Privacy Policy

Last updated: November 10, 2025

At Revly ("we", "us"), we take your privacy seriously. This Privacy Policy describes how we collect and process your personal information through our website, mobile application, online service offerings and other products or services (collectively, the "Services").

We collect "consumer health data" in connection with our Services. Please refer to our Consumer Health Data Privacy Policy for additional information about the processing of your consumer health data, and your rights under applicable state privacy laws with respect to such data. When we use the term "Privacy Policy", we mean both this privacy policy and our Consumer Health Data Privacy Policy.

Categories of Personal Information We Collect

We collect the following categories of personal information:

Information you provide to us, including:

• Contact information, such as your name and email address.
• Account information, such as your username and authentication identifiers.
• Consumer health data, including lifestyle habits, medical conditions, diagnostic information such as health test results, blood biomarker panels, fitness metrics from wearable devices, experiment tracking data, and other health-related information that you choose to share with us (see our Consumer Health Data Privacy Policy for more information).
• Commercial data, including subscription history within our Services.
• Payment information needed to complete your transactions with us. If you subscribe on the web, payment information is processed by Stripe. If you subscribe in the iOS app, payment information is processed by Apple. We do not have access to your full payment card information.
• Demographic data such as your age, date of birth, and gender.
• Feedback or correspondence, such as information you provide when you contact us with questions, feedback, or otherwise correspond with us online.
• Communications we exchange with you, including support services or other types of communications.
• Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Information we receive from third party sources, including:

• Third-Party Health Services. When you explicitly grant us permission to collect data from third parties (such as Apple Health via HealthKit or other services you connect), information that you authorize will be transmitted to us.
• Third-party login information, such as information we receive when you authenticate through a third-party service depends on the settings, permissions and privacy policy controlled by that third-party service.

Information we collect automatically, including:

• Device data, such as your computer's or mobile device's operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, device identifiers, language settings, mobile device carrier, radio/network information (e.g., WiFi, LTE, 3G), and general location information such as city, state or geographic area. This automatic collection is primarily for our website and web app.
• Usage data, such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to our website, navigation paths between pages or screens, information about your activity on a page or screen, access times, duration of access, and whether you have opened our service emails or clicked links within them.

We use the following tools for automatic data collection:

• Cookies, which are text files that websites store on a visitor's device to uniquely identify the visitor's browser or to store information or settings in the browser for the purpose of helping you navigate between pages efficiently, remembering your preferences, enabling functionality, and helping us understand website user activity and patterns. We may use analytics on our website to compile reports that disclose trends without identifying individual visitors, and help us improve our website.
• Local storage technologies, like HTML5, that provide cookie-equivalent functionality but can store larger amounts of data, including on your device outside of your browser in connection with specific applications.
• Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.

How We Use Personal Information

We use personal information as follows:

• To provide our Services to you, including to provide personalized health insights and recommendations based on the information you provide, including your health metrics you share with us; analyze your experiments and their impact on your health biomarkers; sync data from connected wearable devices; extract and track blood test biomarkers; provide support and assistance relating to the Services; create and manage your account; and process orders or other transactions.
• To communicate with you. We use personal information to respond to your requests, provide customer support, and otherwise communicate with you about our Services, including by sending announcements, surveys, updates, security alerts, and support and administrative messages.
• To improve, monitor, and personalize our Services. We use personal information to improve our Services, including by understanding your needs and interests, and personalizing your experience with the Services and our communications.
• For research and development. We may use your personal information for research and development purposes, including to analyze and improve our Services and our business. As part of these activities, we may create aggregated, de-identified, or other anonymous data from personal information we collect. We may use this data and disclose it to third parties for our lawful business purposes, including to analyze and improve our Services and promote our business.
• Direct marketing. We may send you product updates or newsletters if you opt in. You may opt out of marketing emails as described in the "Opt out of marketing communications" section below.
• Compliance and protection. We may use personal information to comply with legal obligations, and to defend our company against legal claims or disputes, including to:
  • Comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.
  • Protect our, your or others' rights, privacy, safety or property (including by making and defending legal claims).
  • Audit our internal processes for compliance with legal and contractual requirements and internal policies.
  • Enforce the terms and conditions that govern our website.
  • Prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

We will not use your consumer health data for advertising purposes or sell or share such health information to advertising platforms, data brokers, or information resellers. We use your consumer health data solely to provide the Services to you, including to tailor health improvement recommendations and other Services you request.

How We Disclose Your Data

We may disclose your personal information to:

• Service Providers. In addition to partners that support business operations for payment processing and security and fraud prevention, we may disclose your personal information to service providers who assist us in providing Services to you. This includes:
  • AI service providers (for document processing and insights);
  • Cloud platform and hosting providers;
  • Database and storage providers;
  • Authentication providers;
  • Payment processors (Stripe for web, Apple for iOS in-app purchases).
• Law enforcement, government agencies or other third parties where we believe in good faith to be necessary or appropriate to comply with applicable laws or protect our legitimate interests.
• Business transferees, such as acquirers and other relevant participants in business transactions (or diligence or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale, or other disposition of all or any portion of the business or assets of, or equity interests in, us including, in connection with a bankruptcy or similar proceedings. Should one of these events occur, we will make reasonable efforts to notify you.
• Other third parties at your direction or with your authorization.

Your Rights and Choices

Account information

If you have an account with us, you can review and update certain account information by logging into your account. You can delete your account in the app settings or by contacting us.

Opt out of marketing communications

You may opt out of marketing-related emails and other communications by following the opt-out or unsubscribe instructions at the bottom of the emails or within the messages or other communications you receive from us. You may continue to receive service-related and other non-marketing emails or other communications.

Personal Information Requests

Depending on your location and the nature of your interaction with the Services, you may request the following with respect to your consumer health data:

• Confirm whether we collect, share or sell your consumer health data.
• Access your consumer health data.
• Delete your consumer health data.
• Withdraw your consent from our collection or sharing of your consumer health data.

Please note that in some circumstances, your choices may be limited, such as where fulfilling your request would impair the rights of others, our ability to provide a service you have requested, or our ability to comply with our legal obligations and enforce our legal rights. In those circumstances, we will still respond to notify you of such a decision. In some cases, we may also need you to provide us with additional information, which may include personal information if necessary to verify your identity and the nature of your request.

We will not discriminate against you for exercising your rights described above.

How To Submit Personal Information Requests

To submit a request regarding any of the rights described above, please send us an email at privacy@revly.health

Security

We employ a number of technical, organizational, and physical safeguards designed to protect the personal information we collect. For example, our personnel receive training on our internal privacy and data security policies, we limit access to your data to personnel based on role, and we protect personal information in-transit and at rest using encryption and other security measures. However, no security measures are failsafe and we cannot guarantee the security of your personal information.

Retention of Personal Information

Where required under applicable laws, we retain personal information only for as long as is necessary to fulfill the purposes for which it was collected and processed, in accordance with our retention policies, and in accordance with applicable laws and regulatory obligations.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of personal information, the purposes for which we use personal information and whether we can achieve those purposes through other means, and the applicable legal and regulatory requirements.

Personal Information of Children

We do not knowingly collect or solicit personal information from children under 18. If you are under 18, please do not attempt to register for or otherwise use the Services or send us any personal information. If we learn we have collected personal information from a child under 18, we will delete that information. If you believe that a child under 18 may have provided us personal information, please contact us at privacy@revly.health

Changes to this Privacy Policy

We're constantly trying to improve our Services, so we may need to change this Privacy Policy from time to time. If we do so, we will notify you by updating the date of this Privacy Policy and posting it on our website and online services. If required by law to provide notification of changes in another way, such as by sending you an email, and/or by some other means, we will do so. If you use the Services after any changes to the Privacy Policy have been posted, you acknowledge all of the changes. Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting).

Contact Information

If you have any questions or comments about this Privacy Policy, the ways in which we collect and use your personal information, your choices and rights regarding such use, please do not hesitate to contact us by email at: privacy@revly.health