Consumer Health Data Privacy Policy

Consumer health data we collect

• From the wearable (Oura, Whoop or Garmin, if you connect it): sleep, heart rate, heart-rate variability, temperature and other nightly metrics its API provides.
• From the questionnaire: medication, pregnancy or breastfeeding, health conditions, goals and habits you state.
• From the blood test, if you upload it: the report's values and ranges.
• Inferences: the analysis and the protocol we calculate from the above, and the supplements you buy.
• Adverse events you report to us.

Sources and purposes

• Sources: you (questionnaire, tests you upload, reports) and your wearable provider, with your consent.
• Purposes: producing your analysis; calculating your protocol and filtering out products your answers advise against; preparing and shipping your purchase; handling adverse events and complying with the law.
• We do not use them for advertising, we do not sell them and we do not use geofencing around health-care facilities. The site's advertising pixels and session recording do not load on the pages that handle this data. [REVISIÓN LEGAL: verify the per-route suppression in production (FIX-SEG)]

Who we share it with

• Processors working for us: hosting (Supabase, Vercel), AI providers that process the analysis (DeepSeek, OpenAI, Groq, Anthropic), email (Resend).
• To ship your purchase: Shopify and Supliful receive your name, address, phone and the products in each box; Stripe processes the payment.
• Authorities: the FDA, in the case of a serious adverse event, and when the law requires it.
• We ask for your consent to collect this data and, separately, to share it beyond what is necessary to provide the service you request. [REVISIÓN LEGAL: MHMDA requires separate consents to collect and to share; verify the flow asks for them that way]

Your rights

• Confirm and access: know whether we process your health data, see it and know who we share it with.
• Withdraw consent and delete your data: from your account or by writing to us (contact).
• Appeal if we deny your request. [REVISIÓN LEGAL: response and appeal procedure and deadlines]
• Records the law requires us to keep (purchases, consent to the charges, adverse events) are kept even if you request deletion. See privacy.