CA Privacy Policy and Notice of Collection

California Privacy Policy and Notice at Collection

Effective Date: July 10, 2026, Last Reviewed on: July 10, 2026

This California Privacy Policy and Notice at Collection ("Notice") supplements the information contained in the Privacy Notice ("General Privacy Notice") and Well World Mobile App Privacy Notice that are each applicable to Designs for Health, Inc., its subsidiaries, and its other affiliates (collectively, "DFH," "us," "we", or "our"). This Notice applies solely to California residents that are "Consumers" ("consumers" or "you") as defined in the California Consumer Privacy Act of 2018 ("CCPA"). Any terms defined in the CCPA have the same meaning when used in this Notice. In the event of a conflict between this Notice and any other DFH policy, statement, or notice, this Notice will prevail as to California Consumers and their rights under the CCPA.

This Notice covers how we may currently collect, use, disclose, and share California Consumers' "Personal Information" ("PI") as defined by the CCPA, as well as our historical collection, use, disclosure, and sharing of such PI during the twelve months preceding the Effective Date. However, this Notice does not apply to information exempt from the notice obligations of the CCPA, such as (i) medical information governed by the Confidentiality of Medical Information Act and (ii) protected health information that we collect in our capacity as a business associate under the Health Insurance Portability and Accountability Act of 1996 (also known as "HIPAA"). Also, the information we collect about our job applicants, employees, contractors, or other workforce members is posted in the Privacy Notice for Job Applicants and Workforce Members. It is not covered in this California Privacy Policy and Notice at Collection.

Consistent with the CCPA, the term "personal information" as used in this Notice does not include deidentified information. With respect to deidentified information, we: (1) take reasonable measures to ensure that deidentified information cannot be associated or reassociated with the consumer or household that that it was originally about, (2) maintain and use deidentified information only in deidentified form and do not attempt to reidentify it (except as necessary as part of the process of confirming the information cannot be reidentified); and (3) do not disclose deidentified information to any third party unless the third party enters into a contract obligating it to comply with the earlier two points.

Collection, Use, Disclosure, and Sharing of PI

Generally, we collect, retain, use, disclose, and share your PI to provide you with our products and services (collectively, "Services") and as otherwise related to the operation of our business. In addition, we may collect, use, disclose, and share your PI as required or permitted by applicable law, or as directed by you, in accordance with this Notice. More detailed information is provided below.

Collection, Use, and Disclosure of PI

We collect PI from healthcare practitioners, other resellers of our products, and vendors (collectively, "Business Partners") that assist us in providing Services, running our internal business operations, and identifying potential customers. We may also collect PI from you, your device or browser, our corporate affiliates, government entities, social networks, data brokers, and data analytics providers.

We collect, use, and disclose PI for the CCPA-defined business purposes in the bulleted list below, and also for the purposes described in our General Privacy Notice and Well World Mobile App Privacy Notice (our operational purposes) (collectively, our "Business Purposes").

Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards;

Detecting security incidents, protecting against malicious, deceptive, or illegal activity, and prosecuting those responsible for such activity;

Debugging to identify and repair errors that impair existing intended functionality;

Short-term, transient use in which PI is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer's experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction;

Providing Services, including maintaining and servicing your account with us, verifying your information, processing payments, analytic services, and similar functions and services;

Providing advertising and marketing services to you, other than cross-context behavioral advertising;

Undertaking internal research for technological improvement and demonstration;

Quality and safety assurance, and improving, upgrading, and enhancing the Services

The categories of third parties to which we disclose PI for Business Purposes include our Business Partners and government entities. We also disclose PI to service providers and contractors that assist us in providing Services, including technology providers, payment processors, analytics providers, and marketing platforms. The categories of PI disclosed to service providers and contractors for Business Purposes include identifiers, commercial information, internet or similar network activity, and professional information. We make disclosures to government entities, for example, in connection with investigating fraud, enforcing our rights, or as required by law. The table below describes the CCPA-defined categories of PI that we collect, use, and disclose for Business Purposes.

Categories of PI Collected, Used, and Disclosed for Business Purposes

Category of PI

Examples

Identifiers

A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, mobile telephone number, SMS/text message opt-in and consent records, or other similar identifiers.

Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))

Name, signature, physical characteristics or description, address, telephone number, bank account number, credit card number, debit card number, and similar financial information, medical information, or health insurance information.

Protected classification characteristics under California or federal law

Age (40 years or older), medical condition, physical or mental disability, sex (including gender and pregnancy or childbirth and related medical conditions), and genetic information.

Commercial information

Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

Biometric information

Genetic, physiological, behavioral, and biological characteristics

Internet or other similar network activity

Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.

Geolocation data

Physical location or movements.

Sensory data

Audio, electronic, and visual information.

Professional or employment-related information

Professional licensure and other credentials, for instance to verify resellers' status as qualified healthcare practitioners

Inferences drawn from other PI

Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Sensitive Personal Information

We also collect, from the sources earlier described the following CCPA-defined categories of "sensitive personal information," and we disclose the information for Business Purposes to the same categories of third parties identified above. The list below provides more details about the contexts in which this occurs.

With consent, we may collect the social security, drivers' license, state identification card, or passport number of a reseller of our products to investigate fraud or verify his or her identity and/or professional credentials.

A consumer's account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account, for example to process purchases and link them to your account

With consent, a consumer's genetic data, if the consumer submits such data or genetic material for analysis through our Genomic Spotlight® service, described in more detail below.

With consent, a consumer's biometric information, to the extent that you submit urine, stool, or saliva for analysis through our Spotlight Tests, defined below, to the extent such biological samples could have the potential to identify you when used singly or in combination with each other or with other identifying data.

PI collected and analyzed concerning a consumer's health, including for example health and fitness data the consumer inputs into the Well World Mobile App.

We may also collect any of the foregoing categories of sensitive personal information, as well as a consumer's racial or ethnic origin, religious or philosophical beliefs, union membership, sex life or sexual orientation, or the contents of a his or her mail, email, or text messages if: (i) the consumer happens to disclose such PI to our Customer Experience team; (ii) the consumer happens to include such PI in a message or other transfer of information to the consumer's healthcare practitioner via the Well World Mobile App; or (iii) if we collect such PI by subpoena or other legal process due to investigating fraud or enforcing our rights.

We do not use or disclose sensitive personal data for any purposes that would require a consumer to exercise a right to limit processing according to California law. We also do not use automated decision-making technology ("ADMT") to make any significant decision concerning you, as those terms are defined in the CCPA and its implementing regulations, without the opportunity for human review. To the extent we use ADMT in connection with the DFH Sites, such use is limited to website analytics, ad measurement, and security purposes, and does not involve decisions that produce legal or similarly significant effects concerning you.

Deletion of PI After Fulfilling the Purpose of Collection

We delete Your PI after retention of the PI is no longer reasonably necessary to fulfill the purposes for which the PI was collected and in accordance with our Records Retention Policy & Schedule. When assessing retention periods, we examine whether it is necessary to retain the personal data collected and, if retention is required, reasonably endeavor to retain the personal data for the shortest possible period permissible under law. We store your personal information as necessary to comply with our legal obligations, resolve disputes, and enforce and exercise our agreements and rights, or if it is not technically and reasonably feasible to delete your personal information. Please see below for information regarding whether you may be entitled to request that your information be deleted.

Sharing, Cookies, and Similar Technologies

When you use the DFH Sites, we and our Business Partners collect information, which may include PI, from your browser, devices, or apps using a variety of methods, such as cookies, pixel tags, tag management systems (such as Google Tag Manager), retargeting pixels (such as SafeOpt by AddShoppers, Inc.), and other similar technologies. Google Tag Manager is a tag management system that allows us to deploy and manage various tracking technologies on the DFH Sites. SafeOpt is a retargeting platform operated by AddShoppers, Inc. that uses cookies and pixel tags to identify site visitors and deliver personalized offers and marketing communications; for more information, see AddShoppers' privacy policy at https://www.safeopt.com/privacy. We use cookies and these similar technologies for the following Business Purposes:

To analyze and understand how our consumers access, use, and interact with the DFH Sites, and our consumer's preferences (such as country and language choices);

to assess, secure, protect, optimize, and improve the performance of the DFH Sites, enabling us to provide services to our consumers and practitioners and improve their online experience;

to obtain aggregate data about traffic and interaction on the DFH Sites, conduct analytics, identify trends, and obtain statistics;

to target advertising and content across the DFH Sites and third-party sites and services;

to provide or make available certain features or portions of the DFH Sites;

to serve you with relevant ads and content;

to manage, improve, and measure our advertising campaigns;

to match information that we hold with personal information in third-party platforms' databases to create custom audiences and tailor advertising to your interests on the Internet, including social media; and

as necessary to respond to your requests.

Some of these activities require us to share the categories of PI listed in the chart below. The categories of third parties with which we share the PI include advertising networks, data analytics providers, social networks, retargeting and identity resolution platforms (such as AddShoppers/SafeOpt), and data brokers, each of which may use this information for their own advertising and marketing activities.

Categories of PI Shared for Business Purposes

Category of PI

Examples

Identifiers

IP address, unique cookie identifier and information obtained through cookies; unique device identifier and device type

Commercial information

Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

Internet or other similar network activity

Domain, browser type, language, operating system, system settings, previously visited websites, referring URLs, and information about your interaction with the DFH Sites such as click behavior, search history, purchases and indicated preferences, and access times

Geolocation data

Country and time zone

Inferences drawn from other PI

Profile reflecting consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes

To be clear, DFH does not disclose your PI to third parties in exchange for money or similar compensation, and we do not sell or share: (i) sensitive personal information; (ii) PI about individuals who we have actual knowledge are, or who we reasonably should know to be, under the age of 16; (iii) your health, fitness, or activity information obtained from the Well World Mobile App; or (iv) any information derived from your submission of biological samples for laboratory analysis using the Spotlight Tests (defined below). Additionally, we do not share PI to the extent doing so is prohibited by law. Consistent with amended CCPA regulations, we treat personal information of consumers we have actual knowledge are under 16 years of age as sensitive personal information. Please see "CCPA Privacy Rights" below for information regarding exercising your rights to opt-out of data sharing.

SMS/Text Message Marketing Program

We offer an SMS/text message marketing program (the "SMS Program") that allows you to receive recurring marketing, promotional, and transactional text messages from DFH. Participation in the SMS Program is entirely voluntary. We collect and use your mobile phone number and related SMS opt-in and consent records only after you provide express written consent to receive text messages at the point of sign-up, following the notice and consent process presented to you at that time. By enrolling, you agree to receive autodialed or automated recurring text messages at the mobile number you provide; consent is not a condition of purchasing any goods or services.

Message frequency varies. Message and data rates may apply. You may reply STOP at any time to unsubscribe and cancel your participation in the SMS Program, or reply HELP for assistance. You may also contact us using the information in the "Contact Information" section below.

We will not share, sell, rent, or transfer your mobile phone number or your SMS opt-in data or consent information to any third parties or affiliates for their marketing or promotional purposes. Any sharing of your mobile phone number is limited to service providers or vendors acting on our behalf solely to operate, deliver, and support the SMS Program (for example, our text-messaging platform provider), and such providers are contractually restricted from using this information for any other purpose. This commitment applies regardless of any other data-sharing practices described in this Notice.

Spotlight Tests

We offer, Genomic Spotlight®, Metabolomics Spotlight®, and GI Spotlight® (collectively, "Spotlight Tests") for purchase by healthcare practitioners. The Spotlight Tests enable you to submit your saliva, urine, stool, or other kinds of biological samples for laboratory analysis and generate data your practitioner may use to offer you health insights and recommendations regarding nutritional supplements and lifestyle changes. Based on the data, your practitioner may recommend that you purchase additional products or services, which may include supplements manufactured by or for DFH. We partner with Diagnostic Solutions Laboratory, LLC ("DSL") and Datapunk Bioinformatics LLC ("Datapunk") to provide these services to your practitioner. DFH, DSL, and Datapunk will not share your sample, or any PI derived from it, with any other person except for service providers or contractors that DFH, DSL, or Datapunk engage solely for assistance in performing these services for you. DFH, DSL, Datapunk, and their service providers and contractors will not use or retain your sample or PI except as necessary to facilitate your practitioner's analysis of the lab data, to comply with legal obligations, or for business purposes permitted by law, such as improving platform functionality. As to each sample collected for genomic analysis, for example, DSL will retain the sample for one month after completing testing, upon which the sample will be destroyed as biomedical waste. If you need to exercise any applicable data privacy rights, such as data deletion requests, regarding your biological sample or the data derived from it, please do not contact DFH directly. Please contact your practitioner, who can ensure that valid requests are forwarded to DFH, DSL, and Datapunk as applicable.

CCPA Privacy Rights

California Consumers have the right to exercise certain privacy rights under the CCPA. California Consumers may exercise these rights via an authorized agent who meets the agency requirements of the CCPA. Any request you submit to us, other than a request to opt-out of the sale or sharing of your PI or to limit the use and disclosure of your sensitive PI, is subject to an identification and residency verification process ("Verifiable Consumer Request"). We will not fulfill your CCPA request to know, delete, or correct unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI. We will not require you to verify your identity, create an account, or complete any unnecessary step in order to process a request to opt-out of the sale or sharing of your PI.

Unless you have provided us with your email address (such as by signing up for an account on the Service), we will be unable to verify your identity to fulfill a request to know, delete, or correct. As a result, to exercise certain CCPA rights, such as your rights to know, delete, or correct, we must be able to verify your identity as the owner of the email address and/or DFH account that is associated with your request. We may not be able to fulfill your request until we can do so. In general, we verify identity by confirming that you are the owner of the email address. We reserve the right to ask you to provide additional information in order to help verify your identity.

Some personal information we maintain about Consumers is not sufficiently associated with a Consumer for us to be able to verify that it is a particular Consumer's personal information (e.g., clickstream data tied only to a pseudonymous browser ID). As required by the CCPA, we do not include that personal information in response to Verifiable Consumer Requests. If we cannot comply with a request, we will explain the reasons in our response.

We will make commercially reasonable efforts to identify Consumer PI that we collect, process, store, disclose, share, and otherwise use and to respond to your California Consumer privacy rights requests. We will typically not charge a fee to fully respond to your requests, but we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, repetitive, unfounded, or overly burdensome.

A. The Right to Know

1. Categories

You have the right to send us a request, no more than twice in a twelve-month period, for any of the following for the period that is twelve months prior to the request date, and, if you so request, for the period on or after January 1, 2022:

The categories of PI we have collected about you.

The categories of sources from which we collected your PI.

The business or commercial purposes for our collecting or selling your PI.

The categories of third parties to whom we have shared your PI.

A list of the categories of PI disclosed for a business purpose in the prior 12 months, or that no disclosure occurred.

2. Specific Pieces

You have the right to make or obtain a transportable copy, no more than twice in a twelve-month period, of your PI that we have collected in the period that is 12 months prior to the request date, or, if you so request, on or after January 1, 2022, and are maintaining.

Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant going back 12 months prior to the request.

B. The Right to Deletion

Except to the extent we have a basis for retention under the CCPA, you may contact us at the phone number or email address posted below to request that we delete your PI that we have collected directly from you and are maintaining. Our retention rights include, without limitation, to complete transactions and services you have requested or that are reasonably anticipated, for security purposes, for legitimate internal business purposes, including maintaining business records, to comply with law, to exercise or defend legal claims, and to cooperate with law enforcement. Note also that we are not required to delete PI that is publicly available, and we are not required to delete lawfully obtained, truthful information that is a matter of public concern.

You may alternatively exercise more limited control of your PI by instead by canceling or modifying our email marketing communications you receive from us. You can do so by following the instructions contained within our promotional emails. This will not affect subsequent subscriptions and if your opt-out is limited to certain types of emails the opt-out will be so limited. Please note that we reserve the right to send you certain communications relating to your account or use of our Service, such as administrative and service announcements and these transactional account messages may be unaffected if you choose to opt-out from receiving our marketing communications.

C. The Right to Opt Out of Sale or Sharing of PI

We do not knowingly "sell" PI that we collect from you, in accordance with the definition of "sell" in the CCPA, and therefore will not treat personal information we collect from you as subject to a do not sell request.

You have the right to opt-out of sharing your PI with third parties for cross-context behavioral advertising. You may exercise this right by clicking the "Do Not Sell or Share My Personal Information" link on our website or by contacting us using the information in the "Contact Information" section below; you do not need to create an account with us to submit an opt-out request, and we will confirm to you that your request has been processed. Adjusting the settings on your browser may also help you exercise control over browser-based cookies and other sharing. Additionally, we provide access to privacy information related to browsers and cookies and, if available, opt-out programs here. We do not represent that the third-party tools, programs, or statements referenced in our General Privacy Notice are complete or accurate. For the avoidance of doubt, as described in the "SMS/Text Message Marketing Program" section above, we do not share, sell, rent, or transfer your mobile phone number or your SMS opt-in or consent data to any third parties or affiliates for their marketing or promotional purposes. You may withdraw your consent and stop receiving text messages at any time by replying STOP.

Another option that may be available for you to exercise your right to opt-out of sharing is to engage Global Privacy Control ("GPC") settings. On browsers, browser extensions, or devices that support GPC functionality, it can generally be engaged by manipulating the browser or device settings. When we detect a valid GPC or other opt-out preference signal, we will process it as a request to opt out of the sale or sharing of your PI associated with the browser or device from which the signal was sent, and, where we can reasonably associate that browser or device with a consumer account or other identifier by which we know you, we will apply your opt-out to your account across all associated browsers and devices. We will also provide a means for you to confirm that your opt-out request has been processed. Not all websites respond to GPC signals in the same way.

We may disclose your PI for the following purposes, which are not a sale: (i) if you direct us to share PI; (ii) to comply with your requests under the CCPA; (iii) disclosures amongst the entities that constitute DFH as defined above; (iv) as part of a merger or asset sale; and (v) as otherwise required or permitted by applicable law.

D. The Right to Correct Inaccurate PI

You have the right to ask that we correct the personal information we may have collected about you if that information is inaccurate. To correct your PI, please revise the PI yourself by logging into your account or, if that is not possible, please reach out to us at the contact information below.

E. The Right to Non-Discrimination

We will not discriminate against you in a manner prohibited by the CCPA because you exercise your CCPA rights. However, we may charge a different price or rate, or offer a different level or quality of good or service, to the extent that doing so is reasonably related to the value of the applicable data.

F. The Right to Limit the Use and Disclosure of Sensitive Personal Information

California Consumers have the right to limit the use and disclosure of their sensitive personal information to those uses that are necessary to perform the services or provide the goods reasonably expected by an average consumer, and to certain other purposes permitted under the CCPA (such as security, fraud prevention, and short-term, transient use). As described above under "Sensitive Personal Information," we do not use or disclose sensitive personal information for purposes that would require us to offer you the ability to limit such use, and therefore we are not required to provide a "Limit the Use of My Sensitive Personal Information" link. If our practices change such that this right becomes applicable, we will update this Notice and provide the means to exercise it.

Data Security and Breach Notification

We maintain reasonable administrative, technical, and physical safeguards designed to protect your PI against unauthorized access, use, or disclosure. In the event of a breach of the security of the system involving your PI, we will notify affected California residents in the most expedient time possible and without unreasonable delay, and in any event within 30 days after discovery of the breach, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system, as required by applicable California law.

Other California Privacy Rights

It is our understanding that "California's "Shine the Light" law (Civil Code Section § 1798.83) may require certain covered businesses, in response to a consumer request, to provide either: (i) information about the business's disclosure of the consumer's PI to third parties for those third parties' direct marketing purposes, or (ii) a cost-free opportunity to opt out of such disclosures. DFH is not covered by "Shine the Light" because it is and has been DFH's policy not to disclose your PI to any third party that we know or reasonably should know intends to use your PI for the third party's direct marketing purposes, as those terms are defined by Shine the Light. Therefore, there is no need to submit Shine the Light Requests to DFH. Please note that because consumers' rights under Shine the Light and the CCPA are not the same and exist under different laws, DFH may not respond to requests that indicate "Shine the Light" in the subject line or body of the request.

Changes to Our Privacy Notice

We reserve the right to amend this Notice at our discretion and at any time. When we make changes to this Notice, we will post the updated notice on the Website and update the Notice's effective date. This includes any changes to the terms of our SMS/Text Message Marketing Program; material changes affecting the SMS Program will be communicated in accordance with applicable law and, where required, your renewed consent will be obtained. Your continued use of our Website following the posting of changes constitutes your acceptance of such changes.

Contact Information

If you have any questions or comments about this Notice, the ways in which we collect and use your information described here and in the General Privacy Notice or Well World Mobile App Privacy Notice, including our SMS/Text Message Marketing Program, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:

Phone: 1-800-847-8302

Website: www.designsforhealth.com

Email: techsupport@designsforhealth.com

Postal Address: Designs for Health, Inc. Attn: Customer Experience Department 31 Lupi Court, Suite 110 Palm Coast, FL 32137 USA

To complete your request, you will be required to respond to any follow up inquires we may make, and we may deny your request if you do not do so.

You may use an authorized agent to submit a consumer rights request. If you use an authorized agent to submit a request, we may require proof that the agent has been authorized by you to do so, and take other steps permissible under the CCPA, to ensure it is a proper request by an authorized agent.