Our Policies

Information about your health — even general wellness markers like sleep quality, energy levels, or menstrual cycle phase — is more sensitive than most other personal data. Under laws like Washington State's My Health My Data Act (MHMDA), the California Confidentiality of Medical Information Act (CMIA), the EU GDPR (Article 9), and the UK Data Protection Act 2018, this kind of information is treated as a special category of data with extra protections.

This policy explains what consumer health data element³ may collect, how we use it, and what rights you have over it. It applies in addition to our Privacy Policy — if there's any conflict between this policy and the Privacy Policy, the more protective standard applies.

For the purposes of this policy, "consumer health data" means any personal information that identifies you and relates to your past, present, or future physical or mental health status, including:

• Information about wellbeing markers — sleep quality, energy levels, mood, stress, focus
• Information about hormonal or menstrual cycle phase
• Information about life stage — trying to conceive, pregnancy, postpartum, perimenopause, menopause
• Information about supplements, vitamins, or medications you take
• Information about specific health symptoms or goals you share with us
• Inferences we draw from any of the above

We do not collect or process information about specific medical diagnoses, genetic data, biometric data, or clinical records.

We collect consumer health data only when you choose to share it with us, in three main contexts:

• Product quizzes and questionnaires — if you complete a wellness or product-fit quiz on our website
• Customer support conversations — if you mention health context when contacting us by email, chat, or social media
• Product reviews — if you share health-related experiences in a review you submit

We do not collect health data passively, from third-party data brokers, or from public sources. We do not infer health conditions from your browsing behaviour or purchase history without your knowledge.

We use consumer health data only for the following purposes:

• Personalising your experience — recommending products that match the goals you've shared
• Responding to your questions — providing context-appropriate customer service
• Improving our products — analysing aggregated, de-identified patterns to improve formulations and content
• Complying with safety obligations — if you report an adverse event or side effect, we may be legally required to share your information with regulators

We do not use consumer health data for advertising targeting, profile-building, or any decision that produces a legal or similarly significant effect on you.

We share consumer health data only with:

• Our trusted service providers under contractual confidentiality — currently Shopify, Klaviyo, and our customer support tools. Each is bound by data processing agreements.
• Regulatory authorities if legally required, such as a mandatory adverse event report to NZ MedSafe.
• A successor entity in the event of a merger, acquisition, or sale — and only with notice to you and continued protection under this policy.

We do not sell consumer health data to third parties. We do not share it with advertisers or data brokers.

You have the right to:

• Access the consumer health data we hold about you
• Correct any information that is inaccurate or out of date
• Delete your consumer health data at any time
• Withdraw consent for us to use it, without affecting any processing already done
• Object to any use of your data you don't agree with
• Receive a copy in a portable, machine-readable format

To exercise any of these rights, email privacy@element3.co.nz . We will respond within 30 days for NZ/AU/UK requests, 45 days for US state law requests.

Consumer health data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access within element³ is restricted to staff who need it to perform their job, under strict confidentiality terms.

We retain consumer health data only for as long as needed for the purpose we collected it. Default retention:

• Quiz responses: 2 years from your last interaction, then deleted
• Customer support conversations: 5 years (for warranty and dispute resolution), then deleted
• Review content: As long as the review is published; you can request deletion at any time

If you close your account or request deletion, all consumer health data is removed within 30 days, except where we are legally required to retain it.

element³ is a New Zealand company. Our service providers may be based in the United States, European Union, United Kingdom, or Australia. Where your consumer health data is transferred outside your country of residence, we ensure equivalent protection through:

• Standard Contractual Clauses (for EU/UK transfers)
• Adequacy decisions where they exist
• Service-provider contractual safeguards for transfers to the US

We do not transfer consumer health data to any jurisdiction without an appropriate legal safeguard in place.

For any question, request, or concern relating to consumer health data, email privacy@element3.co.nz .

If you are not satisfied with our response, you have the right to lodge a complaint with the privacy regulator in your jurisdiction:

• New Zealand: Office of the Privacy Commissioner — privacy.org.nz
• Australia: Office of the Australian Information Commissioner — oaic.gov.au
• United Kingdom: Information Commissioner's Office — ico.org.uk
• United States: State Attorney General (varies by state)