Consumer Health Data Privacy Policy

Effective date: September 14, 2026

This Consumer Health Data Privacy Policy (“Policy”) applies to personal information that may be considered “consumer health data” under U.S. state consumer health privacy laws, in particular Washington’s My Health My Data Act and the Nevada Consumer Health Data Privacy Law (together, the “Consumer Health Laws”).

This Policy applies to our online store, including any mobile or device-specific version of the store, our quiz, our social media accounts, and related services (collectively referred to as the “Store” or the “Services”).

This Policy supplements, and should be read together with, our Privacy Policy (“Privacy Policy”), and applies only to consumers who are protected by the Consumer Health Laws. For all other information about how we handle personal data, please review our Privacy Policy. If there is any conflict between this Policy and our Privacy Policy with respect to consumer health data of consumers covered by the Consumer Health Laws, this Policy controls.

Our Store is intended only for individuals who are at least 18 years old. We do not knowingly collect consumer health data from anyone under 18.

Contents:

1. What is consumer health data?

2. Categories and sources of consumer health data

3. Purposes and intended uses of consumer health data

4. Disclosing consumer health data

5. How we collect your consent

6. Your privacy rights

7. Exercising your privacy rights

8. Appeals

9. Non-discrimination

10. How we protect consumer health data

11. How to contact us

12. Changes to this Policy

1. What is consumer health data?

For the purpose of this Policy, “consumer health data” means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. Depending on how you use our Services, this may include, for example, your health goals, body measurements, information about your use of or interest in our products, the products or materials we recommend to you, and other information you choose to share with us.

2. Categories and sources of consumer health data

When you use our Services, we may collect information that may be considered consumer health data under the Consumer Health Laws. We may obtain consumer health data from the following categories of sources:

• Directly from you: For example, when you complete our quiz or contact our support team;
• From third parties: For example, from service providers that operate parts of our Store on our behalf;
• Automatically when you use our Services: For example, from your interactions with our quiz and product pages.

2.1. Data you provide directly to us

When you use our Services, and in particular when you complete our quiz, you may provide us with information that may be considered consumer health data. For example:

Quiz responses, such as the health goals you select, the difficulties you report, how you describe your energy levels, your age, your height, your weight, the lifestyle factors you identify, and other information you choose to share with us. We use this information to assess which of our products may be suitable for you and to provide recommendations, offers, and materials.

Customer service and feedback, where you voluntarily choose to include health-related details in a message to us, in a survey response, or in other correspondence with us.

Order and subscription information, where the products you order or subscribe to may indicate your interest in a health-related outcome.

2.2. Data we receive from our service providers or third parties

We do not currently obtain consumer health data about you from independent third parties. Our service providers, including the providers that host our Store, may collect consumer health data on our behalf and transfer it to us.

2.3. Data collected automatically

When you use our Services, we may automatically collect information that, in combination with the information described above, may be considered consumer health data, including:

Usage and browsing data relating to health-related parts of the Store, such as the quiz pages you view, the questions you start or skip, the products you view or add to your cart, and the date and time of those interactions.

Device and connection data collected through cookies and similar technologies when you use those parts of the Store

3. Purposes and intended uses of consumer health data

We collect and use your consumer health data for the following purposes:

• To assess suitability and provide recommendations and materials. Our primary purpose is to deliver what you request. When you complete our quiz, we use your answers to assess which of our products may be suitable for you, to generate recommendations, and to offer you one or more additional or alternative products or materials. We also use quiz responses to check that the quiz is working properly and to correct any errors.
• To communicate with you in connection with our products, recommendations, offers, or materials. For example, to make the recommended materials available to you and to respond to your questions about our products, recommendations, offers, or materials.
• To provide customer support. For example, where you contact us about a product or an order and choose to share health-related details with us.
• To maintain, improve, and develop our Services. With your consent where required, we may analyze how you use the Services to understand which products, recommendations, offers, or materials are most helpful to users, and to develop, test, or provide new ones. We may also process your data for these purposes if you consent to participate in a specific study, research initiative, or a similar program.
• For safety, security, legal, and compliance purposes. We may use consumer health data as needed to secure our Services, prevent and address fraud, enforce our Terms of Service (“Terms of Service”), comply with legal obligations, and establish, exercise, or defend legal claims (for example, to respond to payment disputes and chargebacks).

4. Disclosing consumer health data

We may disclose each of the categories of consumer health data described above in order to achieve the listed purposes.

We may disclose consumer health data to the following categories of recipients:

• Affiliates: companies within our corporate group that work together to provide the Services.
• Processors (service providers) that help us provide, operate, support, and improve the Services and that act only on our instructions under binding contracts. These include our e-commerce platform, hosting, and infrastructure provider, Shopify, our cloud hosting and infrastructure providers such as Amazon Web Services. For more detail about the processors we work with, please see our Privacy Policy.
• Public authorities and others where necessary: we may disclose consumer health data when reasonably necessary to comply with applicable law or a valid legal request (e.g., subpoenas, court orders, or legal processes), to enforce our Terms of Service, to assert our legal rights or defend against legal claims, or to protect the rights, safety, or property of you, us, or others.
• Successors in a corporate transaction: if we are involved in a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, consumer health data may be transferred as part of that transaction, subject to this Policy.

5. How we collect your consent

Under the Consumer Health Laws:

When we rely on your consent to process your consumer health data, we ask for your consent before we collect consumer health data that is not necessary to provide a product or part of the Services you have requested from us.

Your consent is voluntary, and you may decline or withdraw it at any time. Answering the questions in our quiz is entirely voluntary. If you prefer not to answer them, you can still browse the Store and place an order. Because some of the Services we provide may depend on consumer health data, withdrawing your consent may mean that we can no longer provide certain Services to you.

6. Your privacy rights

In addition to the privacy rights outlined in our Privacy Policy, you have the following rights regarding your consumer health data:

• Right to confirm. You have the right to confirm whether we are collecting, sharing, or selling your consumer health data, and to access detailed information about that processing. We strive to comply with transparency requirements and provide most of the relevant information in this Policy and our Privacy Policy. However, if you have any questions about our data processing practices or would like more details about how we use your personal data, please contact us.
• Right of access: You have the right to access your consumer health data. If you would like to receive a copy of the data we process about you, please submit a data access request.
• Right to delete. You have the right to request that we delete your consumer health data. In some cases we may be required or permitted by law to retain certain data (for example, records of your requests, or transaction records for tax and accounting purposes). Where this applies, we will delete the data that is not subject to a retention obligation and delete the remainder once the obligation has been met.
• Right to withdraw consent. You have the right to withdraw your consent to our processing of your consumer health data. You may withdraw or update your preferences at any time by contacting us. If your consent is necessary for us to provide some of the Services, withdrawing your consent may mean that you can no longer use certain Services. In this case, you may also request the erasure of your data at any time by contacting us.

7. Exercising your privacy rights

To exercise any of these privacy rights, please contact us.

• Timing. We are committed to responding to all legitimate requests in accordance with applicable laws and will process your request as promptly as possible, generally within 45 days.
• Verification. To protect your information, we must verify your request before acting on it. Depending on the type of request, we may ask for information such as your email address, your order number, the date of your most recent order, or other information that reasonably identifies you. We may ask for additional proof of identity if necessary, but we aim to request as little as possible.
• Authorized agent. You may designate an authorized agent to make a request on your behalf. We will ask the agent to provide proof that you have authorized them, such as a signed permission or a valid power of attorney. We may also contact you directly to confirm the authorization and to verify your identity.
• Cost. We will respond to your request free of charge, unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act, as permitted by law.

8. Appeals

Under the Consumer Health Laws, if we deny your privacy request, you have the right to appeal our decision within a reasonable time. To appeal, contact us and clearly include “U.S. CONSUMER HEALTH DATA APPEAL” in your message.

Please include a copy of, or otherwise reference, our decision on your request so that we can review it properly. We will respond and explain the action we have taken or declined to take and the reasons for our decision.

If your appeal is denied, you may submit a complaint to the Attorney General of your state:

• Washington residents: the Washington State Office of the Attorney General (https://www.atg.wa.gov/).
• Nevada residents: the Nevada Office of the Attorney General (https://ag.nv.gov/).

9. Non-discrimination

We will not unlawfully discriminate or retaliate against you for exercising any of your rights under the Consumer Health Laws. For example, by denying you products or Services, charging a different price or rate, or providing a different level of service, except where a difference is permitted by law (for example, where consumer health data is reasonably necessary to provide some of the Services you have requested and you choose not to provide it).

10. How we protect consumer health data

We maintain administrative, technical, and physical safeguards designed to protect consumer health data against unauthorized access, use, or disclosure. These include the security features of our Store, encryption of data in transit, and access controls that limit access to the personnel and service providers who need it to carry out the purposes described in this Policy. We require our processors to protect consumer health data under binding contracts and to process it only on our instructions.

11. How to contact us

If you have any questions about this Policy or how we handle your consumer health data, or if you would like to exercise any of your rights, contact us:

By mail to: 3753 Howard Hughes Parkway, Suite 200, Las Vegas, Nevada, the United States of America

By email to: support@mysunbreak.com

12. Changes to this Policy

We may update this Policy from time to time to reflect changes to our practices or for other operational, legal, or regulatory reasons. When we do, we will post the revised Policy on the Store, update the “Effective date” at the top, and, where the changes are material, provide additional notice or obtain your consent as required by applicable law. We encourage you to review this Policy periodically. Your continued use of the Services after a revised Policy takes effect means you are aware of the changes.