Privacy Policy

Shop Holistico Inc. ("Holistico," "we," "us," or "our") is a company incorporated in Alberta, Canada, that sells whole food supplements through shopholistico.com (the "Site"). We also refer customers to a functional lab test sold by DHA Laboratory. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you:

• visit the Site
• buy from us, including by subscription
• buy a lab test through our referral link
• contact us
• receive our emails or texts
• interact with us on social media

Together, these are the "Services."

We are responsible for (the "controller" of) the personal information described in this policy. The exception is where we say a third party is responsible, such as Shopify for its own enhanced features or DHA Laboratory for the lab test. We have designated a Privacy Officer who is accountable for our compliance with this policy; contact details are in Section 11. If this policy conflicts with our Terms of Service, this policy controls on matters of personal information.

What we collect depends on how you use the Services. It may include:

• Contact details: name, email address, phone number, and billing and shipping address.
• Payment and transaction information: payment method and confirmation, order history, items viewed or added to cart, returns, and subscription details such as products, delivery frequency, and renewal dates. Card numbers are handled by our payment processor and are not stored by us. If you subscribe, your payment processor securely stores your payment method so renewals can be charged automatically.
• Account information: login credentials, preferences, and settings.
• Lab test information: if you buy the Cell Science Systems test through our link, we receive your name and the fact of your purchase. As the referring practitioner, we also have access to your test results, which include your date of birth, in DHA Laboratory's practitioner portal (see Section 4).
• Communications: messages, support requests, survey responses, and reviews you send us.
• Device and usage information: IP address, device and browser type, cookie and pixel identifiers, pages viewed, links clicked, and how you navigate the Site.
• Inferences: product interests or preferences we derive from the information above, used to recommend products or tailor marketing. We never draw inferences from lab test information.

We collect personal information from:

• you directly
• cookies, pixels, and similar technologies on the Site, automatically
• service providers and partners who work on our behalf, such as Shopify, Appstle, our payment processor, and our fulfillment partner
• DHA Laboratory, which sends us purchase information for tests bought through our link and gives us practitioner access to results

We use personal information to:

• process orders and payments, and manage subscriptions, including renewal charges and deliveries
• process returns and exchanges
• ship products
• create and manage your account and remember your preferences
• provide customer support
• verify and reconcile commissions on lab tests bought through our link
• review your lab test results with you, if you ask us to
• send transactional messages about your orders, subscriptions, and account
• send marketing by email or text where you have agreed to receive it
• show you advertising on other websites and apps (see Section 6)
• analyze and improve the Site, our products, and our marketing
• detect and prevent fraud, abuse, and security incidents
• comply with legal, tax, and regulatory obligations, and establish or defend legal claims

We will ask for your consent before using personal information for a purpose not described here, unless the law permits or requires the use without consent.

Our Site links to the Cell Science Systems Cellular Micronutrient Assay, which you buy from DHA Laboratory through our practitioner referral link. We earn a commission on those purchases. DHA Laboratory collects and processes your information, including your health information and test results, under its own privacy policy, available on DHA Laboratory's website. We are not responsible for DHA Laboratory's privacy practices, laboratory methods, result accuracy, or turnaround times.

Commission information. To pay our commissions, DHA Laboratory gives us your name and the fact that you bought a test. We use this only to verify and reconcile our commissions.

Access to your results. As the referring practitioner, we have access to your test results, which include your date of birth, in DHA Laboratory's practitioner portal. We view your results only if you ask us to review them with you. We do not download or store your results outside DHA Laboratory's portal.

If you ask us to review your results. We may recommend specific products, including Holistico products. Shop Holistico Inc. makes and sells Holistico products, so we have a financial interest in any Holistico products we recommend, and you are never required to buy them. Our review is educational and is not a medical diagnosis or treatment. Please talk to your healthcare provider about your results.

What we never do. We do not use lab test information for marketing or advertising. We do not add you to our email or text lists because you bought a test. We do not share lab test information with Meta or other advertising partners. We do not sell it.

Deleting your results. Your results remain stored in DHA Laboratory's portal for as long as DHA keeps them, and we cannot delete them from it. If you would like your results deleted, or would like us to no longer have access to them, contact DHA Laboratory, and let us know so we can help with your request.

For residents of Washington, Nevada, and other states with consumer health data laws, our Consumer Health Data Privacy Policy also applies and is linked on our homepage.

We disclose personal information to:

• Shopify, which hosts our store and processes checkout and payments, including subscription renewal charges.
• Appstle, which manages subscriptions, renewal scheduling, and your subscription account.
• Fulfillrite, which stores and ships our products.
• Email, text messaging, analytics, and customer support providers, which send our communications, measure Site performance, and help us answer you.
• Advertising partners, including Meta, which measure our ads and show you personalized ads (see Section 6). We never share lab test information with them.
• Professional advisers, for legal, accounting, and audit services.
• Authorities and other parties, when required by law, to respond to legal process, or to protect our rights, customers, or others.
• A buyer or successor, if we are involved in a merger, sale of assets, financing, or bankruptcy.

We also disclose information when you ask us to, such as when you connect a social media account or ship to someone else.

Shopify may use information about your interactions with our store, other merchants, and Shopify to provide features such as fraud protection and personalized advertising. For those uses, Shopify is responsible for your information. See https://privacy.shopify.com/en to learn more or exercise your rights with Shopify.

We use cookies, pixels, and similar technologies to run the Site, remember your cart and preferences, measure traffic, and support advertising. These include the Meta Pixel and Meta Conversions API. They send Meta information such as pages you visit, products you view or buy, and device identifiers, so we can measure our ads and show you ads on Facebook, Instagram, and other sites. We exclude pages about lab testing from advertising tracking.

We do not sell personal information for money. However, under some US state laws, including California's, letting advertising partners collect device and usage information and inferences through our Site for targeted advertising may count as "selling" or "sharing" personal information. We never sell or share lab test information.

Your choices:

• Opt out of targeted advertising using the "Your Privacy Choices" link in our Site footer.
• If you visit with a Global Privacy Control signal turned on, we treat it as an opt-out request for that browser and device. If we can link that device to your account, the opt-out applies to your account too. We do not respond to other "Do Not Track" signals.
• Block or delete cookies in your browser settings. Some Site features may not work without them.
• Adjust your ad preferences directly in your Facebook or Instagram settings.

Where the law requires consent for non-essential cookies, we ask for it through a cookie banner before setting them.

Retention. We keep personal information only as long as needed for the purposes in this policy:

• Order, payment, subscription, and transaction records: as long as Canadian tax law requires, generally six years.
• Commission information (name and test purchase): as long as needed to reconcile commissions and meet tax requirements, generally six years.
• Notes from reviewing your results, if you ask us to: 7 years, then deleted.
• Account information: while your account is open, then up to 2 years.
• Communications and support requests: up to 3 years.
• Marketing preferences: until you unsubscribe, plus the time needed to honour your opt-out.
• Device and usage data: up to 2 years, or as set by the cookie or advertising tool that collects it.

We do not store your test results; they remain in DHA Laboratory's portal (see Section 4).

Security. We use administrative, technical, and physical safeguards suited to the sensitivity of the information. These include encrypted connections, access limited to people who need it, and service providers bound by confidentiality. No system is perfectly secure, so please avoid sending sensitive information to us through unsecured channels such as regular email. If a breach creates a real risk of significant harm to you, we will notify you and the relevant regulators as the law requires.

International transfers. We are based in Canada and use service providers in the United States and elsewhere. Your information may be stored and processed outside the country where you live, where courts and authorities may be able to access it under local law. For transfers from the European Economic Area or United Kingdom, we rely on recognized safeguards such as the European Commission's Standard Contractual Clauses or the UK equivalent.

Children. Our Services are intended for adults and are not directed to anyone under 18. We do not knowingly collect personal information from children under 16, and we do not sell or share the information of anyone we know to be under 16. If you believe a child has given us personal information, contact us and we will delete it.

Depending on where you live, you may have the right to:

• know what personal information we hold about you and how we use and disclose it, and get a copy of it
• correct inaccurate or incomplete information
• delete your information, subject to legal exceptions (for test results stored by DHA Laboratory, see Section 4)
• receive your information in a portable format
• opt out of the sale or sharing of your information and of targeted advertising
• limit our use of sensitive personal information (we use lab test information only for commissions and to review results when you ask)
• withdraw consent you previously gave, without affecting earlier processing
• unsubscribe from marketing at any time, using the link in our emails or by replying STOP to texts (we will still send messages about your orders and subscriptions)

Canada. Under PIPEDA and Alberta's Personal Information Protection Act, you can access and correct your personal information and withdraw consent, subject to legal and contractual limits.

United States. Residents of California and other states with comprehensive privacy laws have the rights listed above. We will not discriminate against you for exercising them.

EEA and UK. We process your information on these legal bases:

• to perform our contract with you
• with your consent, for example for marketing, non-essential cookies, and lab test information
• to comply with legal obligations
• for our legitimate interests in running and securing our business, where your rights do not override those interests

You may also object to our processing or ask us to restrict it.

How to make a request. Email hello@shopholistico.com with the subject line "Privacy Request," or use the "Your Privacy Choices" link on the Site. We will verify your identity before responding, usually by confirming details linked to your order or account. An authorized agent may make a request for you if they provide proof of your permission. We respond within the time the law requires: 30 days in Canada and the EEA/UK, and 45 days under US state laws, with extensions where permitted.

Appeals. If we deny your request, you can appeal by replying to our decision with the subject line "Privacy Appeal." If you are not satisfied with the outcome, you may contact your state Attorney General.

We may offer a discount when you join our email or text list. To get it, you give us your email address or phone number, which we use to send marketing. We consider the offer reasonably related to the value of that information to us, based on what we expect to earn from marketing to subscribers minus the cost of the discount. Joining is optional, you are never signed up automatically, and you can unsubscribe at any time and still keep any discount already used.

Please contact our Privacy Officer first so we can try to resolve your concern. You also have the right to complain to a regulator, such as:

• the Office of the Privacy Commissioner of Canada
• the Office of the Information and Privacy Commissioner of Alberta
• your state Attorney General
• your local data protection authority in the EEA or UK

We may update this policy to reflect changes in our practices, technology, or the law. We will post the updated version here and change the "Last updated" date at the top. If we make material changes, we will notify you by email or a notice on the Site, and ask for your consent where the law requires it.

Privacy Officer, Shop Holistico Inc.
1811 4th Street SW, Suite 212
Calgary, Alberta T2S 1W2, Canada
hello@shopholistico.com