Privacy Policy

Effective Date: October 30, 2026

1. Scope of This Policy

This Privacy Policy explains how BioSocial LLC ("BioSocial," "we," "us," "our") collects, uses, shares, and protects information in connection with the BioSocial website, mobile application(s), and related services (the "Service"). It applies to registered users and, where noted, to visitors of public pages such as practice, biomarker, and profile pages. It should be read together with our Terms of Service.

Because the Service is built around health information, we describe our practices in more detail than a typical consumer app, and we include specific sections addressing state consumer-health-data laws (Section 9) and international users (Section 11).

2. Information We Collect

2.1 Information You Provide Directly

Account and profile information: name or display name, email address, password, profile photo, and any bio or profile fields you choose to complete.

Content you post: community posts, questions, comments, likes, and messages.

Communications: messages you send to support or in response to surveys.

2.2 Health and Biomarker Information

This is the most sensitive category of data the Service handles, and we treat it as "consumer health data" and, where applicable, "sensitive personal information" under the laws described in Section 9. It includes:

Biomarker values and lab results you upload or connect (e.g., CRP, LDL, A1c, and other markers from a blood panel), whether entered manually, uploaded as a document/image, or imported from a connected lab or lab-booking partner.

Health practices you log (e.g., cold plunge, Zone 2 cardio, intermittent fasting, supplements, and medications such as statins or GLP-1s, where those are in scope for the Service).

Symptoms you record.

Biometric and fitness data received from connected devices (e.g., heart-rate variability, resting heart rate, VO2 max, sleep, readiness/health-age scores) via Apple Health or similar integrations.

2.3 Information From Connected Devices, Apps, and Labs

If you connect a third-party account — such as Apple Health, a wearable device maker (e.g., Oura, Whoop), or a direct-to-consumer lab or lab-booking partner (e.g., Quest Diagnostics, Function Health, Superpower) — we receive the data you authorize that platform to share with us. What we receive depends on the permissions you grant in that platform's own consent flow; we do not receive more than you authorize.

2.4 Usage and Technical Information

Log and device data (IP address, browser/device type, operating system, pages viewed, referring URLs).

Cookies and similar technologies, as described in Section 15.

Approximate location derived from IP address (we do not collect precise geolocation unless you separately enable a feature that requests it).

2.5 Information About You From Other Users

Other users may mention you, reply to your posts, or include you in community content. We do not control this content, but it is subject to our content-removal and reporting process described in the Terms of Service.

3. "Consumer Health Data" — Special Notice

Under Washington's My Health My Data Act, Nevada's SB 370, and similar laws, most of the information described in Section 2.2 and 2.3 qualifies as "consumer health data" — personal information that is linked or reasonably linkable to you and that identifies your health status, health conditions, biometric data, or bodily functions. These laws require specific, opt-in consent before we collect consumer health data beyond what is strictly necessary to provide a feature you requested, and separate, specific consent before we "sell" or share consumer health data with third parties as defined by those laws. Consistent with Washington law, this section serves as our Consumer Health Data Privacy Policy and is linked from our homepage.

Consistent with these laws, we will not:

Sell consumer health data.

Use geofencing around healthcare facilities to target advertising to you, or to infer or collect consumer health data based on your presence at such a facility.

Collect consumer health data beyond what is necessary to provide a feature you have requested, without your separate, prior consent.

You have the right to withdraw consent to our collection and sharing of your consumer health data and to request its deletion; see Section 8.

4. How We Use Information

We use the information described above to:

Operate the Service, including logging practices, storing biomarker data, and generating your personal Before → Practice → After narratives.

Generate community benchmarks and percentile comparisons by analyzing de-identified or pseudonymous data across users doing similar practices.

Power AI/ML systems that normalize uploaded lab formats, generate narratives, and surface insights.

Operate community and social features, including public profiles and discussion pages, according to your visibility settings.

Personalize content and, where you have not opted out, provide relevant sponsored content on practice pages.

Maintain and improve the Service, including security, fraud prevention, and troubleshooting.

Communicate with you about your account, updates, and (where you have opted in) marketing.

Compile aggregate, de-identified insights for research and, in the future, for licensing to life sciences, health system, or payer partners (see Section 6).

Comply with legal obligations.

5. Our "Shared by Default" Community Model & Your Privacy Controls

BioSocial's core value — proof that a practice moved a biomarker, benchmarked against real people — depends on community data sharing. Unlike apps that keep your health data fully private by default, biomarker and practice data you log is used, in de-identified or pseudonymous form, to power community benchmarks that other users see (for example, "top 28% of Cold Plunge members for CRP improvement").

You have the following controls:

Display identity: you may use a display name rather than your legal name on your public profile.

Health profile visibility: you choose one of three settings for your individual health profile (your biomarkers, symptoms, practice and activity history, and related health highlights), and you may change it at any time in Settings. Public: any BioSocial member can view your health profile. Approved Connections: only followers you individually approve can view it. Private: only you can view it.

Approved Connections: any follower may request access to your health profile, and you may approve or ignore the request. You may also approve any follower who has not requested access. Approval grants access to your entire health profile; there are no category-specific grants in this version of the Service. You may remove access at any time, and access ends automatically if the person stops following you. Members who are not approved see a locked state and do not see your individual health values.

Access notices: requests, approvals, declines, and removals of health profile access are communicated through in-app notifications. We do not currently send email notifications for these events.

Community activity is always public: regardless of your health profile visibility, your community posts, comments, replies, and reactions, together with your display name and profile photo, are public and may be visible to visitors who are not registered users. Do not include health details in community activity that you prefer to keep private.

Consent withdrawal and deletion: see Section 8.

Your health profile visibility controls who can view your individual health information; it does not control participation in community aggregates. The biomarker and practice data of every member, including members who choose Approved Connections or Private, is included in de-identified community aggregates such as averages, percent changes, optimal-range percentages, rankings, and the contributor counts shown with them. We do not identify non-public members as contributors to these aggregates. Aggregates are shown only when they meet a minimum number of contributors that we set for the Service. While the Service is in its prototype stage, this minimum is one contributor, which means an aggregate may reflect a single member's data; we expect to raise this minimum as the community grows and may change it at any time.

6. How and With Whom We Share Information

6.1 With the Community

Content you choose to make public (profile information, posts, comments) is visible to other users and, for public pages, to visitors and search engines. De-identified or pseudonymous versions of your biomarker/practice data contribute to benchmarks shown to other users doing the same practice, as described in Section 5.

6.2 Service Providers

We share information with vendors who perform services on our behalf — such as cloud hosting, data storage, customer support, analytics, and AI model providers — under contracts that restrict their use of your information to providing services to us.

6.3 Device, Wearable, and Lab Partners

When you connect a third-party device, wearable, or lab account, information flows between BioSocial and that partner according to the permissions you grant. Some of these relationships (e.g., referral arrangements with device makers or lab services) may generate compensation to BioSocial, as described in the Terms of Service; this does not involve selling your consumer health data.

6.4 Research and Data-Licensing Partners

BioSocial plans to license aggregate, de-identified insights derived from community data to life sciences companies, health systems, payers, and researchers studying which practices are associated with which biomarker outcomes. We will not share data in a form that identifies you as an individual through this program. This is a planned, future revenue line; before it launches commercially, we intend to define a de-identification methodology and statistical-rigor standard, and this Policy will be updated accordingly, with any legally required consent obtained in advance.

6.5 Legal, Safety & Corporate Transactions

We may disclose information if required by law, subpoena, or legal process; to protect the rights, safety, or property of BioSocial, our users, or the public; or in connection with a merger, acquisition, financing, or sale of assets, subject to applicable notice and consent requirements for health data.

7. AI Processing of Your Data

We use automated systems, including large language models and other machine-learning tools, to parse and normalize uploaded lab/device data, generate Before → Practice → After narratives, and support benchmarking. Where third-party AI providers are used to process your data, they operate under contractual terms that restrict use of your data to providing the service to us and prohibit using it to train their own general-purpose models, unless we tell you otherwise.

8. Your Rights and Choices

Depending on your location, you may have the right to:

Access the personal and health information we hold about you.

Correct inaccurate information.

Delete your account and associated personal/health information, including withdrawing consent to further collection and sharing of your consumer health data.

Obtain a portable copy of your data.

Opt out of the use of your de-identified data in the aggregate research/data-licensing program described in Section 6.4, where technically feasible for data already aggregated.

Opt out of targeted advertising or the "sale"/"sharing" of personal information, where applicable under state law.

Appeal a denied privacy request, where required by state law.

In Settings, choose Download my data to prepare a portable ZIP containing a JSON copy of your account and profile information, health samples, bloodwork records, practice and workout history, community content, social relationships, preferences, integration records and uploaded files currently stored by BioSocial. Choose Save data copy when it is ready. This copy includes consent choices stored in the browser you use for the download; it does not include passwords, sign-in credentials, or records held only by connected services. Keep your downloaded copy secure because it contains sensitive health information.

To permanently delete your account, choose Delete account in Settings and confirm by typing DELETE. We remove your uploaded files, account, identifiable health records, community posts and comments, preferences, connections, and device tokens from our active systems. Download a copy first if you wish to keep your data. Deletion cannot be undone and stops further imports into that account. It does not delete information held by Apple Health, a lab, or another connected service; you can separately revoke access in that service.

These self-service tools require a signed-in account. For additional personal information not included in the download, an inaccessible account, correction, consent withdrawal, appeals, or another privacy request, contact us as described in Section 17. We verify identity before fulfilling requests involving sensitive health data. Information already irreversibly aggregated and de-identified cannot be individually extracted or deleted. Copies made by other users or search engines may remain outside our control.

9. State Law Disclosures

9.1 California (CCPA/CPRA and CMIA)

California residents have rights under the California Consumer Privacy Act, as amended by the CPRA, including the rights described in Section 8, plus the right to limit use of "sensitive personal information" (which includes health information). We do not sell personal information for money. Our data-licensing and referral/affiliate arrangements, described in Sections 6.3 and 6.4, may constitute a "sale" or "sharing" of personal information as those terms are broadly defined under CCPA/CPRA; you may opt out of these arrangements using the "Do Not Sell or Share My Personal Information" link on our website or the contact information in Section 17. California's Confidentiality of Medical Information Act (CMIA) may also apply to certain health information we collect, and we handle that information consistently with CMIA's requirements.

9.2 Washington and Nevada Consumer Health Data Laws

See Section 3 above. Washington and Nevada residents (and, under Washington's law, any consumer whose data is processed in Washington) have the specific consent, opt-out, and deletion rights described there, in addition to any other rights described in this Policy.

9.3 Other U.S. States

Residents of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, and other states whose laws take effect over time) have similar rights to access, correct, delete, and port their data, and to opt out of targeted advertising and certain profiling. You may exercise these rights, including through an authorized agent, using the contact information in Section 17. Where required by applicable state law, we honor recognized universal opt-out preference signals (such as the Global Privacy Control) for browsers on which they are enabled.

10. HIPAA — Where It Does and Doesn't Apply

BioSocial is a direct-to-consumer platform, not a health plan, healthcare clearinghouse, or (in most respects) a healthcare provider, so the Health Insurance Portability and Accountability Act (HIPAA) is not expected to directly govern most of the information you provide to us. However, HIPAA may apply to specific data flows — for example, data received through a lab-booking integration with a HIPAA-covered lab, or any future partnership with a health system, insurer, or provider — depending on the contractual relationship, and we enter into business associate or similar agreements with partners where that relationship requires one. Regardless of HIPAA's applicability, we apply the safeguards described in Section 12 to all health information we hold.

11. International Users

The Service is currently offered to users located in the United States. If BioSocial makes the Service available to users outside the United States, health data may qualify as a "special category" of personal data under the EU/UK General Data Protection Regulation (GDPR) and similar laws, which generally require explicit consent or another specific legal basis before such data is processed, and may restrict international transfers. We will update this Policy to describe the applicable safeguards and your rights before offering the Service in any additional jurisdiction.

12. Data Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and at rest for health data, access controls limiting internal access to identifiable health data on a need-to-know basis, and regular security review of third-party processors. No system is completely secure, and we cannot guarantee absolute security. We periodically review our security program against recognized industry frameworks and will disclose any relevant certifications (such as SOC 2) on our website as they are obtained.

13. Data Retention

We retain your account and health information while your account is active. Confirmed self-service account deletion removes identifiable account and health information from our active systems. Limited copies may remain in restricted backups or service-provider logs until their normal retention periods expire, or where retention is required by law; these copies are not used to operate your deleted account. We handle verified privacy requests within the timeframe required by applicable law and communicate any legally permitted exceptions. Irreversibly de-identified aggregates may be retained because they are no longer linked or reasonably linkable to you.

14. Children's Privacy

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

15. Cookies, Analytics & Tracking Technologies

Strictly necessary cookies and browser storage support sign-in, security and interface preferences. Our Your Privacy Choices control lets you separately allow or refuse optional analytics and advertising. Google Analytics and Amplitude are planned for usage and performance measurement; Google Ads and Meta are planned for campaign measurement and advertising optimization. These optional tools are not currently installed. Any future integration must respect your choices and disclose its enabled data and purposes before use.

In the EU, EEA, UK and Switzerland, non-essential tracking stays off until you opt in. When we cannot determine your region, we also require opt-in. US visitors receive notice and can opt out; Global Privacy Control disables advertising. An explicit refusal overrides regional defaults. You can reject non-essential technologies or withdraw an earlier choice through Your Privacy Choices in the footer or Settings. Opening preferences does not change your choices. Withdrawal applies immediately to future optional tracking in this browser and other open BioSocial tabs; it does not undo past permitted processing.

Advertising tools are blocked in the member app and on health-related pages, including biomarker and practice pages and community content. The consent manager does not authorize transmitting personal health information, lab results, community content, customer matching identifiers or health-related URLs to advertisers. Optional tracking events are not stored for later replay when you refuse.

We store a random browser-specific consent reference, each choice, its time, approximate country or an unresolved-region indication, Global Privacy Control status, and the version and text of the notice presented. Earlier acceptance is preserved if you later withdraw. These records stay in this browser’s local storage; clearing browser storage removes them and requires a new choice. Choices do not automatically transfer between devices. If browser storage is unavailable, choices apply only to the current visit.

16. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy with a new "Last Updated" date and, for material changes affecting how health data is collected, shared, or used for benchmarking or data licensing, provide advance notice and obtain any legally required renewed consent before applying the change to previously collected data.

17. How to Contact Us / Exercise Your Rights

To ask a question about this Policy or exercise your privacy rights, contact us at: privacy@joinBioSocial.com or by mail to BioSocial, Attn: Privacy Officer. We will respond within the timeframe required by applicable law.