Privacy policy

Privacy Policy

Last revised: July 30, 2026

Reset Rx, Inc., a Delaware corporation doing business as ResetRx (the “Company”, “we”, “us”, or “our”), is committed to protecting the privacy of visitors to our website located at resetrx.life (the “Site”) and of users of our related products and services — including the ResetRx health and wellness platform, the personalized testing and biomarker program, and the Eva AI coaching feature (collectively, the “Services”). This Privacy Policy describes how we collect, use, disclose, and protect “Personal Information” (meaning information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, to you or your household) in connection with our Services, and your choices with respect to your Personal Information. Please read this Privacy Policy carefully before using our Site or Services.

1. About This Policy

This Privacy Policy governs our collection, use, and disclosure of Personal Information in connection with the Site and Services. It is part of a related suite of legal documents that govern your use of the Services, and should be read together with the documents identified in subsection (e) below. Capitalized terms used but not defined in this Privacy Policy have the meanings given in our Terms of Service or our Consumer Health Data Privacy Policy.

  1. Scope. This Privacy Policy applies to Personal Information we collect when you access or use the Site or Services, including information exchanged through email, forms, account onboarding, the Eva coaching interface, and other electronic communications with us. It does not apply to information collected by third parties, including the laboratory, physician, payment, and other third-party services described in this Privacy Policy, each of which is governed by its own privacy practices.
  2. Acceptance. By accessing or using the Site or Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree to the terms of this Privacy Policy, please do not access or use our Site or Services.
  3. United States Only. The Services are intended only for users located in the United States and are not directed to individuals located in the European Union, the United Kingdom, or other non-U.S. jurisdictions. If you are located outside the United States, you should not use the Services or provide us with any Personal Information. See Section 14 (International Users).
  4. Health Information; HIPAA Status. The Company acts as a business associate of the Ordering Physician Network, Kulbersh Health Screening Services, LLC, within the meaning of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”), with respect to protected health information received through the Testing Services. The Laboratory Partner reports your test results to the ordering physician of the Ordering Physician Network, and the Company receives and handles that information in its capacity as the Ordering Physician Network’s business associate. Not all information the Company processes is governed by HIPAA; much of the information you provide is consumer health data or other personal information governed by the Privacy Policy and the Consumer Health Data Privacy Policy rather than by HIPAA. Regardless of whether HIPAA applies to a particular data flow, the Company applies protections to your health-related information that are designed to be consistent with HIPAA-level safeguards, as described in those policies. Where HIPAA applies to information held by the Ordering Physician Network or a covered Laboratory Partner affiliate, that information is governed by HIPAA and by that party’s notice of privacy practices.
  5. Relationship to Other Policies. This Privacy Policy is one of several documents that govern the Services. Your use of the Services is also governed by our Terms of Service, including the Supplemental Eva Terms set out in the Terms of Service. In addition, our collection and use of “Consumer Health Data” — a category defined broadly under the laws of Washington, Nevada, Connecticut, and certain other states — is separately governed by our “Consumer Health Data Privacy Policy”, which supplements this Privacy Policy for residents of those states. In the event of a conflict between this Privacy Policy and the Consumer Health Data Privacy Policy with respect to Consumer Health Data, the Consumer Health Data Privacy Policy controls.

2. Information We Collect

We collect Personal Information in four main ways, as described in this Section: information you provide directly; health and testing information generated through our laboratory and physician partners; information collected automatically when you use our Services; and information we receive from third parties.

  1. Information You Provide Directly. We collect information that you submit to us voluntarily, including the following:
    1. Account and Registration Information. When you create an account or register to use our Services, we collect information such as your name, email address, date of birth or age confirmation, and any other information you provide at registration. The Site uses passwordless authentication; we do not collect or store passwords.
    2. Health, Lifestyle, and Onboarding Information. When you set up and use the Services, we collect the health and lifestyle information you provide through onboarding questionnaires, intake forms, goal-setting, and ongoing use — which may include self-reported health history, symptoms, conditions, medications and supplements, diet, sleep, activity, and similar wellness inputs. This information may reveal or allow inferences about your health and is treated as sensitive.
    3. Eva Interaction Data. When you interact with Eva, our AI coaching feature, we collect the messages, prompts, corrections, and other content you submit, together with the responses generated and related usage data. See Section 3 (How We Use Your Information) and Section 13 (Automated Decision-Making) for how this information is used.
    4. Service-Related Information. When you request, purchase, or use our Services — including selecting a plan or scheduling testing — we collect information necessary to fulfill your request, including your name, contact information, billing or service address, plan selection, and subscription history. Payment card and financial account information is collected and processed exclusively by our third-party payment processor; we do not receive or store that information directly. See Section 12 (Payment Processing).
    5. Communications. When you contact us by email, online form, telephone, or other means, we collect your contact information and the content of your communications, including any attachments, and may retain this information to respond to your inquiry and maintain records of our interactions.
    6. User-Generated Content. If our Services permit you to post, upload, submit, or share content — such as reviews, comments, ratings, profiles, or similar materials — we collect that content when you submit it. Such content may be visible to other users or the public and is subject to our Terms of Service.
    7. Surveys, Promotions, and Other Participation. If you participate in a survey, contest, sweepstakes, promotion, or similar activity we offer, we collect the information you provide in connection with that participation.
  2. Health and Testing Information from Our Laboratory and Physician Partners. To deliver the testing and biomarker features of the Services, we work with one or more laboratory partners and a third-party physician network. Through that workflow, and subject to your authorization in the Terms of Service, we collect and receive the following:
    1. Test Orders and Authorizations. Records relating to the ordering and authorization of your tests, including the test panels selected and the date and status of each order.
    2. Laboratory and Biomarker Results. Test results, biomarker values, and related diagnostic information — including genetic information, where a test panel you select includes a genetic or DNA-based assay — generated by Quest Diagnostics Incorporated (the “Laboratory Partner”) and reported to the ordering physician of the Ordering Physician Network, which the Company receives and makes available to you as described in Section 1(d) and in our Terms of Service.
    3. Clinician-Related Information. Information generated by Kulbersh Health Screening Services, LLC (the “Ordering Physician Network”) in connection with reviewing and authorizing your test orders, to the extent provided to us.
  3. Information Collected Automatically. When you access or use our Services, we and our third-party Service Providers automatically collect certain information about your device, browser, and usage patterns, including the following:
    1. Log and Usage Data. Standard server log information, including your IP address, browser type and version, operating system, referring and exit URLs, pages and features accessed, actions taken on the Site, and timestamps of your access.
    2. Device Information. Information about the device you use to access our Services, including device identifiers, hardware model, and network information.
    3. Connected Device and Wearable Data. If you choose to connect a wearable device or health-data platform — such as Apple Health, Health Connect, Fitbit, or Garmin — we collect the physiological and activity data you authorize that platform to share with us, such as heart rate, sleep, steps, weight, exercise, and similar metrics, for use in the coaching and analytics features of the Services. Health and fitness data you sync from Apple Health or Health Connect is used only to provide and improve the health and wellness features of the Services for you, consistent with the requirements of those platforms. We do not use it for advertising or marketing, we do not sell it, and we do not disclose it to advertising platforms, data brokers, or information resellers. You may disconnect an integration at any time through your account settings or the applicable platform; disconnecting stops future collection but does not delete data already received. See Section 4 and Section 13.
    4. Approximate Location. We may infer your general geographic location (such as city or region) from your IP address. We do not collect precise geolocation data from your device unless you grant us permission to do so.
    5. Cookies and Similar Technologies. We use cookies, web beacons, pixel tags, software development kits (SDKs), and similar tracking technologies to collect information about how you interact with our Services. See Section 5 (Cookies and Tracking Technologies).
  4. Information We Receive from Third Parties. We may receive Personal Information about you from third parties, including the following:
    1. Analytics and Advertising Partners. Third-party analytics providers and advertising partners may provide us with information about users who have interacted with our Site through other platforms or digital properties. These partners currently include Impact (affiliate tracking).
    2. Social Networking Services. If you connect a social networking account (such as a Google or Facebook account) or use a social login feature, we may receive your name, email address, and profile information from that service, whose own privacy policy governs its collection and sharing of your information.
    3. Laboratory, Physician, and Integration Partners. We receive information from the laboratory and physician partners and connected-platform integrations described elsewhere in this Section, in connection with delivering the Services.
    4. Other Sources. We may receive Personal Information from other third-party sources, such as data providers, referral partners, or publicly available sources, and may combine it with other Personal Information we have collected.

3. How We Use Your Information

We use the Personal Information we collect for the following business and commercial purposes:

  1. To Provide and Improve Our Services. To fulfill requests for our Services, deliver your testing and coaching features, process transactions, support the Services, maintain and improve the Site and Services, develop new features, and ensure the technical operation of our systems.
  2. Health and Coaching Personalization. To generate the personalized testing, biomarker, and coaching outputs that are central to the Services — including by processing your onboarding inputs, laboratory results, connected-device data, and Eva interactions to produce recommendations tailored to you.
  3. Communications. To send you transactional and administrative communications (such as order confirmations, receipts, account updates, testing-status notices, and security notices), respond to your inquiries, and provide customer support.
  4. Marketing. Subject to your preferences and applicable law, to send you promotional communications about our Services. You may opt out of marketing communications at any time as described in Section 8.
  5. Eva and Artificial Intelligence. We use the information you provide to and through Eva — together with your health, lifestyle, laboratory, and connected-device data — to operate Eva and generate its coaching outputs. Eva is built on the Suggestic Inc. platform and uses OpenAI as its underlying large-language-model provider. Eva retains memory across sessions, meaning that your prior interactions inform subsequent coaching outputs within your account. We and our AI Service Providers process this information to deliver, personalize, and improve the AI features of the Services. The capabilities and limitations of Eva, including that Eva does not provide medical advice and does not continuously monitor your health, are described in the Supplemental Eva Terms in our Terms of Service and in Section 13 (Automated Decision-Making).
  6. Training and Improvement of AI Models. Subject to your consent where required, we may use information described in this Privacy Policy to train, develop, and improve the artificial-intelligence models and algorithms that power the Services. Before using your information for AI-training purposes, we de-identify or pseudonymize it where reasonably practicable so that it is not used in directly identifiable form for model training. Where the information used for AI-training purposes originates from the testing workflow and is or was protected health information, we de-identify it to a standard consistent with the safe-harbor or expert-determination method under HIPAA (45 C.F.R. § 164.514(b)) before using it for model training, such that the de-identified data is no longer protected health information for purposes of HIPAA or the applicable business associate agreement. You may decline the use of your Personal Information for AI-training purposes, while continuing to use the Services, as described in Section 8. If you request deletion of your Personal Information, we will delete it as described in Sections 6 and 8; however, information already used to train a model in de-identified form generally cannot be removed from a previously trained model, and we will not re-use your identifiable information for further training after your request.
  7. Analytics and Research. To understand how users interact with our Services, measure the effectiveness of our content and campaigns, and conduct research and analysis to improve the Services.
  8. Targeted Advertising. We do not currently use Personal Information collected through our Services to display targeted advertisements to you or to measure their performance. If we do so in the future, together with our advertising partners and using Personal Information such as identifiers and inferred interests, any such use will be subject to the conditions described in Section 5(a)(iv). You have the right to opt out of targeted advertising as described in Sections 5, 8, and 9. We do not use the health, laboratory, biomarker, connected-device, wearable, or Eva-interaction information described in Section 2 for targeted advertising.
  9. Legal Compliance and Protection. To comply with applicable legal obligations; respond to legal process, subpoenas, or government requests; enforce our Terms of Service and other policies; protect the rights, property, and safety of the Company, our users, and others; and detect, investigate, prevent, and address fraud and unlawful activity.
  10. Business Operations. For internal administrative, financial, audit, and record-keeping purposes, and as otherwise necessary to operate our business, fulfill contractual obligations, and maintain the security and integrity of our systems.
  11. Other Purposes. For any other purpose described in this Privacy Policy or disclosed to you at the time of collection, or with your prior consent where required by applicable law.

4. How We Share Your Information

We do not sell your Personal Information to third parties in exchange for monetary consideration. We may share your Personal Information with the following categories of recipients:

  1. Service Providers. We engage third-party companies and individuals to perform functions on our behalf — such as web hosting, data storage, analytics, email and marketing (including Klaviyo), customer support, fraud detection, security operations, and the AI infrastructure supporting Eva (the “Service Providers”). Service Providers access Personal Information only as needed to perform their assigned functions and are contractually required to protect that information in a manner consistent with this Privacy Policy.
  2. Laboratory and Physician Partners. To deliver the testing features of the Services, and subject to your authorization in the Terms of Service, we share and exchange information with our Laboratory Partner and Ordering Physician Network for the purpose of ordering, authorizing, performing, billing for, and reporting your tests. The information we provide for these purposes includes your demographic information; your insurance, health-plan, and eligibility information, including Medicare or Medicaid eligibility where applicable; diagnosis codes associated with your order; and, where the Laboratory Partner requests it in connection with an order, supporting medical records and clinical notes. Where the Laboratory Partner bills you or your health plan directly, it also collects payment, insurance, and eligibility information from you in its own right. Those parties’ own privacy practices, and any applicable HIPAA Notice of Privacy Practices, govern their handling of your information.
  3. AI Service Providers. We share information with the third-party provider(s) of the AI platform and infrastructure that support Eva and our coaching features, solely to operate, secure, and improve those features on our behalf and subject to contractual data-protection obligations. Eva is operated on the Suggestic Inc. platform. Suggestic is contractually restricted from using identifiable health information received from the Company for its own purposes, subject to the terms of its agreement with the Company. Certain categories of data processed through the platform—including non-health onboarding inputs, lifestyle data, Eva conversation content, and inferred or derived data that does not constitute identifiable health information under the terms of the platform agreement—may not be subject to the same contractual restrictions as identifiable health information. Suggestic uses OpenAI as its underlying large-language-model provider; user queries and related data may be transmitted to OpenAI’s API in connection with generating coaching outputs. Information transmitted in connection with Eva interactions may include health-related information that you choose to provide.

    Under the terms of the Company’s agreement with Suggestic Inc., certain platform-usage metadata—such as interaction patterns, feature-engagement frequency, and protocol-usage metrics—may be collected and used by the platform provider in connection with operating, securing, and improving its platform. The Company’s representations in this Privacy Policy regarding the sharing and sale of Personal Information apply to the Company’s own practices; Suggestic’s use of platform-usage metadata it independently collects or owns under the terms of its agreement with the Company is governed by Suggestic’s own terms and privacy practices.

  4. Advertising and Analytics Partners. We work with Impact (affiliate tracking). We may in the future share certain Personal Information — such as hashed email addresses or cookie identifiers — with additional advertising and analytics partners, subject to the conditions described in Section 5(a)(iv). Sharing of Personal Information with advertising partners for cross-context behavioral advertising may constitute “selling” or “sharing” under applicable state privacy law and trigger consumer opt-out rights. See Sections 5, 8, and 9. As described in Section 3, we do not share the health, laboratory, biomarker, connected-device, wearable, or Eva-interaction information described in Section 2 with advertising partners for targeted advertising.
  5. Payment and E-Commerce Processing. Your subscription purchases are processed through our e-commerce and payment providers, which receive the information necessary to complete and service your transaction, including your identity and plan selection. Because plan selection can reveal your enrollment in a health program, we treat the information exchanged in this flow as sensitive and limit it to what is necessary to process your order. See Section 12 (Payment Processing).
  6. E-Commerce Platform Provider. The Site is hosted on, and subscription transactions are processed through, a third-party e-commerce platform. The E-Commerce Platform Provider collects and processes personal information about you in connection with your visits to the Site and your transactions, including identifiers, purchase and transaction information, browsing activity on the Site, device information, and IP addresses. The E-Commerce Platform Provider processes this information as a service provider on our behalf, subject to contractual data-protection obligations and its own privacy policy, available at https://www.shopify.com/legal/privacy/consumers. For information about how the E-Commerce Platform Provider handles your data and how to exercise privacy rights with respect to data it holds, visit https://privacy.shopify.com.
  7. Legal Compliance and Protection. We may disclose Personal Information if we believe in good faith that disclosure is reasonably necessary to: (i) comply with applicable law, regulation, legal process, or governmental request; (ii) enforce our Terms of Service and other agreements; (iii) protect the rights, property, or safety of the Company, our users, or others; or (iv) detect, prevent, or address fraud, security incidents, or other unlawful activity.
  8. Business Transfers. In connection with any actual or contemplated merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, Personal Information may be transferred to or acquired by a successor or acquiring entity. We will provide notice of any such transfer and any material changes to this Privacy Policy as required by applicable law.
  9. With Your Consent. We may share Personal Information with third parties when you have given us your prior express consent or when you affirmatively direct us to make the disclosure.
  10. Aggregated and De-Identified Data. We may share aggregated or de-identified information — information that cannot reasonably be used to identify any specific individual — without restriction for any business purpose. We take reasonable measures designed to ensure that such information remains de-identified in accordance with applicable law.

5. Cookies and Tracking Technologies

We and our third-party Service Providers and advertising partners use cookies and similar tracking technologies in connection with our Services, as described in this Section.

  1. Types of Tracking Technologies. The following types of cookies and similar technologies may be used in connection with our Site:
    1. Strictly Necessary. Technologies required for the Site to function and for you to use its core features, such as authentication, security, session management, and load balancing. These cannot be disabled without impairing your ability to use the Site.
    2. Analytics and Performance. Technologies that collect information about how you use our Site to help us understand and improve its performance and user experience. Our Site also uses hCaptcha for bot detection and fraud prevention on Site forms; hCaptcha may collect device and usage information subject to its own privacy policy and terms of service. The E-Commerce Platform Provider (Shopify) places its own cookies and similar technologies on the Site in connection with analytics, fraud prevention, and platform services. For information about Shopify’s cookies, see https://www.shopify.com/legal/cookies.
    3. Functional. Technologies that enable enhanced functionality and personalization, such as remembering your preferences and settings. Our Site uses Klaviyo, our email and marketing Service Provider, which places an onsite script that records your activity on the Site — including pages viewed and plan-selection activity — and associates that activity with your email profile so that we can personalize the communications we send you. Klaviyo processes this information as a Service Provider on our behalf under a data-processing agreement and is not permitted to use it for its own purposes or to sell or share it. Disabling these may affect aspects of your experience.
    4. Targeting and Advertising. Cookies and similar technologies placed by us or our advertising partners to track your online activity across websites and over time, build a profile of your interests, and serve targeted advertisements on our Site and on third-party platforms. We do not currently deploy any targeting or advertising cookies on the Site. If in the future we elect to deploy additional third-party analytics or advertising software on the Site (such as Google Analytics or Meta Pixel), it will not be activated unless and until you have given affirmative, opt-in consent; it will be excluded entirely from our plan-selection, checkout, and logged-in account pages; and we will continue to honor the Global Privacy Control signal as described in subsection (b) below.
  2. Your Choices. You have several ways to control or limit the use of cookies and similar tracking technologies:
    1. Browser Settings. Most browsers allow you to refuse or delete cookies through their settings. Disabling cookies may impair certain features of our Site.
    2. Global Privacy Control. We honor the Global Privacy Control (GPC) browser signal as a valid opt-out of the sale and sharing of your Personal Information for targeted advertising purposes, to the extent required by applicable law. If your browser or extension supports GPC and you have activated it, we will process your visit as an opt-out request.
    3. Opt-Out of Interest-Based Advertising. You may opt out of interest-based advertising from many networks via the Digital Advertising Alliance (www.aboutads.info) and the Network Advertising Initiative (www.optout.networkadvertising.org). These opt-outs are device- and browser-specific and may not persist after you clear cookies. To opt out of Meta’s use of your data for advertising, visit www.facebook.com/settings/?tab=ads. To opt out of Google’s advertising features, visit adssettings.google.com.

6. Data Retention

We retain Personal Information for as long as reasonably necessary to fulfill the purposes for which it was collected, provide our Services, comply with our legal and contractual obligations, resolve disputes, and enforce our agreements. When Personal Information is no longer required for these purposes, we delete or de-identify it in accordance with our data-management practices and applicable law. The retention periods applicable to our principal categories of Personal Information are:

  1. Account Information — Duration of active account plus three (3) years following account closure or cancellation, to accommodate potential membership renewal.
  2. Health, Laboratory, and Biomarker Results — Duration of active account plus seven (7) years following account closure, to align with applicable medical-record retention obligations and tax/accounting requirements. Laboratory and physician partners may retain their own copies in accordance with their own retention policies and applicable clinical-records laws.
  3. Coaching and Eva-Interaction Data — Duration of active account and thereafter for so long as reasonably necessary to support reactivation of your account, resolve disputes, and comply with our legal obligations.
  4. Connected-Device and Wearable Data — Duration of active account plus two (2) years following account closure or disconnection of the integration.
  5. Payment and Transaction Records — Seven (7) years from the date of the transaction, consistent with IRS record-retention guidance and state tax/accounting requirements.
  6. Device, Log, and Analytics Data — Fourteen (14) months from collection, then deleted or aggregated/de-identified.

Notwithstanding the retention periods stated above, we may retain Personal Information for longer where necessary to comply with a legal obligation, respond to a subpoena or other governmental request, preserve information subject to a litigation hold, establish or defend legal claims, or prevent fraud or abuse. We may retain de-identified or aggregated information indefinitely.

Information held by our third-party service providers and platform partners — including the E-Commerce Platform Provider, the Laboratory Partner, and the Ordering Physician Network — may be retained by those parties in accordance with their own retention policies and applicable law, even after we delete our copy of that information.

7. Data Security and Breach Notification

  1. Our Safeguards. We implement commercially reasonable administrative, technical, and physical safeguards designed to protect your Personal Information against unauthorized access, disclosure, alteration, and destruction. Our security practices include encryption of data in transit using Transport Layer Security (TLS); access controls limiting access to Personal Information to authorized personnel with a need to know; and periodic review of our security practices and systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
  2. Breach Notification. In the event of a security incident affecting your Personal Information, we will notify affected individuals and applicable regulatory authorities as and when required by applicable law. Because we may operate as a vendor of personal health records, our notification obligations may include those of the FTC Health Breach Notification Rule, in addition to applicable state breach-notification laws, including those of California, New York, Washington, and Texas.

8. Your Privacy Rights

Depending on your state of residence, and subject to applicable thresholds, exemptions, and verification requirements, you may have some or all of the rights described in this Section with respect to your Personal Information. California residents have additional rights described in Section 9, and residents of Washington, Nevada, Connecticut, and certain other states have additional rights regarding Consumer Health Data described in our Consumer Health Data Privacy Policy.

  1. General Consumer Rights. Residents of states with comprehensive consumer privacy laws — including (as applicable) California, Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and others — may have the following rights:
    1. Right to Know and Access. To know the categories and specific pieces of Personal Information we have collected, the sources, the purposes of use, and the categories of third parties with whom it is shared or sold, and to receive a portable copy.
    2. Right to Correction. To request that we correct inaccurate Personal Information we hold about you.
    3. Right to Deletion. To request that we delete Personal Information we have collected from you, subject to exceptions permitted by law.
    4. Right to Portability. To receive a copy of Personal Information you provided, in a portable and, where technically feasible, readily usable format.
    5. Right to Opt Out of Targeted Advertising and Sale. To opt out of the “sale” of your Personal Information and its use for “targeted advertising” (also called cross-context behavioral advertising). To exercise this right, see Sections 5(b) and 8(e).
    6. Right to Opt Out of Profiling. To opt out of processing of your Personal Information for profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. See Section 13 (Automated Decision-Making).
    7. Right to Limit Use of Sensitive Data; Right to Withdraw Consent. To direct us to limit our use of sensitive personal information, and to withdraw consent you previously gave to process sensitive data, in each case as provided by applicable law.
    8. Right to Non-Discrimination. Not to receive discriminatory treatment for exercising any of these rights.
  2. Multi-State Opt-Out Enumeration. Residents of the following states have the right, under their respective state laws, to opt out of targeted advertising, the sale of Personal Information, and certain profiling: California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Texas, Virginia, and others as additional state laws take effect. To exercise these rights, use the methods described in Sections 5(b) and 8(e).
  3. Nevada Opt-Out (NRS Chapter 603A). If you are a Nevada consumer, you may submit a verified request directing us not to make any “sale” of certain covered information about you, as “sale” is defined under Nevada law. To submit such a request, contact us using the information in Section 16.
  4. Submitting a Request. To exercise any of these rights, contact us using the information in Section 16 (Contact Us / Privacy Rights Requests). We will verify your identity before fulfilling your request and will respond within the time required by applicable law (typically 45 days, with an extension of up to 45 additional days where reasonably necessary upon prior notice). We may decline requests that are unfounded, excessive, or not required under applicable law.
  5. Appeals. If we deny your request in whole or in part, you may appeal by submitting a written appeal to info@resetrx.life within 60 days of our denial, describing the basis for your appeal. We will respond within the time required by applicable law. If your appeal is denied, residents of states that provide this right may submit a complaint to their state attorney general or applicable authority.
  6. Authorized Agents. In certain states, you may designate an authorized agent to submit a request on your behalf. We may require documentation confirming the agent’s authority and may also verify your identity directly before processing the request.

9. California Privacy Rights (CCPA/CPRA)

This Section applies to residents of California and supplements Section 8. The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), provides California residents with specific rights regarding their Personal Information. For purposes of this Section, “Personal Information” has the meaning given under the CCPA.

  1. Rights of California Residents. In addition to the rights in Section 8, California residents have the right to request disclosure of the specific pieces and categories of Personal Information we have collected, the sources, the business or commercial purpose, and the categories of third parties with whom it is shared; to request deletion and correction, subject to exceptions; to opt out of the “sale” or “sharing” of Personal Information (including sharing for cross-context behavioral advertising, regardless of monetary consideration); and to receive equal service and pricing without discrimination for exercising these rights.
  2. Sensitive Personal Information. The CCPA affords heightened rights with respect to certain categories of “Sensitive Personal Information”, which for ResetRx may include health or medical information; genetic data; precise geolocation (if collected); and the contents of communications not directed to us. California residents have the right to request that we limit our use and disclosure of Sensitive Personal Information to purposes permitted by the CCPA, unless an exception applies.
  3. Sale and Sharing of Personal Information. We have not sold your Personal Information for monetary or other valuable consideration, and we have not shared your Personal Information with any third party for cross-context behavioral advertising. We do not sell or share the health, laboratory, biomarker, connected-device, wearable, or Eva-interaction information described in Section 2 for those purposes. If that changes, we will update this Privacy Policy before any sale or sharing begins and will provide the notice and obtain the consent required by applicable law. A “Do Not Sell or Share My Personal Information” link is available in the footer of our Site, and you may also opt out through a Global Privacy Control signal as described in Section 5(b).
  4. Required CCPA Disclosures. We collect the following categories of Personal Information enumerated in the CCPA: (i) identifiers, such as name, email address, telephone number, account identifiers, and IP address; (ii) customer-records information, such as billing information processed by our Payment Processors; (iii) characteristics of protected classifications, such as age and sex, where you choose to provide them; (iv) commercial information, such as Subscription Plan selection and purchase history; (v) internet or other electronic network activity information, such as usage activity, device data, and cookie data; (vi) sensory or physiological information received from wearable integrations you choose to connect; (vii) inferences drawn from the foregoing, such as wellness-plan personalization; and (viii) Sensitive Personal Information, consisting of health information (including biomarker results, genetic information, and Eva-interaction content). The sources from which each category is collected, the business purposes for which each category is collected and used, and the categories of third parties to which each category is disclosed are described in Sections 2 through 5 of this Privacy Policy, and the retention period or criteria applicable to each category are described in Section 6. Prior to the posting of this version of this Privacy Policy, we have not sold any category of Personal Information for monetary or other valuable consideration, and we have not shared any category of Personal Information for cross-context behavioral advertising. If this changes, we will update these disclosures as described in Section 9(c) before any sale or sharing begins. We update these disclosures at least annually.
  5. Submitting a CCPA Request. California residents may submit a request by emailing us at info@resetrx.life. We will acknowledge receipt within 10 business days and respond to a verified request within 45 calendar days, with one 45-day extension where reasonably necessary upon prior notice. We are not required to respond to more than two requests per California resident within a 12-month period.

10. Children’s Privacy

The Services are intended for users 18 years of age and older and are not directed to children. We do not knowingly collect Personal Information from individuals under the age of 13 without verifiable parental consent as required by the Children’s Online Privacy Protection Act (COPPA). If we learn that we have inadvertently collected Personal Information from a child under 13, we will promptly delete it and, where required, notify the parent or guardian. If you believe a child under 13 has provided us Personal Information, please contact us at info@resetrx.life.

11. Third-Party Links and Services

Our Site and Services may contain links to, or integrations with, third-party websites, applications, and services that we do not own or control — including our laboratory, physician, payment, and connected-device partners. This Privacy Policy does not apply to those third-party services, and we encourage you to review their privacy policies before providing Personal Information to them. For the Company’s disclaimer of liability with respect to third-party sites and services, see the Terms of Service.

12. Payment Processing

Payment transactions made through our Services are processed by our E-Commerce Platform Provider, Shopify, Inc. and its payment affiliates, including Shopify Payments (USA) Inc. and Stripe, Inc. We do not receive, collect, or store your payment card number, bank account credentials, or other sensitive financial data; that information is provided by you directly to the applicable processor and governed by its own privacy policy and security practices. The E-Commerce Platform Provider receives and processes information beyond payment data in connection with your transactions, including your name, contact and billing information, plan selection, browsing activity on the Site, device information, and IP address, as described in Section 4. We may receive limited transaction data — such as a transaction identifier, the last four digits of the card used, billing name and address, plan selected, and order status — solely as necessary to fulfill your order, process returns or refunds, and maintain our records.

13. Automated Decision-Making

We use automated processes, including Eva and related profiling, to generate personalized health-education and lifestyle-coaching recommendations. Eva analyzes the information described in Section 2 — including your onboarding inputs, laboratory and biomarker results, and connected-device data — to produce coaching outputs tailored to you. These outputs are educational and informational; they are not medical advice, diagnosis, or treatment, and Eva does not make eligibility, financial, healthcare-coverage, or other legally or similarly significant decisions about you. The capabilities and limitations of Eva are described in the Supplemental Eva Terms in our Terms of Service.

To the extent our use of Eva’s profiling is subject to opt-out or human-review rights under applicable state law, residents of California, Colorado, Connecticut, and other states may opt out of such automated processing as described in Sections 8 and 9, and may request human review of an automated decision by contacting us at info@resetrx.life.

In addition, the E-Commerce Platform Provider may apply automated processing, including machine learning, to transaction and browsing data collected through the Site in connection with platform services, subject to that provider’s own privacy policy.

14. International Users

This Privacy Policy is directed at users located in the United States, and our Services are operated in the United States. We do not affirmatively direct our Services to individuals in the European Union, the United Kingdom, or other non-U.S. jurisdictions, and we make no representation that our practices comply with the General Data Protection Regulation (GDPR), the United Kingdom GDPR, or the data-protection laws of any jurisdiction outside the United States. If you are located outside the United States and choose to use our Services, your Personal Information will be transferred to, stored, and processed in the United States, where data-protection laws may provide different or lesser protections than those of your home country. By using our Services from outside the United States, you acknowledge that your information will be processed in the United States in accordance with this Privacy Policy.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, our Services, or applicable law. When we do, we will update the “Last Revised” date above. For material changes, we will provide additional notice as required by applicable law, which may include posting a prominent notice on our Site or emailing registered users. Your continued use of our Services following the posting of any update will constitute your acknowledgment of the changes.

16. Contact Us / Privacy Rights Requests

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, or wish to exercise a privacy right described in Sections 8 or 9, please contact us by any of the following means:

  • By email: info@resetrx.life
  • By mail: Reset Rx, Inc., Attn: Privacy Officer, 2810 N. Church Street, Suite 578340, Wilmington, Delaware 19802

When submitting a privacy rights request, please include your full name, your state of residence, and a description of your request so that we may verify your identity and respond promptly.

Historical Modifications

July 30, 2026: Initial version posted.