Privacy policy

Last updated: September 24, 2026

Breakoutlabs Inc. ("BreakoutLabs," "we," "us," or "our") operates our store website at trybreakoutlabs.com, our member app at app.trybreakoutlabs.com (also reachable at app.breakoutlab.co), and the related tests, products, membership, content, features, tools and services we offer (together, the "Services"). Our store website is powered by Shopify. This Privacy Policy describes how we collect, use, disclose and protect your personal information when you visit or use the Services, make a purchase, or otherwise communicate with us. Capitalized terms not defined here have the meanings given in our Terms of Service. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described in this Privacy Policy.

We also publish a separate Consumer Health Data Privacy Policy. It explains how we handle health information under the Washington My Health My Data Act and similar laws in Nevada, Connecticut and other states. It applies to everyone, wherever you live.

If you have questions, contact us at info@breakoutlab.co or by mail at 650 NE 2nd Ave, Miami, FL 33132.

Who We Are and How We Protect Health Information

BreakoutLabs sells at-home blood test kits, supplements, and a membership that helps you understand your results and act on them. Your test is ordered by an independent physician, and your sample is analyzed by an independent CLIA-certified laboratory. When you take a test, you authorize the laboratory and the physician to send your results to BreakoutLabs so we can show them to you and build your plan.

BreakoutLabs maintains a privacy and security program built to the safeguards of the Health Insurance Portability and Accountability Act ("HIPAA"): administrative safeguards (such as policies, staff training and role-based access), physical safeguards (such as using secure, access-controlled data centers run by our hosting providers), and technical safeguards (such as encryption, access controls and logging). We monitor this program continuously through a compliance platform.

The independent physician and the laboratory have their own obligations under HIPAA for the records they keep, and their own notices of privacy practices may also apply to those records. This Privacy Policy and our Consumer Health Data Privacy Policy explain how BreakoutLabs handles your information.

1) Scope

This Privacy Policy applies to information we process about:

• Visitors to our store website and member app
• Individuals who create an account or purchase Services or products
• People whose test is purchased or registered by someone else, including teens aged 14 to 17 whose parent or guardian registers a test for them
• Individuals who use our membership, skin specialist calls, group calls, progress check-ins, or health coaching features
• Individuals who interact with our emails, text messages, ads, or customer support

This Privacy Policy does not apply to third-party websites or services we don't control, or to records the independent physician or laboratory keep for themselves.

2) Information We Collect

When we say "personal information," we mean information that identifies or can reasonably be linked to you or another person. It does not include information that is collected anonymously or that has been de-identified so that it cannot identify or be reasonably linked to you. Depending on how you use the Services, where you live, and as permitted or required by law, we collect the following, including inferences drawn from it.

A. Information You Provide

• Account and profile: name, email, phone, date of birth, sex, shipping and billing addresses, login credentials, and your preferences and settings.
• Test taker details: the name, date of birth and sex of the person being tested, if you order or register a test for someone else (including your teen).
• Orders and support: the products and Services you view, add to your cart, buy, return, exchange or cancel; transaction details (card numbers are handled by our payment providers, not stored by us); and your communications with our care team and skin team.
• Health questionnaire: your answers about your skin and acne, diagnosed conditions, prescription medicines, pregnancy or breastfeeding, menopause, your menstrual cycle, hormonal birth control, skincare products and supplements you use, reactions to products, diet, sleep, stress, exercise, gut health, and how acne affects how you feel. Some earlier customers answered an older version of this questionnaire through Typeform.
• Photos: face and skin photos you upload for progress tracking.
• Progress check-ins: your answers and photos at each check-in.
• User content: reviews, messages and uploads you post or send through the Services.

B. Information Collected Automatically

• Device and usage data: IP address, device identifiers, browser type, operating system, pages viewed, referring and exit pages, timestamps, and how and when you navigate the Services.
• Cookies and similar technologies: cookies and pixels for core functionality, analytics, error monitoring and marketing measurement. See "Advertising, Cookies and Pixels" below.

C. Information From Others

• A parent or guardian, or another buyer, who orders or registers a test for you.
• Laboratories and physicians: your test results, biomarker values, reference ranges, lab reports, and kit status.
• Payment providers: payment status and limited payment details (we don't store full card numbers).
• Shipping and fulfilment partners: shipping and delivery status for your kit and your returned sample.
• Sales platforms: order and contact details for orders you place through Shopify or TikTok Shop.
• Service providers that collect or process information for us, and analytics and marketing providers that give us aggregated or pseudonymous insights about site performance and campaign effectiveness.

Categories of Information at a Glance

Category	Examples	Source
Identifiers and contact	Name, email, phone, shipping address, account ID	You
Orders and payments	Items bought, subscription, payment method type	You, payment providers
Lab results (health)	Biomarker values, reference ranges, lab reports, kit IDs	Laboratory, physician
Questionnaire (health)	Skin history, conditions, medicines, cycle, pregnancy, lifestyle, products and supplements you use	You, or your parent or guardian
Photos (health)	Face and skin progress photos	You, or your parent or guardian
Plan and care notes (health)	Your Clear Skin Blueprint, skin specialist and care team notes	Us, skin specialists
Check-ins (health)	Progress check-in answers and photos	You
Messages (may include health)	Messages with our care team and skin team	You
Test taker details	Name, date of birth and sex of the person being tested, including teens	Buyer, parent or guardian
Device and usage	IP address, browser, pages viewed, error reports	Automatically
Marketing preferences	Email and text message opt-ins and opt-outs	You

We do not collect precise geolocation. Photos taken in our current photo step have location and device details removed. To delete photos uploaded with an older questionnaire, email info@breakoutlab.co.

3) How We Use Information

Depending on how you use the Services, we use personal information to:

• Provide, tailor and improve the Services: process payments, fulfill orders, arrange shipping, handle returns and exchanges, create and manage your account, remember your preferences, send account notifications, enable reviews, and recommend products related to your purchases.
• Run your test and plan: facilitate laboratory and physician workflows (including identity checks, suitability and safety screening, and delivering results), create and update your Clear Skin Blueprint, and provide skin specialist calls, group calls and progress check-ins.
• Market and advertise: send marketing by email, text message (if you opt in) or postal mail, and show you online ads, including based on items you bought or added to your cart and other activity on our store website, as described in "Advertising, Cookies and Pixels."
• Keep the Services secure: authenticate your account, provide a secure payment experience, run analytics and debugging, and detect, investigate or act on fraudulent, illegal, unsafe or malicious activity. You are responsible for keeping your account credentials safe; please do not share your password or other access details with anyone.
• Communicate with you: provide customer support and maintain our relationship with you.
• Meet legal duties: comply with law and valid legal process (including requests from law enforcement or government agencies), take part in legal proceedings, and enforce our terms and policies.

Our commitments for health information:

• We use your test results, questionnaire answers, photos, check-ins and messages to provide the service you asked for, keep it safe, improve our tests and plans, and meet our legal duties.
• We do not send your test results, questionnaire answers, photos, check-ins or messages to advertising platforms, and we do not use them to target ads or to build ad audiences.
• We share health information with partner physicians and practices, and share de-identified data, only as described in section 4 and in "De-identified Data."

Legal bases (where applicable): performance of a contract (to provide the Services), legitimate interests (to secure and improve them), consent (for certain cookies, marketing and health data uses), and legal obligations.

4) How We Share Information

Recipient	What	Why
The independent physician who orders your test, and the independent CLIA-certified laboratory that runs it (currently Celesta and its partner laboratory)	Your name, date of birth and sex, your kit ID and the tests ordered (no contact details), and your sample. The physician receives your results from the laboratory. For some earlier kits processed through SpotDx, the order also included the buyer's name and shipping address.	To order your test, run it and report results
Kit and order fulfilment (Supera for test kits, ShipStation for supplements, UPS and other carriers)	Name, address, phone, kit ID, order details	To ship kits and products and track returned samples
Payment providers (Stripe, including Link; Klarna; Cash App Pay; Amazon Pay; Flex for HSA and FSA payments; Shopify Payments and Recharge for store orders)	Payment and order details	To take payments, manage subscriptions and prevent fraud
Hosting, storage and error monitoring (Supabase, Vercel, Amazon Web Services, Sentry)	Account and health information, stored encrypted	To run the Services and fix problems
Email, text messaging and support (Klaviyo, SendGrid, Twilio, TxtCart, Gorgias)	Contact details, order and kit status, support messages	To send you account, order and (if you opt in) marketing messages, and to answer you
Scheduling, calls and forms (Calendly, Google Meet, Google Maps, Typeform for older questionnaires)	Name, email, booking details; the address you type; older questionnaire answers	To book and hold calls, complete your address, and keep older questionnaire answers
AI provider (currently Anthropic)	The information described in "AI Assistant (Klara)"	To power Klara
Sales platforms (Shopify, TikTok Shop)	Order and contact details for orders placed there	To sell and deliver products
Your skin specialist	The results, plan, questionnaire answers and photos needed to advise you	To advise you on your plan
Partner physicians and private practices	See "Partner physicians and practices" below	Business-to-business collaborations
Advertising and measurement partners (Meta, TikTok, Google, Triple Whale, Trybe and others)	Website activity and purchase information as described in "Advertising, Cookies and Pixels." Never your results, answers, photos, check-ins or messages.	To measure and improve our ads and credit creators

Our service providers act on our instructions under contracts that require them to protect your information. Some, such as payment providers, also use information for their own legal and fraud-prevention duties under their own privacy policies.

Partner physicians and practices

We collaborate with independent physicians and private practices. In these business-to-business collaborations, we may share your information, including identifiable health information such as your results, with a partner physician or practice, for example so they can offer you care or related services. Partners must protect your information and use it only for the purposes we agree with them.

• This applies to information we collect after this update. We will not share information you gave us before this update with partner physicians or practices, or include it in de-identified data we share or license, unless you agree first. We will ask you in your account.
• Where state law requires your consent before we share consumer health data with a partner physician or practice (for example Washington, Nevada and Connecticut), we will ask for it first and will not share it with them without it.
• We never share your photos with partners unless you give separate permission for that photo.
• We do not sell your identifiable health information for money or other valuable consideration.
• We do not share information about anyone under 18 this way.
• You can opt out of this sharing at any time by emailing info@breakoutlab.co. We will stop future sharing once we receive your request.

Other sharing

• Shopify: our store website runs on Shopify, as described in "Relationship with Shopify." We also use Shopify to support personalized advertising with third-party services based on your online activity with different merchants and websites. Our marketing partners use your information under their own privacy notices.
• Corporate transactions: in connection with a merger, acquisition, financing, bankruptcy or asset transfer, subject to this Policy's protections.
• Legal and safety: to comply with law, respond to lawful requests such as subpoenas and search warrants, enforce our terms, or protect rights, safety, and security.
• With your direction or consent: for example, when you ask us to send your results to your own doctor, or when you use a social media widget or login integration.

We have no affiliates.

Advertising, Cookies and Pixels

On our store website (trybreakoutlabs.com), we and our partners use cookies and pixels, including from Meta, TikTok, Google, Triple Whale, Trybe, Klaviyo and TxtCart, to measure our ads, understand how the site is used, and show you ads. These record the products you view, add to your cart and buy, which can show interest in a health product.

In our member app, advertising pixels from Meta, Google, Triple Whale and other tools only load only on our checkout and order-confirmation pages. They do not load on pages that show or collect your health information, such as your results, your plan, questionnaires, photos, check-ins, Klara, or your account pages. On the checkout pages, these pixels record checkout steps: a page view, starting checkout, entering contact and payment details, and the purchase.

Our error-monitoring provider (Sentry) runs across the app to help us find and fix bugs. It records about 10% of app sessions and sessions where an error happens, with text and images masked.

What the checkout pixels receive in your browser:

• Meta: a page view, plus starting checkout, adding payment details and the purchase, each with the order value, currency and a product identifier.
• Triple Whale: the same checkout steps, with the products in your cart, your email address once you enter it, your city, state and ZIP code once you enter your address, and your phone number with the purchase.
• Trybe: the purchase, with the order value and your email address.
• Google: starting checkout, with the order value and currency, and the purchase, with the order value, currency, an order reference and your email address. Google’s tag may also read the contact details you type into the checkout form, such as your email address, phone number, name and address. Google receives these in hashed (scrambled) form. We turn off Google’s ad personalization on these pages.

   

When your payment goes through, our servers also tell these partners about the purchase:

• Meta: that a purchase happened, its value and currency, your email address and phone number in hashed (scrambled) form, your IP address and browser details, Meta's own cookie identifiers, and for supplement orders a product identifier. Our servers also send Meta the checkout steps (starting checkout and adding payment details), with the order value, currency, product identifiers, Meta’s own cookie identifiers, your IP address and browser details.
• Triple Whale (our analytics and attribution tool): the order, including the product name, value and any discount, and your name, email address, phone number and shipping address, so we can match the order to the ad or visit that led to it.
• Trybe (creator attribution): if you arrived through a creator's link, the order value, the product name and your email address, so the creator gets credit.

Because a product name or product identifier describes what you bought (for example, an acne test kit), this information can show that you bought a health-related product.

For orders shipping to Washington, Nevada or Connecticut, and for orders where we know a person being tested is under 16, we do not send the purchase to Meta, Google, Triple Whale or others. Our servers send nothing about the purchase, and once you choose one of those states, the checkout pixels stop sending your address, payment and purchase steps. Before we know your shipping state, the checkout pixels still record what they record for everyone: the checkout page view (with the pixel’s cookie, your IP address, browser details and the page address); starting checkout (with the order value and product identifiers for Meta, the order value for Google, and the products in your cart for Triple Whale); and, for Triple Whale, your email address if you enter it before choosing your state.

We never send these partners your test results, questionnaire answers, photos, check-ins or messages.

Your choices: you can opt out of targeted advertising and of the "sale" or "sharing" of your information for advertising on our store website at Your Privacy Choices. On our store website, we treat a Global Privacy Control signal as an opt-out for that browser.

In our member app, if your browser sends a Global Privacy Control signal, we treat it as an opt-out: the advertising pixels do not load, and we do not send your purchase to Meta, Triple Whale or Trybe.

Other than the Global Privacy Control, we do not recognize "Do Not Track" signals. To learn more about Global Privacy Control, visit globalprivacycontrol.org.

De-identified Data

De-identified data is information that has been changed so that it cannot reasonably be used to identify you. We may share or license de-identified data, including for payment, with research partners, companies, physicians and practices, for example to study what drives acne.

• This applies to information we collect after this update. We will not share information you gave us before this update with partner physicians or practices, or include it in de-identified data we share or license, unless you agree first. We will ask you in your account.
• When we de-identify information, we take reasonable measures so it cannot be linked to you. We publicly commit to keep and use it only in de-identified form and not to try to re-identify it.
• Anyone who receives de-identified data from us must agree in writing not to try to re-identify it and not to pass it on except under the same restrictions.
• BreakoutLabs may sell or disclose de-identified patient information derived from patient information. When we do, we de-identify it using the HIPAA Safe Harbor method (45 CFR 164.514(b)(2)).
• Photos are never included.
• Information about anyone under 18 is never included.
• You can opt out of having your information included in de-identified data we share or license by emailing info@breakoutlab.co. We will leave your information out of data sets we create after we receive your request.

Sale of Personal Information

We do not sell your identifiable personal information or consumer health data for money or other valuable consideration. Some state laws define "sale" or "sharing" broadly enough to include advertising cookies and pixels like those described in "Advertising, Cookies and Pixels," even when no money changes hands. You can opt out of those as described in that section.

Photos and Biometric Information

BreakoutLabs does not collect biometric identifiers. We do not use face recognition, and we do not create face scans, face geometry, faceprints, voiceprints, or any template that could identify a person from photos. We use photos to show your progress over time, for our skin team to review your skin when you message them, and to personalize your plan. We do not sell photos, share them with advertisers, or let outside companies train AI models on them, and we never post them anywhere without your separate permission. Photos taken in our current photo step have location and device details removed, and you can delete them at any time from your account (Profile, then Photos). To delete photos uploaded with an older questionnaire, email info@breakoutlab.co. How long we keep photos is set out in "Retention" below. If this ever changes, we will update this policy and ask for your written consent first.

AI Assistant (Klara)

Klara is our AI assistant. Today, our care team uses Klara to look up orders and results and to help draft answers when you contact us. A version of Klara that members chat with directly is not available yet; before it is, we will show you its terms.

• What Klara sends to our AI provider: only what a question needs, such as the question you sent us, as our team enters it; notes our team has logged about your order; your name and email; your order and kit status; your sex and age range; and, for authorized staff, the status of your results markers (for example, in range or out of range), your plan, and relevant questionnaire answers (such as pregnancy, birth control, medicines and diagnosed conditions). Klara does not send your date of birth, phone number, street address, payment details or photos.
• Who processes it: our AI provider, currently Anthropic, processes this information for us under contract. Its commercial terms do not allow it to train its models on our data.
• Limits: Klara does not diagnose, prescribe or change your plan. Your plan comes from our rules and review, not from chat.
• Our records: we keep logs of Klara conversations to check quality and safety, and we aim to delete them after 12 months. A small number of authorized staff can see them. They are never used for advertising or sold. We may use Klara conversations, with names, contact details and other identifiers removed, to improve Klara.

Text Message (SMS/MMS) Program

Your privacy is extremely important to us. We will only use the information you provide through our text message program (the "Program") to send your messages and respond to you, if necessary. This includes sharing information with platform providers, phone companies (carriers), and other vendors who help us deliver messages.

Phone numbers and consent collected through our text message program are not shared with third parties or affiliates for their marketing or promotional purposes. WE DO NOT SELL, RENT, LOAN, TRADE, LEASE, OR OTHERWISE TRANSFER FOR PROFIT ANY PHONE NUMBERS OR CUSTOMER INFORMATION COLLECTED THROUGH THE PROGRAM TO ANY THIRD PARTY.

Nonetheless, we reserve the right at all times to disclose any information as necessary to satisfy any law, regulation, or governmental request, to avoid liability, or to protect our rights or property. When you complete forms online or otherwise provide us with information in connection with the Program, you agree to provide accurate, complete, and true information. You agree not to use a false or misleading name or a name that you are not authorized to use. If, in our sole discretion, we believe that any such information is untrue, inaccurate, or incomplete, or you have opted into the Program for an ulterior purpose, we may refuse you access to the Program and pursue any appropriate legal remedies.

California Civil Code Section 1798.83 and the General Data Protection Regulation 2016/679 (GDPR) allow users of the Program who are California or European Union residents to request certain information regarding our disclosure of the information you provide through the Program to third parties for their direct marketing purposes. To make a request, contact Breakoutlabs Inc., 650 NE 2nd Ave, Miami, FL 33132, info@breakoutlab.co. Your other privacy rights are described in "Your Rights and Choices."

Relationship with Shopify

Our store website is hosted by Shopify, which collects and processes personal information about your access to and use of the store in order to provide and improve it for you. Information you submit to the store will be transmitted to and shared with Shopify as well as third parties that may be located in countries other than where you reside. In addition, to help protect, grow, and improve our business, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our store, along with other merchants and with Shopify. To provide these enhanced features, Shopify may make use of personal information collected about your interactions with our store, along with other merchants, and with Shopify. In these circumstances, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights over use of your personal information for these purposes. To learn more about how Shopify uses your personal information and any rights you may have, you can visit the Shopify Consumer Privacy Policy. Depending on where you live, you may exercise certain rights with respect to your personal information through the Shopify Privacy Portal.

Third Party Websites and Links

The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

Children and Teens

• Teens aged 14 to 17 may have their own account, with a teen consent. A parent or legal guardian can also register and manage a test for their teen. When a parent or guardian registers a teen's test, they sign a parental consent and the teen's results are released to the parent's account.
• We do not test children under 14 or let them use the Services. If we learn that we have collected information from a child under 14, we will delete it.
• We do not use a minor's test results, questionnaire answers, photos or messages for marketing, advertising or research. We do not share a minor's information with partner physicians or practices, and we never include it in de-identified data we share or license, even if a parent agrees.
• A parent or guardian can ask to see, correct or delete their child's information by contacting us.

Security

We protect your information with safeguards modeled on HIPAA, including encryption in transit and at rest, role-based access so staff see only what their job needs, short-lived links for viewing photos, and logging and monitoring of our systems. No security measures are perfect or impenetrable, and we cannot guarantee "perfect security." Any information you send to us may not be secure while in transit, so we recommend that you do not use unsecure channels to communicate sensitive or confidential information to us.

If a breach affects your information, we will notify you, regulators and others as required by law, including the FTC Health Breach Notification Rule where it applies.

Retention

We keep information only as long as we need it for the purposes in this policy, to meet legal duties, resolve disputes and enforce our agreements. These are our retention periods:

Information	How long we keep it	Notes
Account and contact details	We aim to keep them for the life of your account plus 3 years, then delete or de-identify them	Accounts created without any order are deleted automatically after about 30 days without activity
Lab results and reports	We aim to keep them for the life of your account plus 7 years, or until you ask us to delete them	The laboratory and physician keep their own copies under their own legal duties
Questionnaire answers, plan, check-ins and care notes	We aim to keep them for the life of your account plus 7 years, or until you ask us to delete them
Minors' records	We aim to keep them until the child reaches the age of majority plus 7 years, or until the parent, guardian or teen account holder asks us to delete them
Photos	Until you delete them. If you ask us to delete your account, we aim to delete your photos within 30 days. We aim to delete photos 24 months after your membership ends if your account has no activity, and for Illinois residents no later than 3 years after your last interaction with us	You can delete photos from our current photo step at any time from your account
Klara conversation logs	We aim to delete them after 12 months
Consent records	We aim to keep them for the life of your account plus 6 years	Kept as proof of your choices
Payment records	We aim to keep them for 7 years	Tax and accounting
Email and text message consent records	We aim to keep them for 5 years after the last message we send you
Backups	We aim to remove deleted information from our backups within 90 days

Your Rights and Choices

Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. However, these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law.

• Right to Access / Know. You may have a right to request access to personal information that we hold about you, including the categories of information, sources, purposes and recipients.
• Right to a List of Recipients. You may have a right to get a list of the specific third parties we have shared your health information with.
• Right to Delete. You may have a right to request that we delete personal information we maintain about you. When we delete it, we also tell our service providers and any third parties we shared it with to delete it, and we aim to remove it from our backups within 90 days. The laboratory and physician may need to keep their own records by law.
• Right to Correct. You may have a right to request that we correct inaccurate personal information we maintain about you.
• Right of Portability. You may have a right to receive a copy of the personal information we hold about you and to request that we transfer it to a third party, in certain circumstances and with certain exceptions.
• Right to Withdraw Consent. Where we rely on your consent, you can withdraw it at any time. This does not affect what we did before you withdrew it.
• Right to Opt Out of Sale or Sharing for Targeted Advertising. Depending on where you reside, you may have a right to opt out of the "sale" or "sharing" of your personal information or of its use for "targeted advertising," as defined in applicable privacy laws. You can opt out on our store website at Your Privacy Choices, and by using Global Privacy Control as described in "Advertising, Cookies and Pixels." If we can associate the device sending a Global Privacy Control signal to a Shopify account, we will apply the opt-out to that account as well.
• Right to Limit Use of Sensitive Personal Information (California). You may ask us to limit our use of your sensitive personal information, including health information, to what is needed to provide the Services. This includes opting out of sharing with partner physicians and practices. Email info@breakoutlab.co.
• Opting Out of De-identified Data. You can ask us to leave your information out of de-identified data we share or license by emailing info@breakoutlab.co.
• Managing Communication Preferences. We may send you promotional emails and, if you opt in, text messages. You may opt out at any time by using the unsubscribe option in our emails or by replying STOP to our texts. If you opt out, we may still send you non-promotional messages, such as those about your account, your test or orders that you have made.

You may exercise these rights by emailing info@breakoutlab.co or writing to Breakoutlabs Inc., 650 NE 2nd Ave, Miami, FL 33132, unless a different method is given above. To learn more about how Shopify uses your personal information and any rights you may have, including rights related to data processed by Shopify, you can visit the Shopify Privacy Portal.

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before we can process your requests, as permitted or required under applicable law, for example by matching your account or order details. In accordance with applicable laws, you may designate an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us. Parents and guardians can make requests for a minor's record. We will respond within 45 days, and if we need more time where the law allows, we will tell you why and respond within another 45 days.

Complaints and Appeals

If you have complaints about how we process your personal information, please contact us using the contact details provided below. If we decline your request, you can appeal by replying to our decision or emailing info@breakoutlab.co with "Appeal" in the subject line. We will answer your appeal within 45 days. If we deny your appeal, you can contact your state Attorney General (for Washington residents, at www.atg.wa.gov/file-complaint). Depending on where you live, you may also have the right to lodge your complaint with your local data protection authority.

International Transfers

Please note that we may transfer, store and process your personal information outside the country you live in.

If we transfer your personal information out of the European Economic Area or the United Kingdom, we will rely on recognized transfer mechanisms like the European Commission's Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority of the UK, as relevant, unless the data transfer is to a country that has been determined to provide an adequate level of protection.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on this website, update the "Last updated" date and provide notice as required by applicable law. If we make a material change to how we use or share health information you already gave us, we will ask for your consent first, and we will not apply the change to your existing information without that consent.

Contact

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please email us at info@breakoutlab.co, call or text +1 (205) 291-1433 (Monday to Friday, 9am to 5pm ET), or write to Breakoutlabs Inc., 650 NE 2nd Ave, Miami, FL 33132.