Consumer Health Data

Last updated November 11, 2026

This is our consumer health data privacy policy. It explains how MONOTY LLC ("UMBER", "we", "us" or "our") collects, uses, shares and keeps safe consumer health data, as defined by Washington's My Health My Data Act (Chapter 19.373 RCW), Nevada's consumer health data law (Senate Bill 370 of 2023) and similar rules in other states, such as Connecticut. It adds to our Privacy Policy, which explains how we handle all other personal information.

Effective date: November 10, 2026. We apply this policy to every customer in the United States, wherever you live.

The shop does not take orders yet. Until online payment opens, no order can be placed or paid, and the only consumer health data we may receive is what you choose to tell us by e-mail.

In short

• We sell dietary supplements. Buying a supplement can reveal an interest in your health, and so can what you tell us about a reaction, a medication, a pregnancy or a condition. We handle all of it as consumer health data.
• We collect it only to fulfill your order and to answer you: to sell, pack, ship and deliver what you bought, handle a cancellation, a return or a claim, and handle a reaction report.
• We share the contents of your orders only with the companies that take your payment and deliver your order. A reaction report goes to the maker of the product and to the FDA only when needed, with as little personal detail as possible.
• We never sell it. We never use it for advertising, targeted advertising or profiling, and no other company can track you through our website.
• We have no app and no customer accounts, and we never ask about your health to sell you a product.
• You can confirm, access, delete or correct your consumer health data, withdraw your consent and appeal our decisions, by e-mailing contact@umberdrops.com with "Health data request" in the subject line.

What consumer health data means

These laws define consumer health data broadly. It is personal information that is linked, or can reasonably be linked, to you and that identifies your past, present or future physical or mental health status. It can include information about a condition, a medication, a reaction or a symptom, the purchase of a product related to health, such as a dietary supplement, and conclusions drawn from other information, such as what a person buys.

We do not diagnose anything, and we draw no conclusions about you. Because our products are dietary supplements, we handle the information below as consumer health data, even where the law might not require it.

The consumer health data we collect

What we do not collect

• No app and no accounts: we have no app, no customer accounts and no newsletter.
• No precise location: we do not collect precise geolocation, and we never set up a virtual boundary (a geofence) around any place, including places where people receive care.
• No biometric or genetic data.
• No tracking: our website uses no analytics, no advertising pixels and no scripts from other companies. No third party can collect information about what you look at on our website, or about your online activities over time and across different websites, through our pages.
• No health questions: we never ask about conditions, diagnoses or medicines to sell you a product, and we do not buy information about you from anyone. If you report a reaction, we may ask only what is needed to understand it and, where the law requires, to report it to the FDA.
• No inferences: we draw no conclusions about your health from what you buy.

Why we collect and use it

We collect and use consumer health data only for these purposes:

• to process, pack, ship, import and deliver your order;
• to answer your questions and to handle cancellations, returns, claims and refunds;
• to handle reaction reports, keep the adverse event records that federal law requires for dietary supplements, report a serious adverse event to the FDA when the law requires it, and look into a batch with the maker;
• to contact you about a recall or a safety notice for a product you bought;
• to keep the tax and accounting records the law requires;
• to detect and stop fraud, and to assert our rights, as the law allows.

We do not use it for marketing, advertising, profiling or any other purpose.

Your consent

We collect and use consumer health data only as needed to provide the product or service you asked for: an order, an answer, a return, a claim or the handling of a reaction report. When you place an order or write to us, that is the request we act on.

If we ever wanted to collect or use consumer health data for any other purpose, we would first ask for your consent, in a clear request of its own. We would ask for a separate consent before sharing it for any purpose other than providing what you asked for. Without that consent, we do neither. In particular, we ask for your consent before we pass on your name or contact details with a reaction report to the maker of a product. Without it, the report goes without them.

You can withdraw a consent at any time by e-mailing contact@umberdrops.com. We then stop the use that consent covered. Withdrawing it does not undo what was done before, and it does not stop what we need to do to complete an order you placed or to meet our legal duties.

Who receives it

We share consumer health data only with the recipients below, only what each one needs, and only for the purposes above.

To complete your order: payment and delivery only

• The payment processor, once online payment opens: the amount of your order and, where needed for the receipt or for fraud screening, the items in it.
• Delivery: our partner warehouse overseas, the carriers and the customs brokers, which receive your name, delivery address, a phone number if you give one, and the order contents, which appear on the customs declaration of the package.

Our service providers, acting only for us

These providers act on our behalf, under contracts or terms that bind them to use it only for us. They do not use it for themselves.

• Our e-mail provider: stores and delivers the e-mails we exchange with you.
• Our website hosting provider: the technical information any website receives when you visit, including the pages you open. We do not link it to your name or your orders.
• The people who help us run the shop: they handle orders and answer messages for us, under a duty of confidentiality, and may work from outside the United States.
• Our accountants and lawyers, when needed.

For a reaction report

• The maker of the product, so it can look into the batch: the report, without your name or contact details unless you agree.
• The U.S. Food and Drug Administration, when federal law requires a serious adverse event to be reported, with the details the law requires.

When the law requires it

• Authorities: customs and tax authorities, courts or law enforcement, when the law requires it.
• A buyer or successor of our business, if we are involved in a merger, acquisition or reorganization. Your consumer health data would remain covered by this policy.

We do not share consumer health data with any affiliate. On request, we give you the list of the companies that received your consumer health data, with an e-mail address or another online way to contact each of them.

We do not sell it or use it for advertising

• We do not sell consumer health data, and we have never sold it.
• We do not use it, or share it, for advertising, targeted advertising, retargeting or marketing of any kind.
• We do not build profiles, and we do not use it to make decisions about you.
• If this ever changed, we would update this policy first and ask for your consent, or your signed authorization where the law requires one, before doing anything else.

How we keep it secure

Access to consumer health data is restricted to the people and service providers who need it to deliver and look after your order, and they are bound to keep it confidential. We use reasonable administrative, technical and physical safeguards suited to the information we hold, our website is served over an encrypted HTTPS connection, and our service providers must keep what they receive secure. No website or e-mail service is completely secure. If a security breach affects your information, we will notify you as the law requires.

How long we keep it

• Order records, including the items bought: as long as tax and accounting laws require, generally 7 years after the order.
• E-mails, returns and claims: 3 years after our exchange ends, or longer if needed for a dispute or a legal claim.
• Reaction reports: 6 years after the report, the period federal law sets for dietary supplement adverse event records, or longer if a pending claim requires it.

When we no longer need information, we delete it or make it anonymous.

Your rights

Whatever state you live in, you can:

• Confirm: ask us whether we collect, share or sell your consumer health data. We never sell it.
• Access: get a copy of the consumer health data we hold about you, with the list of all third parties and affiliates with which we shared it, and an e-mail address or another online way to contact each of them.
• Delete: ask us to delete your consumer health data. We delete it from our records and tell every service provider and third party that received it to delete it too. Copies kept in archives or backups are deleted within 6 months after we confirm your request. If the law requires us to keep something, such as a tax record or an adverse event record, we tell you what and why.
• Correct: see your consumer health data and ask us to correct anything inaccurate.
• Stop: ask us to stop collecting or sharing your consumer health data. We may then be unable to complete an order or answer a question that needs it, and we will tell you if so.
• Withdraw consent: withdraw any consent you gave us, at any time.
• No discrimination: we will not deny you products, charge you a different price or give you a different level of service because you used any of these rights.

How to use your rights

E-mail contact@umberdrops.com with the subject line "Health data request". Tell us which right you want to use and your state of residence, and include the e-mail address you used with us and, if you have one, an order number. Please do not send more health details than your request needs.

• Verification: to keep your information safe, we verify each request before acting on it, usually by matching the details you give us with our records and confirming by e-mail from the address you used with us. We may ask for one more detail from a past order, such as its date. We use what you give us for verification only to handle your request.
• Authorized agents: where your state's law allows it, an authorized agent can make a request for you with your signed written permission or a valid power of attorney. We may also ask you to confirm your identity and the permission directly with us.
• No charge: there is no charge for up to two requests in any 12 months. Beyond that, or for a request that is manifestly unfounded, excessive or repetitive, we may charge a reasonable fee or decline it, where the law allows, and we tell you why.
• Response times: we confirm receipt within 10 business days and respond within 45 days after we receive your request. If we reasonably need more time, we may take up to 45 more days, once, and we tell you why within the first 45 days.

Appeals

If we decline your request, in whole or in part, we explain why. You can appeal by replying to our answer or by e-mailing contact@umberdrops.com with the subject line "Health data appeal", within a reasonable time after our decision. We respond in writing within 45 days after we receive your appeal, explaining what we decided and why.

If we deny your appeal, you can file a complaint with the Attorney General of your state:

• Washington: the Washington State Office of the Attorney General, online at atg.wa.gov/file-complaint.
• Nevada: the Office of the Nevada Attorney General, at ag.nv.gov.
• Other states: the Attorney General of your state. We will tell you how to reach the right office in our answer to your appeal.

Changes to this policy

We will post any change to this policy on this page, with an updated effective date and "last updated" date. If a change is material, for example another category of consumer health data, another purpose or another kind of recipient, we will tell you before it takes effect, by e-mail to the address used with us and with a notice on our website, and we will ask for your consent where the law requires it. We never use consumer health data we already hold for any other purpose without your consent.

Contact

For any question or request about your consumer health data, e-mail contact@umberdrops.com. We reply within 2 business days, and we handle formal requests within the times given above. Our mailing address is 30 N Gould St Ste R, Sheridan, WY 82801, United States, also on our Seller Information page.