Consumer Health Data Privacy Policy

Last updated: October 29, 2026

This Consumer Health Data Privacy Policy explains how Breakoutlabs Inc. ("BreakoutLabs," "we," "us," or "our") collects, uses, shares and protects "consumer health data" as defined by the Washington My Health My Data Act, Nevada's consumer health data law (SB 370), Connecticut's data privacy law and similar laws in other states. It applies to everyone who uses our store website (trybreakoutlabs.com), our member app (app.trybreakoutlabs.com, also reachable at app.breakoutlab.co) and our services, wherever you live. It adds to our Privacy Policy, which explains how we handle all other personal information.

BreakoutLabs maintains a privacy and security program built to the safeguards of HIPAA, and we monitor it continuously through a compliance platform. The independent physician and laboratory that handle your test have their own HIPAA obligations for the records they keep.

Consumer Health Data We Collect

  • Blood test results, biomarker values, reference ranges, lab report files (PDFs) and kit IDs.
  • Questionnaire answers about your skin and acne, diagnosed conditions, prescription medicines, pregnancy or breastfeeding, menopause, your menstrual cycle, hormonal birth control, skincare products and supplements you use, reactions to products, diet, sleep, stress, exercise, gut health, and how acne affects how you feel.
  • Your Clear Skin Blueprint (your plan) and notes from our skin specialists, skin team and care team.
  • Face and skin photos you upload.
  • Progress check-in answers and photos.
  • Your chats with Klara, our AI assistant, and chats our care team has with Klara about your account.
  • Messages with our care team and skin team about your health.
  • The fact that you bought or used a health test, supplement or program from us, including the product information and order value in checkout and purchase events.
  • Your age, sex and state, when used together with the information above.

We do not collect precise geolocation and we do not use geofencing. We do not collect biometric identifiers and we do not use face recognition. When you take a photo in our current photo step, a check that runs only on your own device looks for a face in the frame; it does not identify you, does not create a face template and does not send any face data to us. Photos taken in our current photo step have location and device details removed. To delete photos uploaded with an older questionnaire, email care@breakoutlab.co.

Where It Comes From

  • From you, including through Klara.
  • From the independent laboratory and physician that process your test.
  • From our skin specialists, skin team and care team.
  • From your parent or guardian, if they register a test for you.
  • From your browser and our checkout, for the checkout and purchase events described below.

Why We Collect and Use It

  • To process your test, deliver your results, store your lab reports so you can download them, and create and update your plan (the service you ask for).
  • To provide Klara, skin specialist calls, group calls, progress check-ins and support.
  • To ship products and manage your membership.
  • To improve our tests, plans, Klara and our services, including by reviewing Klara chats.
  • To measure our advertising, using the checkout and purchase information described under "Advertising and measurement partners" below.
  • For safety, quality, security, fraud prevention and legal compliance.
  • To share with partner physicians and practices, and to create de-identified data, as described below.

We do not use your test results, questionnaire answers, photos, check-ins, Klara chats or messages to target ads or to build ad audiences.

Who We Share It With

Your test providers

The independent physician who orders your test, and the independent CLIA-certified laboratory that runs it (currently Celesta and its partner laboratory), receive the information needed to run your test: your name, date of birth, sex, kit ID and the tests ordered, with no contact details. The physician receives your results from the laboratory. For some earlier kits processed through SpotDx, the order also included the buyer's name and shipping address.

Service providers (processors)

Companies that act only on our instructions under contract, in these categories:

  • Cloud hosting, database, file storage and error monitoring: Supabase, Vercel, Amazon Web Services, Sentry.
  • Kit and product fulfilment and shipping: Supera (shipping details and kit IDs), ShipStation, UPS and other carriers.
  • Payments: Stripe (including Link) and, where offered, Klarna, Afterpay, Cash App Pay and Amazon Pay; Flex for HSA and FSA payments; and Shopify and Recharge for store orders.
  • Customer support: Gorgias.
  • Email and text messaging: Klaviyo, SendGrid, Twilio, TxtCart.
  • Scheduling, calls and forms: Calendly, Google Meet (group calls), Typeform (older questionnaires).
  • AI processing for Klara: currently Google (Gemini) and Anthropic (Claude). Under the business (API) terms we use, they are not permitted to use this information to train their own AI models. As their terms allow, they may keep it for a limited time for safety and abuse monitoring.
  • Sales platforms for orders placed there: Shopify, TikTok Shop.

Your skin specialist

The results, plan, questionnaire answers and photos needed to advise you.

Partner physicians and private practices

We collaborate with independent physicians and private practices. In these business-to-business collaborations, we may share consumer health data, such as your results, with a partner physician or practice, for example so they can offer you care or related services.

  • This applies only to consumer health data we collect on or after October 29, 2026. We will not share data you gave us before that date with partner physicians or practices, or include it in de-identified data we share or license, unless you agree first when we ask you in your account.
  • If you live in Washington, Nevada or Connecticut, or anywhere else state law requires your consent before we share consumer health data with a partner physician or practice, we will ask for your consent first and will not share it with them without it.
  • We never share your photos with partners unless you give separate permission for that photo.
  • We never sell your consumer health data.
  • We do not share information about anyone under 18 this way.
  • You can opt out at any time by emailing care@breakoutlab.co. We will stop future sharing once we receive your request.

Advertising and measurement partners

On our store website (trybreakoutlabs.com), cookies and pixels from Meta, TikTok, Google, Triple Whale, Trybe, Klaviyo, TxtCart and others record the pages and products you view, add to your cart and buy, which can show interest in a health product. You can opt out at Your Privacy Choices, and we treat a Global Privacy Control signal as an opt-out for that browser.

In our member app, advertising pixels from Meta, Google, Triple Whale and Trybe load only on our checkout and order-confirmation pages, never on pages that show or collect your health information. These partners receive page views and checkout and purchase events, which can include the order value, product information and identifiers such as your email address or phone number, some of them in hashed (scrambled) form:

  • Meta: in your browser, a page view, starting checkout, adding payment details and the purchase, each with the order value, currency and a product identifier. From our servers, that a purchase happened, its value and currency, your email address and phone number in hashed form, your IP address and browser details, Meta's cookie identifiers, and for supplement orders a product identifier; and the checkout steps with the order value, currency and product identifiers.
  • Google: in your browser, starting checkout with the order value and currency, and the purchase with the order value, currency, an order reference and your email address. Google's tag may also read the contact details you type into the checkout form, which Google receives in hashed form. We turn off Google's ad personalization on these pages.
  • Triple Whale: in your browser, the checkout steps with the products in your cart, your email address, your city, state and ZIP code, and your phone number with the purchase. From our servers, the order, including the product name, value and any discount, and your name, email address, phone number and shipping address.
  • Trybe: the purchase with the order value and your email address; and, if you arrived through a creator's link, from our servers the order value, the product name and your email address.

Because a product name or product identifier describes what you bought, this information can show that you bought a health-related product.

For orders shipping to Washington, Nevada or Connecticut, and for orders where we know a person being tested is under 16, we do not send the purchase to Meta, Google, Triple Whale or Trybe. Our servers send nothing about the purchase, and once you choose one of those states, the checkout pixels stop sending your address, payment and purchase steps. Before we know your shipping state, the checkout pixels still record what they record for everyone: the checkout page view (with the pixel's cookie, your IP address, browser details and the page address); starting checkout (with the order value and product identifiers for Meta, the order value for Google, and the products in your cart for Triple Whale); and, for Triple Whale, your email address if you enter it before choosing your state.

We honor Global Privacy Control signals in our member app as an opt-out of sharing for advertising: if your browser sends one, the advertising pixels do not load, and we do not send your purchase to Meta, Google, Triple Whale or Trybe.

We never send advertising partners your test results, questionnaire answers, photos, check-ins, Klara chats or messages.

Others

With your consent, when you ask us to (for example, to send your results to your own doctor), in a merger or acquisition subject to this policy, or when the law requires it. We have no affiliates.

You can ask us for a list of the specific third parties we have shared your consumer health data with, and how to contact them.

De-identified Data

De-identified data cannot reasonably be linked to you and is not consumer health data. We may share or license de-identified data, including for payment, with research partners, companies, physicians and practices.

  • This applies only to data we collect on or after October 29, 2026, unless you agree first when we ask you in your account.
  • We take reasonable measures so it cannot be linked to you, we publicly commit to keep and use it only in de-identified form and not to try to re-identify it, and we require anyone who receives it to promise the same in writing.
  • We de-identify data using the HIPAA Safe Harbor method (45 CFR 164.514(b)(2)).
  • Photos are never included.
  • Information about anyone under 18 is never included.
  • You can opt out of having your information included by emailing care@breakoutlab.co.

Sale

We do not sell consumer health data.

Klara Chats

Klara is an AI tool, not a person and not a doctor, and what it says is not medical advice. We keep Klara chats and use them to answer you, to check quality and safety, and to improve Klara and our services. We never use them for advertising and never sell them. We keep chats unless the law requires us to delete them when you ask. If you live in Washington, Nevada or Connecticut, or another state whose law gives you the right to have your consumer health data deleted, your deletion request includes your Klara chats. Chats from before October 29, 2026 stay under the rule we described at the time (we aim to delete them after 12 months) unless you agree to the current terms when we ask you in your account.

Teens and Children

You must be at least 14 to use our services. Teens aged 14 to 17 may have their own account with a teen consent, and a parent or guardian may register and manage a test for their teen. We do not test or serve children under 14, and our systems block registration for children under 13. We do not use a minor's consumer health data for marketing, advertising or research, we do not share it with partner physicians or practices, and we never include it in de-identified data we share or license.

Your Rights

You have the right to:

  • Confirm whether we collect, share or sell your consumer health data.
  • Get a copy of your consumer health data.
  • Get a list of the third parties we have shared it with, with their contact details.
  • Ask us to correct consumer health data that is wrong.
  • Withdraw your consent at any time, including consent to share with partner physicians or practices.
  • Have your consumer health data deleted. When we delete it, we also tell our service providers and any third parties we shared it with to delete it, and we aim to remove it from our backups within 90 days. The laboratory and physician may need to keep their own records by law.

We respond within 45 days. If we need more time where the law allows, we will tell you why and respond within another 45 days. You will not be treated differently for using these rights.

Appeals

If we deny your request, you can appeal by replying to our decision or emailing care@breakoutlab.co with "Appeal" in the subject line. We will answer your appeal within 45 days and explain our decision. If we deny your appeal, you can contact your state Attorney General. Washington residents can file a complaint at www.atg.wa.gov/file-complaint.

How to Make a Request

Email care@breakoutlab.co or write to Breakoutlabs Inc., 650 NE 2nd Ave, Miami, FL 33132. We will verify your identity using your account or order details. Parents and guardians can make requests for a minor's record. You can also use an authorized agent where the law allows.

Changes to This Policy

When we update this policy, we will post the new version on this page and change the "Last updated" date. If we make a material change to how we collect, use or share consumer health data you already gave us, we will tell you by email or in your account and ask for your consent first.

Contact

Breakoutlabs Inc., 650 NE 2nd Ave, Miami, FL 33132. Email care@breakoutlab.co. Phone or text +1 (205) 291-1433 (Monday to Friday, 9am to 5pm ET).