The Vitality Collective
Request a Private Call

Privacy Policy

Effective: October 13, 2026

What changed on October 13, 2026: We added how we handle information from people who join the waitlist for our online community, The Collective (Section 3 and Section 14), and we now say “private call” instead of “discovery call.” Waitlist information is never sold or used for advertising. Nothing else changed.

What changed on October 2, 2026: We added Section 14A, Genetic Testing and Genetic Data, which explains how our genetic test works and how genetic test information is handled, and we updated the introduction and Sections 2, 3, 5, 10, and 14 to match. We also updated Sections 6, 13, 14, and 15 to describe our current cookie practices and how you can make privacy choices, and we added a note to Section 14 about our third-party booking calendar.

The Vitality Collective LLC (“The Vitality Collective,” “we,” “us,” or “our”) is an online wellness and telehealth company based in Milford, Connecticut. We help adults in the states where our services are available access hormone replacement therapy (HRT), peptide therapy, and custom lab and blood panels through a network of independently licensed clinicians, and genetic testing through an independent testing company.

Your privacy matters to us, especially because our services relate to your health. This Privacy Policy explains what information we collect, how we use and share it, the choices you have, and how to contact us.

Contents

1. Introduction and Scope

This Privacy Policy applies to personal information we collect when you:

  • Visit thevitalitycollective.co or any of its subdomains, including our booking site at book.thevitalitycollective.co (together, the “Site”);
  • Sign up for our emails, text messages, or free resources;
  • Purchase the Hormone Reset Blueprint or other digital products;
  • Request a private call with our team;
  • Join or use our affiliate and referral program; or
  • Contact us by email, text message, social media, or otherwise.

In this Policy, we refer to all of these together as our “Services.” “Personal information” means information that identifies, relates to, or could reasonably be linked to you or your household.

This Policy does not apply to:

  • Protected health information that is governed by HIPAA and the applicable Notice of Privacy Practices provided at or before intake (see Section 2);
  • Information collected by third-party platforms under their own terms and privacy notices, including the patient ordering storefront described in Section 17; or
  • Information collected offline or through any website or service that links to this Policy only for reference.

2. This Policy and HIPAA: Our Notice of Privacy Practices

It is important to understand the difference between this Privacy Policy and the privacy protections that apply to your medical care.

Clinical care and protected health information

Medical evaluations, prescriptions, and clinical care offered through The Vitality Collective are provided by independently licensed clinicians in a third-party clinical network. When you become a patient, for example, when you complete a medical intake, consult with a clinician, receive a prescription, or have labs ordered, the health information created or received in the course of that care may be “protected health information” (“PHI”) under the federal Health Insurance Portability and Accountability Act of 1996 and its regulations (“HIPAA”).

PHI is governed by the applicable Notice of Privacy Practices (“NPP”), which patients receive at or before intake. You can request a copy of the NPP at any time by contacting us at welcome@thevitalitycollective.co. The NPP explains how PHI may be used and disclosed and describes your rights under HIPAA, such as the right to access and request amendment of your health records. Where HIPAA applies, the NPP, not this Privacy Policy, controls how your PHI is used and disclosed. If this Privacy Policy and the NPP conflict with respect to PHI, the NPP controls.

Information covered by this Privacy Policy

Information you share with us outside of clinical care, such as when you browse the Site, join our email list, buy the Hormone Reset Blueprint, request a private call, or participate in our affiliate program, is generally not PHI and is covered by this Privacy Policy. Some of this information may still relate to your health (for example, if you tell us about your health goals when booking a call). We treat health-related information with extra care, and certain state laws protect it as “consumer health data” or “sensitive data.” See Section 14 for details.

Private calls are informational conversations with our team and are not medical appointments. Please do not send detailed medical information through general website forms, email, text messages, or social media. If you decide to become a patient, the information needed for your care will be collected through the patient intake process.

3. Information We Collect

We collect only the information we reasonably need for the purposes described in this Policy. The information we collect falls into three groups.

Information you provide to us

  • Contact and identity information, such as your name, email address, phone number, mailing or shipping address, and date of birth or confirmation that you are at least 18.
  • Marketing preferences and consent records, such as whether you agreed to receive marketing emails or text messages, and the date, time, and method of your consent or opt-out.
  • Purchase information, such as the products you buy (for example, the Hormone Reset Blueprint), order amounts, billing address, and transaction history. Payment card details are entered directly into our payment processor’s systems. We do not receive or store full card numbers. We may receive limited payment details, such as card type, the last four digits of your card, and payment status.
  • Genetic test orders, if you buy a genetic test: your order details, your shipping address, and your genetic test consent records. See Section 14A.
  • Booking information, such as your preferred appointment time and anything you choose to tell us about your goals or questions when you request a private call.
  • Health-related information you choose to share outside of clinical care, such as your health goals, symptoms, interest in particular services, age, or sex.
  • Communications, such as the content of your emails, text messages, chat messages, and calls with us, notes from private calls, survey responses, reviews, and testimonials. If we record a call, we will tell you before recording begins.
  • Private calls with the founder. If you agree at the start of a call, we may record or transcribe it using a third-party tool (Fathom). We use recordings and transcripts only to follow up with you, never for advertising, and we delete them within 90 days. You can say no and still have the call.
  • Community waitlist: your name, your email, and the fact that you joined the waitlist, used to confirm your spot and invite you to The Collective. It’s never sold or used for advertising.
  • Affiliate information, if you join our affiliate and referral program, such as your name, contact details, social media handles, website, payout details, and tax information (for example, a Form W-9, which may include a Social Security number or other taxpayer identification number).

Information we collect automatically

  • Device and connection information, such as your IP address, browser type, operating system, device identifiers, and language settings.
  • Usage information, such as pages viewed, links clicked, time spent on pages, the website that referred you to us, and the date and time of your visit.
  • Approximate location, such as city, state, or ZIP code, inferred from your IP address. We do not collect precise geolocation information.
  • Cookie and similar identifiers, as described in Section 6.
  • Email and text message engagement, such as whether you open our emails, click links in them, or reply to our messages.
  • Referral information, such as the affiliate code or link you used to reach us.

Information we receive from third parties

  • Our telehealth, pharmacy, and lab partners and our clinical network, such as order and fulfillment status, subscription or refill status, and referral attribution, to the extent needed to support you, operate our business, and run our affiliate program. Health information received in connection with your clinical care is handled as described in the NPP.
  • Our payment processor, such as payment confirmation and fraud-screening results.
  • Affiliates and referral partners, such as which partner referred you to us.
  • Advertising and analytics providers, such as aggregated reports about how people use the Site and how our ads perform.
  • Social media platforms, such as your public profile information when you interact with our pages or message us, depending on your settings on those platforms.
  • Service providers that collect information on our behalf, such as our customer relationship management (CRM), marketing automation, and scheduling providers.

4. How We Use Information

We use personal information to:

  • Provide and operate the Services, including delivering digital products, scheduling and holding private calls, and providing customer support;
  • Help you get started with care, including connecting you with our clinical network and our telehealth, pharmacy, and lab partners when you choose to become a patient;
  • Process payments, issue refunds, and prevent fraud;
  • Send transactional and service messages, such as order confirmations, appointment reminders, and updates about the Services;
  • Send marketing communications, such as newsletters, educational content, and offers, with your consent where required by law;
  • Show and measure advertising for our Services on other websites and social media platforms, subject to the limits and choices described in Section 6;
  • Operate our affiliate and referral program, including attributing referrals, calculating and paying commissions, tax reporting, and preventing fraud;
  • Understand how people use the Site and improve our content, Services, and user experience;
  • Protect the security and integrity of the Services, detect and prevent fraud and abuse, and enforce our terms;
  • Comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims; and
  • Carry out other purposes we describe to you when we collect the information or with your consent.

We may also create de-identified or aggregated information that cannot reasonably be used to identify you. We maintain and use such information only in de-identified form and do not attempt to re-identify it, except as permitted by law.

We do not use PHI for marketing except as permitted by HIPAA and described in the NPP. We do not use personal information to make decisions about you based solely on automated processing that produce legal or similarly significant effects, and we do not collect, use, or sell personal information to train large language models.

5. How We Share Information

What we do not do

  • We do not sell your personal information or your health information.
  • We do not share health information for targeted advertising.
  • We do not share your mobile phone number or text message opt-in data with third parties or affiliates for their own marketing or promotional purposes.
  • We do not disclose personal information to third parties for their own direct marketing purposes.

Who we share information with

We share personal information only as described below and as permitted by law, including HIPAA where it applies:

  • Service providers. We use vendors that process information on our behalf and under our instructions, such as website hosting and maintenance providers, our CRM and marketing automation provider (which powers our forms, email and text messaging, and booking calendar), email and text message delivery services, analytics providers, customer support tools, cloud storage and IT security providers, a meeting recording and transcription provider (Fathom), for private calls you agree to record, and accountants, lawyers, and other professional advisers. We require these providers to protect the information and to use it only to provide services to us.
  • Our clinical network. When you choose to become a patient or request a clinical consultation, we share the information needed for independently licensed clinicians to evaluate you and provide care, such as your name, contact information, and information you provide for that purpose.
  • Telehealth platform, pharmacy, lab, and genetic testing partners. We share information as needed to process orders, fulfill prescriptions, ship products, collect samples, and deliver test results. Our genetic test is provided by Genomic Dietetics & Performance Corp, an independent company. With your consent, we share only your name and shipping address with it so your test kit can be sent (see Section 14A). Patient orders are placed through a storefront operated by a third-party telehealth and pharmacy-fulfillment platform, which has its own terms and privacy notice (see Section 17).
  • Payment processor. Payments are processed by Stripe, which collects and uses your payment information as described in the Stripe Privacy Policy. We do not include health details in the information we send to Stripe beyond what is needed to complete your payment.
  • Affiliates and referral partners. If you use an affiliate’s code or link, we tell that affiliate only the limited information needed to verify their commission, as described in Section 9. We never give affiliates your name, contact information, the products or treatments you purchased, or any health information.
  • Advertising and analytics partners. As described in Section 6, we allow certain analytics and advertising partners to collect limited information through cookies and pixels on general pages of the Site. We do not share health information with these partners.
  • Legal and compliance. We may disclose information when we believe in good faith that it is necessary to comply with the law, a subpoena, court order, or other legal process; to respond to requests from government or regulatory authorities; to protect the rights, property, or safety of The Vitality Collective, our patients and customers, or others; to investigate fraud or security issues; or to enforce our agreements.
  • Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business or assets, personal information may be transferred to the successor or acquirer as part of that transaction, subject to applicable law. We will require any successor to honor this Policy for information we collected under it, or we will notify you of any material change.
  • With your consent or at your direction. We may share information for other purposes when you ask us to or give us permission.

Advertising cookies and state law definitions

Some state privacy laws define “selling,” “sharing,” and “targeted advertising” broadly enough to include allowing advertising partners to collect information such as cookie identifiers, IP address, and browsing activity through cookies and pixels on a website. To the extent our use of advertising cookies on general pages of the Site is considered “selling,” “sharing,” or “targeted advertising” under those laws, you can opt out at any time, as described in Section 6 and Section 15. We honor Global Privacy Control signals as an opt-out request.

6. Cookies, Pixels, and Analytics

What these technologies are

Cookies are small text files stored on your browser or device. Pixels (also called tags or web beacons) are small pieces of code on a web page or in an email that send information to us or to a third party. Some providers also offer “server-side” tools that send information from our systems directly to the provider. We refer to all of these as “cookies and similar technologies.”

How we use them

  • Strictly necessary. These make the Site work, for example, by keeping it secure and remembering items in your cart. They can’t be turned off on our Site, but you can block them in your browser settings, which may affect how the Site works.
  • Functional. These remember your preferences and support features such as forms and scheduling.
  • Analytics. These help us understand how visitors use the Site so we can improve it. We use Cloudflare Web Analytics, a cookieless tool that gives us aggregate statistics about visits to our Site. We don’t currently use analytics services such as Google Analytics or advertising technologies such as the Meta Pixel on our Site. If we add them, we’ll update this policy and ask for your consent first where the law requires.

Our emails may also contain pixels that tell us whether you opened an email or clicked a link, which helps us understand engagement and manage our email list.

How we protect health information

We limit tracking technologies on health-related parts of our Services:

  • We do not place advertising pixels or similar advertising tools on pages where you book a call, check out, complete a medical intake, or access patient services, or on pages about specific treatments. Our third-party booking calendar loads a script from Meta, as described in Section 14.
  • We configure our analytics and advertising tools so that health information, such as intake answers, the treatments you are interested in or have ordered, and order details, is not sent to advertising platforms.
  • We require our marketing agencies and vendors to follow these same rules.

Your choices

We don’t currently place non-essential cookies on our Site. If we add them, we’ll ask for your consent first where the law requires. You can change your choices at any time by contacting us as described in Section 15 or by adjusting your browser settings. If we add a cookie consent tool, we’ll add a “Cookie Settings” link to the Site footer. You can also use the following tools:

Cookie-based opt-outs apply only to the browser and device you use when you opt out, and they may stop working if you clear your cookies.

Global Privacy Control

We honor Global Privacy Control (“GPC”) signals. If your browser or browser extension sends a GPC signal, we treat it as a request to opt out of the sale or sharing of your personal information and of targeted advertising for that browser or device. If we can associate the browser with you (for example, because you have given us your email address), we will also apply the opt-out to your profile with us. You can learn more at globalprivacycontrol.org.

Do Not Track

Some browsers offer a “Do Not Track” setting. Because there is no common industry standard for how to respond to these signals, the Site does not currently respond to Do Not Track signals. We do honor GPC signals as described above.

7. Email Marketing

If you sign up through one of our forms and check the box agreeing to receive marketing emails, we may send you newsletters, educational content, and information about our Services and offers. Agreeing to receive marketing emails is not a condition of any purchase.

You can unsubscribe at any time by clicking the “unsubscribe” link at the bottom of any marketing email or by emailing us at welcome@thevitalitycollective.co. We will process your request promptly, and in any event within 10 business days. We keep a record of your opt-out so that we continue to honor it.

Even after you unsubscribe from marketing emails, we may still send you transactional or service messages, such as order confirmations, appointment reminders, and responses to your questions.

We aim to keep sensitive health details out of email subject lines and marketing emails.

8. SMS/Text Messaging

The Vitality Collective may send text messages to the mobile number you provide, but only if you agree to receive them. We send two types of text messages:

  • Informational messages, such as booking confirmations and reminders for private calls, appointment reminders, order and account updates, and replies to your customer support requests; and
  • Marketing messages, such as offers, promotions, and updates about our Services, which we send only if you separately agree to receive them.
  • Consent. You agree to receive informational texts, such as booking reminders, by providing your mobile number and checking an unchecked box agreeing to receive them, for example, when you request a private call or complete one of our forms. You agree to receive marketing texts by checking a separate, unchecked marketing consent box or by texting a keyword we publish. By opting in to marketing texts, you agree that we may send recurring marketing messages to the number you provide, which may be sent using automated technology. Consent to receive text messages of any kind is not a condition of any purchase or of booking a call.
  • Message frequency. Message frequency varies. Informational messages are sent in connection with your bookings, orders, and requests.
  • Rates. Message and data rates may apply.
  • Opting out. Reply STOP to any message to cancel at any time. Replying STOP stops all text messages from us to that number, including booking reminders. You will receive one final message confirming your opt-out. You may also opt out by emailing us at welcome@thevitalitycollective.co.
  • Help. Reply HELP for help, or email us at welcome@thevitalitycollective.co.
  • Carriers. Mobile carriers are not liable for delayed or undelivered messages.

Text message privacy. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors that support our services, such as customer service and message delivery, is permitted. All other categories of sharing described in this Policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. For clarity, “affiliates” here includes both companies affiliated with us and participants in our affiliate and referral program.

Standard text messages are not encrypted. We keep our text messages general and avoid including detailed health information in them.

9. Affiliate and Referral Program

We work with creators and other partners (“affiliates”) who share a referral code or link for our Services and earn a commission on referred purchases.

If you use an affiliate’s code or link

When you click an affiliate link or enter a referral code, we record which affiliate referred you, using a link parameter, a cookie, or the code you enter at checkout. We then track qualifying purchases connected to that referral, including later purchases such as subscription renewals or refills, so we can calculate and pay commissions.

Affiliates see only the limited information needed to verify their commissions, such as the date of an attributed sale, an order reference number, and the commission amount. We do not give affiliates your name, contact information, the specific products or treatments you purchased, or any health information. Where referral tracking involves PHI, it is handled as permitted by HIPAA and described in the NPP.

Affiliates are independent and are not our agents. They are not authorized to collect health information on our behalf. If you choose to share information directly with an affiliate, for example, by telling them about your treatment, their own privacy practices apply to that information.

If you are an affiliate

We collect your name, contact details, social media handles and website, payout details, and tax information. We use this information to manage the program, attribute referrals, pay commissions, meet tax reporting obligations (for example, issuing a Form 1099), communicate with you, and prevent fraud. We share it with our payment, tax, and program-management service providers as needed for these purposes.

10. Data Retention

We keep personal information only as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, meet legal, tax, and accounting requirements, resolve disputes, and enforce our agreements. When deciding how long to keep information, we consider the amount, nature, and sensitivity of the information, the risk of harm from unauthorized use or disclosure, why we collected it, and our legal obligations. As a general guide:

  • Marketing contact information: until you unsubscribe or ask us to delete it, plus a short period to process your request. We keep a minimal record of opt-outs so we can continue to honor them.
  • Private call and booking records: generally up to 24 months after our last interaction, unless you become a patient or ask us to delete them sooner.
  • Private call recordings and transcripts: deleted within 90 days, as described in Section 3.
  • Purchase and transaction records: generally up to seven years, as needed for tax, accounting, and legal purposes.
  • Affiliate records: for the duration of the affiliate relationship and generally up to seven years afterward for tax and accounting purposes.
  • Consent and opt-out records for email and text messages: generally at least five years, to demonstrate compliance with marketing laws.
  • Analytics data: generally no longer than 14 months in identifiable form, depending on the tool’s settings. Cookies expire according to their own settings, and you can delete them at any time.
  • Consumer health data: only as long as needed for the purpose for which it was collected, or as long as you consent, unless a longer period is required by law.
  • Genetic testing: We don’t keep your report or your raw DNA data. If the testing company sends your report to us, we forward it to you and delete our copy. Deleted copies are fully removed from our email systems within 30 days. Genetic test order, shipping, and consent records are kept like the purchase and consent records described above. See Section 14A.
  • Medical records: retained by the clinicians and partners responsible for them as required by applicable medical records laws and as described in the NPP.

When we no longer need personal information, we delete it or de-identify it. Information in backup systems is deleted on a regular schedule.

11. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, taking into account its sensitivity. These include encrypting data in transit to and from the Site, limiting access to personal information to people who need it for their work, and requiring our service providers to protect the information they handle for us.

No method of transmission or storage is completely secure, and we cannot guarantee the security of your information. Please use care when sending information to us, and contact us right away at welcome@thevitalitycollective.co if you believe your information has been compromised. If a security incident affects your personal information, we will notify you and the appropriate authorities as required by law.

12. Children’s Privacy

Our Services are intended only for adults 18 years of age or older and are not directed to children. We do not knowingly collect personal information from children under 13, consistent with the Children’s Online Privacy Protection Act (COPPA), and we do not knowingly sell or share the personal information of anyone under 18. If we learn that we have collected personal information from a child under 13, or from anyone under 18 without authorization, we will delete it. If you believe a child has provided us with personal information, please contact us at welcome@thevitalitycollective.co.

13. Your State Privacy Rights

Depending on where you live, you may have rights over your personal information under state privacy laws. Some of these laws apply only to businesses that meet certain size or volume thresholds. Even where a law may not apply to us, we extend the rights described in this section to residents of all U.S. states, subject to verification and the exceptions allowed by law. See Section 15 for how to submit a request.

Protected health information governed by HIPAA is generally exempt from these state laws. Requests about PHI, such as requests to access or amend your medical records, are handled as described in the NPP. If you are not sure which applies, contact us and we will help direct your request.

California residents

This section applies to California residents and supplements the rest of this Policy. It describes our practices under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), and serves as our notice at collection.

Categories of personal information. In the past 12 months, we have collected the following categories of personal information. The sources, purposes, and recipients of each category are described in Sections 3, 4, and 5, and how long we keep each category is described in Section 10.

Category Examples Sources Categories of recipients for business purposes Sold or shared?
A. Identifiers Name, email address, phone number, postal address, IP address, cookie and device identifiers, order reference numbers; Social Security or taxpayer identification number (affiliates only) You; your browser or device; service providers; telehealth platform, pharmacy, and lab partners; affiliates Service providers; clinical network; telehealth platform, pharmacy, and lab partners; payment processor; legal and compliance recipients Not sold. Online identifiers (such as cookie IDs and IP address) collected on general pages may be shared with advertising partners for cross-context behavioral advertising, subject to your right to opt out.
B. Personal information described in Cal. Civ. Code § 1798.80(e) Name, address, phone number, limited payment information, payout and tax details (affiliates), health information you choose to share You; payment processor; telehealth platform, pharmacy, and lab partners Service providers; clinical network; telehealth platform, pharmacy, and lab partners; payment processor Not sold or shared
C. Characteristics of protected classifications Age, date of birth, sex or gender, when you provide them You Service providers; clinical network; telehealth platform, pharmacy, and lab partners Not sold or shared
D. Commercial information Products purchased, purchase history, refunds, referral codes used You; payment processor; telehealth platform partner; affiliates Service providers; payment processor; telehealth platform partner; affiliates (limited commission information only, as described in Section 9) Not sold or shared
F. Internet or other electronic network activity Pages viewed, links clicked, referring website, email and text engagement Your browser or device; analytics and advertising partners; service providers Service providers; analytics providers Not sold. Browsing activity on general pages may be shared with advertising partners for cross-context behavioral advertising, subject to your right to opt out.
G. Geolocation data Approximate location (city, state, or ZIP code) inferred from IP address; we do not collect precise geolocation Your browser or device Service providers; analytics providers Not sold. May be shared with advertising partners as part of IP address information on general pages, subject to your right to opt out.
H. Audio, electronic, visual, or similar information Call recordings (with notice), voicemails, photos or files you send us You Service providers Not sold or shared
I. Professional or employment-related information Business name, website, and social media audience information (affiliates only) You Service providers Not sold or shared
K. Inferences Preferences and interests drawn from the information above, such as the topics you engage with Derived from other information we collect Service providers Not sold or shared
L. Sensitive personal information Health information you choose to share (such as goals, symptoms, or interest in specific services); Social Security or taxpayer identification number and financial account details for payouts (affiliates only) You; telehealth platform, pharmacy, and lab partners Service providers; clinical network; telehealth platform, pharmacy, and lab partners Not sold or shared

We do not collect biometric information or education information. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

Sensitive personal information. We use and disclose sensitive personal information only for purposes permitted by the CCPA, such as providing the Services you request, ensuring security and integrity, and complying with the law. We do not use it to infer characteristics about you.

Your California rights. Subject to certain exceptions, you have the right to:

  • Know and access: request the categories of personal information we have collected about you, the categories of sources, our business or commercial purposes, the categories of third parties to whom we disclosed it, and a copy of the specific pieces of personal information we hold about you, in a portable format.
  • Delete: request that we delete personal information we collected from you.
  • Correct: request that we correct inaccurate personal information about you.
  • Opt out of sale or sharing: direct us not to sell your personal information or share it for cross-context behavioral advertising. You can do this by enabling Global Privacy Control (GPC) in your browser or by contacting us as described in Section 15.
  • Limit use of sensitive personal information: direct us to limit our use of sensitive personal information to the purposes permitted by the CCPA. Because we already limit our use in this way, we do not offer a separate limit option, but you may contact us with any questions.
  • Non-discrimination: you will not receive discriminatory treatment, such as being denied services or charged different prices, for exercising your privacy rights.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require the agent to provide your signed written permission and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.

Financial incentives. From time to time, we may offer free resources, discounts, or other benefits when you sign up for our emails or text messages or use a referral code. The terms of each offer will be described when it is presented. Participation is voluntary, and you may withdraw at any time by unsubscribing or contacting us. We reasonably estimate the value of your personal information to be equal to the value of the benefit offered, based on our expenses related to the offer.

Shine the Light. California Civil Code § 1798.83 allows California residents to request information about the disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes. You may request this information once per calendar year by contacting us at welcome@thevitalitycollective.co.

Connecticut, Virginia, Colorado, Utah, Texas, Oregon, and other states

Residents of Connecticut, Virginia, Colorado, Utah, Texas, Oregon, and other states with comprehensive privacy laws (including Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Rhode Island, and Tennessee) may have some or all of the following rights, depending on state law:

  • To confirm whether we process your personal data and to access it;
  • To correct inaccuracies in your personal data;
  • To delete personal data provided by or obtained about you;
  • To obtain a copy of your personal data in a portable and, where technically feasible, readily usable format;
  • To opt out of the processing of your personal data for targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects;
  • In some states, such as Oregon and Minnesota, to obtain a list of the specific third parties to which we have disclosed personal data; and
  • To appeal our decision on your request, as described in Section 15.

Sensitive data. Many of these laws treat health information, consumer health data, genetic data, and government identification numbers as “sensitive data.” We process sensitive data only with your consent or as otherwise permitted by law, and you may withdraw your consent at any time by contacting us. Withdrawing consent does not affect processing that occurred before you withdrew it.

As described in Section 5, we do not sell personal data, and to the extent our use of advertising cookies on general pages is considered a sale or targeted advertising, you may opt out using GPC or by contacting us.

Nevada residents

Nevada law allows Nevada residents to opt out of the sale of certain covered information. We do not sell covered information as defined under Nevada law. You may still submit an opt-out request by emailing welcome@thevitalitycollective.co, and we will record your request in case our practices change. Nevada residents should also see Section 14 regarding consumer health data.

14. Consumer Health Data Privacy (Washington, Nevada, and Connecticut)

This section is also published as our standalone Consumer Health Data Privacy Policy. The two are intended to be identical. If they ever differ, the version that is more protective of you applies.

Scope

This section applies to “consumer health data” as defined by Washington’s My Health My Data Act (RCW Chapter 19.373), Nevada Senate Bill 370 (NRS Chapter 603A), Connecticut’s consumer health data provisions of the Connecticut Data Privacy Act, and similar state laws. As a matter of practice, we apply this section to consumer health data about all of our users in the United States, wherever they live.

Consumer health data generally means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. This section does not apply to protected health information (“PHI”) governed by the Health Insurance Portability and Accountability Act (“HIPAA”), which is handled under the applicable Notice of Privacy Practices provided at or before intake. You can request a copy of that notice by contacting us at welcome@thevitalitycollective.co. This section also does not apply to information that has been de-identified in accordance with applicable law.

Consumer health data we collect, why we collect it, where it comes from, and who we share it with

The table below lists each category of consumer health data we collect, the purposes for which we collect and use it, the sources from which we obtain it, and the categories of third parties with which we share it.

Category of consumer health data Purposes and how we use it Sources Categories of third parties we share it with
Health goals, symptoms, and health conditions you tell us about outside of clinical care (for example, when requesting a private call or contacting us) To respond to your questions; to schedule and hold private calls; to understand which of our services may fit your needs; and, if you choose to become a patient, to connect you with our clinical network You Service providers (processors); our clinical network, only if you choose to become a patient or request a consultation
Information about hormones, medications, bodily functions, or wellness that you choose to share with us Same purposes as the category above You Service providers (processors); our clinical network, only if you choose to become a patient or request a consultation
Your interest in, requests for, or purchases of health-related services, such as hormone replacement therapy, peptide therapy, genetic testing, or lab panels To provide the products and services you request; to process orders and payments; to provide customer support; to send transactional messages about your requests and orders; and to send marketing communications, only with your consent You; your interactions with our website and booking pages; our telehealth platform, pharmacy, and lab partners Service providers (processors); our clinical network; our telehealth platform, pharmacy, lab, and genetic testing partners; our payment processor, limited to the information needed to process your payment
Genetic testing information: that you bought a genetic test, your shipping address, and your genetic test consent records. We don’t keep your genetic report or raw DNA data (see Genetic Testing and Genetic Data). To process your order and payment; to send your name and shipping address to Genomic Dietetics & Performance Corp so your test kit can be sent and your test processed, only with your consent; to forward your report to you if the testing company sends it to us; to schedule your report walkthrough; and to keep a record of your consents You; Genomic Dietetics & Performance Corp, only if it sends your report to us. If it does, we forward it to you and delete our copy. Deleted copies are fully removed from our email systems within 30 days. Service providers (processors); Genomic Dietetics & Performance Corp (your name and shipping address only, with your consent); our payment processor, limited to the information needed to process your payment
Age and sex, when collected in connection with health-related services To understand your needs, provide the services you request, and connect you with our clinical network if you choose to become a patient You Service providers (processors); our clinical network; our telehealth platform, pharmacy, and lab partners
Information that identifies you as seeking health care services, such as requesting a private call, placing an order, or your order, subscription, or refill status To schedule calls and send booking reminders; to support your orders; to prevent fraud; and to calculate commissions owed to an affiliate or referral partner whose code or link you used (with your consent where required). Affiliates never receive your identity or any health information. You; our booking and scheduling tools; our telehealth platform, pharmacy, and lab partners Service providers (processors); our clinical network; our telehealth platform, pharmacy, and lab partners
Inferences about your health status drawn from the information above To respond to you and provide the services you request. We do not use these inferences for advertising. Derived from the information above Service providers (processors)

Community waitlist: your name, your email, and the fact that you joined the waitlist, used to confirm your spot and invite you to The Collective. It’s never sold or used for advertising.

Lab results ordered by a clinician in our clinical network are handled under the applicable Notice of Privacy Practices. Genetic testing is provided by Genomic Dietetics & Performance Corp, an independent company; see Genetic Testing and Genetic Data in our Privacy Policy for how genetic test information is handled.

Sources of consumer health data

  • Directly from you, through our forms, booking pages, calls, emails, and messages;
  • From your interactions with our website and booking pages;
  • From our clinical network and our telehealth, pharmacy, and lab partners, such as order and fulfillment status; and
  • From service providers that collect information on our behalf, such as our customer relationship management (CRM), marketing automation, and scheduling providers.

How we use consumer health data

We collect and use consumer health data only for the purposes described in the table above, which are:

  • To respond to your questions and requests;
  • To schedule and hold private calls and send booking reminders;
  • To provide the products and services you request and to connect you with our clinical network and partners when you choose to become a patient;
  • To process orders and payments and provide customer support;
  • To send transactional messages about the services you requested;
  • To send marketing communications, only with your consent;
  • To calculate affiliate and referral commissions without disclosing your identity or health information to affiliates, with your consent where required;
  • To protect the security of our services and prevent fraud; and
  • To comply with the law.

We do not use consumer health data for targeted advertising.

Categories of consumer health data we share and who we share it with

We share the categories of consumer health data listed in the table above only with the categories of third parties shown for each category. Those categories of third parties are:

  • Service providers (processors) that act on our behalf and under our instructions, such as our CRM, marketing automation, scheduling, website hosting, and email and text message delivery providers;
  • Our clinical network of independently licensed clinicians;
  • Our telehealth platform, pharmacy, lab, and genetic testing partners;
  • Our payment processor, limited to the information needed to process your payment;
  • Professional advisers, such as lawyers and accountants, when needed to provide advice to us;
  • Government authorities, courts, and others when required by law; and
  • A successor or acquirer in a merger, acquisition, or sale of all or part of our business, as permitted by law.

Affiliates. We do not currently share consumer health data with any affiliates (companies that control, are controlled by, or are under common control with The Vitality Collective LLC). If that changes, we will update this section to list them.

What we do not do:

  • We do not sell consumer health data. We would never sell it without your valid signed authorization.
  • We do not share consumer health data with advertising platforms or use it for targeted advertising.
  • We do not share consumer health data with participants in our affiliate and referral program.
  • We do not use geofences around locations where health care services are provided to identify or track consumers, collect consumer health data, or send notifications or advertisements.

We collect consumer health data only with your consent or to the extent necessary to provide a product or service you have requested. We share consumer health data only with your separate consent or to the extent necessary to provide a product or service you have requested. When we ask for your consent, we will tell you what consumer health data we will collect or share, why, and with which categories of recipients, and how you can withdraw your consent. We will ask for your consent again before collecting, using, or sharing consumer health data for a purpose not described in this section.

Third-party tracking on our website

Third-party analytics and advertising providers may collect information about your use of general pages of our website over time and across different websites and online services, as described in this Privacy Policy (see Section 6). We do not place advertising tools on pages where you book a call, check out, complete a medical intake, or access patient services, or on pages about specific treatments, and we configure our tools so that consumer health data is not sent to advertising platforms. We don’t currently use these tools on our Site. If we add them, they’ll run only with your consent. You can change your choices at any time by contacting us as described in Section 15 or by adjusting your browser settings. If we add a cookie consent tool, we’ll add a “Cookie Settings” link to the Site footer.

Our online booking calendar is provided by a third-party scheduling platform. Its pages load a script from Meta even though we haven’t set up any Meta tracking on them, so Meta may receive basic technical information, such as your IP address and the page address, when you visit. We don’t send Meta your booking details or any health information.

How we protect and retain consumer health data

We limit access to consumer health data to employees, contractors, and service providers who need it to carry out the purposes described above and who are bound by confidentiality obligations. We require our processors to process consumer health data only under a written contract and according to our instructions. We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the data. We keep consumer health data only as long as needed for the purpose for which it was collected or as long as you consent, unless a longer period is required by law.

Your consumer health data rights

Subject to applicable law, you have the right to:

  • Confirm and access. Confirm whether we collect, share, or sell your consumer health data, and access that data, including a list of all third parties and affiliates with which we have shared or sold it and an active email address or other online way to contact each of them.
  • Withdraw consent. Withdraw your consent to our collection and sharing of your consumer health data.
  • Stop collection, sharing, or sale. Request that we stop collecting, sharing, or selling your consumer health data.
  • Delete. Request that we delete your consumer health data. We will delete it from our records and notify all processors, affiliates, and third parties with which we have shared it so they can delete it too. If the data is stored in archived or backup systems, deletion from those systems may take up to six months.
  • Review and request changes. Review the consumer health data we hold about you and request that we correct or change it.
  • Appeal. Appeal our decision if we decline to act on your request.

We will not discriminate against you for exercising any of these rights.

How to exercise your rights

You can submit a request by email or by mail:

  • Email: welcome@thevitalitycollective.co, with the subject line “Consumer Health Data Request”
  • Mail: The Vitality Collective LLC, Attn: Privacy, 364 Wheelers Farm Road, Unit 302, Milford, CT 06461

Please tell us your name, the email address and phone number you have used with us, your state of residence, and which right you want to exercise.

Verification. To protect your privacy, we will take commercially reasonable steps to verify your identity before acting on a request, usually by matching information you provide with information we already have. We will use information you provide for verification only for that purpose. If we cannot verify your identity, we will tell you and explain what else we need. Where the law allows, an authorized agent may submit a request on your behalf; we may ask the agent for proof of your signed permission and may ask you to verify your identity directly with us.

Timing and fees. We will respond within 45 days after we receive your request. If reasonably necessary, we may extend this period once by up to 45 additional days, and we will tell you about the extension and the reason for it within the first 45 days. We do not charge a fee for requests. If a request is manifestly unfounded, excessive, or repetitive, we may decline it where the law allows, and we will explain why.

How to withdraw your consent

You can withdraw your consent to our collection or sharing of your consumer health data at any time by emailing welcome@thevitalitycollective.co with the subject line “Withdraw Consent” or by writing to us at the mailing address above. You can also unsubscribe from marketing emails using the link in any email and stop text messages by replying STOP. After you withdraw consent, we will stop collecting and sharing your consumer health data for the purposes covered by that consent, except as needed to complete a service you have already requested or as required by law. Withdrawing consent does not affect processing that took place before you withdrew it.

How to appeal a decision

If we decline to act on your request, in whole or in part, you may appeal by replying to our response or by emailing welcome@thevitalitycollective.co with the subject line “Consumer Health Data Appeal” within a reasonable time after receiving our decision. You may also appeal by mail at the address above. We will respond to your appeal in writing within 45 days after we receive it, explaining any action taken or not taken and the reasons for our decision. If we deny your appeal, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint, the Nevada Attorney General at ag.nv.gov, the Connecticut Attorney General at portal.ct.gov/ag, or the Attorney General in your state.

Changes to this section

We may update this section from time to time. When we do, we will post the updated version, change the effective date, and, for material changes, notify you before the changes take effect by posting a prominent notice on our website or by email. We will obtain your consent before collecting, using, or sharing consumer health data in a materially different way than described when we collected it.

For questions about this section, contact us at welcome@thevitalitycollective.co or by mail at The Vitality Collective LLC, Attn: Privacy, 364 Wheelers Farm Road, Unit 302, Milford, CT 06461.

14A. Genetic Testing and Genetic Data

This section explains how information is handled when you buy a genetic test from The Vitality Collective. “Genetic data” means information about your DNA or genetic variants, including test results, your written report, and the biological samples you provide for testing. Genetic data is sensitive. It is unique to you, and it can also reveal information about your biological relatives.

Who provides the test

Our genetic test is provided by Genomic Dietetics & Performance Corp, an independent company, which arranges laboratory testing of your sample and prepares your written report. You buy the test through our checkout and under our Terms of Service. After you purchase, The Vitality Collective submits the kit request for you, but it doesn’t authorize the test or review your results clinically. Each test is authorized by an independent clinician working with Genomic Dietetics & Performance Corp or its laboratory. Genomic Dietetics & Performance Corp is not our service provider. It handles your sample and its own copy of your data under its own policies.

What we collect and keep

When you buy a genetic test, we collect your name, email address, shipping address, order and payment information, and your genetic test consent records. We keep them in our client records system, and our payment processor receives the information needed to process your payment, as described in Section 3 and Section 10. Genomic Dietetics & Performance Corp and its laboratory hold your sample and the genetic data generated from it. We don’t keep your report or your raw DNA data. If the testing company sends your report to us, we forward it to you and delete our copy. Deleted copies are fully removed from our email systems within 30 days. During your walkthrough, you can share your report with us on screen, but we don’t save it. We use your report only to walk you through what it covers. We do not use genetic data to decide whether you can use any service, to set prices, or for marketing.

What we share

With your consent, we share only your name and shipping address with Genomic Dietetics & Performance Corp so your test kit can be sent and your test processed. We do not send it your email address, phone number, or health information. We do not sell genetic data. We do not use or share it for advertising, and we do not share it with employers, insurers, data brokers, or advertising platforms. We do not use genetic data or samples for research. We will not use or share your genetic data for any other purpose without your separate express consent.

The testing company’s own practices

Genomic Dietetics & Performance Corp handles your sample and its own copy of your data under its own policies. Ask it directly how your sample and data are stored, shared, used for research, and deleted, and whether your sample is destroyed.

Before you buy, we ask for two separate consents. Neither box is checked in advance, and both are needed to buy the test:

  • Consent 1, genetic data. I consent to my genetic data being collected and used to provide the genetic test, my written report and the walkthrough.
  • Consent 2, sharing with the testing company. I consent to The Vitality Collective sharing my name and shipping address with Genomic Dietetics & Performance Corp so my test kit can be sent and my test processed.

You can withdraw consent at any time by emailing welcome@thevitalitycollective.co with the subject line “Withdraw Genetic Data Consent.” Withdrawing consent does not undo processing that already happened, such as a kit that was already ordered or a sample that was already processed. After you withdraw, we will stop further use and delete what we hold as described below, except records the law requires us to keep.

Deleting your data

You can ask us to delete the genetic test information we hold by emailing welcome@thevitalitycollective.co with the subject line “Delete My Genetic Data.” We will respond within the time frames in Section 15, and we will forward your deletion request to Genomic Dietetics & Performance Corp. Because it holds your sample and its own copy of your data, please also ask it directly. We may keep a minimal record of your purchase, your consents, and your request where the law requires.

Security

We protect genetic test information with access limits and the safeguards described in Section 11.

State genetic privacy laws

Some states have laws that give you more rights over genetic data, such as express consent for its collection, use, and transfer and for research, and the right to have your data deleted and your sample destroyed. For purposes of those laws, The Vitality Collective is the direct-to-consumer genetic testing company that offers this test to you, and we honor these rights as the law requires where you live. Washington, Nevada, and Connecticut also protect information about genetic testing as consumer health data (see Section 14). To use your rights, contact us as described in Section 15.

Insurance and employment

A federal law, the Genetic Information Nondiscrimination Act (GINA), limits how health insurers and employers with 15 or more employees can use genetic information. It doesn’t cover life, disability or long-term care insurance.

15. How to Exercise Your Rights and Appeal a Decision

How to submit a request

You can submit a privacy request by email or by mail:

  • Email: welcome@thevitalitycollective.co, with the subject line “Privacy Request”
  • Mail: The Vitality Collective LLC, Attn: Privacy, 364 Wheelers Farm Road, Unit 302, Milford, CT 06461
  • Opt-out of sale, sharing, or targeted advertising: enable GPC in your browser, or contact us by email or mail as described above.
  • Marketing: click “unsubscribe” in any marketing email or reply STOP to any text message.

Please tell us your name, the email address and phone number you have used with us, your state of residence, and the right you want to exercise.

Verification

To protect your privacy, we will take reasonable steps to verify your identity before fulfilling requests to access, correct, or delete personal information, usually by matching information you provide with information we already have. We may ask for more information for requests involving sensitive information. We will use the information you provide for verification only for that purpose. You do not need to create an account to submit a request, and we do not require verification for opt-out requests, although we may need enough information to locate your records.

Authorized agents

Where state law allows, an authorized agent may submit a request on your behalf. We may ask the agent for proof of your signed permission and may ask you to verify your identity directly with us, unless the agent provides a valid power of attorney.

Timing and fees

We will confirm receipt of your request within 10 business days where required and respond within 45 days. If we need more time, we may extend this period as permitted by law and will let you know. We do not charge a fee for requests unless they are excessive, repetitive, or clearly unfounded, as permitted by law. If we cannot fully honor a request, for example, because we must keep certain information to comply with the law, we will explain why.

Appeals

If we decline to take action on your request, you may appeal our decision by replying to our response or by emailing welcome@thevitalitycollective.co with the subject line “Privacy Appeal” within a reasonable time after receiving our decision. We will respond to your appeal in writing within the time required by your state’s law (generally 45 to 60 days) and explain the reasons for our decision. If your appeal is denied, you may contact your state’s Attorney General.

Requests about PHI

Requests about PHI, such as access to or amendment of medical records, are handled under HIPAA as described in the NPP that patients receive at or before intake. If you send such a request to us, we will help direct it to the right place. You can also request a copy of the NPP by contacting us at welcome@thevitalitycollective.co.

16. International Users

Our Services are intended only for individuals located in the United States, and our clinical services are available only to patients located in the United States. We do not direct the Services to individuals outside the United States. Personal information we collect is processed and stored in the United States. If you access the Site from outside the United States, you understand that your information will be processed in the United States, where privacy laws may differ from those in your country.

17. Third-Party Links and Platforms

The Site and our communications may link to or integrate with third-party websites, platforms, and services that we do not control. This Privacy Policy does not apply to them, and we encourage you to review their privacy policies.

  • Patient storefront. When you place an order as a patient, you may be directed to a storefront that carries our branding but is operated by a third-party pharmacy/storefront partner. That partner may have its own terms of use and privacy notice, which govern its collection and use of your information. Please review them before placing an order.
  • Clinical network. The independently licensed clinicians who provide care may have their own policies and notices, including the NPP.
  • Payment processing. Stripe processes payments under the Stripe Privacy Policy.
  • Social media. If you interact with us on social media platforms, those platforms’ privacy policies govern their collection and use of your information.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and change the effective date at the top. If we make material changes, we will notify you before they take effect by posting a prominent notice on the Site or by email. Where the law requires, we will obtain your consent before using personal information or consumer health data in a materially different way than described when we collected it.

19. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us by email or mail:

For questions about protected health information, please refer to the applicable Notice of Privacy Practices provided at or before intake. You can request a copy of the NPP by emailing us at welcome@thevitalitycollective.co.

Scroll to Top