Privacy Policy

Last updated: August 12, 2026

Vitalyx Bio, LLC (‘Vitalyx Bio,’ ‘we,’ ‘us,’ or ‘our’) respects your privacy. This Privacy Policy explains what information we collect when you visit vitalyxbio.com or place an order, how we use it, who we share it with, how long we keep it, and the rights you have over it. By using our website or placing an order, you agree to the practices described below.

1. Information We Collect

We collect only the information needed to operate our store, fulfill your orders, document required compliance records, and communicate with you.

Information you provide:

• Account details: name, username, and a password (passwords are stored in encrypted/hashed form)
• Contact details: email address and phone number
• Shipping and billing address
• Order details: the products you purchase, quantities, and order totals
• Any information you include when you contact us through our contact form or by email

Information collected automatically: When you visit the site, our servers and standard web technologies may record your IP address, browser and device type, and the pages you view, through server logs, essential cookies, and the analytics and session-recording tools described in Section 3.

Checkout Form Data. To help us follow up with customers who begin but do not complete an order, we may collect the information you enter into checkout form fields (such as name, email, phone number, and shipping address) as you fill them in, even if you do not complete your purchase. This information is used solely to contact you about your order and is handled according to the same data practices described elsewhere in this policy. You may opt out of this and other data collection at any time — see Section 7.

Research-use attestation record: Before completing checkout, you are asked to affirmatively check a box confirming that you are acquiring products solely for lawful research use and agreeing to our research-use terms. When you do, we create a compliance record of that agreement that includes the IP address you checked out from, a timestamp, and a cryptographically hash-chained copy of the agreement text you accepted. We collect and keep this record specifically to document that you attested to research-only use — it is a compliance and legal-recordkeeping measure, not general tracking, and it exists so we can show, if ever asked by a regulator, payment partner, or in a dispute, that a given order was accompanied by a signed research-use agreement.

Payment information we do NOT collect or store: We do not collect or store credit-card numbers, debit-card numbers, or bank-account credentials. Orders are paid by Zelle or Venmo, which are operated by third parties under their own privacy policies. We receive only confirmation that a payment has been sent, matched to your order number.

2. How We Use Your Information

• Process, fulfill, and ship your orders
• Send order confirmations, payment instructions, and shipping updates
• Respond to your questions and support requests
• Document and verify research-use attestations at checkout, and produce that record if needed to demonstrate compliance
• Detect, prevent, and investigate fraud, chargebacks, or abuse
• Meet our legal, accounting, and tax obligations
• Understand and improve how visitors use our website (see Section 3)
• Send marketing emails only if you have opted in; you can unsubscribe at any time

We do not sell your personal information.

3. Cookies, Analytics, and Session-Recording Tools

We use essential cookies that are necessary for the shopping cart, checkout, and account login to function.

We also use the following third-party analytics tools to understand how visitors use our site and to improve it:

• Google Analytics 4 (GA4) and Google Search Console (accessed through Google’s Site Kit plugin): these collect information such as pages viewed, device and browser type, approximate location, referral source, and search terms that brought you to our site.
• Microsoft Clarity: this tool records session activity on our site, including mouse movements, clicks, scrolling, and page navigation, and generates heatmaps of visitor behavior. It also collects device/browser information and IP address. We use Clarity to identify usability problems and improve the site experience. We are disclosing this explicitly because session-recording tools like Clarity can capture on-page interactions in more detail than typical analytics, and we want you to know it is in use before you browse or check out.

These tools are operated by Google and Microsoft under their own privacy policies, and the data they collect is processed on servers we do not control. You can limit or block these tools by adjusting your browser’s cookie settings, using a browser extension that blocks analytics/tracking scripts, or by opting out directly through the tool provider (for example, Google’s Ads Settings or opt-out browser add-on for Analytics, or Microsoft’s guidance on Clarity at clarity.microsoft.com). Blocking these tools does not affect your ability to shop or check out, though some site features may behave differently.

4. Compliance and Order Records We Maintain

In addition to standard order records, our backend systems maintain the following records for order fulfillment, customer service, and compliance/recordkeeping purposes:

• Order and contact records: your name, contact details, addresses, and order/purchase history, used to fulfill orders and respond to support requests.
• Research-use attestation records: described in Section 1, kept to document that a research-use agreement was signed for a given order, including the IP address and timestamp of that agreement.
• Transactional email records: a log of account- and order-related emails we send you (for example, order confirmations, payment instructions, and shipping updates), kept so we can verify what was sent and when if a question or dispute arises.
• Anonymous site-access log: when a visitor confirms they meet our age/researcher-gate requirement before entering the site, we log that confirmation. This log is tied to the browsing session, not to a named individual, unless that visitor goes on to place an order.

5. How We Share Information

We share the minimum information necessary with trusted service providers who help us run the business, each of whom may use it only to provide services to us:

• Hosting and infrastructure providers that operate our website, CRM, and database
• Email providers used to send order, support, and shipping messages
• Shipping carriers (such as USPS, UPS, or FedEx), which receive your shipping address and order number to deliver your package
• The payment service you choose (Zelle or Venmo), which you interact with directly
• Analytics and session-recording providers described in Section 3 (Google, Microsoft), which receive the data described in that section

We may also disclose information when required by law (for example, a subpoena, court order, or regulator request) or to protect our legal rights, our customers, or the public. We do not sell or rent your personal information.

6. How Long We Keep Your Information

We keep your account and order information for as long as your account is active or as needed to provide our services, and longer where we are legally required to (for example, tax and accounting records).

Research-use attestation records are retained indefinitely. Unlike most of the data described in this policy, these records exist specifically so we can demonstrate, at any point in the future, that a given order was accompanied by a signed research-use agreement — including if a claim or dispute arises years after the original purchase. Because that need doesn’t expire on a fixed schedule, we do not delete or anonymize these records on a set timeline. They are stored with field-level encryption (see Section 8) specifically because we are keeping them long-term.

Anonymous site-access logs (the age/researcher-gate confirmation described in Section 4) are retained for 12 months from the date of the visit, after which they are automatically deleted. Unlike the attestation record, this log has no ongoing compliance purpose beyond routine security monitoring, so we don’t keep it indefinitely.

When you ask us to delete your data, we remove or anonymize it except where we must retain it to meet a legal obligation, defend a legal claim, or maintain required compliance documentation — including the research-use attestation records described above. If that applies to your request, we will tell you which specific records we are retaining and why.

7. Your Rights

Depending on where you live, you may have the right to access, correct, or delete the personal information we hold about you, and to opt out of marketing. California residents have rights under the CCPA/CPRA, including the right to know what personal information we collect, to delete it, to correct it, and to opt out of the sale or sharing of personal information (we do not sell or share your personal information). If you are in the EEA, UK, or Switzerland, you have rights under the GDPR, including access, portability, and the right to object to or restrict processing.

To exercise any of these rights, including requesting a copy of or deletion of your order records, attestation records, or email records, email us at support@vitalyxbio.com from the address associated with your order, and we will respond within 30 days. As noted in Section 6, some records may be retained even after a deletion request where we have a legal or compliance basis to keep them, and we will explain that to you if it applies.

You can also limit analytics and session-recording data collection going forward using the browser settings and opt-out options described in Section 3.

8. Data Security

We protect your information using industry-standard safeguards, including TLS/SSL encryption in transit and access controls. Research-use attestation records, including the IP address associated with each attestation, are additionally encrypted at the database level (field-level encryption), so that data remains protected even in the underlying storage. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident.

9. Children’s Privacy

Our website and products are intended only for adults aged 21 and older who are qualified researchers or professionals. We do not knowingly collect personal information from anyone under 18. If we learn we have collected information from a minor, we will delete it.

10. International Visitors

Vitalyx Bio is operated from the United States. If you visit our site from outside the U.S., your information will be transferred to and processed in the United States, which may have different data-protection laws than your country.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The version posted on the site at the time you visit or place an order is the version that applies. We will update the date above when we make changes.

12. Contact Us

For any privacy question or data request, contact us at support@vitalyxbio.com.

For Research Use Only. All products sold by Vitalyx Bio are intended strictly for laboratory and analytical research purposes. They are not for human or veterinary use, consumption, or any therapeutic or diagnostic application. We do not sell to patients. The statements made on this website have not been evaluated by the U.S. Food and Drug Administration. Our products are not intended to diagnose, treat, cure, or prevent any disease. Vitalyx Bio is a chemical supplier; it is not a compounding pharmacy or chemical compounding facility as defined under Section 503A of the Federal Food, Drug, and Cosmetic Act, and is not an outsourcing facility as defined under Section 503B. Human and animal consumption is prohibited — laboratory / in-vitro experimental use only.