Privacy policy

Last Updated: October 10, 2026

This Privacy Policy explains how BBSF ENTERPRISE, INC d/b/a Bon Pharm (“Bon Pharm,” “we,” “us,” or “our”) handles personal information in connection with our website, online store, educational quiz, customer support, requested communications, separately chosen marketing emails, reviews, analytics, advertising, and subscriptions where offered.

Contact and Scope

BBSF ENTERPRISE, INC d/b/a Bon Pharm137 S Spalding Dr Unit 101, Beverly Hills, CA 90212, United StatesEmail: support@bonpharm.com
This Policy describes our new U.S. website and store launch. Our website and store are intended for U.S. customers. International shipping is not offered at initial launch. This Policy covers Megaspermin MACA, Ovulofert ULTRA, and other Bon Pharm products offered through the website. Additional notices may accompany a particular service.
Our Consumer Health Data Privacy Notice explains additional protections for information that qualifies as consumer health data. Our Cookie & Your Privacy Choices page explains tracking and advertising choices. Those health-data protections apply wherever covered information occurs, including shopping and support, not only in the quiz.

The Quiz Stays in Your Browser

Quiz answers and results are processed only in the active memory of your current browser window. They are not sent to our servers, our CRM, contact forms, analytics services, or advertising platforms. They are not saved in cookies, local storage, session storage, or other persistent browser storage, and they are not linked to your name, email address, telephone number, account, order, or marketing contact record. Before you start, the quiz explains this local processing and lets you continue or skip it. You may skip questions, reset your answers, or leave the quiz. Resetting or closing the quiz clears its answers and result from the active quiz session. We cannot retrieve a saved copy because we do not receive or retain one.

The quiz organizes educational information and product navigation. It does not diagnose, score fertility, predict pregnancy, prescribe treatment, or determine medical suitability. It does not request diagnoses, laboratory or semen-analysis results, sleep history, or the duration of unsuccessful attempts to conceive.

Contact capture is separate. If you request a guide or contact us, we receive the details you submit in that separate form, without your quiz answers or result. A guide request, purchase, or quiz visit does not subscribe you to marketing emails. Ordinary website requests may still generate technical information needed to deliver and secure the site. This does not make all website activity anonymous. Technical information that reveals a health interest receives the additional protections described in the Consumer Health Data Privacy Notice.

Information, Purposes, Recipients, and Retention

The information involved depends on the features you use and the details you provide. We limit collection and use to the relevant purpose. The following describes our handling of each category; the additional disclosure limits in Sections 4 and 5 also apply.

  • Contact and account information
    This includes your name, email address, billing and shipping addresses, telephone number when provided, and account details where an account is offered. We obtain it from you and from providers completing your requested transaction. We use it for orders, accounts, delivery, requested materials, customer support, and separately chosen communications. Relevant ecommerce, payment, fulfillment, carrier, CRM, email, and support providers may receive the information needed for their work. We keep these details while needed for the account, transaction, requested service, or chosen communication and applicable recordkeeping obligations. A limited suppression record may remain after an unsubscribe to prevent further marketing messages.
  • Orders, payments, and subscription administration
    This includes products ordered, purchase history, order and shipment identifiers, payment status, transaction records, returns, refunds, chargebacks, and, where applicable, subscription price, frequency, renewal dates, consent records, and cancellation or change requests. Sources are you and the ecommerce, payment, fulfillment, carrier, returns, and subscription services involved in your transaction.
    We use these records to process and deliver purchases, administer subscriptions, handle support and returns, prevent fraud, and satisfy accounting, tax, and legal obligations. Relevant commerce, payment, subscription, fulfillment, carrier, support, accounting, and legal providers may receive the necessary details. Payment-card information is entered through Shopify-hosted checkout.

    Where available at checkout, you may choose Shop Pay, PayPal, Amazon Pay, Google Pay, or Venmo; the selected service processes the information needed for that payment under its applicable notice. Availability may depend on your device, location, and transaction. Do not send full card details in a support message.
    We retain transaction and subscription records for their administration and applicable tax, accounting, consent-evidence, dispute, and other legal requirements. Cancellation stops future renewals as described in the Subscription Terms; it does not itself erase records we are legally required to keep. Health-revealing transaction information remains subject to the health-data restrictions below.
  • Support, complaints, and safety information
    This includes messages, requested follow-up details, customer-service notes, and product-safety information you choose to provide. Sources are you and the providers handling your request. We use it to respond, investigate complaints or product-quality issues, handle adverse-event reports, and meet applicable legal obligations. Access is limited to relevant support, safety, IT/security, professional-adviser, and legally authorized recipients.

    We retain these records while handling the matter and for an applicable safety, recordkeeping, or legal requirement. We do not require detailed medical records to operate the basic store. Please provide only information relevant to your request. Private support messages are not public reviews and are not made available for advertising under a review license.
  • Device, website, and email activity
    Depending on the technology in use and your choices, this includes IP address, browser and device information, cookie or other online identifiers, page requests, referral information, interactions with the site, and email opens or clicks. Sources are your device and providers operating the site, communications, analytics, or permitted advertising features. Necessary information supports page delivery, checkout, security, fraud prevention, and troubleshooting. Optional analytics and permitted general advertising support website improvement and advertising measurement. Relevant hosting, ecommerce, security, communications, analytics, and advertising providers may receive information only within the restrictions in Section 5. We retain technical records only for the relevant operational, security, measurement, or legally required period, taking account of the purpose, sensitivity, and available deletion controls.
  • Reviews and submitted content
    This includes reviews, ratings, photographs, feedback, and the identifying details you choose to submit. We obtain it from you and the service handling your submission. We use it for the publication you request, moderation, customer support, and applicable compliance obligations. Review and hosting providers may process it; material submitted for public posting may be visible to visitors. We keep it while the publication or a justified moderation, safety, or legal record is needed. Consumer health data remains subject to the additional restrictions in our health-data notice.
  • Consent and preference records
    This includes email opt-in and unsubscribe status, privacy and cookie choices, separate Meta audience-matching choices where offered, requested phone-contact preferences, and subscription consent and cancellation evidence. A future SMS program would require its own separate consent and preference records before enrollment. We obtain it from your choices and the providers administering them. We use it to honor and document those choices, and disclose it only to relevant service providers or legally authorized recipients. We retain the minimum records needed to administer preferences and meet applicable evidentiary requirements. These records do not contain quiz answers or results or link a contact to them.
  • Browser-only quiz information
    Your selected quiz topics, answers, and result exist only in the active browser memory for the educational presentation described in Section 2. They are not received or retained by us or our service providers. Contact and technical information outside the quiz answers and results is addressed separately above.

Service Providers and Other Disclosures

Shopify provides our ecommerce platform. Depending on the service requested, we use providers for payments, hosting, security, fulfillment, shipping, returns, customer support, CRM, email delivery, reviews, and subscription administration. We disclose only the information relevant to their work and apply the contractual restrictions required for their role.

A payment service or carrier may also have independent legal responsibilities and its own privacy notice.We may disclose necessary information to professional advisers, insurers, auditors, legal counsel, or public authorities when required or permitted by applicable law, including for a product-safety matter or establishing or defending legal rights. A proposed business transfer is not permission for unrestricted access: any disclosure must have a lawful basis and appropriate safeguards, and applicable privacy choices and health-data obligations continue to apply.

We do not share consumer health data with corporate affiliates. The Consumer Health Data Privacy Notice identifies the permitted categories of health-data disclosures. General language about service providers, legal matters, or business transfers does not override its restrictions or a statutory deletion right.

General Advertising, Analytics, and Cross-Site Collection

We may use optional analytics and general advertising technologies, subject to applicable notice, consent, and opt-out requirements. Where these technologies are enabled, analytics or advertising providers may collect permitted online identifiers and non-health-revealing activity through our site and combine it with activity over time and across other websites or online services. Depending on the actual disclosure and applicable law, this can be a “sale” of personal information or “sharing” for cross-context behavioral advertising, even without a monetary payment.

We do not sell consumer health data or use or disclose it for targeted advertising, retargeting, custom audiences, lookalike audiences, audience matching, advertising optimization, or advertising measurement. This restriction covers health-revealing product interests, purchases, URLs, referral details, event names, and associated identifiers when they qualify as consumer health data, as well as health information supplied in support. A purchase or product interest is not automatically health data in every context, but removing a diagnosis or hashing an identifier does not by itself remove the restriction.

Quiz answers and results never leave the active browser memory. Advertising tracking is excluded from quiz and result screens. The same health-data restrictions govern other pages, email links, browser pixels, and server-side disclosures. General marketing permission does not authorize health-based segmentation.

Use the website’s Your Privacy Choices / Do Not Sell or Share My Personal Information control to opt out of covered sale, sharing, or targeted advertising. You may also email support@bonpharm.com. These choices do not require an account or identity verification. We request only information needed to apply a manually submitted choice; a recognized browser opt-out signal does not require you to provide additional identifying information.

Where applicable law requires it, we honor Global Privacy Control and other recognized opt-out preference signals for the sending browser or device and associated consumer profiles, including pseudonymous profiles. When we know the consumer, we also apply the signal to that consumer as required. The absence of a signal on a later visit does not by itself reverse an existing opt-out. The older Do Not Track browser setting is not treated as a separate consent instruction. See Cookie & Your Privacy Choices for details.

Optional Meta Customer List Matching

If we make this option available and you separately choose it, we may provide your email address in a hashed format to Meta Platforms, Inc. for customer-list matching with Facebook and Instagram accounts and to show Bon Pharm advertisements. Hashing does not make an email anonymous. This choice is independent of email marketing, SMS, a purchase, a subscription, and cookie consent. An email subscription or purchase does not automatically enroll you in Meta audience matching.

We do not send quiz answers or results, health information, product-level purchase details, or health-based audience segments for this purpose. A general customer list may be used only where its selection, name, context, and contents do not communicate sensitive health information and the disclosure is permitted by applicable law and Meta’s rules. Separate permission does not override these limits. This option is not active at initial launch; no list is uploaded under this planned feature before the required review and activation.

You may decline without affecting a purchase or email subscription. If you later choose this option, you can withdraw through Your Privacy Choices or by emailing support@bonpharm.com. We stop further matching disclosures and request removal from the relevant customer audience as required. A sale/sharing or targeted-advertising opt-out and a recognized opt-out signal take precedence where applicable. You may still see general Bon Pharm advertisements.

Email and Telephone Choices

We send transactional and requested messages for orders, subscriptions, shipping, returns, support, safety, requested guides, and necessary account or policy matters. We send promotional emails, offers, and general product education only after your separate affirmative opt-in. In a dedicated email-only form, entering your email and selecting the clearly labeled Subscribe button gives that email-only permission after the disclosure shown beside it. In checkout, guide-request, quiz-contact, or other mixed-purpose forms, email marketing requires a separate optional unchecked choice; the main action is not marketing consent. Marketing emails identify Bon Pharm, include our mailing address, and contain an unsubscribe link. You may also withdraw by contacting support@bonpharm.com. Unsubscribing from marketing does not stop necessary transactional or requested service messages.

A telephone number you provide may be stored in our CRM and used for the order, delivery, return, fraud-prevention review, support, safety issue, complaint, adverse-event follow-up, or other follow-up you request. It is not linked to quiz answers or results. Providing a number is not consent to SMS marketing, automated marketing calls, or prerecorded marketing calls. Those marketing channels are not active at initial launch. We plan a separate optional SMS step with its own consent and a way to skip it. Until the SMS provider and program terms are finalized and reviewed, that enrollment step remains unavailable and we do not collect advance SMS marketing consent or send marketing texts. Any future activation requires program-specific disclosures, separate affirmative consent, and functioning opt-out and support processes before enrollment begins. Email consent, Meta matching permission, and a service telephone number never substitute for SMS consent. We do not publish a customer-service telephone number at initial launch.

Retention and Deletion

We use the category-specific criteria in Section 3 and do not keep personal information indefinitely merely because it might be useful. We review retention and delete or appropriately de-identify information when the relevant purpose and applicable legal retention period have ended. When responding to a valid deletion request, we delete covered active records and notify the recipients required by applicable law. Information retained under a specific legal obligation or permitted exception is restricted to that purpose. General commercial convenience, marketing, or an undefined “business need” does not override a statutory deletion right. Consumer health data has additional deletion, recipient-notification, and backup requirements explained in its separate notice.

Your Privacy Rights and Requests

Depending on the law that applies to you and our processing, you may have rights to access and obtain a copy of personal information; know its categories, sources, purposes, and recipients; correct inaccuracies; request deletion; opt out of sale, sharing, or targeted advertising; limit certain sensitive-information uses or disclosures; withdraw consent; and appeal a refusal. To make a request, email support@bonpharm.com or write to our postal address in Section 1. Tell us which right you want to exercise and provide only what is reasonably needed to locate the relevant record. You do not need to buy anything or create a new account. Where permitted, an authorized agent may act for you; we may ask for appropriate evidence of authority.

Access, correction, deletion, and health-data requests may require proportionate authentication to protect your information. We do not require identity verification for a California sale/sharing opt-out, a recognized opt-out preference signal, or a covered request to limit sensitive-information use. We do not ask for unnecessary health information to authenticate a request.

We respond within the period required by the applicable law and explain any permitted extension or refusal. To appeal, reply to our decision or email the same address and ask us to review it. “Privacy Appeal” in the subject line helps us route your message but is not required. We provide the applicable appeal outcome and regulator complaint information. Washington and Nevada health-data deadlines and appeal routes are stated in the Consumer Health Data Privacy Notice.

We do not unlawfully discriminate or retaliate against you for exercising privacy rights. Some information is necessary for a service you request, such as an address to deliver an order; if a request affects our ability to provide that service, we will explain why.

California Residents

Where the California Consumer Privacy Act, as amended (“CCPA”), applies, California residents have rights to know and access the categories and specific pieces of personal information collected about them; receive information about sources, purposes, and disclosure recipients; obtain a portable copy; correct inaccurate information; request deletion subject to lawful exceptions; opt out of sale or sharing; limit covered uses or disclosures of sensitive personal information; and receive equal treatment when exercising those rights.

Section 3 describes the categories involved in the services covered by this Policy and the related purposes, sources, recipients, and retention criteria. Health information and information concerning sex life or sexual orientation, when processed, receive the additional protections in the Consumer Health Data Privacy Notice. We do not use consumer health data to infer characteristics for advertising. We do not knowingly sell or share personal information of consumers under 16.

Use the methods in Sections 5 and 8 to exercise your rights. For covered requests to know, correct, or delete, we confirm receipt within 10 business days and respond within 45 calendar days after receipt, subject to a permitted extension of up to 45 additional calendar days that we explain within the initial period. Verification does not restart that response period. We implement a covered sale/sharing opt-out as soon as feasibly possible and no later than 15 business days after receipt. Opt-outs and recognized opt-out signals do not require identity verification.

Security and Children

We use reasonable administrative, technical, and physical safeguards and restrict access according to the relevant purpose. No system can guarantee absolute security.
Our website, quiz, and products are intended for adults 18 and older and are not directed to children. We do not knowingly collect personal information from children under 13. Contact support@bonpharm.com if you believe a child has submitted personal information so we can address it under applicable law.

Other Services

A website reached through an external link or a payment service you independently choose may handle information under its own notice. This does not authorize undisclosed tracking by tools embedded in our website or override our restrictions on the information we disclose.

Changes to This Policy

We post updates here with a revised date. For material changes, we provide a prominent website notice and any direct notice required by applicable law. When appropriate contact information is available, required direct notices may be sent by email. We obtain any legally required consent before beginning a new processing purpose or introducing new health-data categories or disclosures that require consent. Merely posting a revised policy or your continuing to browse does not replace that consent. For questions, requests, or an accessible copy of this Policy, contact support@bonpharm.com.