Privacy Policy

Vitality, Inc., a Delaware C-Corporation (“Trait,” “we,” “us,” or “our”), is committed to protecting your privacy, including the privacy of your genetic information. This Privacy Policy describes how we collect, use, store, share, and protect your personal data, including genetic data, when you use our website, services, and products.

By using our services, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use our services.

1. Information We Collect

1.1 Personal Information

When you create an account or place an order, we collect: name, email address, shipping address, phone number, date of birth, sex (the laboratory requires it with your sample), and payment information. Payment data is processed directly by our third-party payment processor (Stripe, Inc.) and is not stored on Trait servers.

1.2 Genetic Data

When you submit a DNA sample through our at-home collection kit, your sample is processed by our CLIA-certified, CAP-accredited, HIPAA-compliant diagnostic partner (Dynamic DNA Labs, Springfield, MO; CLIA #26D2106631). The laboratory genotypes more than 650,000 single nucleotide polymorphisms (SNPs) from your sample. We receive the resulting digital genotype data to generate your personalized supplement formula.

Your genetic data is collected and processed only with your explicit, informed consent. Before your sample is processed, you will be asked to provide affirmative consent to the collection, analysis, and storage of your genetic information for the specific purposes described in this policy.

1.3 Health and Wellness Information You Provide

During onboarding we ask you to provide self-reported health and wellness information, including current medications and supplements, allergies, medical conditions, pregnancy or nursing status, and lifestyle details (such as diet and activity). We collect this information for one primary reason: your safety. We screen every formula against it to flag potential ingredient–medication, ingredient–allergy, and ingredient–condition interactions before anything is manufactured. It is also used to personalize your wellness insights. We do not use this information for marketing or advertising, and we do not sell or share it except as described in Section 4. Keeping this information accurate and current is important to the safety of your formula.

1.4 Usage and Device Information

We automatically collect standard usage data when you visit our website, including: IP address, browser type and version, operating system, device identifiers, pages visited, time spent on pages, referring URLs, and interaction data. This data is collected through cookies and similar tracking technologies (see Section 9).

2. How We Use Your Information

2.1 Genetic Data, Limited Use

Your genetic data is used solely and exclusively for:

• Filtering your genotype data to our curated panel of 48 supplement-related SNP markers, plus 27 wellness and lifestyle trait markers
• Evaluating those markers through our proprietary rules engine to determine your custom formula
• Generating a supplement specification sent to our manufacturing partner for production
• Presenting personalized genetic insights to you through your member dashboard, including your formula rationale and general wellness and lifestyle traits (such as caffeine metabolism, nutrient conversion, or taste)

A few of the markers we read also have medical significance, such as markers that affect iron handling, blood clotting and cholesterol transport. We use them only to shape your formula, for example to keep iron out of it or to set the amount of an ingredient, and we do not report them to you as results or health findings.

We do not use your genetic data for marketing, advertising, research, insurance underwriting, employment decisions, or any purpose other than supplement personalization and delivering your genetic insights.

Wellness, not diagnosis. Our genetic analysis is used to personalize nutritional supplementation and to present educational wellness insights. It is not clinical or diagnostic genetic testing, and the insights we show you are not a medical or disease-risk report. Our supplement rules and safety guardrails are developed with input from our medical advisor, a licensed physician; this does not create a doctor–patient relationship. See our Disclaimer and Terms.

2.2 Personal Information

We use your personal information to:

• Process your membership, orders, and payments
• Ship your DNA kit and supplement products
• Communicate with you about your account, orders, and formula
• Send marketing communications (with your consent; you may opt out at any time)
• Comply with legal obligations

3. Genetic Data, Storage, Retention, and Deletion

3.1 Physical Samples

Your physical DNA sample (cheek swab) is processed at our CLIA-certified partner laboratory, which keeps or disposes of it under its own protocols and the rules that govern clinical laboratories. Trait never receives or holds physical biological samples.

3.2 Digital Genotype Data

Your digital genotype data is stored on access-controlled servers, reachable only by authorized personnel, and is encrypted in transit (TLS 1.2+). We keep it while you have a Trait account, so that we can remake your formula without a new test, and until you ask us to delete it. It is not deleted automatically when your membership ends: deletion happens when you ask for it, as described in Section 3.3.

3.3 Your Right to Deletion

You may request deletion of your genetic data at any time by emailing hello@vitalityformulas.co. Each request is handled by a person: once we have verified it, we will delete your genetic data from our systems within 30 days and confirm the deletion in writing. Once deleted, we will no longer be able to remanufacture your formula without a new DNA test.

When you ask us to delete your genetic data, we remove your DNA file, the genetic interpretation and formula records we built from it, and your health survey. We keep your account, order and billing records, which contain no genetic data, and the record of the safety screen run on your formula, including what it flagged and any decision made about producing it, and by whom. We keep that safety record because it is the evidence your formula was checked before it was made; it contains no genetic data and is not used for any other purpose. Our confirmation to you lists what was deleted and what was kept.

Our laboratory partner keeps its own record of your test, as clinical laboratories are required to (federal CLIA rules require laboratories to keep test records and reports for at least two years). When you ask us to delete your data, we also pass your request on to the laboratory, which handles it under those rules. Our manufacturing partner keeps its production records of the formulas it made for you (ingredients and doses, never genetic data).

4. Third-Party Data Sharing

We share your information only in the following circumstances:

• Diagnostic laboratory partner (Dynamic DNA Labs): Your DNA sample, with your name, date of birth, sex, email, phone number and address, is shared with our partner laboratory so it can ship your kit and genotype your sample. Dynamic DNA Labs is CLIA-certified, CAP-accredited, and HIPAA-compliant. The laboratory keeps its own record of your test and results, as clinical laboratory rules require (see Section 3.3).
• Manufacturing partner (Personalized Nutrients): Your formula specification (ingredients and doses), and the name, shipping address and phone number needed to deliver it, are shared with our manufacturing partner to make and ship your supplement. If we have no name on file for you, your email address is sent in its place. It never receives your genetic data or your health survey.
• Medical advisor: When our safety screen holds a formula, what it flagged, the answers that triggered the hold, and your name and email address may be shared in confidence with our medical advisor, a licensed physician, to help us decide whether that formula is made, changed, or not made. This is a decision about the product, not medical care, and it does not create a doctor–patient relationship.
• Payment processor (Stripe, Inc.): Payment information is processed by Stripe in accordance with their privacy policy and PCI DSS standards.
• Email delivery (Resend): Your name and email address, and the content of the emails we send you (for example order and shipping updates, and notices that your results or formula are ready), pass through our email provider so they can be delivered.
• Hosting providers (Railway and Vercel): Our servers and database, which hold your account, health survey and genetic data, run on Railway; our website runs on Vercel. They host our systems for us and do not use your data for their own purposes.
• Analytics and advertising (Google and Meta): Google Analytics 4 and the Meta Pixel run only on our public marketing pages, as described in Section 9. They never receive genetic data, health information, or anything from your member portal.
• Legal requirements: We may disclose information if required to do so by law, regulation, subpoena, court order, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others. We disclose genetic data to law enforcement or any other authority only when the law requires it, for example under a valid subpoena, warrant or court order.

We never sell your genetic data. We never share your genetic data with insurance companies, employers, data brokers, or third parties for marketing, research, or any purpose other than those described above.

5. GINA, Genetic Information Nondiscrimination Act

The Genetic Information Nondiscrimination Act (GINA) is a federal law that prohibits discrimination based on genetic information in health insurance and employment. Under GINA, health insurers may not use genetic information to make coverage or premium decisions, and employers may not use genetic information in hiring, firing, or promotion decisions.

Trait acknowledges and supports GINA protections. We do not provide genetic information to health insurers, employers, or any entity that could use it for discriminatory purposes. However, please be aware that GINA does not apply to life insurance, disability insurance, or long-term care insurance.

6. State Genetic Privacy Laws

6.1 California, CalGIPA

Under the California Genetic Information Privacy Act (Cal. Civ. Code §56.18 et seq.), we are required to obtain your express consent before collecting, analyzing, or sharing your genetic information. We collect genetic information only after you provide informed, written (electronic) consent. You have the right to revoke consent and request destruction of your genetic data at any time.

6.2 Florida

Under Florida law (Fla. Stat. §760.40), DNA analysis results are the exclusive property of the person tested. We recognize your ownership of your genetic data. We do not perform DNA analysis without your informed consent, and we do not disclose results to any third party without your authorization except as described in Section 4.

6.3 Texas

Texas law, including the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code ch. 541), gives Texas residents rights over their personal data, with added protection for sensitive data. Whether or not a particular law applies to us, we obtain your express consent before your sample is processed, and we honor deletion requests as described in Section 3.3.

7. HIPAA Non-Applicability

Vitality, Inc. is not a “covered entity” or “business associate” as defined under the Health Insurance Portability and Accountability Act (HIPAA). We are a direct-to-consumer dietary supplement company, not a healthcare provider, health plan, or healthcare clearinghouse.

While we are not subject to HIPAA, we protect your genetic and health data with the safeguards described in Section 14, and we will notify you of a breach as described in Section 12.

Our diagnostic laboratory partner (Dynamic DNA Labs) is HIPAA-compliant in their capacity as a clinical laboratory and handles your physical sample under their own HIPAA obligations.

8. California Consumer Privacy Act (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, “CCPA”):

• Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the third parties with whom we share it.
• Right to delete: You may request deletion of personal information we have collected from you, subject to certain legal exceptions.
• Right to correct: You may request correction of inaccurate personal information.
• Right to opt out of sale/sharing: We do not sell personal information. The Meta Pixel on our public marketing pages (Section 9) lets Meta measure our ads and may let us show our ads to people who have visited our site, which the CCPA can treat as “sharing” for cross-context behavioral advertising. It never carries genetic data, health information or product names. Its checkout and purchase events do carry the price, and because the DNA kit and the membership are priced differently, the price shows which one it was. To opt out, turn on Global Privacy Control in your browser: we honor it by loading no analytics or advertising tags at all. The Meta Pixel runs only in your browser and we send Meta nothing about you from our servers, so the opt-out has to be set in the browser, and it applies to each browser you turn it on in.
• Right to limit use of sensitive personal information: Genetic data is classified as sensitive personal information under CCPA. We use it only for the purposes disclosed in this policy and will not use it for purposes beyond what is necessary to provide our services.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise any of these rights, email hello@vitalityformulas.co with the subject line “CCPA Request.” We will verify your identity before processing any request and respond within 45 days.

9. Cookies and Tracking Technologies

We use the following cookies and tracking technologies:

• Strictly necessary cookies: “vit_session” keeps you signed in to your member portal and “aff_session” to your partner dashboard. After a checkout, “trait_order” remembers for 7 days which order you just placed, so that the order confirmation page can show it to you. They are not used for analytics or advertising.
• Referral cookie: If you arrive through a Trait partner's referral link, a first-party cookie (“trait_ref”) keeps that partner's referral code for 30 days. If you place an order in that time, the code is attached to your order record with our payment processor so that the partner who referred you is credited. When the link is opened we also log the click, with a one-way hash of the network address it came from and the browser's user-agent string, so the partner's clicks can be counted. It holds no health or genetic data.
• Campaign attribution cookie: A first-party cookie (“trait_attrib”) that records, for 90 days, the campaign tags and ad click identifiers in the links that first and most recently brought you to our public pages (utm_source, utm_medium, utm_campaign, utm_content, utm_term, gclid, gbraid, wbraid, fbclid and msclkid), together with which of our pages you landed on, and when. If you place an order, we attach them to your order record with our payment processor so we know which ads lead to orders. It holds no health or genetic data.
• Analytics and advertising tags: Google Analytics 4 and the Meta Pixel, and the cookies they set (such as “_ga” and “_fbp”), which use device identifiers to measure how visitors use our site and how our ads perform.

Where the tags run. Google Analytics 4 and the Meta Pixel load only on our public marketing pages (such as the home, science, pricing, FAQ and legal pages) and on the order confirmation page, and never on your member portal, sign-in pages, the health survey, our administrative pages, or any page whose web address carries a sign-in link or token. The web addresses they are shown have everything removed except campaign tags and ad click identifiers. Google Signals and ad personalization are turned off in Google Analytics, which records page views and, when you start or complete a checkout, the price and whether it was for the DNA kit or the membership. In the Meta Pixel, automatic configuration and automatic advanced matching are off, so it does not read what is on the page or what you type. It sends page views, an event carrying only the price and currency when you press a buy button, and, when you complete a purchase, one Purchase event carrying only the order value, the currency and an order reference used to count it once: never product names, health information or genetic data.

Your choices. If your browser sends a Global Privacy Control signal, we load neither Google Analytics nor the Meta Pixel. You can also block or delete cookies in your browser settings; the strictly necessary ones are needed to sign in to your portal. We do not use a cookie banner.

We do not use cookies or tracking technologies to collect, transmit, or correlate genetic data with browsing behavior.

10. European Economic Area (GDPR)

If you access our services from the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Lawful basis: We process your data based on your explicit consent (for genetic data) and contractual necessity (for service delivery).
• Right of access: You may request a copy of all personal data we hold about you.
• Right to rectification: You may request correction of inaccurate data.
• Right to erasure: You may request deletion of your data (“right to be forgotten”).
• Right to data portability: You may request your data in a structured, commonly used, machine-readable format.
• Right to restrict processing: You may request that we limit how we use your data.
• Right to object: You may object to processing based on legitimate interests.
• Right to withdraw consent: You may withdraw consent at any time without affecting the lawfulness of processing performed before withdrawal.

To exercise GDPR rights, email hello@vitalityformulas.co with the subject line “GDPR Request.” You also have the right to lodge a complaint with your local data protection authority.

International transfers: Your data is processed in the United States. By using our services, you consent to the transfer of your data to the U.S. We implement appropriate safeguards for international transfers, including standard contractual clauses where applicable.

11. Children's Privacy (COPPA)

Trait services are intended exclusively for adults aged 18 and older. We do not knowingly collect personal information, genetic data, or any other data from children under the age of 18 (or under the age of 16 for residents of the EEA).

If we become aware that we have inadvertently collected data from a person under the applicable age, we will promptly delete that data and any associated genetic information. If you believe we have collected data from a minor, please contact us immediately at hello@vitalityformulas.co.

12. Data Breach Notification

In the event of a data breach that compromises the security, confidentiality, or integrity of your personal or genetic data, Trait commits to:

• Notifying affected individuals by email within 72 hours of confirming the breach
• Notifying applicable state attorneys general and regulatory authorities as required by law
• Providing a clear description of the nature of the breach, the data involved, and the steps we are taking to mitigate harm
• Offering appropriate remediation measures, which may include credit monitoring services

We will give the notices that applicable breach-notification laws require, including those of California (Cal. Civ. Code §1798.82), Texas (Tex. Bus. & Com. Code §521.053), Florida (Fla. Stat. §501.171), and, where it applies, the GDPR (Articles 33 and 34).

13. Data Retention

We do not run automatic deletion schedules. We keep each kind of information for as long as we need it for the purpose below, or until you ask us to delete it, subject to what the law requires us to keep:

• Genetic data: While you have a Trait account, until you ask us to delete it (Section 3.3). It is not deleted automatically when your membership ends.
• Health survey: While you have a Trait account, until you ask us to delete it, because every formula is screened against it.
• Account and order information: While you have a Trait account, and afterwards for as long as we need it to answer questions about your orders, resolve disputes and meet our legal obligations.
• Billing records: At least 7 years (as required by tax law).
• Safety screen records: Kept, as explained in Section 3.3.
• Analytics data: Held by Google under our Google Analytics retention setting, which keeps user-level data for no longer than 14 months.
• Marketing consent records: For as long as you are subscribed, and afterwards as a record of your consent or opt-out.

14. Security

These are the safeguards we use to protect your data:

• Encryption in transit (TLS 1.2+) between your browser, our servers and our partners
• Stored genetic data can be reached only by a small number of authorized people, through password-protected administrative access
• Member sign-in uses one-time sign-in links sent to your email, so there is no Trait password to steal or reuse
• Payment card details are handled by Stripe and never touch our servers
• Our manufacturing partner receives your formula, never your genetic data
• Every deletion of genetic data is recorded with who carried it out and why

To report a security concern, email hello@vitalityformulas.co.

No system is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will provide at least 30 days' advance notice of material changes by: (a) updating the “Last updated” date; (b) sending email notification to the address on your account; and (c) displaying a prominent notice on our website. Your continued use of our services after the effective date constitutes acceptance of the revised policy.

For changes that materially affect how we use or share genetic data, we will seek your renewed consent before the changes take effect.

16. Contact

If you have questions about this Privacy Policy, your data, or wish to exercise any of your rights, please contact:

Vitality, Inc. (operating as Trait)
Attn: Privacy
1826 Ponce De Leon Blvd, Coral Gables, FL 33134
Email: hello@vitalityformulas.co