ZeroCortisol Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy describes how Tribute LLC, doing business as ZeroCortisol (“ZeroCortisol,” “we,” “us,” or “our”), collects, uses, processes, shares, and protects consumer health data.

This policy supplements our general Privacy Policy and is intended to provide additional disclosures regarding consumer health data, including where required by applicable U.S. state consumer health privacy laws.

ZeroCortisol provides a consumer wellness assessment, CortiScore, personalized 7-Day Reset, check-ins, repeat assessments, and related wellness services.

ZeroCortisol is not a healthcare provider, medical diagnostic service, or laboratory testing service. CortiScore does not measure or estimate cortisol levels.

1. Consumer Health Data We Collect

Depending on how you use ZeroCortisol, we may collect or derive consumer health data relating to areas such as:

• sleep duration, timing, consistency, quality, and related sleep habits;
• daytime sleepiness, energy, and feelings of restoration;
• perceived stress, stress intensity, rumination, perceived control, and ongoing stressors;
• physical and mental demands, fatigue, decompression, and restorative time;
• physical activity, exercise, strength activity, and sedentary behavior;
• nutrition and eating patterns;
• caffeine use and timing;
• alcohol use;
• nicotine use;
• lifestyle habits relevant to sleep and recovery;
• pregnancy or breastfeeding status where requested for safety or recommendation-limitation purposes;
• certain diagnosed endocrine, adrenal, pituitary, or sleep conditions where requested;
• use of certain medications that may affect sleep, alertness, mood, or steroid hormones where requested;
• responses to daily wellness check-ins;
• follow-up and repeat assessment responses.

We may also derive consumer health information from these responses, including:

• CortiScore;
• category and factor scores;
• derived assessment variables;
• lifestyle or wellness patterns identified by the scoring system;
• eligibility or exclusion flags;
• recommendation candidates;
• selected 7-Day Reset actions;
• changes between assessments or check-ins.

These outputs are wellness-product outputs. They are not medical diagnoses or measurements of your cortisol level.

2. Sources of Consumer Health Data

We collect consumer health data primarily:

• directly from you when you complete the ZeroCortisol assessment;
• directly from you when you complete check-ins or repeat assessments;
• from information you voluntarily provide through the Services;
• by deriving scores, variables, patterns, eligibility rules, and recommendations from the information you provide.

ZeroCortisol does not currently obtain laboratory cortisol measurements, medical records, pharmacy records, wearable-device health records, or information directly from healthcare providers as part of the V1 Services.

If we add materially different sources of consumer health data in the future, we will update this policy and obtain additional consent where required.

3. Why We Collect and Use Consumer Health Data

We collect and use consumer health data to provide the ZeroCortisol Services you request, including to:

• calculate your CortiScore;
• calculate category and factor scores;
• identify lifestyle and behavioral factors reflected in your assessment;
• determine which wellness interventions are eligible or inappropriate based on your responses;
• identify and rank potential 7-Day Reset actions;
• personalize your 7-Day Reset;
• explain why particular actions were selected;
• operate daily check-ins;
• measure changes between your initial assessment and follow-up assessment;
• display your assessment and Reset history;
• improve the functionality, reliability, safety, and usefulness of the Services;
• troubleshoot technical problems;
• protect the Services against fraud, misuse, or security incidents.

We do not use consumer health data to determine whether your biological cortisol level is high or low.

4. How Consumer Health Data Is Processed

ZeroCortisol uses a rules-based scoring and recommendation system.

Your assessment responses may be transformed into derived variables, factor scores, category scores, an overall CortiScore, eligibility or exclusion flags, recommendation candidates, and selected Reset actions.

The scoring and recommendation system operates separately from the artificial-intelligence language layer.

Artificial intelligence may be used to help explain or personalize the presentation of actions that have already been selected by the ZeroCortisol recommendation system.

AI is not intended to independently:

• determine your CortiScore;
• diagnose a medical condition;
• measure or estimate cortisol levels;
• prescribe or modify medication;
• interpret laboratory tests;
• override exclusion or safety criteria;
• independently create medical treatment.

5. Consumer Health Data We Share

We may share limited consumer health data with service providers where reasonably necessary to provide, secure, maintain, or support the Services you request.

Depending on the Services in use, these providers may include:

• database and authentication providers;
• application and infrastructure hosting providers;
• artificial-intelligence technology providers;
• transactional communication providers;
• security, monitoring, and technical-support providers.

We seek to limit the information provided to each service provider to what is reasonably necessary for that provider's role.

For example, ZeroCortisol's current AI integration is designed so that relevant assessment context may be provided where necessary to explain selected Reset actions, while your email address and personal notes are not included for that purpose.

Payment information is processed separately by our payment provider and is not used to calculate CortiScore.

6. Categories of Third Parties and Service Providers

ZeroCortisol currently uses or anticipates using service providers in the following categories:

• Vercel — application and website infrastructure;
• Supabase — database, authentication, and application infrastructure;
• OpenAI — AI-assisted personalization and explanation;
• Stripe — payment processing;
• Google — account and service communications;
• Product analytics is not currently enabled.

The exact providers used may change as ZeroCortisol develops.

We will update this policy where required if we materially change the categories of parties with whom consumer health data is shared.

7. Advertising and Tracking

ZeroCortisol does not intend to disclose your identifiable assessment answers, CortiScore, health-related flags, Reset recommendations, check-in responses, or other consumer health data to advertising platforms for targeted advertising.

We may use campaign, referral, or analytics information to understand how users discover ZeroCortisol and how the product funnel performs.

We seek to separate marketing and acquisition measurement from identifiable consumer health data.

We do not permit third-party advertising platforms to collect consumer health data from authenticated assessment, results, Reset, or check-in areas for targeted advertising unless we have provided the disclosures and obtained the consent required by applicable law.

8. Sale of Consumer Health Data

ZeroCortisol does not sell consumer health data.

We do not sell assessment responses, CortiScores, health-related information, check-in data, or personalized Reset information to data brokers or other third parties for monetary consideration.

If ZeroCortisol ever proposes to sell consumer health data in a manner regulated by applicable law, we will obtain any separate authorization required before doing so.

9. Your Consumer Health Data Rights

Depending on where you live and applicable law, you may have the right to:

• confirm whether ZeroCortisol is collecting, using, sharing, or selling your consumer health data;
• access consumer health data associated with you;
• request correction of inaccurate consumer health data;
• request deletion of consumer health data;
• request a list of third parties or affiliates with whom your consumer health data has been shared, where required;
• withdraw consent to certain collection, use, or sharing;
• request that ZeroCortisol stop certain collection or sharing of your consumer health data;
• obtain a copy of certain consumer health data;
• appeal a decision regarding a consumer health data request where applicable;
• exercise applicable privacy rights without unlawful discrimination.

To exercise a consumer health data right, contact:

privacy@zerocortisol.com

We may need to verify your identity before processing certain requests.

Where required by law, we will also provide a method to appeal a decision concerning your privacy request.

10. Withdrawing Consent

Where our processing of consumer health data requires your consent, you may withdraw that consent by contacting:

privacy@zerocortisol.com

Withdrawal will not affect processing that was lawful before your consent was withdrawn.

Depending on the information involved, withdrawing consent may make it impossible for us to continue providing certain features, including CortiScore, personalized recommendations, Reset history, or follow-up comparisons.

11. Deletion

You may request deletion of consumer health data associated with you by contacting privacy@zerocortisol.com or through any account-deletion functionality we make available.

Where required by applicable law, we will also notify relevant processors, contractors, affiliates, or other third parties that received the data of an applicable deletion request.

Certain information may be retained where permitted or required by law, including information reasonably necessary for security, fraud prevention, legal compliance, dispute resolution, or financial recordkeeping.

12. Reviewing or Correcting Your Information

You may review certain information through your ZeroCortisol account where that functionality is available.

If you believe consumer health data associated with you is inaccurate, you may request correction by contacting privacy@zerocortisol.com.

Because CortiScore and recommendations are generated from assessment responses, changing an underlying response may require a new assessment rather than retroactively changing a previously completed assessment.

13. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect consumer health data.

These measures may include:

• authenticated access to user accounts;
• access controls for production systems;
• encrypted communications;
• restricted service-provider access;
• server-side handling of sensitive credentials and API keys;
• separation of certain marketing information from assessment information;
• monitoring and security practices appropriate to the nature of the Services.

No internet-connected service can guarantee absolute security.

14. Data Minimization and Retention

We seek to collect consumer health data reasonably relevant to providing and improving the ZeroCortisol Services.

We retain consumer health data for as long as reasonably necessary to provide your account, assessment history, purchased Services, check-ins, follow-up comparisons, and other requested functionality, and to satisfy legitimate security and legal requirements.

We may retain de-identified or aggregated information that can no longer reasonably be linked to you.

15. Third-Party Collection Across Websites or Services

ZeroCortisol does not intend to permit third parties to use identifiable consumer health data from ZeroCortisol to track you over time across unrelated websites or online services for targeted advertising.

Some infrastructure, security, analytics, or payment providers may process technical information as necessary to provide their services.

We configure our Services with the goal of preventing identifiable assessment and Reset data from being used for unrelated cross-site advertising.

16. Material Changes to This Policy

If we materially change the categories of consumer health data we collect, the purposes for which we use it, or the categories of third parties with whom we share it, we will update this policy.

Where applicable law requires additional notice or consent before a new collection, use, or disclosure, we will seek that consent before engaging in the new practice.

The effective date at the top of this policy indicates when it was most recently updated.

17. Relationship to Our General Privacy Policy

This Consumer Health Data Privacy Policy supplements the ZeroCortisol Privacy Policy.

If a provision of this policy provides greater protection to consumer health data than the general Privacy Policy, we will apply the greater protection where required by applicable law.

18. Contact Us

Questions, complaints, requests, withdrawals of consent, and other inquiries concerning consumer health data may be directed to:

ZeroCortisol / Tribute LLC
Email: privacy@zerocortisol.com
Address: 3445 Stratford Rd NE #3401, Atlanta, GA 30326
Website: ZeroCortisol.com