Consumer Health Data Privacy Policy
Last Updated: July 28, 2026
Effective Date: July 28, 2026
This Consumer Health Data Privacy Notice ("Notice") is published by UNI NUTRITION INC. (d/b/a Hexabiome), a corporation incorporated in the Province of British Columbia, Canada. UNI NUTRITION INC. does not maintain a registered U.S. corporate entity. However, because we collect and process consumer health data of residents of Washington State and Nevada through our online activities, we comply with the MHMDA and Nevada SB 370 to the extent they apply to our operations.
This Notice explains how UNI NUTRITION INC. (d/b/a Hexabiome) collects, uses, discloses, and protects consumer health data as defined under applicable privacy laws. It applies only to information that qualifies as consumer health data under those laws.
This Notice supplements — but does not replace — our general Privacy Policy, and should be read together with our Privacy Policy and Cookie Policy. If information falls within both this Notice and our Privacy Policy, we apply the protections and rights described in this Notice in addition to those described in our Privacy Policy.
Hexabiome is a dietary supplement company and is not a healthcare provider. We do not provide medical diagnosis, treatment, or healthcare services, and we do not require consumers to provide health information to purchase our products.
Applicable State Laws. This Notice is designed to comply with:
• The Washington My Health MY Data Act ("MHMDA," RCW 19.373, effective July 23, 2023), which applies to Washington State residents; and
• Nevada Senate Bill 370 ("Nevada SB 370," NRS Chapter 603B, effective June 12, 2023), to the extent Hexabiome conducts business in Nevada, targets Nevada residents, or processes the consumer health data of Nevada residents. UNI NUTRITION INC. evaluates its status as a "regulated entity" and, where applicable, a "small business" under Nevada SB 370 based on the number of Nevada consumers whose consumer health data we process annually, and reassesses this determination at least annually.
This Notice is primarily designed to comply with the MHMDA and Nevada SB 370. It may also be interpreted in harmony with other state privacy laws that classify health-related information as sensitive data, including (without limitation) the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CPRA"), the Colorado Privacy Act, and the Connecticut Data Privacy Act. Residents of states not listed above should refer to our general Privacy Policy for rights under applicable state comprehensive privacy laws.
This Notice will be updated as additional state consumer health data laws take effect.
Why Hexabiome is covered. Hexabiome operates https://hexabiome.com, a Shopify-based online store selling Morning Clarity, a dietary supplement containing probiotic ingredients positioned around the gut-brain axis and cognitive wellness. The purchase, browsing, and interest data generated when consumers interact with our Site may identify or reasonably infer a consumer's interest in cognitive wellness, gut health, microbiome support, or stress management. Depending on the nature of the information collected, the context in which consumers interact with our Site, and applicable legal requirements, certain purchase, browsing, or interaction data may constitute Consumer Health Data under applicable laws, even when such information is inferred rather than obtained from clinical records. Hexabiome's product positioning within the gut-brain wellness category may bring certain Hexabiome activities within the scope of these laws, depending on applicable legal requirements and the nature of our data processing activities.
What we do not collect. Hexabiome does not intentionally collect:
• medical records;
• diagnosis information;
• treatment information;
• prescription information;
• laboratory or test results;
• genetic information; or
• healthcare provider records.
What we do not do with Consumer Health Data. We do not use Consumer Health Data to:
• diagnose medical conditions;
• provide medical advice;
• make healthcare decisions;
• determine insurance eligibility; or
• provide healthcare services.
Marketing and advertising technologies. Where we use marketing or advertising technologies, we do so in accordance with applicable privacy laws and your consent choices. Specifically:
• where such technologies are used, and where required by applicable law, they operate only after you provide consent through the cookie preference controls provided on our Site;
• we do not intentionally configure advertising technologies to collect Consumer Health Data; and
• where we implement measures to exclude health-related data parameters from advertising technologies, we will describe those measures accurately once they are in place.
Because our products are dietary supplements, information about your interactions with product pages may nonetheless be capable of supporting inferences about wellness interests. We address this through the consent and authorization requirements described in this Notice rather than by representing that no such inference is ever possible.
Relationship to our Privacy Policy. In the event of a conflict between this Notice and our general Privacy Policy with respect to consumer health data, this Notice controls.
If you do not want Hexabiome to collect or process your consumer health data beyond what is strictly necessary to fulfill your order, please contact support@hexabiome.com before placing an order or using our Site.
1. Definitions
"Hexabiome," "we," "us," or "our" means UNI NUTRITION INC., doing business as Hexabiome.
"Consumer" means a natural person residing in a U.S. state whose consumer health data law applies to Hexabiome's activities, including Washington State and Nevada.
"Consumer Health Data" means personal information that is linked or reasonably linkable to a Consumer and that identifies, or that a reasonable person would conclude is used to identify, the Consumer's past, present, or future physical or mental health status. This includes:
These categories describe information covered by applicable consumer health data laws. They do not mean that Hexabiome requests or collects medical records, diagnoses, or clinical information as part of normal product purchases.
• Health conditions, diseases, diagnoses, or related symptoms;
• Social, psychological, or behavioral health-related attributes;
• Use, purchase, or acquisition of dietary supplements or other health products;
• Bodily functions, vital signs, or physical symptoms that identify or infer health status;
• Data that is used or could reasonably be used to infer a health-related product interest; and
• Any inferences drawn from non-health data to derive health-related characteristics.
"Collect" means to buy, rent, access, retain, receive, acquire, infer, derive, or otherwise obtain Consumer Health Data by any means.
"Process" or "Processing" means any operation performed on Consumer Health Data, whether or not by automated means, including collection, storage, use, disclosure, combination, deletion, or destruction.
"Share" means to disclose, release, transfer, disseminate, make available, license, or otherwise communicate Consumer Health Data to a third party. Under applicable consumer health data laws, transmitting Consumer Health Data to an advertising or analytics platform that uses it for retargeting, performance measurement, or audience development may constitute "sharing."
"Sell" means to exchange Consumer Health Data for monetary consideration or other valuable consideration. For purposes of this Notice, the receipt of services — including advertising targeting, platform features, or audience development benefits — may constitute "other valuable consideration." Hexabiome structures its third-party relationships to avoid arrangements that would constitute a "sale" of Consumer Health Data under applicable law.
"Authorization" or "Consent" means a freely given, specific, informed, and unambiguous affirmative act by a Consumer signifying agreement to the Processing of Consumer Health Data for a stated purpose. Consent may not be obtained through pre-checked boxes, dark patterns, or bundling with other consents. Hexabiome presents Consumer Health Data authorization requests in a separate, clearly labeled interface that is not bundled with general marketing consents, terms of sale, or other unrelated permissions.
"Service Provider" means a third party that Processes Consumer Health Data solely on Hexabiome's behalf pursuant to a written data processing agreement that prohibits the third party from Selling or Sharing the data for its own business purposes.
2. Categories of Consumer Health Data We Collect
The following table identifies categories of information that Hexabiome may collect and that may constitute Consumer Health Data depending on applicable law and the context of processing, for Washington State and Nevada residents.
• Category: Health product purchase history — Specific Examples: Purchases of Morning Clarity — Why It Qualifies as Consumer Health Data: Identifies acquisition of a product that supports cognitive and digestive wellness
• Category: Health-related browsing behavior — Specific Examples: Pages viewed on gut-brain axis, stress resilience, microbiome health, or probiotic topics — Why It Qualifies as Consumer Health Data: Reveals interest in health-related topics or conditions
• Category: Shopping cart and search activity — Specific Examples: Products added to cart; search queries for wellness or supplement terms — Why It Qualifies as Consumer Health Data: Identifies intent to acquire health products
• Category: Customer support communications — Specific Examples: Product experience feedback, wellness-related questions, or other information voluntarily provided by consumers — Why It Qualifies as Consumer Health Data: May directly disclose health-related information
• Category: Subscription and reorder history — Specific Examples: Recurring purchases of a cognitive wellness supplement — Why It Qualifies as Consumer Health Data: Infers ongoing use of a health product
• Category: Newsletter and communications preferences — Specific Examples: Email signup for microbiome, wellness, or cognition content — Why It Qualifies as Consumer Health Data: Infers interest in health topics
• Category: Inferred health characteristics — Specific Examples: Inferences about gut health interest, cognitive wellness concern, or probiotic use derived from the above — Why It Qualifies as Consumer Health Data: Derived health data
• Category: Device and location identifiers — Specific Examples: IP address, device ID — used to determine state of residence for compliance — Why It Qualifies as Consumer Health Data: Used to assess whether consumer health data laws apply
We collect Consumer Health Data only to the extent reasonably necessary for the purposes stated in Section 4. We do not collect additional categories without updating this Notice.
3. Sources of Consumer Health Data
Directly from you, when you:
• Place an order for Morning Clarity on our Site;
• Create an account or enroll in our Subscribe & Save program;
• Subscribe to our newsletter or respond to a promotional popup;
• Contact our customer support team by email; or
• Submit a product review or testimonial.
Automatically from your device and browser, using:
• Cookies and similar tracking technologies placed by our Site;
• Our e-commerce platform (Shopify) for checkout and session management;
• Analytics and advertising tools (Google Analytics 4, Meta Pixel, Shopify Analytics); and
• Email marketing technology (Klaviyo) for email engagement tracking.
From our Service Providers, including:
• Shopify, which shares order, account, and browsing data with us as part of platform operation; and
• Klaviyo, which provides email delivery and tracks engagement metrics.
We do not purchase Consumer Health Data from data brokers or third-party commercial data sources.
4. Purposes for Processing Consumer Health Data
Hexabiome Processes Consumer Health Data only for the following purposes. Where applicable law requires Consumer authorization before Processing, we will obtain that authorization before Processing begins.
• Purpose: Order fulfillment — Description: Processing and shipping your purchase of Morning Clarity — Authorization Required?: No — necessary to perform the contract
• Purpose: Subscription management — Description: Managing your Subscribe & Save enrollment, billing cycles, and cancellations — Authorization Required?: No — necessary to perform the contract
• Purpose: Customer service — Description: Responding to inquiries, processing returns, and resolving complaints — Authorization Required?: No — strictly necessary to fulfill the requested product or service
• Purpose: Fraud prevention and security — Description: Detecting and preventing fraudulent transactions and unauthorized account access — Authorization Required?: No — strictly necessary to safely complete the requested transaction
• Purpose: Legal compliance — Description: Complying with applicable laws, regulations, court orders, and legal process — Authorization Required?: No — legal obligation
• Purpose: Email marketing and newsletters — Description: Sending promotional content to consumers who have opted in — Authorization Required?: Yes — affirmative opt-in required; separate from Consumer Health Data authorization
• Purpose: Site analytics and improvement — Description: Understanding how consumers use our Site using tools such as Google Analytics 4, Meta Pixel, Shopify Analytics — Authorization Required?: Yes — required for WA and NV residents when analytics tools receive Consumer Health Data
• Purpose: Targeted advertising and retargeting — Description: Delivering or measuring advertising based on health product interactions or inferred health interests — Authorization Required?: Yes — written authorization required before Consumer Health Data is transmitted to advertising partners
5. Legal Basis for Processing
Hexabiome Processes Consumer Health Data only where at least one of the following bases applies:
Consumer Authorization. For Processing that is not strictly necessary to fulfill an order or comply with law — particularly analytics, personalization, and advertising — we rely on your affirmative written authorization obtained through our on-site authorization tool. You may withdraw authorization at any time as described in Section 7. Withdrawal does not affect the lawfulness of prior Processing.
Performance of a Contract. When you place an order or subscribe to a program, we Process Consumer Health Data to the extent necessary to complete that transaction and provide the requested service.
Legal Obligation. We may Process Consumer Health Data to comply with applicable laws, court orders, regulatory requirements, or other enforceable governmental demands.
Strictly Necessary to Provide a Requested Product or Service (limited scope). Where permitted by applicable law, we may Process limited Consumer Health Data without prior authorization when doing so is strictly necessary to: (a) fulfill a specific product or service you have requested, including the safe completion of your transaction; (b) prevent fraud or ensure payment security in direct connection with your requested purchase; or (c) comply with a legal obligation. This basis is narrowly construed and does not extend to analytics, advertising, personalization, or marketing. Hexabiome does not rely on broad "legitimate interest" concepts as a legal basis for Processing Consumer Health Data.
1. How We Share Consumer Health Data
Hexabiome does not Share Consumer Health Data except as described in this Section.
With Service Providers (no Consumer authorization required):
We Share Consumer Health Data with the following categories of Service Providers that Process data solely on our behalf under written agreements prohibiting them from using the data for their own purposes.
• Category: E-commerce platform — Examples: Shopify — Purpose: Checkout, order management, account operations
• Category: Email and marketing platform — Examples: Klaviyo — Purpose: Email delivery, list management, engagement tracking
• Category: Payment processors — Examples: Integrated via Shopify — Purpose: Payment authorization, fraud detection
• Category: Fulfillment and logistics — Examples: Shipping carriers, 3PL providers — Purpose: Order shipping and delivery
• Category: Cloud infrastructure — Examples: Hosting and storage providers — Purpose: Secure data storage and Site operation
• Category: Customer support software — Examples: Help desk and ticketing systems — Purpose: Customer inquiry and case management
With Advertising and Analytics Partners (Consumer authorization required):
We do not transmit Consumer Health Data to the following third parties unless required authorization has been obtained under applicable law.
• Category: Analytics providers — Examples: Google Analytics 4, Shopify Analytics — Purpose: Site performance measurement and improvement
• Category: Advertising platforms — Examples: Meta Pixel — Purpose: Advertising measurement and campaign performance evaluation
Washington State and Nevada residents who have not authorized these disclosures will not have their Consumer Health Data transmitted to advertising or analytics partners.
Where Hexabiome transmits Consumer Health Data to analytics or advertising partners pursuant to Consumer authorization, we require such partners to act as Service Providers under written contracts that: (i) prohibit them from using Consumer Health Data for their own independent business purposes, building profiles for other advertisers, or any purpose beyond the specific measurement or delivery purpose for which authorization was obtained; and (ii) require equivalent security standards.
Affiliates:
UNI NUTRITION INC. does not currently operate U.S. affiliates that receive Consumer Health Data. This Notice will be updated if affiliate sharing begins.
Legal Disclosures:
We may disclose Consumer Health Data when required by applicable law, valid court order, subpoena, regulatory demand, or to protect the safety of any individual.
Corporate Transactions:
In connection with a merger, acquisition, reorganization, or sale of assets, Consumer Health Data may be transferred to a successor entity. We will provide notice and, where required by applicable law, obtain Consumer authorization before such transfer.
7. We Do Not Sell Consumer Health Data
Hexabiome does not Sell Consumer Health Data.
Hexabiome does not Share Consumer Health Data with third parties except:
• With Service Providers operating under written data processing agreements (Section 6);
• With advertising and analytics partners after receiving Consumer written authorization (Section 6);
• Where required or expressly permitted by applicable law; or
• In connection with a corporate transaction as described in Section 6.
In addition, Hexabiome:
• Does not use Consumer Health Data to create or upload custom audiences, lookalike audiences, or similar audience segments on advertising platforms without explicit Consumer authorization where required by applicable law; and
• Prohibits its advertising partners from using Consumer Health Data received from Hexabiome to build generalized profiles, audience segments, or data products for other advertisers or third parties.
8. Your Consumer Rights
Washington State residents have rights under the MHMDA (RCW 19.373.020). Nevada residents have rights under Nevada SB 370. These rights are described below. These rights are in addition to, and do not limit, rights available under our general Privacy Policy or other applicable law.
Right to Confirm and Access (MHMDA § 19.373.020(1)(a)–(b); NRS 603B.350)
You have the right to confirm whether Hexabiome is Processing Consumer Health Data about you and to receive a copy of that data in a portable, readily usable format.
Right to Delete (MHMDA § 19.373.020(1)(c); NRS 603B.350)
You have the right to request deletion of Consumer Health Data we have collected about you. We will comply and will instruct our Service Providers and authorized third parties to delete as well, unless retention is required by law (for example, for tax, legal, or dispute resolution purposes).
Right to Withdraw Authorization (MHMDA § 19.373.030(5))
You have the right to withdraw your authorization for any Processing of Consumer Health Data at any time. Withdrawal is prospective only and does not affect prior lawful Processing. We will honor withdrawal requests within 30 days.
Right to Obtain a List of Third Parties (MHMDA § 19.373.020(1)(d))
Washington State residents have the right to receive a list of all third parties and affiliates to which Hexabiome has disclosed Consumer Health Data, including the specific data disclosed and the reason for each disclosure.
Right to Review and Request Correction (Nevada SB 370, NRS 603B.350; voluntarily extended to all Consumers)
Where applicable under Nevada SB 370, Nevada residents may request access to and correction of Consumer Health Data maintained by Hexabiome (NRS 603B.350). Hexabiome voluntarily extends this right to all Consumers as a matter of best practice. This correction right is not expressly required under all applicable consumer health data laws, including the MHMDA, and is provided voluntarily to promote data accuracy and transparency.
If you believe Consumer Health Data we hold about you is inaccurate, please contact support@hexabiome.com with a description of the inaccuracy. We will honor correction requests where feasible and consistent with our legal obligations and recordkeeping requirements. If we are unable to fulfill a correction request, we will notify you and explain the reason.
Right to Non-Discrimination
Hexabiome will not deny you products or services, charge you a different price, or provide you a lower quality of service because you exercised any right under this Notice or applicable law.
Right to Appeal
If we decline your request, you may appeal as described in Section 9.
Right to File a Complaint
If you are dissatisfied with our response:
• Washington State: File a complaint with the Washington State Attorney General at www.atg.wa.gov (https://www.atg.wa.gov).
• Nevada: File a complaint with the Nevada Attorney General at ag.nv.gov (https://ag.nv.gov).
Private Right of Action (Washington State only)
Violations of the MHMDA constitute per se violations of the Washington Consumer Protection Act (RCW 19.86). Washington State residents may bring individual civil claims.
9. How to Submit a Rights Request
To exercise any right described in Section 8, contact us:
Email: support@hexabiome.com
Subject line: "Consumer Health Data Request — describe the right you are exercising"
For general inquiries, visit our Contact Us (https://hexabiome.com/pages/contact) page.
Please include in your request:
10. Your full name;
11. The email address associated with your Hexabiome account, if any;
12. Your U.S. state of residence (Washington State, Nevada, or other, as applicable);
13. The specific right or rights you wish to exercise; and
14. Any additional information needed to locate and process your request.
Identity Verification. To protect your privacy, we will verify your identity before processing your request. We will confirm information already associated with your account and may request limited additional identifying information. We will not retain verification information beyond the period needed to complete verification.
Response Timeline. We will respond within 45 days, with one additional 45-day extension where permitted by applicable law. If we need the extension, we will notify you before the initial period expires and explain the reason.
No Fee. We will not charge a fee unless your request is manifestly unfounded, excessive, or repetitive, in which case we will inform you of the reason and the applicable fee before proceeding.
11. Appeal Process
If Hexabiome declines to take action on your request — in whole or in part — you have the right to appeal that decision.
How to appeal: Send a written appeal to support@hexabiome.com with the subject line "Consumer Health Data Appeal" within 30 days of our denial.
Internal review: Your appeal will be reviewed independently of the person who made the original determination.
Timeline: We will respond to your appeal within 45 calendar days of receipt and provide a written explanation of our reasoning.
Escalation: If your appeal is denied, you may file a complaint with the relevant state authority:
• Washington State Attorney General: www.atg.wa.gov (https://www.atg.wa.gov)
• Nevada Attorney General: ag.nv.gov (https://ag.nv.gov)
12. Data Retention
We retain Consumer Health Data only as long as reasonably necessary to fulfill the purpose for which it was collected, to comply with legal obligations, and to resolve disputes.
• Category: Order and purchase history — Retention Period: 7 years from order date — Basis: Tax, accounting, and legal compliance
• Category: Subscription and billing records — Retention Period: Duration of subscription + 3 years — Basis: Legal compliance and dispute resolution
• Category: Customer support communications — Retention Period: 3 years from last interaction — Basis: Quality assurance and legal compliance
• Category: Email marketing engagement data — Retention Period: Duration of consent + 1 year after opt-out — Basis: Consent recordkeeping
• Category: Analytics and advertising data — Retention Period: Retained according to applicable provider retention policies and our contractual arrangements with those providers, subject to applicable legal requirements — Basis: Performance measurement
• Category: Identity verification records for rights requests — Retention Period: 3 years — Basis: Evidence of response and legal compliance
• Category: Authorization and preference records — Retention Period: Duration of authorization + 3 years after withdrawal — Basis: Legal compliance, accountability, and evidence of authorization
When Consumer Health Data is no longer needed, we will delete, destroy, or de-identify it securely. Where immediate deletion is not technically feasible, we will restrict access until deletion is complete.
13. Security
We implement reasonable and appropriate administrative, technical, and physical safeguards to protect Consumer Health Data against unauthorized access, use, disclosure, alteration, or destruction. Given the sensitive nature of Consumer Health Data, we apply heightened measures including:
• Access controls: Employee access to Consumer Health Data is limited to those with a documented business need, with access logs maintained.
• Encryption: Consumer Health Data is encrypted in transit (TLS) and at rest where technically feasible.
• Vendor requirements: Service Providers with access to Consumer Health Data are required by contract to implement equivalent security standards and to notify us promptly of any suspected security incident.
• Incident response: We maintain procedures to detect, contain, assess, and notify affected Consumers and state regulators of data breaches, in accordance with applicable Washington State, Nevada, and Canadian breach notification law.
No security system is impenetrable. We cannot guarantee that Consumer Health Data will never be accessed by unauthorized parties. In the event of a breach affecting Consumer Health Data, we will notify affected Consumers and applicable regulators as required by law.
14. Cookies and Tracking Technologies
This section addresses cookies and tracking technologies specifically as they relate to Consumer Health Data. For a general description of all cookie categories we use and how to manage them, see our Cookie Policy.
Our Site uses cookies and similar tracking technologies that may collect or derive Consumer Health Data based on your interactions with health-related product content.
• Technology: Site analytics — Provider: Google Analytics 4 — Purpose: Traffic measurement, conversion tracking — Transmits Consumer Health Data?: May involve Consumer Health Data, depending on the pages viewed and configuration
• Technology: E-commerce analytics — Provider: Shopify Analytics — Purpose: Store performance and purchase funnel — Transmits Consumer Health Data?: May involve Consumer Health Data, depending on purchase and browsing activity
• Technology: Advertising pixel — Provider: Meta Pixel — Purpose: Ad effectiveness, campaign performance evaluation — Transmits Consumer Health Data?: May involve Consumer Health Data depending on the events transmitted and applicable legal requirements
• Technology: Email tracking — Provider: Klaviyo — Purpose: Email open and click rates — Transmits Consumer Health Data?: May involve Consumer Health Data depending on consumer-provided content and communication context
• Technology: Functional cookies — Provider: Shopify — Purpose: Cart, checkout, session management — Transmits Consumer Health Data?: Minimal — required for Site operation
Hexabiome treats analytics and advertising technologies — including Google Analytics 4, Shopify Analytics, and Meta Pixel — as non-essential to providing your requested product or service. These technologies will only operate with your prior written authorization where required by applicable law. Hexabiome treats Shopify Analytics as a health-related analytics tool when it processes Consumer Health Data and subjects it to the same authorization requirements as other analytics providers for Washington State and Nevada residents.
Washington State and Nevada residents: Advertising and analytics technologies that transmit Consumer Health Data will not activate until you have provided written authorization through our on-site consent tool. You may decline authorization for these technologies and still purchase our products and use our Site without any reduction in product availability or price.
Managing your preferences:
• Use the privacy preference center on our Site when authorization is requested.
• Adjust your browser settings to block or delete cookies (some Site features may be affected).
• Opt out of Google Analytics data collection: tools.google.com/dlpage/gaoptout (https://tools.google.com/dlpage/gaoptout).
• Manage Meta advertising preferences: www.facebook.com/adpreferences (https://www.facebook.com/adpreferences).
• Use industry opt-out tools: optout.aboutads.info (http://optout.aboutads.info) (DAA) or optout.networkadvertising.org (http://optout.networkadvertising.org) (NAI).
Hexabiome recognizes Global Privacy Control (GPC) signals from Washington State residents as a valid withdrawal of authorization for advertising and analytics Consumer Health Data collection.
15. International Data Transfers
UNI NUTRITION INC. is incorporated in Canada and our Service Providers may store and Process Consumer Health Data in data centers located in Canada, the United States, the European Economic Area, or other jurisdictions.
Canadian privacy law. UNI NUTRITION INC. complies with the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and, where applicable, Quebec's Act Respecting the Protection of Personal Information in the Private Sector ("Law 25"). Consumer Health Data may be processed in Canada, the United States, or other jurisdictions where our service providers operate.
Cross-border safeguards. UNI NUTRITION INC. applies safeguards designed to maintain protections consistent with applicable consumer health data laws, regardless of the jurisdiction in which Consumer Health Data is stored or Processed. Where Consumer Health Data is transferred to a Service Provider or third party operating in another jurisdiction, we do so pursuant to written data processing agreements requiring the recipient to:
• Implement administrative, technical, and physical security safeguards equivalent to those described in Section 12;
• Process Consumer Health Data only on our behalf and solely for the purposes stated in this Notice; and
• Honor consumer rights requests that Hexabiome is required to fulfill under applicable U.S. state law.
Transfer impact assessments. Where required by applicable law — including under PIPEDA, Law 25, or applicable U.S. state privacy law — Hexabiome conducts transfer impact assessments to evaluate the legal and security risks associated with cross-border Processing of Consumer Health Data and retains records of those assessments.
By using our Site or purchasing our products, you acknowledge that your Consumer Health Data may be transferred to and Processed in the jurisdictions described above, subject to the safeguards set forth in this Section.
16. Children's Privacy
Our Services are intended for individuals 18 years of age or older, as stated in our Terms of Service. Our Site, products, and services are not directed to, and are not intended for use by, children under the age of 16 years. We do not knowingly collect Consumer Health Data from children.
If you believe we have inadvertently collected Consumer Health Data from a child under 16, please contact support@hexabiome.com immediately. We will promptly delete any such data upon confirmation.
17. No Prohibited Geofencing
Hexabiome does not use geofencing technology around hospitals, clinics, pharmacies, mental health facilities, addiction treatment centers, or any other healthcare facilities to collect Consumer Health Data from individuals visiting or near those locations, as prohibited by the MHMDA (RCW 19.373.070) and Nevada SB 370.
18. Changes to This Notice
Hexabiome may update this Notice from time to time to reflect changes in our data practices, business operations, or applicable law. When we make material changes, we will:
• Post the revised Notice on our Site with an updated "Last Updated" date above;
• Provide direct notice to affected Consumers where required by applicable law (for example, by email); and
• For Washington State residents, obtain new authorization where applicable law requires it before implementing material changes to how we Process Consumer Health Data.
We encourage you to review this Notice periodically. Your continued use of our Site after a change is posted constitutes acceptance of the updated Notice, except where applicable law requires affirmative consent to the change.
18. Contact Us
For questions about this Notice, your Consumer Health Data, or your privacy rights under applicable state law:
UNI NUTRITION INC. (d/b/a Hexabiome)
Principal address (Canada):
450 SW Marine Drive, Floor 18, Vancouver, BC V5X 0C3, Canada
U.S. mailing address (correspondence only — not a registered office):
1448 New Market St., Suite 500, Seattle, WA 98107, United States
Privacy inquiries: support@hexabiome.com (for consumer health data requests, please include "Consumer Health Data Request" in your subject line)
Subject line: "Consumer Health Data — describe your inquiry or request"
General contact: Contact Us (https://hexabiome.com/pages/contact) page
General inquiries will typically receive a response within 2 business days. This general response time is separate from the 45-day timeline described in Section 9 for formal Consumer Health Data rights requests.
For a complete description of how we collect and use personal information beyond Consumer Health Data, please see our Privacy Policy.