Consumer Health Data Privacy Notice 

Last Updated and Effective Date: October 10, 2026

This Notice explains how BBSF ENTERPRISE, INC d/b/a Bon Pharm (“Bon Pharm,” “we,” “us,” or “our”) handles information that qualifies as consumer health data. It supplements our Privacy Policy and covers relevant information in the educational quiz, shopping, orders, subscriptions where offered, support, and voluntary submissions.

Contact: support@bonpharm.comBBSF ENTERPRISE, INC d/b/a Bon Pharm137 S Spalding Dr Unit 101, Beverly Hills, CA 90212, United States
State-law rights described below apply when the relevant law covers the consumer, information, and processing. Our browser-only quiz and no-health-data-advertising commitments apply regardless of whether a particular state law applies.

Categories and Sources

Consumer health data may include the following when linked or reasonably linkable to a person and when it identifies health status, health interests, or other information protected by the applicable law:

• Selected preconception or reproductive-wellness topics, educational preferences, quiz answers, and the locally displayed result. These originate from your choices in the quiz and remain only in the active browser memory as explained in Section 2.
• Product interests, browsing or transaction details, including orders or subscriptions, where the context reveals protected health information or health-related inferences. Sources include your shopping activity and the commerce, payment, fulfillment, carrier, returns, or subscription providers involved in your requested transaction. A product purchase or interest is not automatically consumer health data in every circumstance.
• Health information you deliberately include in a support request, product complaint, adverse-event report, or other submission. Sources are you and the providers handling that request or report.
• Associated identifiers and permission records, such as contact details, order or support identifiers, IP addresses, cookie or device identifiers, and relevant preference records, when linked to covered health information. Sources are your submissions, necessary website requests, and the providers involved in the relevant service. This does not include linking contact details to quiz answers or results, which we do not do.

The basic store does not require diagnoses, laboratory reports, semen-analysis results, IVF records, prescription lists, or a detailed medical history. The quiz does not ask for diagnoses, laboratory or semen-analysis results, sleep history, or the length of unsuccessful attempts to conceive. Please do not include unnecessary medical information in a support message.

Browser-Only Quiz Processing

Quiz answers and results are used only in the active memory of your current browser window to organize educational information and product navigation. They are not transmitted to our servers, a CRM, contact forms, analytics providers, advertising platforms, or other service providers. They are not saved in cookies, local storage, session storage, or any other persistent browser storage and are never attached to a name, email address, telephone number, account, order, or marketing contact record.

The start notice explains this local processing and gives you the choice to continue or skip the quiz. You may skip any question, view general information, or shop without taking it. Resetting or closing the quiz clears the active answers and result. We do not retain a server-side copy that could later be retrieved, emailed, or deleted. Quiz choices do not generate a diagnosis, fertility score, pregnancy prediction, prescription, treatment plan, or medical suitability decision. An optional contact or guide-request form operates separately and does not receive quiz answers or results. Necessary site delivery and security requests may still produce technical records. When those records qualify as consumer health data, the restrictions in this Notice apply to them.

Purposes and Manner of Processing

Outside the browser-only quiz, we use the minimum relevant consumer health data to:

• Provide the product or service you request, including payment, order fulfillment, delivery, returns, and subscription administration where applicable.
• Respond to your question, provide requested support or follow-up, investigate a product complaint, or handle an adverse-event report.
• Secure the relevant service, restrict unauthorized access, administer privacy choices, and maintain the minimum records required for applicable consent or legal obligations.
• Comply with a specific applicable legal duty or other legally authorized purpose.

This processing may involve restricted electronic records and communications used by the personnel and providers responsible for the requested service. The quiz itself uses only temporary browser processing. Neither routine website improvement nor a general marketing permission authorizes additional health-data collection or use. We collect and share covered consumer health data only with the consent required by applicable law, to the extent necessary for a product or service you request, or under another specific legal authorization that applies. If separate sharing consent is required, we obtain it separately from consent to collect and before sharing. Consent requests identify the categories, purpose, relevant recipient categories, and how to withdraw. Acceptance of website terms, a purchase, a general newsletter opt-in, or a subscription agreement is not blanket permission for unrelated health-data processing. If you deliberately submit health information for support, it is handled for that separate support or safety purpose. Marketing emails require a separate affirmative opt-in and are not segmented using your consumer health data.

Categories Disclosed and Recipients

Quiz answers and results are not disclosed to anyone outside the active browser session. For other covered information, permitted disclosures depend on the service and applicable law:

• Health-revealing order or subscription details and necessary contact identifiers: ecommerce and hosting providers, payment processors, fulfillment and warehouse providers, carriers, returns providers, and subscription-administration providers, only as needed for the requested transaction or another specific lawful purpose.
• Health information deliberately supplied in support, complaints, or safety reports, together with necessary identifiers: restricted customer-support and
  communication providers, safety-reporting providers, hosting and IT/security providers, and professional advisers, insurers, legal counsel, or public authorities where the particular disclosure is legally authorized or required.
• Covered technical information and relevant permission records: hosting, ecommerce, security, and other restricted providers responsible for delivering the requested service, protecting it, and administering applicable rights or permissions.

We restrict processors to documented, permitted purposes and the applicable contractual requirements. Access is limited to people and providers who need it for those purposes. Calling a recipient a “service provider” does not eliminate a consent requirement that applies to the actual disclosure. We do not share consumer health data with corporate affiliates. Any lawful transfer in connection with a merger, acquisition, or other business transaction remains subject to applicable health-data duties and does not authorize a new purpose without the required notice and consent.

No Health-Data Advertising or Sale

We do not sell consumer health data. We do not disclose it to advertising platforms or use it for targeted advertising, retargeting, custom or lookalike audiences, audience matching, advertising optimization, or advertising measurement. This restriction includes health-revealing product interests, purchases, URLs, referral details, event names, and associated identifiers when they qualify as consumer health data. It applies to browser-based technologies and server-side transmissions. Advertising tracking is excluded from quiz and result screens, and other pages must observe the same health-data restrictions. Hashing a contact identifier does not by itself make health-related information anonymous. We do not permit third parties to collect consumer health data through our website for tracking over time and across different websites or online services. Providers handling necessary transactions or support remain subject to the purpose and disclosure limits above. Separate general advertising described in our Privacy Policy does not authorize cross-site health-data collection. We do not use geofencing around in-person health care facilities to identify, track, or target people based on receiving or seeking health care.

Retention, Withdrawal, and Deletion

Quiz answers and results last only in the active quiz session and are cleared when you reset or close the quiz. They are not stored for later use. Other consumer health data is retained only for the requested transaction, support or safety matter, valid consented purpose, or an applicable legal obligation. You may ask us to withdraw consent, cease covered collection or sharing, or delete covered information by emailing support@bonpharm.com. We apply the rights, deadlines, and legally permitted exceptions governing your request. We do not rely on an undefined “business need,” marketing purpose, or general retention statement to defeat a statutory deletion or withdrawal right. If a specific law or exemption requires or permits retention of a record, we restrict it to that purpose and explain the basis where legally permitted. We delete information outside that basis and notify the recipients required by law. Backup data awaiting lawful deletion is not reused for marketing.

Making a Request or Appeal

Email support@bonpharm.com or write to our postal address above. You may ask about covered collection and disclosures, request access where applicable, request deletion, withdraw consent, ask us to cease covered collection or sharing, or ask to review and correct information we hold. To request a correction, identify the record and the change you believe is needed; do not resend unnecessary medical details. We use commercially reasonable, proportionate authentication for requests requiring it. We ask only for additional information reasonably needed to authenticate the request. No purchase, marketing subscription, or new account is required. We do not unlawfully discriminate against you for exercising applicable health-data rights. To appeal a refusal, reply to our decision or email the same address asking for review. You may use “Health Data Appeal” in the subject line, but that wording is not required. The state-specific time limits and complaint routes are below.

Washington Consumer Health Data Rights

Where the Washington My Health My Data Act applies, you may:

• Confirm whether we collect, share, or sell your consumer health data and access that data.
• Obtain a list of all third parties and affiliates with whom covered data was shared or sold, together with an active email address or other online contact method for those third parties.
• Withdraw consent to collection and sharing.
• Request deletion of your consumer health data.

We act without undue delay and within 45 days after receiving your request. Authentication does not restart or extend this initial deadline. When reasonably necessary because of the complexity or number of requests, we may extend the period once by up to 45 additional days, notifying you and explaining the reason within the initial 45 days. For a covered deletion request, we delete the data from our records and network, including active systems, and notify all affiliates, processors, contractors, and other third parties with whom we shared it as required by the Act. A permitted delay for archived or backup systems may not exceed six months after authentication. This limited backup rule does not postpone deletion from active systems. If you appeal a refusal through Section 7, we provide a written decision with reasons within 45 days after receiving the appeal. If denied, we also provide an available method to complain to the Washington Attorney General. Information in response to covered requests is provided without charge up to twice annually. We charge a reasonable administrative fee or decline a manifestly unfounded, excessive, or repetitive request only where the Act permits and we can demonstrate the basis.

Nevada Consumer Health Data Rights

Where Nevada’s consumer health data law applies, you may request confirmation of whether we collect, share, or sell your consumer health data; a list of third parties with whom we shared or sold it; cessation of covered collection, sharing, or sale; and deletion. We respond without undue delay and within 45 days after authenticating your request. If reasonably necessary because of the complexity and number of requests, we may extend the response period by up to 45 additional days and explain the extension within the initial period. A covered deletion request has a separate, shorter deadline: within 30 days after authentication, we delete the requested data from active records and our network and notify each relevant affiliate, processor, contractor, and other third party. The general 45-day response period does not postpone that 30-day duty. A recipient notified under Nevada law must delete the covered data within 30 days after receiving that notice, subject to the statutory backup rule. Where the statute permits a necessary delay for restoration of archived or backup systems, deletion from those systems may be delayed for no more than two years after authentication; a shorter requirement under another applicable law still applies. If you appeal a refusal through Section 7, we provide a written decision and reasons within 45 days after receiving the appeal. If we do not grant the requested action, we include contact information for the Nevada Attorney General’s complaint process. Information in response to covered requests is free at least twice annually and for additional requests that are not manifestly unfounded, excessive, or repetitive. Any fee must meet the limits of Nevada law.

Changes to This Notice

We post updates here with a new effective date. We notify consumers of material changes through a prominent website notice and, when we have contact information for affected consumers, an email or other direct notice as required by applicable law. Before collecting, using, or sharing additional health-data categories, adding disclosure recipients, or using data for an additional purpose requiring consent, we disclose the change and obtain the required affirmative consent. A revised notice or continued browsing alone is not that consent. Questions, requests, and appeals may be sent to support@bonpharm.com.