Privacy Policy

"Personal information" means information that identifies or can reasonably be linked to you. Depending on how you interact with us, we may collect or process:

• Contact details: name, billing and shipping address, phone number, email address
• Financial information: payment card and transaction details. AraHealth does not directly collect or store your full payment card number — payment processing is handled securely by Shopify Payments and its PCI-DSS-compliant payment partners.
• Account information: your Shopify customer account credentials (managed through Shopify's passwordless login system), preferences, and subscription settings, if you create an account or subscribe to a product
• Transaction information: items you view, add to cart, purchase, return, exchange, or cancel, and your order history
• Communications: information you share when contacting customer support or otherwise messaging us
• Device and usage information: IP address, browser and device type, referring URLs, and how you interact with our site
• Marketing sign-up information: your email and/or phone number if you subscribe to our newsletter, join our SMS list, or download a resource such as our supplement buyer's checklist

What we don't collect: AraHealth does not currently use health assessments, quizzes, or intake forms asking about medical conditions or health goals. If this changes, this policy will be updated accordingly.

Sources of information

We collect personal information: directly from you (account creation, checkout, communications); automatically through cookies and similar technologies as you use our site; from service providers who process data on our behalf (Shopify, Klaviyo); and from advertising partners (Meta, and Google in the future).

• Provide and improve the Services — process payments, fulfill and ship orders, manage your account and subscription, arrange returns/exchanges, and improve our site and product offering based on how it's used
• Marketing and advertising — send marketing emails and SMS messages (via Klaviyo) where you've opted in, and show you relevant ads on platforms like Meta (and Google in the future) based on your activity on our site
• Security and fraud prevention — authenticate accounts, secure payment and checkout, and detect or investigate fraudulent or unsafe activity
• Customer communication — respond to support inquiries and maintain our relationship with you
• Legal compliance — comply with applicable law, respond to valid legal process, and enforce our terms and policies

We do not sell your personal information for money. We may disclose personal information to:

• Shopify, which hosts our checkout, payments, and order infrastructure, and processes personal information to provide and improve those services (see Section 4)
• Service providers who perform services on our behalf, including:

• When you direct or consent to disclosure, such as shipping to an address you provide
• In connection with a business transaction (e.g., a merger), to comply with legal obligations, or to protect the rights, safety, or property of AraHealth or others

Some data sharing with advertising partners may be considered a "sale" or "share" of personal information under California law even without a monetary exchange — see Section 6 for how to opt out.

AraHealth currently uses Meta Ads (Facebook and Instagram), and plans to use Google Ads in the future. These platforms use tracking tools ("pixels") placed on our site to:

• Measure whether visitors who saw or clicked our ads went on to browse or purchase
• Show you relevant ads based on pages or products you've viewed on our site (retargeting)
• Build audiences of people who share characteristics with our existing customers (lookalike audiences)

These tools may collect your IP address, browser/device information, and pages or products viewed. Where supported, we may share a securely hashed (non-readable) version of your email or phone number with Meta or Google to improve ad measurement accuracy; this cannot be reversed back into your original contact information by these platforms.

You can control this tracking as described in Section 6 and in our Cookie Policy.

If you opt in to marketing communications, we use Klaviyo to send and track engagement with emails and SMS messages.

• Email: unsubscribe anytime via the link at the bottom of any marketing email.
• SMS: by opting in, you consent to receive recurring automated marketing texts from AraHealth. Message and data rates may apply; frequency varies. Reply STOP to opt out, or HELP for help. SMS opt-in is never shared with third parties for their own marketing purposes.

For all customers

• Right to Access/Know — request access to the personal information we hold about you
• Right to Delete — request deletion of your personal information, subject to certain exceptions
• Right to Correct — request correction of inaccurate personal information
• Right of Portability — request a copy of your personal information, or that we transfer it to a third party, in certain circumstances
• Managing communication preferences — unsubscribe from marketing emails via the link provided, or SMS by replying STOP

Right to Opt Out of Sale/Sharing for Targeted Advertising

Depending on where you live, you may have the right to opt out of the "sale" or "sharing" of your personal information, or its use for "targeted advertising" as defined under applicable law (this includes advertising-related data sharing with platforms like Meta or Google). You can exercise this right by:

• Emailing privacy@myarahealth.com with the subject line "Do Not Sell or Share My Information," or
• Using the cookie consent tool on our website to disable advertising cookies (see our Cookie Policy)

If you visit our site with a Global Privacy Control (GPC) signal enabled, we automatically treat this as an opt-out request for the device and browser you used, and will apply it to your Shopify account where we're able to associate the two. We do not currently honor other "Do Not Track" browser signals.

California residents (CCPA/CPRA)

California residents have the specific rights listed above, plus the right to non-discrimination — we will not deny goods or services, charge different prices, or reduce service quality because you exercised a privacy right.

Residents of other U.S. states

If you live in a state with a comprehensive privacy law (e.g., Virginia, Colorado, Connecticut, Utah, and others), you may have similar rights. Contact us at privacy@myarahealth.com to make a request.

International visitors

AraHealth currently ships to and markets exclusively within the United States. This policy is written to comply with applicable U.S. state privacy laws. If we begin shipping or marketing outside the U.S., this policy will be updated to reflect any additional applicable rights (such as under GDPR) and international data transfer safeguards.

How to exercise your rights

Contact us at privacy@myarahealth.com. We will verify your identity before processing requests, as permitted or required by law, and respond within the timeframe required by applicable law. You may designate an authorized agent to submit a request on your behalf, subject to proof of authorization and identity verification.

We will not discriminate against you for exercising any of these rights.

If you have concerns about how we process your personal information, contact us at privacy@myarahealth.com. Depending on where you live, you may also have the right to lodge a complaint with your state attorney general's office or applicable data protection authority.

Our checkout, payments, and order infrastructure are hosted and processed by Shopify. Information you submit during checkout is transmitted to and processed by Shopify in order to provide and secure that infrastructure. In these circumstances, Shopify acts as an independent processor/controller of your information for these specific purposes, and you may have rights directly against Shopify related to this processing. You can learn more, and exercise applicable rights, at Shopify's Consumer Privacy Policy (privacy.shopify.com) and Shopify's Privacy Portal.

Our Services may link to websites or platforms operated by third parties. We are not responsible for the privacy or security practices of sites we don't control, and encourage you to review their policies before providing information to them.

The Services are intended for adults. We do not knowingly collect personal information from children under 13 (or the applicable age of majority in your jurisdiction). If you are a parent or guardian and believe your child has provided us with personal information, contact us to request its deletion. As of the date of this policy, we do not have actual knowledge that we sell or share the personal information of individuals under 16.

We retain personal information as long as necessary to maintain your account, provide the Services, comply with legal/tax obligations, and resolve disputes. We use reasonable administrative, technical, and physical safeguards, including Shopify's PCI-DSS-compliant infrastructure and encrypted (SSL/TLS) connections. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security — we recommend avoiding unsecured channels for sensitive communications with us.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. The "Last updated" date above reflects the most recent revision, and material changes will be posted on this page.

AraHealth LLC
220 N. Glenoaks Blvd. Ste A
Burbank, CA 91502
Email: privacy@myarahealth.com