Behavior Metabolic Sciences, LLC, a limited liability company organized under the laws of the State of Delaware, and licensed to provide the Invoy product and service (“Invoy”), (collectively “Metabolic”, “Invoy”, “us**”, “we”, “our” or the "Company”) respects your privacy and is committed to protecting the privacy of the users (“User(s)”, “you” or “your”) of our website located at invoy.com (the “Website”) and Invoy’s mobile and online platforms (the “Mobile App” and and “Web App”, collectively “Invoy Apps”). The Invoy Apps are provided in conjunction with the Invoy proprietary breath acetone analyzer system (the “Product”), along with the associated test capsules (“Pods”), and the services the Company offers through the use of our Product ("Ancillary Services”). The Web Services, the Product and the Ancillary Services shall be referred to hereunder as the “Services”.

‍

This Privacy Policy (the “Privacy Policy”) is intended to describe our practices regarding the information we may collect from you when you use the Services, the ways in which we may use such information, and the options and rights available to you. This Privacy Policy supplements and should be read in conjunction with our Terms of Services (the “Terms of Services”), which provides additional information on the Services.

We encourage you to read this Privacy Policy carefully and to review it periodically, as your use of our Services (or any part thereof) constitutes consent to this Privacy Policy, including the collection and processing of your Personal and Health Information (as defined below). We will periodically update this Privacy Policy, and any changes will be reflected here. If the changes are significant, we may provide a more prominent notice, and at our discretion, may contact you directly with information on the same. If you do not agree with the practices described in this Privacy Policy, you should not use our Services or otherwise interact with us or the Invoy Product or Invoy Apps.

If you have any questions about this Privacy Policy or how we use your Personal Information or other data, please feel free to contact us at support@invoy.com.

The Services are not intended for children under 18 years of age, and we do not knowingly collect personal information from children under 18. If we learn we have collected or received personal information from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 18, please contact us at support@invoy.com.

1. WHAT INFORMATION WE COLLECT

We may collect the following types of data and information from our Users:

1a) Personal Information

Personal Information is information by which you may be personally identified, such as name, postal address, email address, telephone number, credit card information, provider and health insurance information. Some technical parameters may also be considered as Personal Information, such as IP address and UDID (Unique Device Identifier).

1b) Health, Wellness and Nutrition Related Information (“Health Information”)

Health Information includes information that is not necessarily Personal in nature and corresponds to a measurement of your physical/mental and/or subjective state and nutrition data, such as gender, eating habits, height, weight, blood pressure, heart rate, body fat percentage, breath analytic data including the breath measurement and acetone score.

1c) Non-Personal Information

Non-personal information includes information which is non-identifying and without reference to the identity of any User such as the device you use to access our Services (such as the type of device, the time and date of your access, your browser type, and other information related to how your device interacts with our Services). This may include data collected via cookies and other tracking technologies that track your interaction with the Services (“web beacon”).

2. HOW WE COLLECT INFORMATION

We obtain personal information from you and any devices you use when you register for our Services, use our Services, upload or transmit data or results, provide information via the Mobile App, or communicate with Invoy, such as when you correspond with an analyst (coach) or customer support.

More specifically we collect personal information from the following categories of sources:

2a) Directly from you:

This category refers to any information, data, or content you actively and voluntarily create or provide through our Services such as:

- Contact information such as your name, email, physical address, or telephone number that you provide through the Services when you fill out an online form or register for an account with us or when you update your account details;

- Health information and any other information you provide us in the scope of your use of the Services, such as breath samples, daily diet, exercise routine, as well as ongoing feedback that you provide us or provided to us by your healthcare provider;

- Financial (such as credit card or bank account numbers) and transactional information you provide through the Services, which is processed by our third party services providers as further detailed below; and,

- Your interaction with our customer support, sales team, or your analyst, which likely includes text or audio recordings and corresponding transcripts of such communications (including information you enter in our “Contact Us” online or Mobile App form).

2b) Automatically from your activity on our Services:

This category refers to information we may gather, collect and record relating to usage of our Services by using “cookies” and other tracking technologies or from devices you use for the Website or Mobile App, information concerning your traffic to and from the Website. Please take into consideration that certain portions of such above mentioned information may also be collected from your device or software, when the Mobile App is running in the background, i.e. when it has been launched but not used. Please keep in mind that most mobile devices and auxiliary software, allow you to control or disable the use of certain collectible information including location services, by any application, in the device's settings menu.

When you use our Services, certain third parties may use automatic information collection technologies to collect information about you or your Device. These third parties may include (i) advertisers, ad networks, and ad servers; (ii) analytics companies; (your mobile device manufacturer; or (iv) your mobile service provider. These third parties may use tracking technologies to collect information about you when you use our Services. The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites, apps, and other online services websites. We do not control these third parties' tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly.

2c) Integrations permitted by you:

When using the Mobile App you may choose to connect the Mobile App with certain other third party accounts you hold with such third party applications and platforms (such as Apple Health, Google Fit, etc.), and we will have access to such data shared by those third party applications.

The information that you provide in each case will vary. In some cases, you may be able to provide Personal Information directly via email or text boxes in our Mobile App. When providing your Personal Information, please provide only relevant information and do not provide unnecessary sensitive information, such as Social Security numbers, credit card information or other sensitive data, unless required for our Services. If you provide any additional Personal Information beyond what we require, such as in your communications with us, doing so is entirely your choice and at your own risk. We may retain the Personal Information that you choose to provide in those instances.

We collect this information by using technologies such as:

Cookies: Cookies are small pieces of instruction stored on your hard drive or device. They may enhance your experience as you navigate our Services. A “session cookie” disappears after you close your web browser, or may expire after a fixed period of time. A “persistent cookie” remains after you close your web browser and may be accessed every time you use our Services. We may use both session and persistent cookies. You can configure your web browser to warn you each time a cookie is being sent or to refuse cookies completely. However, if you opt to refuse cookies created by our Website, you accept that your ability to use our Services may be impaired or limited, up to and including loss of access to certain Services, until such time as you accept these cookies.

Log Files: A log file is a text file that resides on our servers, and which records pertinent information about your interactions with our Services at the time of access. Log file data is used primarily for diagnostic and auditing purposes.

Local Storage Objects: A Local Storage Objects (“LSOs”) such as HTML5 store content information and preferences. Various browsers may offer their own management tools for removing HTML5 LSOs. However, our Services may not recognize or respond to “do not track” technologies employed by your browser.

Embedded Scripts: An embedded script is programming code (particularly JavaScript) that collects information about your interactions with our Website. The code is temporarily downloaded onto your device, from our server or a third-party service provider, and is deactivated or deleted when you disconnect from our Website. You can configure your web browser to disable the use of embedded scripts. However, if you opt to disable embedded scripts which we incorporate into our Website, you accept that your ability to use our Services may be impaired or limited, up to and including loss of access to certain Services, until such time as you enable these embedded scripts.

Web Beacons: We may also occasionally use “web beacons” (also known as “clear gifs,” “web bugs,” “1-pixel gifs,” etc.) that allow us to collect non-identifiable information about You. Web beacons are tiny images, placed on a web page or e-mail that can tell us if you have visited a particular area of our Website.

There may be other tracking technologies now and later devised and used by us in connection with our Services. Further, third parties may use tracking technologies with our Services. We do not control those tracking technologies, and we are not responsible for them. However, you consent to potentially encountering third party tracking technologies in connection with your use of our Services and accept that this Privacy Policy does not apply to the tracking technologies or practices of such third parties. In such cases, you must check the third party websites to confirm how your information is collected and used.

Our Services also use Amplitude and Firebase (or other such software systems) to help us collect, process and analyze data. We may use other third-party tracking technologies as needed for us to monitor or improve our Services.

3. HOW WE USE THE INFORMATION

We use the Personal Information and other data that you provide primarily as necessary to provide our Services, including, but not limited to:

3a) To Provide our Services

We process personal data when you use our Services, such as to provide you with personalized insights about your fat metabolism, sleep, activity, and other inferences about your health status.

3b) To Provide Customer Service

We process personal data to provide customer service and manage our customer communication. For example, if you contact our customer support with questions regarding your account, we may use the provided information to answer your questions, and for solving any issues you may have. We may use the information you provide to send you notices that contain information about events, content, materials and services that may be of interest to you.

3c) To Protect Your Privacy

We may process personal data regarding your use of the Services to protect your privacy. This may involve the use of privacy enhancing technologies and other privacy-protective techniques. When information is aggregated or anonymized, it is no longer personal data.

3d) To Improve Our Services

We process personal data regarding your use of our Services to understand how you use our Services and how we can improve them. For example, we may process personal data to improve your user experience in the Mobile App or to develop cutting-edge features to provide you with new insights about your health. When feasible, we do this using data that has been processed in a manner to protect your privacy, such as by pseudonymization.

3e) To Perform Analysis

We may process personal data about human performance and wellbeing to benefit our users and improve the cutting-edge insights we provide with our Services. Some features of our Services may use third-party automated technology to provide a more personalized experience, and to give you comprehensive insights about your data. For example, our Services include intelligent features that may use the responses you provide to better personalize the Services. When feasible, we do this using data that has been processed in a manner to protect your privacy.

3f) To Market Services

We process marketing-related personal data to provide online advertising and other marketing communications on behalf of Invoy and our partners. For example, as explained more fully in our Cookie Policy, we use cookies and similar technologies on our Website to create audiences for online advertisement. You can opt out of direct marketing communications from Invoy.

3g) To Enable Third-party Integrations and Services

We process personal data you provide to Invoy to enable third party integrations, services, features, and offerings. For example, with your permission, our Services may integrate with third-party services like Google Health Connect and Apple HealthKit, or those of our partners. Invoy takes measures to help ensure third-party services protect your personal data, which means that Invoy only processes your data with respect to third-party integrations when you choose to integrate them with our Services, or when you provide the necessary consents. We process the data we receive from these third-parties according to applicable terms, such as the Google Health Connect Permissions policy and Google Limited Use requirements, as well as relevant third-party developer license agreements, as we become aware of those policies and agreements.

3h) To Comply with Legal Obligations‍

In certain cases, we must process certain data when it is required by applicable laws and regulations. Such statutory obligations are related, for example, to accounting and tax requirements, legal claims, or other legal purposes. We intend to oppose requests to provide legal authorities with access to user data for surveillance or prosecution purposes. We will notify users if we receive any such request whenever legally permissible.

4. HOW WE SHARE INFORMATION WITH THIRD PARTIES

We will not share or otherwise allow access to any Personal or Health Information it collects to any third party, except in the following cases:

4a) Your known health care providers, care management services, employer or healthcare payers**. To the extent your relationship with us originates from one of them, we may provide your Personal and Health Information to that party for its use in connection to the services it provides to you.

4b) Third Party Services. We may disclose your information if we need to so a third-party vendor can help us provide our Services. Whenever we share data with third-party service providers, we require that they use your information only for the purposes we have authorized, and for the limited reasons explained in this Policy. We also require these service providers to protect your personal information to at least the same standards that we do.

4c) Law enforcement, legal proceedings, and as authorized by law. We may disclose Personal Information to satisfy any applicable law, regulation, legal process, subpoena or governmental request.

4d) Protect the rights, property, or personal safety of our Services, its users, or the public. We may share Personal Information to enforce this Privacy Policy and/or the Terms of Service, including investigation of potential violations thereof; to detect, prevent, or otherwise address fraud, security or technical issues; to respond to claims that any content available on the Services or the Website violates the rights of third-parties; or otherwise if we believe in good faith that this will help protect the rights, property or personal safety of Invoy, any of our users, or any member of the general public.

5. YOUR RIGHTS, CHOICES AND ACCURACY OF YOUR PERSONAL INFORMATION

We strive to provide you with choices regarding the personal information you provide to us. You always have the choice whether or not to provide Personal Information to us. As indicated above, some of our Services require that you register an account but doing so is at your discretion. If you choose not to provide required Personal Information, you can still use any portion of our Services that do not require Personal Information. If the law applicable to you grants you such rights, you may ask to access, correct, or delete your Personal Information that is stored in our systems or that we otherwise control. You may also ask for our confirmation as to whether we process your Personal Information or ask to withdraw any consent you have previously provided us in connection with our use and processing of your Personal Information. Exercising such rights of deletion and/or withdrawing such consent may result in our inability to provide you with our Services and in such event, we may notify you of the termination of our engagement with you or otherwise cease providing you with our Services.

If you do not want us to use your email address to promote our own or third party services, you can opt-out by clicking “unsubscribe” from an email sent to you or by contacting us at support@invoy.com. However, understand that if you opt out of email communications, that will not include opting out of communications for certain operational purposes (for example payment confirmation, account creation, shipment alerts and internal support), we will still continue to communicate with you via email for these purposes.

If you are a resident of California you may have other choices and rights with respect to your Personal Information. Please see our California Privacy section below for more details.

6. HOW WE PROTECT YOUR INFORMATION

Our security measures are designed to protect your information from loss, unauthorized access, disclosure, alteration, or destruction. Our Services have commercially standard physical, electronic, and managerial procedures, such as Secure Sockets Layer (SSL) software, which encrypts information you provide to us through our Services. This protects Your information and helps prevent unauthorized access. Although we take these measures to protect against unauthorized disclosure of Your information, we cannot guarantee you that your Information will never be disclosed in a manner that is inconsistent with this Privacy Policy.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. Unfortunately, the transmission of information via the internet and mobile platforms is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted through our Services. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures we provide.

7. THIRD PARTY LINKS

Our Services may provide links to websites of other organizations or companies that may offer materials and services as well as links to other sites. In using our Services or the linked sites of other organizations or companies, you may have the option to sign up for email lists operated by these organizations or companies. If you choose to request that your address is removed from the such an organization’s or company’s lists, we cannot control whether or not they will immediately stop using your address. To stop receiving communications from these organizations or companies, you should contact them directly.

8. CALIFORNIA PRIVACY

California residents have additional rights regarding the privacy and disclosure of Personal Information, including, but not limited to a right to request that we not sell their Personal Information. We do not sell your Personal Information, and we use and disclose Personal Information solely in accordance with this Policy.

California residents are also specifically entitled to exercise the following rights with respect to Personal Information:

- Right to Know. You have the right to request what Personal Information we collect, use, disclose, and/or sell, as applicable.‍

- Right to Delete. You have the right to request that we delete the Personal Information that we have collected about you. (To be clear, we can delete the data that we store – not data stored by third parties. You will need to reach out to those third parties (listed above) for assistance removing your records from their services.)

- ‍Right to Opt-out of the Sale of Personal Information. You have the right to request to be opted-out from the sale of your Personal Information; however, as set forth above, we do not sell Personal Information.‍

- Right to Non-Discrimination. You have the right not to receive discriminatory treatment by us for the exercise of the privacy rights described above.

You may also authorize someone to exercise the above rights on your behalf. If you have provided us information on your minor child, you may exercise the above rights on behalf of your minor child.

The above rights are subject to our being able to reasonably verify your identity (or the identity of someone exercising these rights on your behalf) and authority to make these requests by providing verifiable information such as the following:

- Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information, or an authorized representative of such person.

- Describe your request with sufficient detail that allows us to sufficiently evaluate and respond to it. We cannot respond to your request if we cannot verify your identity or authority to make the request and confirm the Personal Information requested relates to you.

To exercise your rights, submit your request to us via email at support@inovy.com.

We will respond to authorized and verified requests as soon as practicable and as required by law. In addition, the above rights are subject to various exclusions and exceptions under the law, and under certain circumstances, we may be unable to implement your request. We will advise you of any reason for denying or restricting a request.

9. CALIFORNIA SHINE THE LIGHT LAW

California Civil Code Section 1798.83, known as the “Shine the Light” law, permits individuals who are California residents to request and obtain from us a list of what personal information (if any) we disclosed to third parties for direct marketing purposes in the preceding calendar year and the names and addresses of those third parties. We will never disclose Your personally identifiable information to third parties for direct marketing purposes without Your authorization.

10. CHILDREN’S PRIVACY

You must be 18 years of age or older in order to establish an account on and use the Services. We are concerned about the safety and privacy of children online. Because of this, we will make all efforts to comply with the Children’s Online Privacy Protection Act of 1998 (“COPPA”). COPPA and its accompanying FTC regulations establish United States federal law that protects the privacy of children using the internet. Further, our Services are neither intended for nor designed to attract Users under the age of 18. It is possible that by fraud or deception by others we may receive information given to us or pertaining to minors, including children under 13. If we are notified of this, as soon as we verify the information, we will immediately obtain parental consent or else delete the information from our servers. If you want to notify us of our receipt of information by minors, including children under 13, please email support@invoy.com.

11. OTHER STATES’ PRIVACY

Other states are now joining California in adopting their own privacy laws. If you reside in a state with such a law which is applicable to Invoy and would like to invoke any right you have under such law, please submit your request to us via email at support@invoy.com.

12. CHANGES TO THE PRIVACY POLICY

We may revise or enhance this Privacy Policy from time to time. We will post a current version of our Privacy Policy on our Services with the date the Privacy Policy became effective. If any modification is unacceptable to you, you should quit using our Services. If you do not quit using our Services, you will be conclusively deemed to have accepted the changes.

13. QUESTIONS OR COMMENTS

Our Services are committed to protecting your privacy and to protecting your information. If you have any questions, comments or complaints regarding these issues or how we process that information, or any other security-related issues regarding our Services, we urge you to contact us. Email us at support@invoy.com.

‍