PRIVACY POLICY

Outlier Health, Inc. — Complement® (lovecomplement.com)

Effective Date: July 15, 2026 | Last Updated: July 15, 2026

1. Introduction and Scope

This Privacy Policy explains how Outlier Health, Inc. (“Complement,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you visit lovecomplement.com and our related online stores (the “Site”), purchase our products, enroll in a subscription, or otherwise interact with us. Our Site and checkout are hosted on the Shopify platform.

This Policy is part of, and incorporated into, our Terms of Service and Terms of Sale. It applies to personal information about visitors, customers, and subscribers. It does not apply to information we handle on behalf of other businesses as a service provider, or to third-party websites or services we do not control.

Quick summary. We collect the information needed to operate our store, fulfill and ship orders, manage subscriptions and billing, provide customer support, market our products, and comply with law. We use cookies and similar advertising and analytics technologies, and we share certain information with advertising and analytics partners, which may be a “sale” or “sharing” of personal information under U.S. state privacy laws. You have choices and rights described in Sections 6–9, including the right to opt out of the sale/sharing of your personal information and, where applicable, to limit certain uses.

2. Personal Information We Collect

We collect the categories of personal information below. We use the category names from the California Consumer Privacy Act (CCPA) so the same disclosure works across states.

Category (CCPA)	Examples	Sources
Identifiers	Name, shipping/billing address, email address, phone number, account login, order number, IP address, device and online identifiers	You; your device/browser; Shopify
Commercial information	Products viewed and purchased, cart contents, order and subscription history, payment confirmations	You; Shopify; payment processors
Financial / payment information	Payment-method details (processed and stored by our payment processors; we do not store full card numbers)	You; payment processors
Internet / electronic activity	Pages and products viewed, clicks, referring/exit pages, browsing and interaction data, email/SMS engagement	Cookies, pixels, SDKs and analytics tools (see Section 4)
Geolocation data	Approximate location inferred from IP address; shipping region	Your device; Shopify
Audio/visual	Customer-service emails, chat, call recordings, and messages you send us	You
Inferences	Preferences and characteristics derived from the above to personalize and market our products	Derived by us and our partners
Sensitive personal information	Account login credentials, if you choose password-based sign-in (passwordless sign-in is also available). Payment-card numbers and security codes are provided directly to and processed by our payment processors; we do not store them.	You
Consumer health data (a category of sensitive personal information)	Responses to our optional wellness quiz (health and wellness goals, dietary preferences, reasons for purchase) and inferences drawn from them, to the extent they reveal a specific health condition. Collected only with your separate opt-in consent; handled as described in Section 9 and our Consumer Health Data Privacy Policy.	You (optional wellness quiz)

We do not knowingly collect from children. Our Site and products are intended for adults. We do not knowingly collect personal information from anyone under 13. See Section 11.

3. How We Use Personal Information

We use personal information for the following business and commercial purposes:

• Process, fulfill, ship, and confirm your orders and returns, and form and perform our contract with you.
• Create and manage your account, and operate, renew, and bill your subscriptions, including automatic renewals.
• Verify payment, prevent and detect fraud, and maintain the security and integrity of the Site.
• Provide customer support and respond to your requests and inquiries.
• Send transactional messages (order, shipping, renewal, and cancellation confirmations and required reminders).
• Market and advertise our products, including by email, SMS (with your consent), and online and social-media advertising, and to measure and improve those efforts.
• Personalize your experience and our product recommendations, including (only with your opt-in consent) recommendations based on your optional wellness-quiz responses, as described in Section 9.
• Analyze use of the Site and improve our products, services, and operations.
• Comply with legal obligations, enforce our Terms, and establish, exercise, or defend legal claims.

We will not collect additional categories of personal information, or use the personal information we collected for materially different, unrelated purposes, without providing you notice.

4. Cookies and Tracking Technologies

We and our partners use cookies, pixels, web beacons, tags, SDKs, local storage, and similar technologies to operate the Site, remember your cart and preferences, measure performance, and deliver and measure advertising. Non-essential advertising and analytics technologies load only if you affirmatively accept them through our cookie banner, and we honor opt-out preference signals as described in Section 6.

The technologies we and our partners currently use include, but are not limited to, the following. The specific tools may change from time to time; the current list and your controls are available through our cookie preference center:

Category	Purpose	Example providers	Sale/Share?
Strictly necessary / functional	Cart, checkout, login, security, fraud prevention, site functionality	Shopify	No
Performance / analytics	Measure traffic and how the Site is used	Google Analytics (GA4)	May be a share
Advertising / targeting	Deliver, retarget, and measure ads across sites and social media (cross-context behavioral advertising)	Meta (Facebook/Instagram) Pixel; Google Ads / conversion tags; TikTok Pixel	Yes — sale/share
Email / onsite personalization	Identify you across visits, send and measure email/SMS, personalize onsite content	Klaviyo	May be a share

Notice regarding tracking. Some of these technologies, including third-party pixels and tags, may record and transmit your interactions with the Site to the providers listed above for their own purposes. We load non-essential trackers only after you are given the opportunity to consent through our cookie banner, and non-essential advertising and analytics technologies load only if you affirmatively accept them; if you decline, we honor that choice, and you can change your preferences at any time as described in Section 6.

Your controls. You can manage cookies through our cookie banner / “Your Privacy Choices” preference center, your browser settings, and the advertising-industry opt-out tools at the Network Advertising Initiative (optout.networkadvertising.org) and the Digital Advertising Alliance (optout.aboutads.info). We also honor browser-based opt-out preference signals, including the Global Privacy Control, as described in Section 6.

5. How We Share Personal Information; Sale and Sharing for Advertising

We disclose personal information to the following categories of recipients for the business purposes described above:

• Service providers and processors: that perform services for us, such as our e-commerce platform (Shopify), payment processors, shipping and fulfillment providers, customer-support and communications tools (including Klaviyo), hosting, fraud-prevention, and analytics providers.
• Advertising and analytics partners: such as Meta and Google, in connection with online and social-media advertising and measurement.
• Professional advisors and authorities: such as lawyers, auditors, and government or law-enforcement bodies, where required by law, to enforce our Terms, or to protect our rights, safety, or property.
• A successor: in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, in which case personal information may be transferred as a business asset.

“Sale” and “sharing.” Our advertising and analytics technologies transmit identifiers and internet-activity information to advertising partners for cross-context behavioral advertising. Under the CCPA and similar state laws, these disclosures are considered a “sale” or “sharing” of personal information, even though no money is exchanged. In the preceding 12 months, we shared identifiers, commercial information, internet/electronic activity, and inferences with advertising and analytics partners for cross-context behavioral advertising. Going forward, we do not share purchase information with advertising or analytics partners for orders billed or shipped to Washington or Nevada. You may opt out of this sale/sharing at any time, as described in Section 6. We do not knowingly sell or share the personal information of consumers under 16 years of age.

We do not sell sensitive or health data. We do not sell or share sensitive personal information or consumer health data, and we do not use or disclose them for purposes other than those permitted under applicable law. We exclude sensitive personal information and consumer health data from the advertising and analytics sharing described in this Section, and we do not use consumer health data to create, target, suppress, or build lookalike advertising audiences. Consumer health data is handled as described in Section 9 and our Consumer Health Data Privacy Policy.

6. Your Privacy Choices and Opt-Outs

Do Not Sell or Share My Personal Information. You can opt out of the sale or sharing of your personal information for cross-context behavioral advertising at any time through the “Do Not Sell or Share My Personal Information” or “Your Privacy Choices” link in our website footer, or by contacting us using Section 19. You do not need an account and we will not charge you to opt out.

Opt-out preference signals (Global Privacy Control). We recognize and honor the Global Privacy Control (GPC) and other recognized universal opt-out mechanisms as a valid request to opt out of the sale and sharing of personal information and of targeted advertising for the browser or device that sends the signal. Where we can associate the signal with your account, we apply your choice to that account as well. When we receive and process a GPC signal, we display confirmation that the opt-out request was honored.

Marketing communications. You may unsubscribe from marketing email using the link in any message, reply STOP to marketing SMS, or contact us. Transactional messages about your orders and subscriptions are not marketing and may continue.

7. Your Privacy Rights

Depending on your state of residence, you may have some or all of the following rights, subject to legal exceptions:

• Know / Access: to learn what personal information we collect, use, disclose, sell, and share, and to obtain a copy in a portable format.
• Delete: to request deletion of personal information we collected from you (and, in some states, that concerns you).
• Correct: to request correction of inaccurate personal information.
• Opt out: of the sale or sharing of personal information and of targeted advertising.
• Opt out of profiling: in furtherance of decisions that produce legal or similarly significant effects (where applicable).
• Limit sensitive information: to limit our use and disclosure of sensitive personal information to permitted purposes (California), or to withhold consent for sensitive-data processing (other states).
• Non-discrimination / non-retaliation: we will not deny you goods or services, charge a different price, or provide a different level of quality because you exercised your rights.

How to exercise your rights

You may submit a request by (1) using our online request form / “Your Privacy Choices” page, or (2) emailing team@lovecomplement.com or calling 844-752-6822. Account holders may also submit requests through their account.

Verification. To protect your information, we will take reasonable steps to verify your identity before responding, typically by matching information you provide with information in our records. For deletion or correction we may require additional verification.

Authorized agents. You may use an authorized agent to submit requests on your behalf. We may require the agent to provide proof of authorization and may require you to verify your identity directly.

Response times. We will acknowledge a rights request within 10 business days and respond within 45 days (extendable by an additional 45 days where permitted, with notice).

Appeals. If we decline your request, you may appeal by replying to our response or contacting us using Section 19. We will respond to an appeal within 45 days, extendable where applicable law permits, with notice. If your appeal is denied, you may contact your state attorney general.

8. State-Specific Disclosures

California (CCPA/CPRA). The categories of personal information we collect, our sources, purposes, and the categories of third parties to whom we disclose are described in Sections 2–5; the categories sold/shared are described in Section 5. California residents have the rights in Section 7, including the right to opt out of sale/sharing and to limit sensitive personal information, and the right to be free from discrimination. We do not use or disclose sensitive personal information beyond the purposes permitted by CCPA regulation 7027(m); accordingly, the “right to limit” may not apply unless our practices change. We are not required to report request metrics under section 7102.

Notice of Financial Incentive. We offer financial incentives in exchange for the collection and use of certain personal information — for example, a discount for joining our email list and savings for enrolling in a subscription. The personal information involved includes your email address and contact details and your purchase and engagement activity. You may opt in by enrolling (for example, by signing up for emails) and may withdraw at any time by unsubscribing or contacting us using Section 19, after which the incentive ends. Participation is voluntary. We have made a good-faith estimate that the value of the personal information collected through these programs is reasonably related to, and does not exceed, the value of the discount or benefit we provide; we base this estimate on the cost to us of the discount or promotional benefit offered. The differences in price or service we offer are reasonably related to that value.

Colorado (Colorado Privacy Act). We provide Colorado residents the rights of access, correction, deletion, portability, and to opt out of sale, targeted advertising, and certain profiling, with a right to appeal. We honor the Global Privacy Control as a universal opt-out mechanism for sale and targeted advertising, and we describe in Section 6 how those requests are processed. We obtain consent before processing sensitive data.

Virginia, Connecticut, Oregon, Montana, and other states with comprehensive privacy laws. Residents of states with comprehensive privacy laws have rights similar to those above, including access, correction, deletion, portability, opt-out of sale/targeted advertising/profiling, and appeal. We honor recognized universal opt-out signals where required.

Oregon and Minnesota. Residents of Oregon and Minnesota may request a list of the specific third parties to which we have disclosed personal information. Submit requests using Section 19.

Texas. We do not sell sensitive personal data or biometric personal data.

Maryland. We limit our collection of personal information to what is reasonably necessary to provide the products and services you request, and we do not sell sensitive personal data.

Nevada. Nevada residents may submit a verified request directing us not to sell certain covered information; we do not sell covered information as defined under Nevada law for monetary consideration.

9. Sensitive Information and Health-Related Information

We aim to minimize the sensitive information we collect. To the extent we collect account credentials or payment-card security codes, we use them only to provide the Site, process payments, secure accounts, and prevent fraud.

Health-related information. Complement sells nutritional supplements. We offer an optional wellness quiz that asks about your health and wellness goals, dietary preferences, and reasons for purchase so that we can recommend products. Taking the quiz is voluntary, and we collect your quiz responses only with your separate, affirmative opt-in consent, which we record at the time you take the quiz.

What we treat as consumer health data. “Consumer health data” means the quiz responses you provide, and the inferences we draw from them, to the extent they identify or reveal a specific health condition. General product purchases and shopping activity are not treated as consumer health data and may be used for marketing and advertising as described in Sections 4–5.

How we use it — and how we do not. We use consumer health data only to provide the product recommendations you request, to personalize the first-party communications (such as email) you have opted into, to respond to your inquiries, and to comply with law. We do not sell consumer health data. We do not use it for advertising or share it with advertising partners, and we do not use it to create, target, suppress, or build lookalike advertising audiences. If you volunteer health-related information (for example, in a message to customer service), we use it only to respond to your request. For more detail, including your rights and how to withdraw consent, see our Consumer Health Data Privacy Policy at lovecomplement.com/pages/consumer-health-data-privacy-policy, which governs our handling of consumer health data.

Washington and Nevada. Because supplement purchase records could be viewed as revealing health-related interests, we do not share purchase information with advertising or analytics partners for orders billed or shipped to Washington or Nevada, and we do not sell consumer health data as defined under Washington or Nevada law.

10. Email and SMS Marketing; Communications Consent

When you provide your information to complete a transaction or create an account, we use it for that purpose. If we use your information for a separate purpose such as marketing, we will either obtain your consent or give you the opportunity to decline.

SMS/text marketing. We send marketing text messages only with your prior express written consent. Consent to receive marketing texts is not a condition of any purchase. Message and data rates may apply; reply STOP to opt out or HELP for help. We honor opt-out requests through any reasonable means.

Email marketing. Every marketing email includes an unsubscribe link, which we honor promptly.

Subscriptions and automatic renewal involve separate disclosures and consent presented at checkout. For how subscriptions renew and how to cancel, see our Terms of Sale, Cancellation Policy, and Refund Policy. You may withdraw marketing consent at any time by contacting team@lovecomplement.com or by mail to the address in Section 19.

11. Children’s Privacy

Our Site and products are intended for adults 18 and older. We do not knowingly collect personal information from children under 13, and we do not knowingly sell or share the personal information of consumers under 16. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete it. If you believe a child has provided us personal information, contact us using Section 19.

Consistent with our Terms, the arbitration agreement and class-action waiver do not apply to anyone who was under 18 at the time of acceptance.

12. Data Retention

We retain personal information for as long as needed to fulfill the purposes described in this Policy, including to provide our products and services, maintain your account and subscription, comply with our legal, tax, accounting, and recordkeeping obligations, resolve disputes, and enforce our agreements. To determine retention periods we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, and applicable legal requirements. When information is no longer needed, we delete or de-identify it. Records relating to consent, subscriptions, and dispute-resolution rights may be retained for the life of the relationship plus the longest applicable limitations period.

13. Data Security

We take reasonable precautions and follow industry practices to protect personal information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. Payment information you provide is encrypted in transit using TLS/SSL and handled in accordance with PCI-DSS by our payment processors. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Third-Party Links and Services

Our Site may link to third-party websites and services, and our store is hosted on Shopify. We are not responsible for the privacy practices of third parties. We encourage you to review their privacy notices, including Shopify’s Privacy Policy and Terms of Service. Once you leave our Site or are redirected to a third-party site or application, this Policy no longer applies.

15. International Users and Cross-Border Transfers

We are based in the United States and process personal information in the United States. Our Site and products are directed to customers in the United States and Canada and are not directed to the European Union or the United Kingdom. If you access the Site from outside North America, you do so on your own initiative and are responsible for compliance with local law.

Canadian residents (PIPEDA and Quebec Law 25). If you are in Canada, we collect, use, and disclose your personal information in accordance with applicable Canadian privacy law. Your personal information may be processed and stored in the United States and may be accessible to U.S. authorities under U.S. law. You may access and correct your personal information, withdraw consent, and make a complaint by contacting our privacy contact in Section 19, and you may also contact the Office of the Privacy Commissioner of Canada. For Quebec residents, our designated person responsible for the protection of personal information can be reached at the contact in Section 19.

16. Disputes About Your Data; Binding Arbitration; Class-Action Waiver; 30-Day Opt-Out

Any dispute, claim, or controversy arising out of or relating to this Privacy Policy or to the collection, use, sharing, or protection of your personal information — including the validity, enforceability, or scope of this provision — is a “Dispute” that is subject to the binding individual arbitration agreement and the class-action and representative-action waiver set forth in Section 18 of our Terms of Service. Those provisions are incorporated into this Privacy Policy by reference and made a part of it, and are governed by the Federal Arbitration Act. By using our Site or purchasing our products, you agree that data- and privacy-related Disputes will be resolved through individual arbitration and not in court or on a class or representative basis, except as provided in Section 18 of the Terms of Service (including the opt-out procedure in Section 18.10).

30-day opt-out. You have the right to opt out of arbitration within 30 days of first accepting the Terms of Service or Terms of Sale, by following the procedure described in Section 18.10 of the Terms of Service. Nothing in this provision waives any right you cannot waive under applicable law, and this provision does not apply to any individual who was under 18 years of age at the time of acceptance.

17. Governing Law and Order of Precedence

This Privacy Policy is governed by the laws of the State of Colorado, without regard to its conflict-of-laws rules, except that (a) the arbitration and class-waiver provisions referenced in Section 16 are governed by the Federal Arbitration Act, and (b) nothing in this Policy limits any non-waivable right or remedy available to you under the mandatory consumer-protection laws of your state or province of residence, which continue to apply. To the extent this Privacy Policy conflicts with our Terms of Service or Terms of Sale on any matter concerning the collection, use, sharing, or protection of personal information (a “data matter”), this Privacy Policy controls. For purchase, payment, subscription, cancellation, return, and refund matters, our Terms of Sale controls, followed by the Refund Policy, then the Cancellation Policy, then the Terms of Service, as described in Section 14 of the Terms of Sale. On all other matters, the Terms of Service and Terms of Sale control.

18. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will post the revised Policy here with a new “Last Updated” date and, where required by law, provide additional notice (for example, by email or a notice on the Site). Changes take effect when posted unless a later effective date is stated or a longer notice period is required by law. We will review this Policy at least every 12 months. We encourage you to review it periodically.

19. How to Contact Us and Submit Requests

To exercise your rights, ask questions, or make a complaint, contact our Privacy Compliance Officer:

Outlier Health, Inc. — Attn: Privacy Compliance Officer

56 Edwards Village Blvd, Ste 124-320, Edwards, CO 81632

Email: team@lovecomplement.com | Phone: 844-752-6822