Your data. Your rights. Our obligations.
We collect only what we need, use it only for what we say, and never sell it. This policy explains exactly what that means.
Overview
This Privacy Policy describes how Upgrade Health, Inc. ("Upgrade Health," "we," "us," or "our"), located at 123 Science Drive, Suite 100, San Diego, CA 92101, collects, uses, and shares information about you when you visit our website, place an order, create an account, contact our support team, or otherwise interact with us.
By using our website or purchasing our products, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our services.
We do not sell, rent, or trade your personal information to third parties for their marketing purposes. Full stop.
Information We Collect
Information you provide directly
Name, email address, shipping and billing address, phone number, payment information (processed by Shopify Payments — we never store full card numbers), order history, and account credentials.
Messages you send via our contact form, email, or customer support channels, including any health or protocol information you choose to share when seeking clinical guidance.
Email address and preferences when you subscribe to our newsletter, promotional communications, or early access programs.
Protocol details, health outcomes, and supporting data (bloodwork, wearable exports) that you voluntarily submit to our results program — only with your explicit written consent.
Information collected automatically
Information from third parties
We may receive limited information about you from payment processors (Shopify Payments, PayPal, Shop Pay), shipping carriers (for delivery confirmation), and analytics providers (Google Analytics). We do not purchase or receive personal data from data brokers.
How We Use Your Information
We use the information we collect for the following purposes, each with a specific lawful basis under GDPR where applicable:
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.
Cookies & Tracking Technologies
We use cookies and similar tracking technologies to operate our website, understand how visitors use it, and improve your experience. Here is what we use and why:
Required for the site to function: shopping cart, checkout session, account login, and fraud prevention. Cannot be disabled without breaking core functionality. No consent required.
Google Analytics (anonymized IP) and Shopify Analytics track page visits, traffic sources, and conversion paths. Used to improve our website and understand which content is useful. Consent required in the EU/UK.
Set by Meta Pixel and Google Ads to measure ad performance and enable retargeting. We use these to show relevant ads to people who have visited our site. Consent required — opt out via our cookie banner or your browser settings.
Remember your currency, language, and region preferences across sessions. Helps deliver a consistent experience on return visits. Consent required in the EU/UK.
You can manage cookie preferences at any time via the cookie banner on our site, your browser settings, or by emailing privacy@upgradehealth.com. Withdrawing consent does not affect the lawfulness of prior processing.
Sharing Your Information
We do not sell your personal information. We share data only in the following limited circumstances:
Data Retention
We retain your personal data for as long as necessary to provide our services and comply with legal obligations. Specific retention periods by data type:
Retained for 7 years after your last order to comply with tax and financial record-keeping requirements. Account data is deleted within 30 days of a verified account deletion request, subject to legal retention minimums.
Retained for 3 years from the date of the last interaction. Clinical enquiries involving health data are retained for the same period unless you request earlier deletion.
Email marketing consent records are retained while you are subscribed and for 3 years after unsubscription, as required for consent record-keeping under GDPR.
Aggregate, anonymized analytics data may be retained indefinitely. Individual-level analytics data is retained for 26 months in Google Analytics in accordance with their data retention policy.
Your Rights
Depending on where you are located, you have the following rights over your personal data. EU and UK residents have rights under GDPR; California residents have additional rights under the CCPA (see Section 08). We honor all verified requests regardless of your location.
Request a copy of the personal data we hold about you.
Request correction of inaccurate or incomplete personal data.
Request deletion of your personal data, subject to legal retention requirements.
Receive your personal data in a structured, machine-readable format.
Object to processing based on legitimate interests, including direct marketing.
Request that we limit how we use your data in certain circumstances.
To exercise any of these rights, email privacy@upgradehealth.com with your request and sufficient information to verify your identity. We will respond within 30 days (EU/UK: within 1 month). If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.
Our legal basis for processing is described in Section 03. You have the right to withdraw consent at any time without affecting the lawfulness of prior processing. You may also lodge a complaint with your national supervisory authority — in the EU via edpb.europa.eu, in the UK via the ICO at ico.org.uk.
California Residents (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you specific rights regarding your personal information.
Categories of personal information collected
In the past 12 months we have collected: identifiers (name, email, IP address); commercial information (purchase history, subscription status); internet or network activity (browsing behavior on our site); and inferences drawn from the above (product preferences). We have not collected sensitive personal information as defined by the CPRA beyond health-related communications you voluntarily submit for clinical support.
Your California rights
To submit a CCPA request, email privacy@upgradehealth.com with the subject "CCPA Request." We will verify your identity and respond within 45 days (extendable by an additional 45 days with notice).
International Data Transfers
Upgrade Health is based in the United States. If you access our website from outside the US, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.
For transfers from the EU and UK to the US, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the lawful transfer mechanism, where applicable. Our primary data processor, Shopify Inc., is certified under appropriate transfer mechanisms and operates under a Data Processing Agreement.
By using our website, you acknowledge and consent to the transfer of your information to the United States as described in this policy.
Security
We implement industry-standard technical and organizational measures to protect your personal information against unauthorized access, loss, destruction, or alteration. These include:
No method of electronic transmission or storage is 100% secure. If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authorities as required by applicable law.
Children's Privacy
Our website and products are not directed to children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@upgradehealth.com and we will delete the information promptly.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will notify you by updating the "Last Updated" date at the top of this page and, where required by law, by sending you an email notification or displaying a prominent notice on our website.
We encourage you to review this policy periodically. Your continued use of our website after any changes constitutes your acceptance of the revised policy.
Contact & Data Controller
Upgrade Health, Inc. is the data controller for personal information collected through our website. For any privacy-related questions, requests, or complaints, please contact our Privacy team:
privacy@upgradehealth.com
Response time: within 30 days (EU/UK) or 45 days (CCPA)
Upgrade Health, Inc.
123 Science Drive, Suite 100
San Diego, CA 92101
United States
Our privacy team responds within 30 days.
For data access, deletion, or correction requests, email privacy@upgradehealth.com with your name and the nature of your request.