement Advisor and the Routine Builder. When you use these features, the information you enter, together with relevant information from your profile and order history, is processed by third-party AI model providers under contract to us in order to generate a response.

• We select AI providers that offer enterprise or commercial terms under which customer inputs and outputs are not used to train or improve their general-purpose models, and our agreements with them prohibit that use. If we ever adopt a provider or feature under which this would not be true, we will update this Policy and give notice before the change takes effect.
• AI-generated responses are educational information only. They are not medical advice, diagnosis, or treatment, and no professional relationship is created by using them. They may be inaccurate or incomplete and should not be relied upon in place of consultation with a qualified healthcare provider.
• You control what you enter. Do not enter medical records, diagnoses, prescription information, government identifiers, financial account details, or information about another identifiable person.
• We review AI interactions for safety, accuracy, and abuse, using de-identified or aggregated data wherever practicable.
• AI inputs and outputs are treated as consumer health data where they concern your health, and are protected accordingly under Section 5. Advertising, targeting, and session recording technologies do not operate on AI Advisor pages.
• AI interaction records are retained for 13 months and are then deleted or de-identified, as stated in Section 10.

We do not use AI or any other automated process to make decisions that produce legal or similarly significant effects concerning you, and we do not use these features to make eligibility, pricing, or credit determinations about individual customers.

16. Children's Privacy

The Services are intended for adults. They are not directed to children under 13, and we do not knowingly collect, use, or disclose personal information from a child under 13 in violation of the Children's Online Privacy Protection Act. We do not condition a child's participation in any activity on the disclosure of more personal information than is reasonably necessary.

Separately, and as described in our Terms and Conditions, you must be at least 18 years old to purchase products or create an account, and certain products cannot lawfully be sold to persons under 18 in some states. We apply an age check before you can create a wellness profile, complete a product questionnaire, or use the AI Supplement Advisor.

Users aged 13 to 17. Because our Products are of interest to young athletes, we apply the following protections to any user we know or have reason to believe is under 18, whether we learn that from an age gate, from information provided to us, or otherwise: we do not sell or share their personal information; we do not process it for targeted advertising or for profiling; we do not use it to build advertising audiences; and we obtain consent from a parent or legal guardian before processing any sensitive data, where the applicable law requires it. We apply these protections in every state, not only in those whose law requires them.

If you believe a person under 13 has provided personal information to us, or if you are a parent or guardian who wishes to review, delete, or refuse further collection of your child's information, contact privacy@thecollectionhealth.com. We will verify the report and act on it promptly.

17. Information Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, and loss. These include encryption of data in transit using current Transport Layer Security protocols and encryption of sensitive data at rest; access controls granted on a least-privilege basis and reviewed periodically; multi-factor authentication for administrative access; tokenization of payment data by a payment processor that maintains PCI DSS compliance, so that we do not store full card numbers; vendor security diligence and contractual data protection commitments; logging and monitoring; and a written incident response procedure.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for all activity under your account. Use a unique, strong password, do not reuse it on other services, and notify us immediately at support@thecollectionhealth.com if you suspect unauthorized access.

If a security incident affecting your personal information occurs, we will notify you and the appropriate authorities as and when required by applicable law.

18. International Data Transfers

We are based in the United States and our service providers are located primarily in the United States. If you access the Services from outside the United States, you understand that your personal information will be transferred to, stored in, and processed in the United States and in other countries where our service providers operate. The data protection laws of those countries may differ from those of your country of residence. Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the United Kingdom International Data Transfer Addendum, and we conduct transfer risk assessments where required. This Section is provided subject to the reservation in Section 1.1.

19. Third-Party Websites, Platforms, and Creators

The Services contain links to and embedded content from third-party websites, including social media platforms, review platforms, payment providers, shipping carriers, and content published by our creator and ambassador partners. We do not control those parties and are not responsible for their privacy practices. Their collection and use of your information is governed by their own privacy notices, which you should read. If you purchase through a creator's link or a co-branded promotion, that creator may receive information about the referral in accordance with our agreement with them, and may receive compensation, which they are required to disclose.

20. Job Applicants and Business Contacts

If you apply for a position with us, we collect the information in your application and use it solely to evaluate your candidacy, conduct any lawful background or reference checks with your authorization, and comply with employment law. We retain applicant records for the period required by law, and thereafter for up to 24 months in case a future opportunity arises, unless you ask us to delete them sooner.

If you are a representative of a supplier, manufacturer, retailer, distributor, creator, or other business partner, we collect your business contact information and records of our dealings, and use them to manage the relationship and comply with law.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top and post the updated Policy on the Services. We review this Policy at least once every twelve months and update the disclosures in Appendix B accordingly.

If we make a material change, including any change that would permit us to use previously collected personal information for a materially different purpose, we will provide advance notice by email to the address associated with your account or by a conspicuous notice on the Services, and where required by law we will obtain your consent before applying the change to information already collected. Your continued use of the Services after the effective date of a non-material change constitutes acknowledgment of the updated Policy. A material change to Section 1.3 gives you a fresh thirty-day right to opt out under that Section.

Prior versions of this Policy are available on request at privacy@thecollectionhealth.com.

22. How to Contact Us

For any question, concern, or complaint about this Privacy Policy or our handling of personal information, contact us:

We will work in good faith to resolve any complaint directly. You also have the right to lodge a complaint with your state attorney general, with the California Privacy Protection Agency if you are a California resident, or with your national data protection authority if you are located in the European Economic Area or the United Kingdom.

Appendix A. State-Specific Disclosures and Rights

This Appendix supplements the main body of the Privacy Policy for residents of the states identified below. Where a provision of this Appendix conflicts with the main body, this Appendix controls for residents of the state to which it applies.

A.1 California

This section applies to California residents and is provided under the California Consumer Privacy Act as amended by the California Privacy Rights Act, and its implementing regulations.

Notice at collection. The categories of personal information we collect, the purposes for which they are used, whether they are sold or shared, and our retention periods are stated in Sections 2, 6, 9, and 10 and in Appendix B. This Policy serves as our notice at collection, and a link to it is provided at or before the point of collection.

Your California rights. You have the rights to know, access, correct, delete, and port; the right to opt out of the sale or sharing of personal information; the right to limit the use and disclosure of sensitive personal information; the right to non-discrimination and to be free from retaliation for exercising your rights; and the right to access information about automated decision-making and to opt out of it. See Section 11 for how to exercise them and Section 9.2 for our opt-out mechanisms.

Sensitive personal information. We collect the categories described in Section 4. We use and disclose sensitive personal information only for the purposes permitted by Section 7027(m) of the CCPA regulations, which do not trigger the right to limit. We nevertheless honor requests to limit.

Shine the Light. California Civil Code Section 1798.83 permits California residents to request information about the disclosure of personal information to third parties for those parties' own direct marketing purposes. We do not disclose personal information for that purpose. To make a request, email privacy@thecollectionhealth.com.

Minors. California residents under 18 who are registered users may request removal of content they have publicly posted on the Services by emailing privacy@thecollectionhealth.com. Removal may not be complete or comprehensive where the content has been copied or republished by others.

Metrics. Where we are required to compile and disclose annual request metrics, we publish them at thecollectionhealth.com/privacy-metrics.

A.2 Washington and Nevada, Consumer Health Data

Section 5 of this Privacy Policy is our consumer health data privacy notice for residents of Washington under the My Health My Data Act and for residents of Nevada under SB 370. It is separately linked from our homepage. Washington residents are advised that the My Health My Data Act provides a private right of action through the Washington Consumer Protection Act. Section 1.3 of this Policy governs how such a claim is to be resolved, subject to your right to opt out.

We do not operate a geofence around any facility that provides health care services, and we do not use geofencing to identify, track, collect data from, or send notifications to consumers regarding their consumer health data.

A.3 States with Comprehensive Privacy Laws

This section applies to residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, Rhode Island, and any other state that has enacted a comprehensive consumer data privacy law.

You have the rights described in Section 11, including the rights to confirm processing and access, to correct, to delete, to obtain a portable copy, to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects, and to appeal under Section 11.5. We obtain opt-in consent before processing sensitive data where the applicable law requires it, and we obtain consent from a parent or legal guardian before processing the sensitive data of a known child. We conduct and maintain data protection assessments where the applicable law requires them.

Colorado, Connecticut, Montana, Oregon, and other applicable states. We honor universal opt-out mechanisms as described in Section 12. Colorado residents may also contact the Colorado Attorney General. Connecticut and Colorado residents have additional protections concerning the processing of the personal data of minors, which we observe.

Minnesota. In addition to the rights above, you have the right to obtain a list of the specific third parties to which we have disclosed your personal data, and the right to question the result of any profiling. We do not engage in profiling that produces legal or similarly significant effects.

Oregon. You have the right to obtain a list of the specific third parties, other than natural persons, to which we have disclosed your personal data.

Maryland. We do not sell sensitive data, we do not sell the personal data of a consumer we know to be under 18, and we do not process the personal data of a consumer we know to be under 18 for targeted advertising. We collect and process personal data only to the extent reasonably necessary and proportionate to provide the Services you request.

Texas. We do not sell sensitive personal data and we do not sell biometric personal data. The Texas Data Privacy and Security Act applies without regard to revenue or processing thresholds to businesses that are not small businesses as defined by the United States Small Business Administration, and we honor the rights described in Section 11 for Texas residents.

Florida. If the Florida Digital Bill of Rights applies to us, Florida residents have the rights described in Section 11.

A.4 Nevada, Sale of Covered Information

Nevada law permits residents to submit a verified request directing an operator of an internet website not to make any sale of certain covered information. We do not sell covered information as defined by Nevada Revised Statutes Chapter 603A. To submit a request, email privacy@thecollectionhealth.com with the subject line "Nevada Opt-Out."

A.5 Vermont, Oregon, and Other Data Broker Registries

We are not a data broker. We do not collect and sell the personal information of consumers with whom we have no direct relationship.

Appendix B. Categories of Personal Information Collected and Disclosed

The following table describes the categories of personal information, using the statutory categories set out in California Civil Code Section 1798.140(v), that we have collected in the twelve months preceding the Last Updated date of this Policy, and the categories of third parties to which each category has been disclosed for a business purpose. The business and commercial purposes for collection are those listed in Section 6, and the sources are those listed in Section 3.

Note on the final column. We receive no money for personal information. The entries stating that a category is "shared" reflect the broad statutory definitions of "sale" and "sharing" that can capture the operation of advertising and analytics technologies, as explained in Section 9.2. You may opt out at any time through the "Your Privacy Choices" link, through the Global Privacy Control, or by contacting us.

Note on scope. This Appendix uses the statutory categories of the California Consumer Privacy Act because they are the most detailed framework in use. Presenting the disclosure in that form is not a concession that the California Consumer Privacy Act or any other statute applies to us. See Section 1.1. Every entry in this Appendix is qualified by Sections 5.4 and 5.5, which control in the event of any inconsistency.

This Privacy Policy is published by Truist Life Sciences LLC, doing business as The Collection. It should be read together with our Terms and Conditions, which govern your use of the Services and your purchases.