Consumer Health Data Privacy Notice

Effective date August 19, 2026

1Why this notice exists

Nefense Professional Corporation sells consumer nasal and airway hygiene and comfort products. We provide no health care, we hold no medical records, and our products are not a treatment for any condition.

Two state laws, the Washington My Health My Data Act and Nevada Senate Bill 370, regulate what a business does with consumer health data. Neither of them depends on how big a business is, and neither of them depends on where the business sits. They follow the person. If you live in one of those states, or you were in one when you shopped with us, the protections can travel with you.

Rather than argue about whether a hygiene product is health related, we have written this notice as though those laws apply to us, and we have made the commitments in it to everyone who shops with us, wherever you live.

2What consumer health data means

Consumer health data

Information that identifies you, or could reasonably be linked to you, and that says something about your past, present or future physical or mental health status.

The important part is what comes next in the definition: it expressly includes information that is inferred or derived from data that is not itself health data.

That is why an ordinary shopping record can be caught. Nothing in an order confirmation looks like a medical record. But a list of what someone bought, or the products they looked at, can be used to guess something about them, and the law treats the guess as the protected thing.

3Why a purchase from us can fall inside that definition

We sell products people use on their nose and their airway. Buying one of them can support an inference about a person's breathing or their respiratory health, whether or not the inference would be correct, and whether or not you had any health reason for the purchase. Plenty of people buy these products for comfort, for sleep, for sport, or simply because a dusty week made them want to rinse their nose.

We do not draw those inferences and we do not want them drawn about you by anybody else. Because the risk is real regardless of our intentions, we treat purchase and browsing information in these categories as sensitive, and we handle it as described below.

4What we collect that can fall into these categories

Only what a store needs to sell you something and get it to you:

• What you bought. Which nasal or airway products you bought, how many, when, and how often you reorder.
• What you looked at. Which of those product pages you looked at, what you added to your bag, and where you stopped in checkout.
• Who to send it to. The name, address, email and phone number attached to the order, which is what links the purchase to you.
• What you tell us. Anything you volunteer in a message, a product question or a review. We do not ask you about your health, but anything you tell us is covered by this notice.
• Technical information. The approximate region we can tell from your network address, and your device and browser type. We do not collect precise location from your device.

It comes from you, from your browser, and from the companies that take the payment and carry the parcel. We do not buy it from a data broker, and we do not receive it from an advertising network.

5What we use it for

Four things, and nothing else:

• To complete your order. To take your order, ship it, bill it correctly, and handle a return, a refund or a warranty claim.
• To help you. To answer you when you write to us, and to look up your order history when you ask us to.
• To keep you safe. To reach you about a product safety issue or a recall on something you bought.
• Because the law requires it. To keep the tax, accounting and product safety records the law requires us to keep. We keep the minimum for that purpose.

6Who we share it with

Only companies that carry out a specific part of your order or support your account, and only the part each one needs: the company that takes the payment, the carriers that deliver the parcel, the service that sends your order emails, and the tooling our support team uses to answer you.

Every one of them is required in writing to use it only for that work, to protect it, and not to keep it any longer than the work needs. None of them is an advertising company.

We also disclose information when a law, a court order or a lawful government request requires it. We tell you when we are allowed to tell you.

Where the law requires your consent before we collect or share consumer health data for a purpose beyond the ones listed in section 5, we ask for it first, we ask separately for collecting and for sharing, and we take no for an answer without changing anything about your order.

7What we never do with it

These are the commitments that matter most, so they are stated as flatly as we can state them.

• No advertising platform. We do not share consumer health data with an advertising platform, an ad network, an ad exchange, a social media platform or a data broker.
• No audience building. We do not use what you bought or what you looked at to build an advertising audience, to seed one, to create a lookalike audience, or to match you against a list held by somebody else.
• No targeting. We do not use it to target advertising to you, on our site or anywhere else, and we do not use it to decide what advertising you see.
• No sale. We do not sell consumer health data, for money or for anything else of value. Under these laws a sale would require a separate, specific, signed authorization from you, on top of consent. We do not ask anyone for that authorization, because we do not intend to sell this information at all.
• No differential treatment. We do not use it to set your price, to decide what discount you see, or to decide whether to help you.

8Geofencing

We do not use a geofence around a health care facility, a pharmacy, or a clinic to identify or track anyone, to collect data, or to send anyone an advertisement or a message.

We do not operate a mobile application that collects location in the background, and we do not collect precise location from your device through our website. If we ever build something that needs location, it will ask you, it will tell you why, and it will still not be used for anything described in the sentence above.

9Your rights

You have the following rights over consumer health data we hold about you. We honor them for anyone who asks, wherever you live.

• Confirm. Ask us to confirm whether we hold consumer health data about you.
• Access. Get a copy of it, together with a list of the companies we shared it with and how to contact them.
• Delete. Ask us to delete it. We delete it from the systems we work in every day, we tell the companies holding a copy for us to delete their copies, and we keep only what tax, accounting or product safety law requires us to keep. We tell you plainly what we kept and why.
• Withdraw consent. Withdraw a consent you gave us, at any time, for collecting or for sharing. Withdrawing consent does not undo what was lawful before you withdrew it, and it does not affect an order already on its way to you.

Exercising any of these costs you nothing, and we will not treat you differently for it. Your prices, your delivery, your returns and the help you get from us stay exactly the same.

10How to exercise them

There is no self-service portal. You write to us and a person handles it.

1. Email support@nefense.com with the subject line "Consumer health data request", or write to our address below.
2. Tell us which right you are exercising, and give us the email address on your order or your account so we can find you.
3. We may ask a question or two to be sure it is you. We ask for the least we can, and we do not keep what you send for verification any longer than the request takes.

We answer within 45 days. If a request is complicated and we need one more 45 day period, we tell you before the first one runs out and say why. If we refuse, we tell you why and how to appeal, and an appeal is looked at by somebody who was not involved the first time.

11If you think we got it wrong

Tell us first, at support@nefense.com. We would rather fix it than have you chase it.

You can also complain to the attorney general of your state. In Washington, the My Health My Data Act is enforced through the state Consumer Protection Act, which in some circumstances lets a person bring their own claim. Nothing in this notice, and nothing in any agreement with us, takes away your right to complain or to bring a claim the law gives you.

12Changes to this document

We update this document when what we do changes, when the law changes, or when we find wording that is unclear. Every version is kept, and each one records the date it took effect.

How you find out depends on how much changed. A correction that does not change your rights is simply published. A change that does affect your rights is announced before it takes effect. A change that materially alters what you agreed to is not applied to you by silence: we ask you to accept it, and continuing to browse the site is not treated as acceptance.

If you want a copy of an earlier version, or want to know what changed and when, write to support@nefense.com and we will send it to you.

13Contact

For anything in this notice, use the subject line "Consumer health data request". Our general Privacy Policy covers everything else we do with personal information, and our Cookie and Tracking Notice covers what our site stores on your device.