California Privacy Notice

1. Scope

This notice describes how Yuvia Holdings LLC collects, uses, discloses, and protects "Personal Information" ("PI") of California residents as those terms are defined in the CCPA. It also describes the rights California residents have with respect to their PI and how to exercise them.

2. Categories collected

In the past 12 months, we have collected the following categories of PI from California residents:

• Identifiers. Name, email address, phone number, postal address, IP address, account ID.
• Customer records. Billing address, payment card information (handled by Stripe; we do not store full card numbers).
• Commercial information. Products purchased, subscription status, cancellation history.
• Internet activity. Pages visited on yuvia.health, browser type, device type, timestamps, referrer URLs.
• Geolocation. Approximate location derived from IP address; precise location only if you grant device-level permission.
• Inferences. Marketing preferences inferred from your interactions with our website and quizzes.
• Sensitive personal information. See section 7.

3. Sources of information

We collect PI from these sources: (1) directly from you when you create an account, complete a quiz, or make a purchase; (2) automatically from your device and browser when you visit yuvia.health; and (3) from service providers such as Stripe, our hosting and analytics providers, and our email service provider.

4. Business purposes

We use PI for the following business purposes: providing and improving our services; processing payments; communicating with you about your account, orders, and our services; detecting fraud and abuse; ensuring website security; complying with legal obligations; and analyzing usage of our website to improve it.

5. Categories shared

We disclose PI to service providers and contractors that perform services on our behalf, including: Stripe (payment processing); Healthie (EHR / clinical record-keeping); compounding pharmacies (prescription fulfillment); our email service provider; our cloud hosting provider; and analytics providers. Each service provider is contractually limited to using PI only to perform services for Yuvia.

We also disclose PI when required by law, in response to lawful requests by public authorities, or to protect our rights, property, or safety, or that of our users.

6. We don't sell or share

Yuvia does not sell personal information for monetary consideration. Yuvia does not share personal information for cross-context behavioral advertising. In the past 12 months, we have not sold or shared personal information as those terms are defined by the CCPA.

See our dedicated Do Not Sell or Share My Personal Information page for our standing position and how to confirm it.

7. Sensitive personal information

The CCPA defines a special category of "Sensitive Personal Information" ("SPI") that includes precise geolocation, government IDs, account credentials, and information about health. Yuvia does not use SPI to infer characteristics about you or for any purpose beyond what is reasonably necessary to provide our services.

Health information you enter inside a medical intake is stored in our EHR partner (Healthie) and is governed by HIPAA, not CCPA. The preferences you select inside a marketing quiz on yuvia.health (such as your goal or preferred format) are not health information and are stored only in your browser until you choose to proceed to intake.

8. Your CCPA rights

As a California resident, you have the following rights:

• Right to know. Request disclosure of the categories and specific pieces of PI we have collected about you in the past 12 months.
• Right to delete. Request deletion of PI we hold about you, subject to certain legal exceptions.
• Right to correct. Request correction of inaccurate PI.
• Right to opt out of sale/sharing. We do not sell or share, but you have the right to confirm this.
• Right to limit use of sensitive PI. Direct us to use SPI only for limited, permitted purposes.
• Right to non-discrimination. We will not deny services, charge different prices, or provide a different level of quality because you exercised any CCPA right.

9. How to exercise your rights

To exercise any of your CCPA rights, email hello@yuvia.health with the subject line "California Privacy Request." Include enough information for us to verify your identity (typically your account email and name). We will respond within 45 days, with a possible 45-day extension if reasonably necessary.

10. Non-discrimination

We will not retaliate against you or deny any service for exercising your CCPA rights. We do not offer financial incentives in exchange for collection, sale, or sharing of PI.

11. Authorized agents

You may use an authorized agent to submit a CCPA request on your behalf. The agent must provide written authorization signed by you, and we will verify the agent's identity and the authority of the agent before processing the request.

12. Minors

Yuvia's services are not directed to minors. We do not knowingly collect PI from anyone under 18 (our public eligibility age), and we have never sold or shared the PI of a minor.

13. Contact

Questions about this notice or California privacy rights should be directed to hello@yuvia.health. We will respond as soon as we can.