Consumer Health Data Privacy Policy

Last updated: October 15, 2026

This Consumer Health Data Privacy Policy explains how Breakoutlabs Inc. ("BreakoutLabs," "we," "us," or "our") collects, uses, shares and protects "consumer health data" as defined by the Washington My Health My Data Act and similar laws in Nevada, Connecticut and other states. It applies to everyone who uses our store website (trybreakoutlabs.com), our member app (app.trybreakoutlabs.com, also reachable at app.breakoutlab.co) and our services, wherever you live. It adds to ourย Privacy Policy, which explains how we handle all other personal information.

Consumer Health Data We Collect

  • Blood test results, biomarker values, reference ranges, lab reports and kit IDs.
  • Questionnaire answers about your skin and acne, diagnosed conditions, prescription medicines, pregnancy or breastfeeding, menopause, your menstrual cycle, hormonal birth control, skincare products and supplements you use, reactions to products, diet, sleep, stress, exercise, gut health, and how acne affects how you feel.
  • Your Clear Skin Blueprint (your plan) and notes from our skin specialists, skin team and care team.
  • Face and skin photos you upload.
  • Progress check-in answers and photos.
  • Messages with our care team and skin team about your health, and logs of Klara (our AI assistant) conversations our team has about your account.
  • The fact that you bought or used a health test, supplement or program from us.
  • Your age, sex and state, when used together with the information above.

We do not collect precise geolocation and we do not use geofencing. Photos taken in our current photo step have location and device details removed. To delete photos uploaded with an older questionnaire, emailย info@breakoutlab.co. We do not collect biometric identifiers and we do not use face recognition.

Where It Comes From

  • From you.
  • From the independent laboratory and physician that process your test.
  • From our skin specialists, skin team and care team.
  • From your parent or guardian, if they register a test for you.

Why We Collect and Use It

  • To process your test, deliver your results, and create and update your plan (the service you ask for).
  • To provide skin specialist calls, group calls, progress check-ins and support, including through Klara.
  • To ship products and manage your membership.
  • To improve our tests and plans.
  • To measure our advertising, using the purchase information described under "Advertising and measurement partners" below.
  • For safety, quality, security, fraud prevention and legal compliance.
  • To share with partner physicians and practices, and to create de-identified data, as described below.

We do not use your test results, questionnaire answers, photos, check-ins or messages to target ads or to build ad audiences.

Who We Share It With

Your test providers

The independent physician who orders your test, and the independent CLIA-certified laboratory that runs it (currently Celesta and its partner laboratory). For the lab order we send your name, date of birth, sex, kit ID and the tests ordered, with no contact details. The physician receives your results from the laboratory. For some earlier kits processed through SpotDx, the order also included the buyer's name and shipping address.

Service providers (processors)

Companies that act only on our instructions under contract, in these categories:

  • Cloud hosting, database, file storage and error monitoring: Supabase, Vercel, Amazon Web Services, Sentry.
  • Kit and product fulfilment and shipping: Supera, ShipStation, UPS and other carriers.
  • Payments: Stripe and the payment methods you choose (Klarna, Cash App Pay, Amazon Pay, Flex for HSA and FSA payments), and Shopify and Recharge for store orders.
  • Customer support: Gorgias.
  • Email and text messaging: Klaviyo, SendGrid, Twilio, TxtCart.
  • Scheduling, calls and forms: Calendly, Google Meet (group calls), Typeform (older questionnaires).
  • AI processing for Klara: currently Anthropic.
  • Sales platforms for orders placed there: Shopify, TikTok Shop.

Your skin specialist

The results, plan, questionnaire answers and photos needed to advise you.

Partner physicians and private practices

We collaborate with independent physicians and private practices. In these business-to-business collaborations, we may share consumer health data, such as your results, with a partner physician or practice, for example so they can offer you care or related services.

  • This applies to information we collect after this update. We will not share information you gave us before this update with partner physicians or practices, or include it in de-identified data we share or license, unless you agree first. We will ask you in your account.
  • If you live in Washington, Nevada or Connecticut, or anywhere else state law requires your consent before we share consumer health data with a partner physician or practice, we will ask for your consent first and will not share it with them without it.
  • We never share your photos with partners unless you give separate permission for that photo.
  • We do not sell your consumer health data for money or other valuable consideration.
  • We do not share information about anyone under 18 this way.
  • You can opt out at any time by emailingย admin@breakoutlab.co.

Advertising and measurement partners

On our store website (trybreakoutlabs.com), cookies and pixels from Meta, TikTok, Google, Triple Whale, Trybe, Klaviyo, TxtCart and others record the products you view, add to your cart and buy, which can show interest in a health product. You can opt out atย Your Privacy Choices.

In our member app, advertising pixels from Meta, Triple Whale and Trybe load only on our checkout and order-confirmation pages, never on pages that show or collect your health information. They record checkout steps: a page view, starting checkout, entering contact and payment details, and the purchase. When you buy through our app checkout, we tell these partners about the purchase:

  • Meta: in your browser, starting checkout, adding payment details and the purchase, each with the order value, currency and a product identifier. From our servers, that a purchase happened, its value and currency, your email address and phone number in hashed (scrambled) form, your IP address and browser details, Meta's cookie identifiers, and for supplement orders a product identifier.
  • Triple Whale: in your browser, the checkout steps with the products in your cart, your email address, your city, state and ZIP code, and your phone number with the purchase. From our servers, the order, including the product name, value and any discount, and your name, email address, phone number and shipping address.
  • Trybe: if you arrived through a creator's link, the order value, the product name and your email address.

Because a product name or product identifier describes what you bought, this information can show that you bought a health-related product.

For orders shipping to Washington, Nevada or Connecticut, and for orders where we know a person being tested is under 16, we do not send the purchase to Meta, Triple Whale or Trybe. Our servers send nothing about the purchase, and once you choose one of those states, the checkout pixels stop sending your address, payment and purchase steps. Before we know your shipping state, the checkout pixels still record what they record for everyone: the checkout page view (with the pixel's cookie, your IP address, browser details and the page address); starting checkout (with the order value and product identifiers for Meta, and the products in your cart for Triple Whale); and, for Triple Whale, your email address if you enter it before choosing your state.

If your browser sends a Global Privacy Control signal, the advertising pixels do not load in our member app, and we do not send your purchase to Meta, Triple Whale or Trybe.

We never send advertising partners your test results, questionnaire answers, photos, check-ins or messages.

Others

With your consent, when you ask us to (for example, to send your results to your own doctor), in a merger or acquisition subject to this policy, or when the law requires it. We have no affiliates.

You can ask us for a list of the specific third parties we have shared your consumer health data with, and how to contact them.

De-identified Data

De-identified data cannot reasonably be linked to you and is not consumer health data. We may share or license de-identified data, including for payment, with research partners, companies, physicians and practices.

  • This applies to information we collect after this update. We will not share information you gave us before this update with partner physicians or practices, or include it in de-identified data we share or license, unless you agree first. We will ask you in your account.
  • We take reasonable measures so it cannot be linked to you, we publicly commit to keep and use it only in de-identified form and not to try to re-identify it, and we require anyone who receives it to promise the same in writing.
  • We de-identify data using the HIPAA Safe Harbor method (45 CFR 164.514(b)(2)).
  • Photos are never included.
  • Information about anyone under 18 is never included.
  • You can opt out of having your information included by emailingย admin@breakoutlab.co.

Sale

We do not sell consumer health data.

Your Rights

You have the right to:

  • Confirm whether we collect, share or sell your consumer health data.
  • Get a copy of your consumer health data.
  • Get a list of the third parties we have shared it with, with their contact details.
  • Withdraw your consent at any time.
  • Have your consumer health data deleted. When we delete it, we also tell our service providers and any third parties we shared it with to delete it, and we aim to remove it from our backups within 90 days. The laboratory and physician may need to keep their own records by law.

We respond within 45 days. If we need more time where the law allows, we will tell you why and respond within another 45 days. You will not be treated differently for using these rights.

Appeals

If we deny your request, you can appeal by replying to our decision or emailingย admin@breakoutlab.coย with "Appeal" in the subject line. We will answer your appeal within 45 days and explain our decision. If we deny your appeal, you can contact your state Attorney General. Washington residents can file a complaint atย www.atg.wa.gov/file-complaint.

How to Make a Request

Emailย admin@breakoutlab.coย or write to Breakoutlabs Inc., 650 NE 2nd Ave, Miami, FL 33132. We will verify your identity using your account or order details. Parents and guardians can make requests for a minor's record. You can also use an authorized agent where the law allows.

Contact

Breakoutlabs Inc., 650 NE 2nd Ave, Miami, FL 33132. Emailย admin@breakoutlab.co. Phone or text +1 (205) 291-1433 (Monday to Friday, 9am to 5pm ET).