Consumer Health Data Privacy Policy

Effective date: August 26, 2026

This Consumer Health Data Privacy Policy supplements the Noophoric Privacy Policy and describes how Noophoric LLC ("Noophoric," "we," "us," or "our") handles consumer health data under laws such as the Washington My Health My Data Act and Nevada's consumer health data law.

This policy applies to consumer health data of covered consumers that Noophoric controls or processes. It does not apply to information exempt from applicable consumer health-data laws.

Our core practices

Noophoric sells general wellness and dietary-supplement products. We do not provide medical care, diagnose conditions, or operate a health-assessment service.

We do not ask customers to provide health conditions, medications, pregnancy status, lab results, or photographs through a quiz, survey, intake form, or health assessment. We do not treat an ordinary visit to a menopause-related landing page or an ordinary product purchase as proof that a customer has menopause or another health condition. We do not create a person-level health profile from routine browsing or purchase activity.

A customer may nevertheless voluntarily include health-related information in a customer-service message, product complaint, adverse-event report, review, SMS reply, email, or social-media message. When that information identifies or is reasonably linkable to the customer and identifies the customer's health status, we treat it as consumer health data where required by law.

Categories of consumer health data we may collect

We may receive the following categories only when a consumer voluntarily provides them or when necessary to address a product-safety matter:

A health condition, symptom, diagnosis, or bodily function described in a communication or product review.
Menopause, pregnancy, reproductive-health, or hormonal information voluntarily included in a communication.
Medication or supplement-use information voluntarily included in a communication.
A reaction, illness, injury, adverse event, product complaint, or other health-related product experience.
Information about health care or advice sought from a health professional that a consumer chooses to include.
Other health-related information contained in material the consumer voluntarily sends to us.

We do not collect genetic data, biometric identifiers, precise location used to identify an attempt to obtain health care, lab results, medical records, or photographs for a health-assessment purpose. If a consumer sends such information without being asked, we will process only what is reasonably necessary to respond, protect product safety, comply with law, or honor a valid privacy request.

Sources of consumer health data

The categories of sources are:

The consumer, including through email, SMS, customer service, a product complaint, an adverse-event report, a review, or a social-media message.
A person authorized by the consumer, such as a parent, guardian, caregiver, or authorized agent.
A service provider processing a communication or request on our behalf.
A marketplace or other business through which a consumer submitted a product-safety or customer-service communication concerning a Noophoric product.

We do not buy consumer health data from data brokers.

Why and how we process consumer health data

We may collect and use consumer health data only as reasonably necessary to:

Respond to the consumer's question or request.
Investigate, document, and resolve a product complaint or product-quality issue.
Evaluate, document, and report an adverse event or other product-safety matter.
Provide a product or service requested by the consumer.
Protect the health, safety, rights, and security of consumers and Noophoric.
Comply with dietary-supplement reporting and recordkeeping obligations, court orders, or other legal requirements.
Establish, exercise, or defend legal claims.
Honor the consumer's health-data privacy rights.

Access is limited to people and processors that reasonably need the information for these purposes. We do not use consumer health data for automated decision-making that produces legal or similarly significant effects.

Depending on the interaction, processing may include receiving the information, reviewing and classifying the communication, associating it with the relevant customer, order, product, lot, or safety record, securely storing and retrieving it, using it to respond or investigate, sharing it with an authorized processor or recipient when necessary, documenting the resolution, and deleting, deidentifying, or archiving it under the retention schedule below. We do not use ordinary browsing or purchase activity to infer consumer health data.

We do not use consumer health data to create advertising audiences, retarget consumers based on a health condition, create lookalike audiences based on health concerns, or personalize advertisements based on a person-level inference that a consumer has menopause or another health condition.

Categories of consumer health data we share

We may disclose the limited health information contained in a consumer communication or product-safety record only as reasonably necessary for the purposes described above. Depending on the request, this may include:

The contents of a support or safety communication.
Contact information associated with the communication.
Product, lot, purchase, subscription, shipping, or transaction information needed to investigate or respond.
Adverse-event or product-complaint information required for safety, quality, insurance, or legal purposes.

Categories of recipients

Consumer health data may be provided to the following categories of processors or recipients only where reasonably necessary and permitted by law:

Commerce and store-hosting providers, including Shopify.
Customer-communications providers, including Klaviyo and email or SMS providers, when the consumer uses those channels.
Review providers, including Judge.me, if a consumer voluntarily includes health information in a review.
Marketplaces through which the relevant order or communication occurred.
Product manufacturers, quality personnel, insurers, laboratories, safety consultants, or fulfillment partners involved in investigating a product complaint or adverse event.
Lawyers, auditors, and other professional advisers subject to appropriate duties of confidentiality.
Regulators, courts, law enforcement, or government agencies where disclosure is required or permitted by law, including the U.S. Food and Drug Administration where applicable.
A third party at the consumer's direction or with the consumer's required consent.

Noophoric has no affiliates with which it shares consumer health data.

When a vendor acts as our processor, we require it to process consumer health data consistently with our instructions, the requested service, this policy, and applicable law.

Advertising and cross-site collection

Third-party advertising and analytics technologies may collect general device, commercial, and online activity as described in the Noophoric Privacy Policy. Some providers may collect general online activity over time and across websites or services.

That general activity can include a page URL or page title, including for a page that discusses a wellness topic such as menopause, together with device or advertising identifiers. We use those technologies for broad advertising, security, analytics, attribution, and ordinary commerce measurement. We do not treat a visit to such a page as proof of a health condition or use it to identify a consumer's health status.

Noophoric does not authorize advertising, analytics, attribution, or social-media providers to determine a consumer's diagnosis or health status on our behalf. We do not send those providers health conditions voluntarily disclosed in communications, medications, pregnancy status, lab results, support-message content, review text, health-assessment answers, or person-level health-concern fields for advertising.

We do not use a visit to a menopause-related landing page or an ordinary product purchase to identify a person's health status, and we do not create or disclose a condition-specific retargeting audience from that activity.

Sale of consumer health data

Noophoric does not sell consumer health data. If that practice ever changes, we will update this policy and obtain the specific written authorization required by applicable law before any sale.

Consent

We collect and share consumer health data only:

With the consumer's affirmative consent where applicable law requires consent; or
To the extent reasonably necessary to provide a product or service the consumer requested, respond to the consumer's communication, address product safety, or perform another activity permitted by law.

Where separate consent is legally required for sharing, a general acceptance of our Terms or Privacy Policy will not constitute that consent. A consumer may withdraw consent for future collection or sharing by contacting us as described below.

Consumer health-data rights

Subject to applicable law and permitted exceptions, a covered consumer may request to:

Confirm whether we collect, share, or sell consumer health data about the consumer.
Access the consumer health data we maintain.
Receive a list of third parties and affiliates with which the consumer's health data was shared or sold and available contact information for those recipients.
Correct or amend inaccurate consumer health data.
Withdraw consent for future collection or sharing.
Require us to stop collecting, sharing, or selling the consumer's health data.
Delete consumer health data, including by directing applicable processors and recipients to delete it.
Appeal our refusal to act on a request.

To exercise a right, email cs@noophoric.com with the subject line Consumer Health Data Request. Describe the request and provide enough information for us to locate the relevant record. Do not send additional medical information unless we specifically explain why it is needed.

We will use reasonable methods to authenticate the request. If we cannot authenticate it, we may request additional information or deny the request as permitted by law. Authorized agents may submit requests where permitted, subject to verification of their authority and the consumer's identity.

We will respond without undue delay and within the period required by applicable law. We generally do not charge a fee. A fee may apply only where legally permitted for a request that is manifestly unfounded, excessive, or repetitive.

If we deny a request, email cs@noophoric.com with the subject line Consumer Health Data Appeal. We will review the appeal and provide a written response within the period required by law. If an appeal is denied, we will provide information about any applicable method for contacting the relevant regulator or attorney general.

Deletion from archived or backup systems may be delayed for the period permitted by law. Where required, we will notify processors, contractors, affiliates, and other applicable recipients of a valid deletion request.

Retention

We retain consumer health data only for as long as reasonably necessary for the purpose for which it was received and to satisfy legal requirements:

Health information contained in a routine customer-service communication is generally retained for up to three years after the matter is closed.
Adverse-event reports, non-serious event reports, and related communications and medical information are retained for at least six years where required by dietary-supplement law.
Health information included in a public review may remain until the review is removed, no longer needed, or deleted in response to a valid request, subject to lawful exceptions.
Records needed for litigation, regulatory review, fraud prevention, insurance, or another legal obligation may be retained until the matter and applicable retention period end.

When consumer health data is no longer required, we delete, deidentify, or securely dispose of it, subject to backup cycles and lawful exceptions.

Security

We maintain reasonable administrative, technical, and physical safeguards appropriate to the volume and nature of the consumer health data we process. We restrict access to personnel and processors that reasonably need the information for an authorized purpose. No security measure can guarantee absolute protection.

Changes to this policy

We may update this policy to reflect changes in our practices, Services, or legal obligations. We will post the revised policy with a new effective date. For a material change affecting consumer health data we have collected, we will also provide a clear notice on the Site and, where required by law or reasonably feasible, direct notice using the contact information associated with the affected consumer. If a material change would permit a new category, purpose, or recipient for consumer health data, we will provide notice and obtain affirmative consent before the new collection, use, or sharing where required by law.

Contact us

For questions, requests, withdrawals of consent, or complaints concerning consumer health data, contact:

Noophoric LLC
8545 West Warm Springs Road
Suite A4-427
Las Vegas, NV 89113
United States
Email: cs@noophoric.com