Consumer Health Data Privacy Policy

Effective date: August 2, 2026.

This policy applies to consumer health data as defined by the Washington My Health My Data Act and the Nevada Consumer Health Data Privacy Law. It applies to residents of Washington and Nevada and to consumer health data collected in those states. brasa, 3550 Altis Cir N, Hialeah, FL 33018, is the entity responsible for that data.

Categories of consumer health data we collect, and why

• Purchase and subscription records for an iron supplement, including the product, quantity, and refill schedule. We collect these to process and deliver your order, to manage a refill you selected, and to provide customer support. A purchase of an iron supplement may indicate an interest in a bodily function, so we treat these records as consumer health data.
• Information you volunteer in a message, a claim, or a review, such as a description of symptoms, how you have been feeling, or why you are taking iron. We collect this only because you chose to send it, and we use it to answer you, to evaluate a guarantee or product claim, or to publish a review you asked us to publish.
• Guarantee claim records, including your statement of daily use, the dates of use, and photographs of product tins and lot codes. We collect these to verify a guarantee claim under our published refund policy.

We do not collect precise location data, biometric data, genetic data, laboratory results, diagnoses, prescription records, or information about healthcare services you obtained.

Categories of sources

• Directly from you, when you place an order, choose a subscription, contact us, submit a claim, or write a review.
• From our commerce platform, subscription application, and review application, which record those same actions on our behalf.

Categories of consumer health data we share

• Order contents and delivery details, shared to fulfill and deliver your order.
• Subscription records, shared to operate a refill you selected.
• Review content you chose to publish, shared to publish it.

We do not sell consumer health data. We do not share consumer health data for advertising, and we do not use it to build or target advertising audiences.

Categories of third parties with whom we share consumer health data

• Our commerce and checkout platform, Shopify Inc.
• Our supplement fulfillment partner and our accessory fulfillment partner.
• Shipping carriers.
• Our subscription management application.
• Our product review application.
• Our email and customer support providers.
• Professional advisors, and government bodies or courts where a law or valid legal process requires disclosure.

We have no affiliates with whom we share consumer health data.

Your rights

You have the right to confirm whether we are collecting, sharing, or selling your consumer health data and to access that data, including a list of the third parties with whom we have shared it. You have the right to withdraw consent to our collection and sharing of it. You have the right to have your consumer health data deleted.

To exercise any of these rights, email support@hellobrasa.com from the email address associated with your order, with "Consumer health data request" in the subject line, or submit the same request through the contact page on this store. We verify a request by matching it to information already in our records.

We respond within 45 days of receiving a request. We may extend that period once by an additional 45 days where reasonably necessary, and we will tell you the reason before the first period ends. Deletion requests are passed to our processors and affiliates, and we will notify them to delete the data as required.

If we deny a request, our response will explain why and how to appeal. To appeal, reply to that response with the word "appeal." We will decide the appeal within 45 days and give you a written explanation. If we deny the appeal, you may submit a complaint to the Washington State Attorney General at www.atg.wa.gov/file-complaint or to the Nevada Attorney General.

Changes

If we materially change this policy, we will post the updated policy here before the change takes effect and will not apply it to previously collected consumer health data without your consent.