Consumer Health Data Privacy Policy

Last revised: July 30, 2026

This Consumer Health Data Privacy Policy (this “Policy”) describes how Reset Rx, Inc., a Delaware corporation doing business as ResetRx (the “Company”, “we”, “us”, or “our”), collects, uses, shares, and protects “Consumer Health Data” in connection with the ResetRx health-and-wellness platform, the personalized testing and biomarker program, the Eva AI coaching feature, and our related websites, mobile applications, and services (collectively, the “Services”). It is a supplement to, and is incorporated into, our Privacy Policy, and it provides the additional disclosures and rights required by the consumer health data privacy laws of Washington, Nevada, Connecticut, and certain other U.S. states. Capitalized terms used but not defined in this Policy have the meanings given in our Privacy Policy or our Terms of Service.

1. About This Policy

This Policy explains your rights and our obligations with respect to Consumer Health Data under U.S. state consumer health data privacy laws. It supplements, and does not replace, our Privacy Policy, which describes our handling of Personal Information generally.

Scope. This Policy applies to Consumer Health Data that we collect, use, share, or process about you in connection with the Services. It applies in addition to our Privacy Policy. To the extent any other notice or policy we provide conflicts with this Policy with respect to Consumer Health Data, this Policy controls as to that Consumer Health Data.
Who This Policy Covers. This Policy applies to you if you are a natural person who is a resident of the State of Washington, the State of Nevada, or the State of Connecticut acting in an individual or household capacity, and to residents of other states to the extent their laws extend comparable consumer health data rights. It does not apply to data we process about you acting in a commercial or employment context. Some of the rights described in this Policy are available only to residents of particular states, as described in Section 12 (State-Specific Provisions).
Relationship to Our Privacy Policy and Terms of Service. This Policy is part of a suite of documents that govern your use of the Services, together with our Privacy Policy and our Terms of Service, including the Supplemental Terms for Eva set out in the Terms of Service. Your authorization for the testing workflow, and the defined terms “Laboratory Partner” and “Ordering Physician Network”, are set out in the Terms of Service and are used here with the same meanings.
Information This Policy Does Not Cover. This Policy does not apply to: (i) protected health information held by the Ordering Physician Network or a covered Laboratory Partner affiliate as a HIPAA-covered entity or business associate—the Company acts as a business associate of the Ordering Physician Network with respect to protected health information received through the Testing Services, and such information is governed by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”) and by the applicable notice of privacy practices, whether that information is held by the Ordering Physician Network, by a covered Laboratory Partner affiliate, or by the Company acting as a business associate. The consumer health data laws of Washington and certain other states exclude information that is protected health information for purposes of HIPAA; that information is therefore governed by HIPAA rather than by this Policy, even while the Company holds it. This Policy governs the other health-related information described in Section 2; (ii) de-identified data that cannot reasonably be linked to you and that we maintain and use in compliance with applicable law; or (iii) publicly available information as defined by applicable law. Our HIPAA status is described in our Privacy Policy and Terms of Service.

2. What Is Consumer Health Data

“Consumer Health Data” means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status, as defined under applicable state law. It includes information from which a conclusion or inference about your health status can be drawn, and information that we process to associate or identify you with such data.

Examples of Consumer Health Data We May Process. Depending on the Services you use, Consumer Health Data we process may include:
1. Biomarker, laboratory, and diagnostic-testing information, including the test panels you select, biomarker values, genetic information where a test panel you select includes a genetic or DNA-based assay, and results made available through the Services;
2. Health and lifestyle information you provide through onboarding questionnaires, intake forms, and ongoing use, including self-reported health history, symptoms, conditions, medications and supplements, diet, sleep, and activity;
3. Bodily, physiological, and biological measurements collected from connected wearable devices or health-data platforms you choose to integrate, such as heart rate, sleep, steps, weight, exercise, and similar metrics;
4. The content of your interactions with “Eva”, our AI coaching feature, and the coaching outputs generated for you, to the extent they reveal or allow inferences about your health;
5. Information that identifies you as having sought or received health-related products or services, including your enrollment in, or selection of, a ResetRx plan that includes testing or health coaching; and
6. Any other information that we process to associate or identify you with any of the foregoing, including derived or inferred data.
What Is Not Consumer Health Data. Consumer Health Data does not include the information described in Section 1(d), or information that does not identify and is not reasonably linkable to your health status. Information that is both available through the Services and unrelated to health — such as your account credentials used solely for authentication — is governed by our Privacy Policy rather than this Policy, except to the extent it is processed to identify you in connection with Consumer Health Data.

3. Categories of Consumer Health Data We Collect, and Our Sources

We collect Consumer Health Data from the following categories of sources:

Directly From You. We collect Consumer Health Data that you provide when you create an account, complete onboarding and intake, set goals, interact with Eva, schedule or purchase testing, connect a wearable device, or otherwise use the Services.
From Our Laboratory and Physician Partners. To deliver the testing features of the Services, and subject to your authorization in the Terms of Service, we collect and receive test orders, authorizations, biomarker and laboratory results, and related information from our laboratory partner, Quest Diagnostics Incorporated (the “Laboratory Partner”), and from the physician network, Kulbersh Health Screening Services, LLC (the “Ordering Physician Network”) to the extent provided to us.
Automatically and From Connected Devices. When you use the Services, we and our service providers collect device and usage information, and — if you choose to connect a wearable device or health-data platform — the physiological and activity data you authorize that platform to share with us, as described in our Privacy Policy.
From Other Third Parties. We may receive Consumer Health Data from the integration partners and other third parties described in our Privacy Policy, in connection with delivering the Services.

4. How We Use Consumer Health Data

We use Consumer Health Data only for purposes that are necessary to provide the Services you have requested, for purposes to which you have consented, and as otherwise permitted or required by applicable law, including the following:

To provide, personalize, and improve the testing, biomarker, and coaching features that are central to the Services, including by processing your onboarding inputs, laboratory results, connected-device data, and Eva interactions to generate recommendations tailored to you;
To facilitate the testing workflow with our Laboratory Partner and Ordering Physician Network, as authorized in the Terms of Service;
To communicate with you about your account, your testing status, and the Services;
To maintain the security and integrity of the Services, and to detect, prevent, and address fraud, security incidents, and unlawful activity;
To comply with our legal obligations and to establish, exercise, or defend legal claims; and
For any other purpose to which you affirmatively consent at or before the time of collection.

We do not use Consumer Health Data for targeted advertising or to profile you in furtherance of decisions that produce legal or similarly significant effects concerning you, except with your consent where permitted by law. Our use of Consumer Health Data to train or improve artificial-intelligence models is described in, and subject to the consent framework set out in, our Privacy Policy and Section 7 of this Policy. Where Consumer Health Data used for AI-training purposes originates from the testing workflow, we de-identify it to a standard consistent with the HIPAA safe-harbor or expert-determination method before using it for model training.

5. How We Share Consumer Health Data; Categories of Recipients

We share Consumer Health Data only as necessary to provide the Services you have requested, with your consent, or as otherwise permitted or required by law. We share Consumer Health Data with the following categories of recipients:

Service Providers and Processors. Third parties that perform functions on our behalf — such as cloud hosting and data storage, security operations, customer support, email and marketing services (including Klaviyo), and the technology infrastructure supporting the Services — which are permitted to process Consumer Health Data only on our documented instructions, only as needed to perform their functions, and under contractual data-protection obligations.
Laboratory and Physician Partners. The Laboratory Partner and the Ordering Physician Network, with whom we exchange information to order, authorize, perform, bill for, and report your tests, subject to your authorization in the Terms of Service. The information we provide for these purposes includes your demographic information, your insurance and eligibility information, diagnosis codes associated with your order, and, where the Laboratory Partner requests it in connection with an order, supporting medical records and clinical notes. Where the Laboratory Partner bills you or your health plan directly, it collects payment, insurance, and eligibility information from you in its own right. Those parties’ own privacy practices, and any applicable HIPAA notice of privacy practices, govern their handling of your information. A business associate agreement is in place between the Company and the Ordering Physician Network. The substantive data-handling terms of the Company’s agreement with the Laboratory Partner are contained in the underlying laboratory services agreement between the Company and the Laboratory Partner.
AI and Health-Platform Technology Provider. The third-party provider of the AI and health-platform technology that supports Eva and our coaching features, Suggestic Inc., solely to operate, secure, and improve those features on our behalf and subject to contractual data-protection obligations. Suggestic Inc. uses OpenAI as a sub-processor to provide the underlying large-language-model technology that powers Eva, and information you provide in Eva interactions — which may include Consumer Health Data — may be processed by that sub-processor in the course of generating Eva’s responses.
Under the terms of the Company’s agreement with the platform technology provider, certain platform-usage metadata—such as interaction patterns, feature-engagement frequency, and protocol-usage metrics generated by users interacting with the platform—may be collected and used by the platform technology provider in connection with operating, securing, and improving its platform. The Company’s no-sale and no-targeted-advertising commitments in Section 6 of this Policy apply to the Company’s own collection, use, and sharing practices. The platform technology provider’s use of platform-usage metadata it independently collects or owns is governed by that provider’s own terms and privacy practices and is outside the scope of the Company’s no-sale commitment.
Payment and E-Commerce Providers. Our E-Commerce Platform Provider, Shopify, Inc. and its payment affiliates (including Shopify Payments (USA) Inc. and Stripe, Inc.), which receive the information necessary to process your subscription, including plan selection that may reveal your enrollment in a health program and therefore constitutes Consumer Health Data. The E-Commerce Platform Provider processes this information as a service provider on our documented instructions, solely as necessary to process your transaction, and subject to contractual data-protection obligations. The E-Commerce Platform Provider’s privacy practices are described in our Privacy Policy.
Legal, Safety, and Compliance Recipients. Governmental authorities, courts, and other parties where we believe in good faith that disclosure is reasonably necessary to comply with applicable law or legal process, to enforce our agreements, or to protect the rights, property, or safety of the Company, our users, or others.
Successors in a Business Transaction. An acquiring or successor entity in connection with an actual or contemplated merger, acquisition, financing, reorganization, or sale of assets, subject to the consent and notice requirements of applicable law and the limitation in Section 6 (we do not sell Consumer Health Data).
Recipients to Whom You Direct or Consent to Disclosure. Third parties with whom you affirmatively direct us to share, or to whom you consent that we share, your Consumer Health Data.

Affiliates. We may share Consumer Health Data with the Company’s corporate affiliates that provide services in support of the Services. As of the date of this Policy, the Company has no corporate affiliates that receive Consumer Health Data.

6. We Do Not Sell Consumer Health Data; No Targeted Advertising

We do not “sell” your Consumer Health Data — meaning we do not exchange it for monetary or other valuable consideration — and we do not share it with advertising or analytics partners for targeted advertising or cross-context behavioral advertising. Because we do not sell Consumer Health Data, we do not seek, and you are not asked to sign, the separate written authorization that applicable state law requires before any sale of Consumer Health Data.

If we ever propose to sell Consumer Health Data, we will first obtain your valid, written authorization that satisfies the specific requirements of applicable law, separately from the consent described in Section 7, and you may decline or revoke that authorization at any time without losing access to any Service for which the sale is not necessary.

7. Your Consent; Withdrawal of Consent

Consent to Collect. Except to the extent the collection is necessary to provide a Service you have requested, or is otherwise permitted by applicable law, we obtain your affirmative, opt-in consent before we collect your Consumer Health Data. We request that consent through a clear, affirmative action, separately from our general Terms of Service and Privacy Policy, and we do not obtain it through a pre-checked box or any deceptive or manipulative interface design.
Consent to Share. Except to the extent the sharing is necessary to provide a Service you have requested, or is otherwise permitted by applicable law, we obtain your separate affirmative, opt-in consent before we share your Consumer Health Data with the categories of recipients described in Section 5. Your consent to share is separate from, and in addition to, your consent to collect.
How to Withdraw Consent. You may withdraw your consent to our collection or sharing of your Consumer Health Data at any time by contacting us as described in Section 14, or through any consent-management tool we make available within the Services. Withdrawing consent is at least as easy as giving it.
Effect of Withdrawal. When you withdraw consent, we will stop the collection or sharing for which consent was withdrawn, and will direct our processors and applicable recipients to do the same, in each case within the time required by applicable law. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, does not require us to undo processing that was necessary to provide a Service you already received, and may mean that we can no longer provide some or all of the Services that depend on the withdrawn data.

8. Your Rights Regarding Consumer Health Data

Subject to applicable law and verification of your identity, you have the following rights with respect to your Consumer Health Data:

Right to Confirm and Access. To confirm whether we are collecting, sharing, or selling your Consumer Health Data and to access that data, including a list of all third parties and affiliates with whom we have shared or to whom we have sold it and an active email address or other online mechanism by which you may contact each such recipient.
Right to Withdraw Consent. To withdraw your consent to our collection and sharing of your Consumer Health Data, as described in Section 7.
Right to Delete. To request that we delete your Consumer Health Data. Upon a valid deletion request, we will delete the Consumer Health Data from our records and will notify all of our processors, affiliates, and the third parties and other recipients with whom we have shared it of the deletion request, and will instruct them to delete the data, in each case to the extent and within the time required by applicable law.
The Company’s deletion cascade to processors and recipients extends to the extent the Company has the contractual right to compel deletion under its agreements with those parties. Where a service provider or technology partner retains independently owned platform-usage metadata under the terms of its agreement with the Company, the Company will use commercially reasonable efforts to cause the recipient to delete data that is linked or reasonably linkable to you, but the Company cannot guarantee deletion of data that the recipient owns independently under the terms of that agreement.
Right to Non-Discrimination. To exercise any of these rights without receiving discriminatory treatment, as described in Section 9.
How to Exercise Your Rights. To exercise any of these rights, contact us using the information in Section 14. We will not require you to create an account in order to make a request, although we may use information associated with an existing account to verify your identity.
Verification. We will take reasonable steps to verify your identity before responding to a request, using information reasonably necessary to confirm that you are the person about whom we hold the Consumer Health Data. If we cannot verify your identity, we may decline the request and will explain why.
Timing. We will respond to your request within forty-five (45) days of receipt. When reasonably necessary, we may extend the response period by an additional forty-five (45) days and will notify you of the extension and the reason for it within the initial 45-day period.
Appeals. If we decline to act on your request, you may appeal our decision by contacting us at info@resetrx.life within a reasonable time. We will respond in writing within the time required by applicable law and will explain the reasons for our decision. If your appeal is denied, you may contact the attorney general of your state to submit a complaint.
Authorized Agents. You may use an authorized agent to submit a request on your behalf where applicable law permits. We may require the agent to provide proof of authorization and may verify your identity directly.

9. Non-Discrimination

We will not discriminate against you for exercising any of the rights described in this Policy — including by denying you the Services, charging you a different price or rate, or providing you a different level or quality of the Services — except to the extent that your withdrawal of consent or deletion request leaves us unable to provide a Service that depends on the affected Consumer Health Data, in which case we may be unable to provide that Service.

10. Data Security

We maintain administrative, technical, and physical safeguards designed to protect Consumer Health Data against unauthorized access, use, disclosure, alteration, and destruction, and we restrict access to Consumer Health Data to those of our personnel, processors, and contractors for whom access is necessary to provide the Services and who are subject to confidentiality obligations. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Our breach-notification practices, including under the FTC Health Breach Notification Rule and applicable state law, are described in our Privacy Policy.

11. No Geofencing

We do not use a geofence to establish a virtual boundary around any facility that provides in-person health-care services in order to identify, track, collect data from, or send notifications, messages, or advertisements to consumers related to their Consumer Health Data. We do not collect precise geolocation data from your device unless you grant us permission to do so.

12. State-Specific Provisions

Washington Residents. If you are a Washington resident, this Policy serves as the consumer health data privacy policy required by the Washington My Health My Data Act, and the rights and obligations it describes — including the consent, withdrawal, access, and deletion provisions and the no-geofencing commitment — apply to you. The Washington My Health My Data Act may be enforced through the Washington Consumer Protection Act.
Nevada Residents. If you are a Nevada resident, the consent, withdrawal, access, deletion, and no-geofencing provisions of this Policy apply to you as required by Nevada’s consumer health data law. Nevada’s law is enforced by the Nevada Attorney General.
Connecticut Residents. If you are a Connecticut resident, your Consumer Health Data is treated as sensitive data under the Connecticut Data Privacy Act, we obtain your consent before processing it as described in Section 7, and you may exercise the rights described in this Policy and in our Privacy Policy. The Connecticut Data Privacy Act is enforced by the Connecticut Attorney General.
Other States. Residents of other states that grant consumer health data rights have those rights to the extent required by, and subject to the conditions of, their respective state laws.

13. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we do, we will revise the “Last Revised” date above and, for material changes affecting Consumer Health Data, provide additional notice and, where required, obtain your renewed consent before the change takes effect. We will not collect, use, or share previously collected Consumer Health Data for materially new purposes without your consent where required by applicable law.

14. Contact Us

If you have questions about this Policy, or wish to exercise any right described in it, please contact us by any of the following means:

By email: info@resetrx.life
By mail: Reset Rx, Inc., Attn: Privacy Officer, 2810 N. Church Street, Suite 578340, Wilmington, Delaware 19802
Through any consumer health data request tool we make available within the Services.

When submitting a request, please include your full name, your state of residence, and a description of your request so that we may verify your identity and respond promptly.

Historical Modifications

July 30, 2026: Initial version posted.