California Privacy Notice

1. Scope

This notice describes how Yuvia Holdings LLC collects, uses, discloses, and protects "Personal Information" ("PI") of California residents as those terms are defined in the CCPA. It also describes the rights California residents have with respect to their PI and how to exercise them.

2. Categories collected

In the past 12 months, we have collected the following categories of PI from California residents:

• Identifiers. Name, email address, phone number, postal address, IP address, account ID, and a photo of your government-issued ID (provided before a prescription is sent).
• Customer records. Billing address, payment card information (handled by Stripe; we do not store full card numbers).
• Commercial information. Products purchased, subscription status, cancellation history.
• Internet activity. Pages visited on yuvia.health, browser type, device type, timestamps, referrer URLs.
• Geolocation. Approximate location derived from IP address; precise location only if you grant device-level permission.
• Inferences. Marketing preferences inferred from your interactions with our website and quizzes.
• Sensitive personal information. See section 7.

3. Sources of information

We collect PI from these sources: (1) directly from you when you create an account, complete a quiz, or make a purchase; (2) automatically from your device and browser when you visit yuvia.health; and (3) from service providers such as Stripe, our hosting and analytics providers, and our email service provider.

4. Business purposes

We use PI for the following business purposes: providing and improving our services; processing payments; communicating with you about your account, orders, and our services; detecting fraud and abuse; ensuring website security; complying with legal obligations; analyzing usage of our website to improve it; and measuring and delivering our advertising (see section 6).

5. Categories shared

We disclose PI to service providers and contractors that perform services on our behalf, including: Stripe (payment processing); Healthie (EHR / clinical record-keeping); compounding pharmacies (prescription fulfillment); our email service provider; our cloud hosting provider; and analytics providers. Each service provider is contractually limited to using PI only to perform services for Yuvia.

We also share limited PI with Meta Platforms, Inc. for cross-context behavioral advertising through the Meta Pixel on our home page and general information pages, and through checkout and purchase records our server sends, as described in section 6. Meta is a third party, not a service provider. We share limited PI with Google LLC in the same way, through the Google Ads tag on the same pages and through a checkout record our server sends, as described in section 6. Google is also a third party.

We also disclose PI when required by law, in response to lawful requests by public authorities, or to protect our rights, property, or safety, or that of our users.

6. Selling and sharing

Yuvia does not sell personal information for monetary consideration. Yuvia shares limited personal information with Meta Platforms, Inc. ("Meta") and Google LLC ("Google") for cross-context behavioral advertising. This sharing happens through the Meta Pixel, which runs on our home page and general information pages only, such as the quiz, how it works, and our specialists. It is not used on product, medical intake, checkout, or account pages. When someone completes checkout, and again only if a physician approves the order and the card is charged, our server also sends Meta a record.

The categories shared are identifiers (such as IP address, cookie identifiers, ad-click information, and, for checkout and purchase records, a hashed email address or phone number), commercial information (that a checkout was completed, with no amount, and, only after a physician approves and the card is charged, that a purchase was made, with a value that is the same for every order), and internet or other electronic network activity (such as a record that a page on our website was viewed, and device and browser information). Yuvia does not share intake answers, or the health information you give us in them, with Meta or for advertising. If your order ships to Washington or Nevada, neither record is sent unless you tick the separate, optional box at checkout agreeing to it; you can withdraw that agreement at any time by emailing hello@yuvia.health. Yuvia also uses the Google Ads tag on the same pages as the Meta Pixel only, with Google's ad personalization turned off, and our server may send Google a checkout record (with no amount) when someone completes checkout. The categories shared with Google are identifiers (such as IP address, cookie identifiers, ad-click information, and, for the checkout record, a hashed email address or phone number), commercial information (that a checkout was completed, with no amount), and internet or other electronic network activity (such as a record that a page on our website was viewed, and device and browser information). Yuvia does not share intake answers, or the health information you give us in them, with Google or for advertising. No record is sent to Google for an order that ships to Washington or Nevada. In the past 12 months, we have not sold personal information as that term is defined by the CCPA.

To opt out of this sharing, use our Do Not Sell or Share My Personal Information page. We also honor the Global Privacy Control signal: when your browser sends it, the Meta Pixel and the Google Ads tag do not load and no checkout or purchase record is sent to Meta or Google.

7. Sensitive personal information

The CCPA defines a special category of "Sensitive Personal Information" ("SPI") that includes precise geolocation, government IDs, account credentials, and information about health. Yuvia does not use SPI to infer characteristics about you or for any purpose beyond what is reasonably necessary to provide our services.

Health information you enter inside a medical intake is stored in our EHR partner (Healthie) and is governed by HIPAA, not CCPA. The preferences you select inside a marketing quiz on yuvia.health (such as your goal or preferred format) are not health information and are stored only in your browser until you choose to proceed to intake.

8. Your CCPA rights

As a California resident, you have the following rights:

• Right to know. Request disclosure of the categories and specific pieces of PI we have collected about you in the past 12 months.
• Right to delete. Request deletion of PI we hold about you, subject to certain legal exceptions.
• Right to correct. Request correction of inaccurate PI.
• Right to opt out of sale/sharing. Opt out of the sharing with Meta and Google described in section 6, using our Do Not Sell or Share My Personal Information page or a Global Privacy Control signal. We do not sell PI.
• Right to limit use of sensitive PI. Direct us to use SPI only for limited, permitted purposes.
• Right to non-discrimination. We will not deny services, charge different prices, or provide a different level of quality because you exercised any CCPA right.

9. How to exercise your rights

To exercise any of your CCPA rights, email hello@yuvia.health with the subject line "California Privacy Request." Include enough information for us to verify your identity (typically your account email and name). We will respond within 45 days, with a possible 45-day extension if reasonably necessary.

10. Non-discrimination

We will not retaliate against you or deny any service for exercising your CCPA rights. We do not offer financial incentives in exchange for collection, sale, or sharing of PI.

11. Authorized agents

You may use an authorized agent to submit a CCPA request on your behalf. The agent must provide written authorization signed by you, and we will verify the agent's identity and the authority of the agent before processing the request.

12. Minors

Yuvia's services are not directed to minors. We do not knowingly collect PI from anyone under 18 (our public eligibility age), and we do not knowingly sell or share the PI of anyone under 16.

13. Contact

Questions about this notice or California privacy rights should be directed to hello@yuvia.health. We will respond as soon as we can.