PRIVACY POLICY

This Privacy Policy explains how Hot by Science Inc. (“we,” “us,” or “our”) collects, uses, discloses, and retains personal information through hotbyscience.com, care.hotbyscience.com, related Hot by Science applications and portals (the “Sites”), and associated customer-support and nonclinical services. It also explains the choices available to you.

1. Scope and Roles

Hot by Science Inc. operates the Hot by Science account, authentication system, and nonclinical platform services. It handles account information and the information needed to administer memberships, support users, facilitate services with licensed providers and other partners, and display educational observational research findings.

Hot by Science Inc. is responsible for the personal information it controls. We limit access according to job function and business need. Licensed healthcare providers, medical groups, laboratories, pharmacies, and other third parties may collect and control information under their own privacy notices.

This Privacy Policy is a website and consumer privacy notice. It is not a healthcare provider's Notice of Privacy Practices. If information is protected by the Health Insurance Portability and Accountability Act or another medical privacy law, the applicable provider notice and law govern that information to the extent of any conflict.

2. Account Access

Hot by Science Inc. administers authentication for the Sites. We use account identifiers, contact details, authentication credentials or tokens, and session and security information to authenticate you, secure your account, and support the Hot by Science services you request. Access to personal information is limited according to user role, authorization, business need, applicable agreements, and law.

3. Information We Collect

The information collected depends on the Site and service you use.

4. Sources of Information

We collect information:

• directly from you, including through account registration, questionnaires, forms, orders, connected devices, and communications;
• from licensed providers, laboratories, pharmacies, and other service partners when needed to provide a service you request and permitted by law;
• automatically from browsers, devices, cookies, software development kits, logs, and similar
  technologies;
• from payment, fraud-prevention, identity-verification, analytics, communications, and shipping providers; and
• from public or commercial sources when permitted by law, such as professional-license databases, sanctions lists, or address-verification services.

5. How We Use Information

We use personal information to:

• create, authenticate, secure, and administer your Hot by Science account;
• provide the Site, memberships, support, orders, shipping, billing, and requested nonclinical services;
• facilitate interactions with licensed providers, laboratories, and pharmacies at your request and support treatment, payment, and healthcare operations when permitted by applicable law and agreements;
• display educational findings from the IRB-approved observational study, including participant experiences grouped by biological profile; where you request findings relevant to your profile, use biological information you provide or authorize us to use to select relevant study findings, subject to applicable consent, privacy law, and provider agreements;
• send transaction, account, security, service, and legally required communications;
• maintain, troubleshoot, analyze, and improve the Sites and develop new features using information permitted for that purpose;
• protect users, enforce agreements, detect fraud, investigate security incidents, and maintain audit records;
• comply with legal, tax, accounting, professional, regulatory, and record-retention obligations; and
• send optional marketing communications or conduct targeted advertising using only information and consent permitted by law. We do not use clinical information for targeted advertising.

6. Clinical Information and Provider Notices

Licensed providers decide what clinical information they need and how they use it for care. Hot by Science Inc. may handle clinical information on behalf of a provider under a business associate or similar services agreement, or may handle certain information in its own nonclinical role. The provider's Notice of Privacy Practices explains uses and disclosures of protected health information, patient rights, and how to contact the provider's privacy office.

When HIPAA applies, uses and disclosures of protected health information are governed by HIPAA, the provider's notice, and applicable agreements. When HIPAA does not apply, health information may still be protected by the Federal Trade Commission Act, the FTC Health Breach Notification Rule, state medical privacy laws, and state consumer health data laws.

7. Observational Research Findings and Participation

The HBS observational study collects biological data and self-reported experiences from people using peptides and small molecules under the applicable study consent and research permissions. Hot by Science may display educational summaries of study findings, including reports from participants with similar biological profiles. If you request findings relevant to your profile, we may use biological information you provide or authorize us to use, including applicable intake elements or laboratory information, to select findings for display. This use must have a legal basis under applicable privacy law and provider agreements, including consent or authorization where required. Receiving clinical services or accepting this Policy does not by itself authorize every use of clinical information for research or educational selection.

We may use information that has been de-identified or aggregated so that it is not reasonably linkable to you, as permitted by law, for analytics, quality improvement, research, and product development. We require recipients of de-identified information not to attempt to re-identify it when required by law.

Viewing research findings, accepting this Privacy Policy, or enrolling in a membership does not constitute consent to participate in human-subject research. Participation in the observational study is optional and governed by a separate research consent and, when applicable, authorization. Identifiable information is used or disclosed for the study only under that permission, an IRB or Privacy Board waiver, or another legal basis that specifically permits the use. The study consent describes the information collected, study recipients, and participant rights, including withdrawal and any limits on withdrawal.

8. How We Disclose Information

We may disclose personal information to:

• research investigators, institutions, IRBs, research service providers, or data repositories as described in an applicable study consent or as otherwise specifically permitted by research and privacy law;
• licensed providers and medical groups for requested evaluation, care, treatment, payment, and healthcare operations;
• laboratories and pharmacies to process provider orders, testing, prescriptions, payment, and support;
• vendors that provide hosting, security, authentication, communications, customer support, analytics, payment processing, fraud prevention, shipping, document management, and other operational services under contractual restrictions;
• professional advisers, auditors, insurers, financing sources, and regulators as reasonably necessary and permitted by law;
• a buyer, investor, lender, or successor in connection with a proposed or completed financing, merger, acquisition, restructuring, bankruptcy, or sale of assets, subject to applicable confidentiality and consumer health data requirements;
• government authorities or other parties when required by law, legal process, or professional obligation, or when reasonably necessary to protect rights, safety, security, or the integrity of the Sites; and
• another person at your direction or with your consent.

We do not sell clinical information or consumer health data. We do not disclose clinical information or information used to select research findings for cross-context behavioral advertising or targeted advertising.

9. Cookies Analytics and Advertising

We use necessary cookies and similar technologies for authentication, security, fraud prevention, preferences, and Site operation. We may use analytics technologies to understand Site performance and general use. Optional advertising technologies may be used on public, nonclinical pages to measure campaigns or show more relevant advertising.

Our policy prohibits advertising pixels and session-replay technology on authenticated clinical pages, questionnaires, provider communications, laboratory-result pages, prescription pages, or pages whose URLs reveal a person's health condition or treatment interest. We do not permit advertising partners to use clinical information or consumer health data for their own advertising.

You may request an opt-out of sale, sharing, or targeted advertising by emailing support@hotbyscience.com with the subject Privacy Choices. Where available, you may also use the Site cookie settings or Your Privacy Choices link to manage optional technologies. We honor legally recognized browser-based opt-out signals, including Global Privacy Control, where required, and obtain consent before enabling optional technologies when required by law. Browser settings may also block cookies, but parts of the Sites may not function without necessary cookies.

10. Consumer Health Data Notice

This section applies to consumer health data governed by laws such as the Washington My Health My Data Act and Nevada's consumer health data law. Consumer health data may include information that identifies or can reasonably be linked to a consumer and reveals or permits an inference about physical or mental health, reproductive or sexual health, diagnoses, medications, bodily functions, biometric or genetic information, health services, or a person's attempt to obtain health-related products or services.

Categories collected. We may collect the clinical and wellness information, research and educational information, identifiers, transaction information, device and use information, communications, and inferences described in Section 3 when they qualify as consumer health data.

Sources. We collect this information from you; your device and use of the Sites; providers, laboratories, pharmacies, connected devices, and service providers you direct or authorize; and the operational sources described in Section 4.

Purposes. We collect and use consumer health data to provide a product or service you request, display educational observational research findings and, where requested and lawfully authorized, select findings relevant to your biological profile; administer the account; facilitate provider and laboratory services; process transactions; secure the Sites; prevent fraud; comply with law; and for another purpose to which you consent. Research uses require the permissions or other legal basis described in Section 7. We do not use consumer health data for targeted advertising.

Disclosures. We may disclose consumer health data to licensed providers, laboratories, pharmacies, research recipients authorized under the separate study consent or applicable law, and operational service providers as described in Section 8, but only as reasonably necessary to provide a requested service, with consent, or as otherwise permitted by law.

Sale. We do not sell consumer health data. If that practice changes, we will obtain the separate authorization required by law before a sale.

Geofencing. We do not use geofences around healthcare facilities to identify, track, collect data from, or send messages or advertising to a person concerning consumer health data.

Rights. Subject to applicable law and exceptions, you may confirm whether we collect, share, or sell consumer health data; access it; obtain a list of affiliates or categories of third parties that receive it; withdraw consent; and request deletion. You may appeal a denial by replying to the decision or emailing support@hotbyscience.com with the subject Privacy Appeal. We will explain any additional right to contact a state regulator.

11. California Privacy Notice

This section supplements the rest of the Privacy Policy for California residents. It applies when the California Consumer Privacy Act applies to the relevant company and information. Medical information governed by the California Confidentiality of Medical Information Act and protected health information governed by HIPAA may be exempt from some CCPA provisions.

During the preceding 12 months, we may have collected the following CCPA categories: identifiers; customer records; characteristics protected by law; commercial information; internet or other electronic network activity; approximate geolocation; professional or employment-related information when relevant; inferences; and sensitive personal information, including account credentials, financial information, precise information you choose to provide, and health, sex-life, sexual-orientation, genetic, or biometric information when relevant to a requested service. Examples, sources, business purposes, and recipients are described in Sections 3 through 10.

We do not sell personal information for money. Public-site advertising technologies may constitute sharing for cross-context behavioral advertising under California law if enabled. We do not sell or share clinical information or consumer health data for cross-context behavioral advertising. Where applicable, you may opt out of sharing by emailing support@hotbyscience.com with the subject Privacy Choices, through the Your Privacy Choices link if available, or through a recognized opt-out preference signal.

Subject to applicable law and verification, California residents may request:

• the categories and specific pieces of personal information collected about them;
• the categories of sources, purposes, and third parties involved;
• deletion of personal information, subject to exceptions;
• correction of inaccurate personal information;
• opt-out of sale or sharing; and
• limitation of certain uses or disclosures of sensitive personal information when the right applies.

We will not discriminate against you for exercising a privacy right. You may use an authorized agent where permitted. We may verify your identity and authority before completing a request. If information is maintained by a licensed provider, laboratory, or pharmacy, you may need to submit the request directly to that organization.

12. Privacy Rights in Other States

Residents of other states may have rights to access, correct, delete, or obtain a portable copy of personal information; opt out of targeted advertising, sale, or certain profiling; withdraw consent; or appeal a denied request. Rights vary by state and are subject to exceptions. We will respond under the law that applies to you.

13 How to Exercise Privacy Rights

Submit a request through the account privacy settings, if available, or email support@hotbyscience.com with the subject Privacy Request. Describe the right you wish to exercise and the Site or service involved. We may ask for information reasonably necessary to verify identity, authority, and jurisdiction. Do not send a full Social Security number, full payment-card number, password, or unnecessary medical information by ordinary email.

We will respond within the period required by applicable law. If we deny a request, we will explain the basis and any available appeal process. A request to delete a Hot by Science account may not include records controlled by a provider, laboratory, or pharmacy or records that must be retained for medical, safety, legal, tax, accounting, fraud-prevention, or transaction purposes.

14. Retention

We retain personal information for the shortest period reasonably necessary for the purposes described in this Policy, taking into account the duration of the account or relationship, the sensitivity of the information, the time needed to provide and support the service, safety and fraud risks, contractual commitments, and legal, tax, accounting, litigation, regulatory, and record-retention requirements.

Account and transaction records may be retained after account closure when needed for these purposes. Clinical records are retained according to the applicable provider's policies and law. When information is no longer required, we delete it, de-identify it, or restrict it from ordinary use. Backup copies may remain until overwritten under standard backup cycles, unless law requires a different process.

15. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including access controls, authentication, logging, vendor controls, and incident-response procedures. Our security requirements include encrypted transmission using HTTPS and Transport Layer Security (TLS) for account, transaction, patient, medical, and other sensitive information submitted through the Sites, and encryption of stored information as required by applicable law and risk-based safeguards. Access to clinical information is limited by role and business need. Use the designated secure forms or portal to submit sensitive records; ordinary email should not be used to send unnecessary medical information, passwords, or full payment-card details. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur.

16. Data Incidents

If a data incident occurs, we will investigate and provide notices required by applicable law. Depending on the information and the role of the affected entity, notification duties may arise under HIPAA, the FTC Health Breach Notification Rule, state medical privacy laws, consumer health data laws, or general breach notification laws.

17. United States Processing

The Sites are operated from the United States. Personal information may be processed in the United States and other locations where contracted service providers operate, subject to applicable law and contractual safeguards. The Sites are not offered outside the United States unless an offering expressly states otherwise and provides any required country-specific terms.

18. Children

The Sites are intended for adults and are not directed to anyone under 18. We do not knowingly permit a person under 18 to create an account or purchase products. If you believe a minor has provided personal information, contact support@hotbyscience.com.

19. Third Party Sites

A link to a third-party website or service does not mean this Privacy Policy applies there. Review the third party's privacy notice. Licensed providers, laboratories, pharmacies, payment processors, connected device providers, and other organizations may act independently and may have separate legal obligations.

20 Changes to This Policy

We may update this Privacy Policy to reflect changes in the Sites, practices, or law. We will post the revised Policy with an updated date. If a change is material, we will provide additional notice or obtain consent when required. Changes apply prospectively unless law permits otherwise.

21. Contact

For privacy questions or requests, email support@hotbyscience.com and use the subject Privacy Request. If a request concerns medical records or a provider's privacy practices, contact the provider identified in your care records or Notice of Privacy Practices.