Privacy policy

01Information we collect

A. Account and identity information. Name, email address, telephone number, date of birth or age eligibility, mailing and shipping address, account credentials, communication preferences, and other information used to create and secure your account.

B. Purchase, membership and transaction information. Membership status, products or services ordered, order history, shipping status, refunds, customer-service history, promotion or referral information, transaction identifiers, and limited payment information received from our payment processor. Payment processors may collect full card or bank details directly under their own privacy terms.

C. Health and wellness profile information. Information you choose to provide about wellness goals, lifestyle, nutrition, activity, sleep, symptoms, medications or supplements you choose to report, health history, family history, preferences, and other information used to personalize the Services.

D. Genetic and DNA information. Genetic test results, variants, trait or predisposition information, DNA-derived reports, and related metadata received from you or an authorized genetics provider. Biological samples are ordinarily handled by the collection and laboratory/genomics provider rather than Blue Pomera, except to the extent a specific workflow states otherwise.

E. Biomarker and laboratory information. Laboratory orders, collection status, test results, reference intervals, units, flags, longitudinal biomarker trends, and related information received from laboratories or authorized providers.

F. Connected-health and device information. Data you authorize from compatible health platforms or devices, which may include activity, steps, workouts, sleep, heart rate, recovery metrics, weight, body measurements, glucose or other supported metrics depending on your device, permissions, and integrations.

G. Derived and AI-generated information. Patterns, summaries, classifications, wellness insights, trend information, goal relevance, recommended topics to review, and other inferences or outputs generated from information in your Blue Pomera profile.

H. Device, website and application information. IP address, browser and device type, operating system, app version, session and event data, crash logs, security logs, cookie or similar identifiers, referral URLs, and interactions with our public website and application.

I. Communications and support information. Messages you send to support, feedback, survey responses, requests, complaints, and records of calls or communications where permitted by law.

02Sources of information

• Directly from you when you create an account, complete a profile, make a purchase, communicate with us, or enter information into the Services.
• From devices and health platforms you affirmatively connect or authorize.
• From independent laboratories, genetics providers, collection/fulfillment partners, and licensed clinical or telehealth providers involved in a service you request.
• From payment processors, shipping providers, fraud-prevention providers, customer-service tools, and other vendors supporting the Services.
• From a referral or independent distributor relationship, limited to commercial information necessary to identify the referral and administer the customer relationship or lawful compensation.
• Automatically through cookies, software development kits, log files, and similar technologies on our public website or application, subject to applicable consent requirements.

03How we use information

• Provide, personalize, maintain and secure your account and the Services.
• Receive, organize and display member-authorized DNA, biomarker, connected-health, lifestyle and wellness information.
• Generate wellness summaries, trends, insights, educational content and goal-related organization.
• Facilitate orders, test authorization, collection, laboratory processing, fulfillment, shipping, result delivery and customer support through appropriate service partners.
• Process membership renewals, purchases, refunds and fraud checks.
• Authenticate users, detect security incidents, investigate misuse and protect members, providers and our systems.
• Improve product quality, reliability and usability using data that is appropriately restricted, aggregated or de-identified where feasible.
• Comply with legal, regulatory, tax, accounting, audit, insurance, safety and dispute-resolution obligations.
• Send service messages and, with the appropriate permission, marketing communications. You can opt out of marketing messages without opting out of essential transactional or safety communications.

04AI and model use

Blue Pomera uses AI-enabled systems to help organize and explain information and to generate personalized wellness content. We may send only the information reasonably necessary for a requested AI function to contracted technology providers acting on our instructions. We apply contractual, technical and access restrictions appropriate to the sensitivity of the information.

The app asks for your permission before your information is first shared with a third-party AI provider, and you can withdraw that permission at any time in the app's settings.

Blue Pomera will not use identifiable genetic or health information to train a general-purpose AI model for unrelated model development without your explicit authorization and legal review. We may use de-identified, aggregated, synthetic, or otherwise lawfully processed information for analytics, quality evaluation, security, and product improvement where permitted by law and consistent with our notices and consents.

05When we disclose information

Service providers and processors. We disclose information to vendors that host, secure, support, analyze, communicate, fulfill, or process the Services on our behalf, subject to contracts and access limitations appropriate to the information involved.

Laboratory, genetics, collection and clinical partners. When you request testing or related services, we may disclose information necessary to laboratories, genetics providers, at-home collection and logistics providers, and licensed clinicians or telehealth providers to authorize, collect, process, fulfill, deliver and support those services.

Connected-health platforms. Information may flow to or from platforms you choose to connect, subject to the permissions you grant and the privacy terms of those platforms.

Apple Health and Google Health Connect. If you connect Apple Health or Google Health Connect, we read only the data types you approve and use that data only to provide and improve your health and wellness experience in Blue Pomera. We never use it for advertising, marketing or data mining, never sell it, and never share it with advertising platforms or data brokers. We do not store data from Apple Health in iCloud. Blue Pomera's use and transfer of information received from Health Connect to any other app will adhere to the Health Connect Permissions policy, including the Limited Use requirements. You can change or remove these permissions at any time in your device settings.

Payment and transaction providers. We disclose order and transaction information to payment processors, banks, fraud-prevention providers and related transaction services as necessary to accept payment and protect against fraud.

Affiliates. Blue Pomera LLC may share information with Blue Pomera Holdings LLC and Blue Pomera Marketing LLC when necessary for corporate administration, operations, referral/customer relationship administration, compliance, or lawful compensation. Health data is segregated from field compensation data as described below.

Legal, safety and corporate transactions. We may disclose information when we reasonably believe disclosure is required by law, legal process, regulatory request, or to protect rights, safety, security, or prevent fraud. Information may also be transferred in connection with a merger, financing, acquisition, restructuring, bankruptcy, or sale of assets, subject to applicable privacy law and ongoing obligations for sensitive information.

06Health data is not field compensation data

Independent distributors and field leaders do not receive access to a member's DNA, genetic results, biomarkers, laboratory values, symptoms, connected-health data, clinical information, or AI-generated health insights merely because they referred, enrolled, or support that member.

Blue Pomera Marketing LLC and eligible field participants may receive only the minimum commercial information required for lawful referral attribution, customer-service status, eligibility, order administration, and compensation. We do not make health data a field marketing asset.

07Sale of health and genetic data; advertising

Blue Pomera does not sell genetic data or consumer health data for money or other valuable consideration, and we do not condition the Services on your authorizing such a sale. We do not disclose member health or genetic data to independent third parties for their own targeted advertising.

We may use analytics or advertising technologies on public marketing pages where permitted by law. We do not permit cross-context behavioral advertising technologies to access authenticated areas of the app that contain DNA, laboratory results, symptoms, connected-health information, or personalized health insights.

08Cookies and similar technologies

Our public website may use necessary cookies for security, preferences and site operation, and may use analytics or marketing cookies subject to applicable consent rules. Where required, a cookie/consent manager will allow you to make choices. Application telemetry and security logs may also be used to operate and protect the Services.

09Data retention and deletion

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including providing the Services, maintaining an appropriate longitudinal member record, fulfilling orders, resolving disputes, preventing fraud, meeting tax/accounting requirements, and complying with legal or contractual retention obligations.

If you close your account or request deletion, we will delete or de-identify information as required by applicable law, subject to permitted retention for legal, security, transaction, laboratory/provider, recordkeeping, or backup purposes. Certain health-data laws require us to transmit deletion requests to processors or other recipients and may allow additional time for deletion from archived backups.

Deleting your account. You can delete your account in the app's settings. You can also request deletion without using the app by emailing [email protected] from the email address on your account.

10Security

We use administrative, technical and physical safeguards designed for the sensitivity of the information we process. These may include encryption in transit and at rest, role-based access, least-privilege controls, audit logging, authentication controls, vendor review, incident-response procedures, and ongoing security monitoring. No system can guarantee absolute security, and you should protect your account credentials and devices.

11HIPAA and other health-privacy laws

HIPAA applies to covered entities and business associates as defined by U.S. law; it does not automatically apply to every consumer health application. Depending on the relationship and service, health information handled by an independent laboratory, clinician or other covered provider may be subject to HIPAA in that provider's hands, and Blue Pomera may have contractual or HIPAA business-associate obligations where applicable. Blue Pomera also designs its health-data program to address consumer-health-data laws that may apply outside HIPAA.

12Your privacy choices and rights

Depending on where you live, you may have rights to request access to, correction of, portability of, deletion of, or information about personal data; to withdraw certain consents; to opt out of certain targeted advertising or sale/sharing uses; to limit certain uses of sensitive information; or to appeal a denied request.

To submit a privacy request, use the privacy-request method in your account, if available, or email [email protected]. We may need to verify your identity before completing a request. We will not unlawfully discriminate against you for exercising a privacy right.

13Consumer health data rights

If consumer health data laws apply to you, additional disclosures and rights are provided in our separate Consumer Health Data Privacy Policy. That policy explains categories of health data collected, sources, purposes, recipients, consent, access, withdrawal and deletion rights, and appeal procedures.

14Genetic information

Genetic information receives heightened protection. Blue Pomera will obtain or rely on appropriate express/written consent for genetic collection, analysis, use and disclosure when required. Genetic testing providers may provide separate consent forms that govern sample handling, laboratory processing, retention, research options, and destruction. Blue Pomera does not use genetic information to make decisions concerning insurance, employment, lending, education, or other unrelated eligibility determinations.

15Users outside the United States

For users outside the United States, Blue Pomera will process personal information in accordance with applicable privacy and data-protection requirements in the user's jurisdiction. Sensitive information, including health and genetic information, will be handled using any additional consent, access, correction, deletion, security, or accountability measures required by law in the user's jurisdiction.

For users outside the United States, personal information may be transferred to or processed in the United States where Blue Pomera or its service providers operate. Blue Pomera will provide notices, obtain consents, and apply safeguards required by law in the user's jurisdiction before covered processing occurs. Where applicable law requires an assessment or additional protection for a data transfer, Blue Pomera will complete those steps before the transfer.

16Children

Blue Pomera's general consumer Services are intended for adults 18 and older. We do not knowingly offer the standard membership or genetic/biomarker ordering flows to children through the general consumer account experience.

17Data breach and incident response

If a security incident triggers a legal notification obligation, Blue Pomera will provide notices to affected individuals and regulators as required by applicable law, including health-data breach rules that may apply to consumer health applications.

18Changes to this Privacy Policy

We may update this Policy as our Services or legal obligations change. We will post the current version and effective date and provide additional notice or obtain new consent when required for a material change involving sensitive information or a new purpose.

19Contact and Privacy Officer

Email: [email protected]
Privacy: [email protected]