Privacy Policy

Reputable Labs Inc. (doing business as Reputable Health) | Effective date: January 1, 2026 | Last updated: Oct 22, 2026

1. About this policy

1.1 This Privacy Policy explains how Reputable Labs Inc., doing business as Reputable Health ("Reputable", "we", "us"), collects, uses, discloses and protects personal information when you use our websites (reputable.health, its subdomains, and any other website, study page or landing page we operate that links to this policy), participant app, dashboard, research community, messaging, kits and devices (the "Platform"), take part in a research study (a "Study"), or interact with us as a business contact.

1.2 Summary of our core commitments:

• We do not sell identifiable health information, and we do not use health information for targeted advertising. The only exception is a photo, quote or recording you personally choose to release to a named Sponsor by signing a Photo and Likeness Release.
• We do not use advertising pixels or website visitor identification on any page that names a health condition, Study or screening question, and we do not send health information from the participant app to advertising companies.
• Sharing your data with a Study Sponsor happens under the Study's Consent Form, and Sponsors normally receive coded data that does not directly identify you.
• We do not currently license or sell de-identified data. If we ever propose to, we will ask for your separate, optional consent first.
• Photos, name or likeness are used for marketing only with a separate, signed release.

1.3 Studies and participant accounts are open to residents of the United States and, for Studies that say so, Canada other than Quebec. We do not currently accept participants from Quebec, the European Economic Area, the United Kingdom or other countries. We previously enrolled some participants from the United Kingdom and the European Union, until July 2026, and this policy continues to protect their information. Our business customers, business contacts and website visitors may be anywhere. Where you live determines some of your rights. Additional information for particular places is in the Regional Supplements at the end of this policy (United States; California; European Economic Area, United Kingdom and Switzerland; Canada and Quebec).

1.4 Service Providers and Domains page. The specific companies we use to run the Platform and Studies, and the domains we operate (including study sites and the domains we send business email from), change over time as Studies start and end. We list them on our Service Providers and Domains page, which forms part of this policy and shows the date it was last updated. We add new providers to that page before they receive your personal information. This policy describes the categories of information each kind of provider receives.

2. Studies and Consent Forms

Each Study has its own informed consent form approved by an institutional review board or ethics committee (a "Consent Form"), and is conducted in accordance with ICH Good Clinical Practice and applicable human-subject protection regulations. The Consent Form describes the specific data collected for that Study, who receives it, how long it is kept and your withdrawal options. For information collected in a Study, the Consent Form takes priority if it differs from this policy. This policy applies to everything else, and fills any gap the Consent Form does not address.

3. Our role

3.1 Reputable is the controller (the organisation that decides how and why information is used) of information collected through the Platform for your account, our research community, screening, communications, de-identified data and our own business purposes.

3.2 For Study data, Reputable conducts the Study on behalf of a company that funds it (a "Sponsor"). Depending on the Study, Reputable and the Sponsor may each be independent controllers of the Study data they hold, or Reputable may act on the Sponsor's behalf. The Consent Form will tell you who the Sponsor is (where required) and who is responsible for your Study data.

3.3 If you are a business contact (for example an employee of a brand, ingredient manufacturer or partner), Reputable is the controller of your business contact information.

3.4 Reputable is generally not a "covered entity" or "business associate" under the US Health Insurance Portability and Accountability Act (HIPAA). If we receive protected health information from a covered entity, we handle it under a business associate agreement and HIPAA applies to that information.

4. Information we collect

4.1 Information you give us

• Account and contact: name, email, phone number, postal address (for kit and product shipping), date of birth, time zone, login credentials, preferences. If you sign in with Google or Apple, we receive your name, email address and an account identifier from that service; we do not receive your Google or Apple password.
• Identity verification: your government-issued photo ID and a selfie, which our verification provider holds for us, and the details we receive from it: your name, date of birth and gender as shown on the ID, and the verification result. We do not keep the ID number. See 4.4 and Supplement A.7.
• Screening and eligibility: answers to screening questionnaires, including health history, conditions, medications, supplements, pregnancy status, lifestyle, height and weight.
• Demographics: age, sex, gender, and, where you choose to provide it or a Study requires it, race and ethnicity.
• Study data: survey and questionnaire responses, diaries, participant-reported outcomes, cognitive assessments, product-use and adherence information, side effects and adverse events.
• Biological samples and results: blood, saliva, urine or other samples you collect, and the lab results derived from them, including biomarker panels and, in some Studies, epigenetic, methylation or other molecular measurements.
• Photos, video and audio: where a Study requires them (for example skin photos for skin studies, or video or audio responses to a survey), and any content you send to support.
• Orders: if a Study sends you products, your shipping address and order details.
• Compensation and tax: we pay Study compensation as Amazon gift card codes issued through Amazon's incentives service and delivered to you. We do not collect bank account or card details. You redeem codes directly with Amazon, and Amazon's own terms and privacy notice apply to that. Where tax law requires us to report compensation, we may ask for your tax identification information.
• Communications: messages with our team, feedback, reviews and testimonials.

4.2 Information from connected devices, apps, labs and assessments

With your authorisation, we receive data from wearables, health platforms and devices you connect (for example Oura, WHOOP, Apple Health, Garmin, Fitbit, Google Health Connect or smart scales such as Renpho), such as sleep duration and stages, heart rate and heart rate variability, respiratory rate, blood oxygen, skin temperature, activity, steps, strain and readiness scores, and, if you choose to share it, weight, body composition, blood pressure or glucose. The connection screen shows exactly which categories are requested. Most device connections and lab orders are handled through our health data integration provider, which passes the data to us.

Depending on the Study, we also receive results from laboratories and assessment providers, for example blood panels, epigenetic or biological-age tests, cognitive assessments, and body composition scans such as DEXA. The Consent Form for each Study names the tests involved.

Data from Apple HealthKit and Google Health Connect is used only as those platforms permit: to run the Platform and Studies you join. It is never used for advertising, and it will never be included in any de-identified data we might license in future. Data from device makers whose terms restrict commercial use is treated the same way.

4.3 Information collected automatically

• App and dashboard: device type, operating system, app version, crash logs and performance data, and how you use the app, collected by our monitoring provider to keep the Platform working and fix problems. This includes session replay, which records the screens you see and your taps so we can diagnose errors; we configure it to mask all text you type and all text shown on screen, and it is used only on our behalf. We also send push notifications through our notification provider.
• App install measurement: our mobile measurement provider, acting only on our behalf, counts app installs and first opens and tells us, in aggregate, which advertising campaigns they came from. We do not send individual install or usage events about you to advertising platforms, and we never send them health information, screening answers, Study names or in-app activity. If you allow tracking on your device (on iOS, through Apple's tracking permission), the provider may use your device's advertising identifier to make that aggregate measurement more accurate; you can refuse or withdraw this at any time in your device settings.
• Websites: IP address, browser, pages viewed, referring pages and cookie identifiers, collected by our web analytics provider (Google Analytics) to understand how our sites are used, with its advertising, signals and data-sharing features turned off for all our sites and IP addresses truncated. On pages that name a health condition, Study or screening question, analytics run only after you accept them in our cookie banner. We also measure visits that come from AI assistants and search tools. Advertising cookies and pixels run only on general pages, only with your consent where required. See our Cookie Policy.
• Business visitor identification: on pages of our main website aimed at business customers that do not name a health condition, Study or product category under study (for example pages about our research services), we use a website visitor identification tool provided by Instantly. It uses a cookie and pixel to recognise the company and, in some cases, the business email address or professional profile of a visitor, so our business development team can follow up with organisations that may be interested in our research services. We never use it in the participant app or on participant, recruitment, Study or health-topic pages, and we do not use it to identify or contact participants. It runs only after you accept it in our cookie banner, wherever you are, and you can withdraw that at any time through Cookie Settings, the "Your Privacy Choices" link or Global Privacy Control. It is a business development tool only: we never load participant information into it, and the provider is bound as our processor. Any follow-up email or call complies with applicable anti-spam and telemarketing laws.
• Location: approximate location derived from IP address (city or region) for time zone, eligibility and fraud prevention. We do not collect precise geolocation unless a Study specifically requires it and you consent in the Consent Form, and we do not use geofencing around healthcare facilities.

4.4 Information from other sources

• Identity verification. Our identity-verification provider compares the selfie you take with the photo on your government-issued ID, and checks the ID, to confirm who you are and prevent duplicate or fraudulent enrolments. It shows you its own consent screen before you begin. See Supplement A.7.
• Laboratories, assessment providers and kit logistics partners: results and shipment status.
• Skin analysis. In skin studies, your Study photos may be analysed by an AI skin-analysis provider that measures features such as wrinkles, spots, texture and redness. See Supplement A.7.
• Advertising platforms. If you respond to one of our ads on a platform such as Meta using the platform's own sign-up form, the platform passes us the contact information you enter (your name, email and phone number). These forms do not ask health questions; screening happens in our own app after you sign up. The platform's own privacy policy governs what it collects when you use it.
• Sponsors (for example product lot or randomisation codes), referral partners, and, for business contacts, publicly available professional information, business data providers and our website visitor identification tool (see 4.3).

4.5 Sensitive information

Much of the information above is sensitive, including health data, biological sample results, genetic or epigenetic data, and, in some Studies, photos. We collect sensitive information only with your consent or as otherwise permitted by law, and use it only for the purposes described in this policy or the Consent Form. Apart from the identity verification and skin analysis described in 4.4 and Supplement A.7, we do not create face templates or other biometric identifiers from photos unless a Consent Form expressly says so and you give any separate biometric consent the law requires.

5. How we use information

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing. Automated tools may help assess Study eligibility or flag data-quality issues, but a member of our team reviews any decision to exclude you from a Study where you ask us to.

6. How we disclose information

6.1 Sponsors. Sponsors receive Study data as described in the Consent Form. We replace direct identifiers (name, contact details) with a study code before sending data to Sponsors, unless the Consent Form explains that identifiable information will be shared or you sign a Photo and Likeness Release. Photos may show your face even when labelled with a code. Sponsor monitors and auditors may also review Study records, including identifiable records, to verify that the Study was conducted properly, as the Consent Form explains. Sponsors are contractually prohibited from attempting to identify participants from coded data. We do not share screening answers with Sponsors before you sign a Study's Consent Form.

6.2 Research partners and service providers. We use service providers that process personal information on our behalf and under written contracts that restrict their use of it. Some companies we work with, such as Apple, Google, Meta, Amazon and the makers of devices you connect, act under their own privacy policies when you use their services directly. They fall into these categories (the current companies are listed on our Service Providers and Domains page):

6.3 Ethics committees, regulators and monitors. Institutional review boards, ethics committees, auditors and study monitors, and government regulators may review Study records as required by law or the Consent Form.

6.4 De-identified data. We do not currently license or sell de-identified data to third parties. We may share aggregated statistics that do not identify you, for example in publications or with Sponsors as Study results. If we ever propose to license de-identified data, we will first ask for your separate, optional consent, and any recipient will be contractually prohibited from attempting to re-identify anyone.

6.5 With your direction or consent. For example, when you connect a third-party service, sign a Photo and Likeness Release, or ask us to share your results with your doctor.

6.6 Legal and safety. Where required by law, legal process or regulators; to protect the rights, safety or property of participants, Reputable or others; or in an emergency.

6.7 Business transfers. In a merger, acquisition, financing or sale of assets, information may be transferred to the successor, which must honour this policy and the consents you gave, or give you notice and choice before any material change.

6.8 No sale of personal health information. We do not sell identifiable health information or exchange it for anything of value, and we do not share it for cross-context behavioural or targeted advertising. The only exception is a photo, quote or recording you choose to release to a named Sponsor by signing a Photo and Likeness Release, which acts as your written authorization. On general pages of our public websites only (never pages naming a health condition, Study or screening question), some advertising cookies may be used with your consent where required; this may be a "sale" or "sharing" of website browsing data under some US state laws, and you can opt out as described in the Regional Supplement for the United States.

7. De-identified and aggregated data

7.1 Methods. We de-identify data by removing direct identifiers (such as name, contact details, account IDs and exact dates of birth); coarsening dates, ages, locations and time series (for example to daily summaries); and suppressing rare values. We use de-identified and aggregated data to improve the Platform, design and support research, and publish aggregate findings.

7.2 Public commitment. Reputable will maintain and use de-identified data only in de-identified form, will not attempt to re-identify it (except to test our own de-identification methods, where the law permits), and will contractually require any recipient to make the same commitment, to meet the de-identification requirements of applicable US state laws, and to impose them on anyone it passes the data to.

7.3 No licensing today. We do not currently license or sell de-identified data. Any future program would require your separate, optional consent, and residents of jurisdictions that restrict such uses (including Maryland and New Jersey) would be limited to aggregated statistics.

7.4 What de-identification means in law. Because Reputable keeps the information that could link data back to you, data we de-identify may still be personal data in our hands under European law, and we continue to protect it as such. The protections in this Section apply in addition.

7.5 Aggregated statistics (for example average sleep change across a Study group) may be published or shared where they do not identify you, never describe fewer than 5 people, and are derived from data we are permitted to use for that purpose.

8. Artificial intelligence

8.1 We use automated and AI tools to operate the Platform, including large language models provided by Anthropic, for example to generate general wellness summaries of your own data, detect data-quality issues, support customer service or help our team analyse Study data. AI-generated content is labelled where we present it to you and is not medical advice.

8.2 Training. We do not use your personal information, including health information, to train AI models, including large language models. We may use de-identified or aggregated data to improve our own analytical tools (for example eligibility matching and data-quality checks); we do not license models trained on participant data to others. Our service providers are contractually prohibited from using your personal information to train their own models.

9. Retention

10. Security

We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit and at rest, separation of identity data from health data, role-based access controls, multi-factor authentication for staff, vendor security review and staff confidentiality obligations. No system is completely secure. If a breach of security affects your personal information, we will notify you and the relevant authorities as required by law, including within the time limits of the US Federal Trade Commission's Health Breach Notification Rule where it applies.

11. International transfers

Reputable is based in the United States. If you live elsewhere, we collect your information directly from you and process it in the United States; our service providers may also process it in the United States, Canada and other countries whose laws may differ from those where you live. Where the law requires, we protect onward transfers (for example from our EU or UK suppliers to us, or from us to service providers) using approved mechanisms such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, and we carry out transfer assessments, including the privacy impact assessment Quebec law requires before communicating information outside Quebec. Contact us for a copy of the relevant safeguards.

12. Your choices and rights

12.1Everyone. Regardless of where you live, you can: access and download your Platform data; correct your profile; disconnect wearables; manage communication preferences; withdraw optional consents (marketing, Photo and Likeness Release) at any time; and close your account. Withdrawing a consent does not affect processing that already took place, and data that has already been de-identified or aggregated cannot be retrieved.

12.2Study data. You may withdraw from a Study at any time as described in the Consent Form. After withdrawal we stop collecting new data. Data already collected may need to be retained and used to protect the integrity of the Study and meet legal and safety obligations, as the Consent Form explains.

12.3Legal rights. Depending on where you live, you may have additional rights, described in the Regional Supplements. To exercise any right, use the privacy settings in your account or email legal@reputable.health with "Privacy Request" in the subject line. We will verify your identity before acting on a request and respond within the time required by law. You may use an authorised agent where the law allows. We will not discriminate against you for exercising your rights.

12.4Global Privacy Control. Our websites recognise the Global Privacy Control browser signal as a valid request to opt out of the sale or sharing of website data and of targeted advertising, for the browser sending it and, if you are logged in or we otherwise know who you are, for your account. Your Cookie Settings panel will confirm that your opt-out has been applied.

13. Children

The Platform is not directed to, and Studies do not enrol, anyone under 18 (or the age of majority where they live). We do not knowingly collect personal information from children. If we learn we have, we will delete it. If you believe a child has provided information, contact us.

14. Changes

We will post updates on this page and change the "Last updated" date. If a change materially affects how we use personal information already collected, we will notify you in advance and, where the law requires, ask for your consent.

15. Contact us

Reputable Labs Inc., attention Privacy, 251 Little Falls Drive, Wilmington, DE 19808, USA. Email: legal@reputable.health.

• Data protection lead and all privacy requests: Kyle Bergquist, legal@reputable.health

Regional Supplements

Supplement A: United States (state privacy laws)

A.1 Scope. This Supplement applies to residents of US states with comprehensive privacy laws, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, and any other state whose law applies to us. Some information collected and used as part of a Study may be exempt from these laws because it is governed by federal human-subject research rules; where that is so, your rights are described in the Consent Form.

A.2 Your rights. Depending on your state, you may have the right to: confirm whether we process your personal data and access it, including inferences we have drawn; obtain a portable copy; correct inaccuracies; delete it; obtain a list of the specific third parties to which we have disclosed personal data (in states that provide this right, including the name of the Sponsor of any Study you joined); opt out of the sale of personal data, targeted advertising, and profiling in furtherance of decisions producing legal or similarly significant effects; and withdraw consent for processing sensitive data. Some states give you the right to know whether your personal data is used to train large language models: we do not use personal data to train large language models (see Section 8).

A.3 Sensitive data. We process sensitive data (including health data, genetic or epigenetic data, and data concerning a known child, which we do not knowingly collect) only with your consent, or where strictly necessary to provide the service or Study you requested, as required in states such as Maryland. We do not sell sensitive data in any state, other than photos, quotes or recordings you choose to release to a named Sponsor under a signed Photo and Likeness Release, which is not offered to residents of Maryland or New Jersey. For Maryland residents, we also do not use health data to invite you to other Studies, because Maryland law limits sensitive data to what is strictly necessary for the service you asked for.

A.4 Appeals. If we decline your request, you may appeal by replying to our decision or emailing legal@reputable.health with "Appeal" in the subject line. We will respond within the time required by law (generally 45 or 60 days). If you are not satisfied, you may contact your state Attorney General.

A.5 Nevada. We do not sell covered information as defined in Nevada law. Nevada residents may submit an opt-out request to legal@reputable.health. Nevada consumer health data is addressed in our Consumer Health Data Privacy Policy.

A.6 Genetic and epigenetic data. Where a Study collects genetic, epigenetic or molecular data that is "genetic data" under a state law (such as those in California, Montana, Tennessee, Texas, Utah or Virginia), we obtain the separate express consents that law requires, including before any transfer to third parties and before any use beyond the Study, and you may request that your sample be destroyed. We do not transfer genomic data to foreign adversaries or countries of concern.

A.7 Biometric information. Two services we use create biometric information on our behalf:

• Identity verification. Our identity-verification provider compares a selfie with the photo on your government-issued ID, which creates facial geometry. It shows you a consent screen before you begin; selecting "Begin verifying" is your consent. It holds this information on our behalf, and Reputable does not receive or store it.
• Skin analysis. In skin studies, the AI skin-analysis provider maps features of your face in your Study photos. The Study Consent Form asks for your separate written consent before any photos are analysed this way.

Laws such as the Illinois Biometric Information Privacy Act, Texas law and Washington's biometric identifier law treat this as biometric information. It is used only for the purposes above, is never sold or used for any other purpose, and is destroyed as set out in our Biometric Data Retention and Destruction Policy page. You may ask for an alternative way to verify your identity. We do not otherwise collect biometric identifiers unless a Consent Form expressly says so and you give a separate written release.

Supplement B: California notice at collection and privacy notice

B.1 This Supplement is provided under the California Consumer Privacy Act as amended ("CCPA"). Some Study data is exempt from the CCPA as information collected under the federal Common Rule or Good Clinical Practice guidelines; the CCPA still applies to other information we hold about you.

B.2 Categories collected in the last 12 months, sources, purposes and disclosures.

Sources and purposes are described in Sections 4 and 5. Retention periods are in Section 9.

B.3 Sensitive personal information. We use sensitive personal information to provide the services you request, including matching you to Studies. You may nonetheless use the "Limit the Use of My Sensitive Personal Information" link on our website or in your settings to limit our use of it to the purposes the CCPA regulations always permit. Limiting may mean we cannot match you to Studies.

B.4 Sale and sharing. We do not sell or share health information, other than photos you choose to release under a signed Photo and Likeness Release. We do not share individual app events with advertising platforms. To opt out of website advertising cookies, use the "Your Privacy Choices" link on our website or enable Global Privacy Control.

B.5 Your California rights. Right to know, access, delete, correct, opt out of sale and sharing, limit use of sensitive personal information (where applicable), and not to be discriminated against. Submit requests as described in Section 12.3. Because we operate online and have a direct relationship with our users, we accept requests by email and in-app. Authorised agents must provide signed written permission.

B.6 Financial incentives. Study compensation is paid for your participation in research activities, not in exchange for personal information. If we offer any incentive connected to providing personal information (for example a reward for joining the research community), we will give you a notice of financial incentive describing its terms, and you may withdraw at any time.

B.7 Shine the Light. We do not disclose personal information to third parties for their direct marketing purposes.

B.8 Metrics. Our annual metrics on consumer requests will be published here where required.

B.9 Automated decision-making. Where we use automated tools to screen eligibility for Studies, you may request human review of an exclusion as described in Section 5. We will provide any pre-use notice and opt-out required by the CCPA automated decision-making regulations from January 1, 2027.

Supplement C: European Economic Area, United Kingdom and Switzerland

C.0 Who this applies to. This Supplement applies to business contacts, customer representatives and website visitors in the EEA, UK and Switzerland, and to people from those countries who took part in our research community or Studies before we stopped enrolling them in July 2026. Studies are not currently open to new participants from those countries.

C.1 Controller. Reputable Labs Inc. (contact details in Section 15). Our EU and UK representatives are listed in Section 15.

C.2 Legal bases. We process business contact information on the basis of our legitimate interests in developing and managing business relationships and promoting our research services to organisations (Article 6(1)(f)), which we have balanced against your rights; to perform a contract with your organisation (Article 6(1)(b)); and on your consent where the law requires it, including for non-essential cookies and our website visitor identification tool (Article 6(1)(a)). Where the law of your country requires consent before we send you business marketing email, we obtain it first. You may object to direct marketing at any time.

For former participants, we hold account and Study data on the basis of the explicit consent you gave when you joined (Article 9(2)(a)), our legal obligations to keep Study and safety records (Articles 6(1)(c) and 9(2)(i)), and, for Study data retained after withdrawal, scientific research purposes under Article 9(2)(j) with the safeguards in Article 89, as provided by the named law, for example UK Data Protection Act 2018, Schedule 1, paragraph 4, only where deletion would seriously impair a completed Study; we told you this when you joined. You may exercise the rights in C.3 at any time.

C.3 Your rights. Access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests), withdrawal of consent at any time, and not to be subject to solely automated decisions with legal or similarly significant effects. Some rights may be limited for scientific research where exercising them would seriously impair the research objectives and the law permits the limitation; the Consent Form explains any such limitation.

C.4 Complaints. You may complain to the data protection authority where you live or work, or where an alleged infringement occurred. In the UK, that is the Information Commissioner's Office. We would appreciate the chance to address your concern first.

C.5 Transfers. See Section 11.

C.6 Cookies. Non-essential cookies are placed only with your prior consent; rejecting is as easy as accepting.

Supplement D: Canada

D.0 Who this applies to. This Supplement applies to participants in Canada outside Quebec (some Studies are open to Canadian residents), and to business contacts, customer representatives and website visitors anywhere in Canada. Residents of Quebec cannot currently create participant accounts.

D.1 Consent. We rely on your express consent to collect, use and disclose sensitive information such as health data, identity verification data and biometric information, and on consent (which may be implied where the law allows) for business contact information. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice; we will explain the consequences of withdrawal. We send commercial electronic messages only in compliance with Canada's Anti-Spam Legislation.

D.2 Your rights. You may access your personal information and request corrections, and, where the law provides, receive a copy in a structured, commonly used format.

D.3 Quebec business contacts. For business contacts in Quebec, the person responsible for the protection of personal information is our data protection lead (Section 15). We collect business contact information for the purposes described in this policy and use it only for those purposes.

D.4 Storage outside Canada. Your information may be stored and processed in the United States and may be accessible to law enforcement and national security authorities there.

D.5 Complaints. You may contact the Office of the Privacy Commissioner of Canada, or, in Quebec, the Commission d'accès à l'information, or in Alberta or British Columbia, the provincial Information and Privacy Commissioner.