Consumer Health Data Privacy Policy

Effective date: 18 September 2026

This Consumer Health Data Privacy Policy supplements the OnyGuard Privacy Policy and explains how OnyGuard, operated by Prolong Lab, UAB ("OnyGuard", "we", "us", "our"), collects, uses and shares consumer health data, and how you can exercise your rights over it. It applies to residents of Washington (under the My Health My Data Act), Nevada (under Senate Bill 370) and Connecticut (under the Connecticut Data Privacy Act as it applies to consumer health data), and to any other person to whom a comparable consumer health data law applies. Where this policy conflicts with the Privacy Policy, this policy controls for consumer health data.

1. What counts as consumer health data

"Consumer health data" means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status. In our business this can include:

Purchase and browsing records for products that relate to health concerns, such as fungal nail and foot conditions, nail and skin health, and foot care.
Information you volunteer about your symptoms, how long you have had a condition, medications, pregnancy or nursing status, allergies or skin sensitivity, for example in a support email, a product review or a survey.
Photographs of nails, feet or skin that you send us in support of a refund, replacement or warranty claim.
Inferences we or our service providers draw from the above, such as an interest in treating a fungal nail condition.

We do not collect precise location, biometric or genetic data, diagnoses from a healthcare provider, prescription records, or information about reproductive or sexual health. Payment card details, delivery addresses and account credentials are personal information covered by the Privacy Policy but are not consumer health data.

2. Sources of consumer health data

Directly from you, when you place an order, complete a form, subscribe to email or text messages, leave a review, or contact customer support.
Automatically, through cookies, pixels, software development kits and similar technologies on our website, which record the pages and products you view and the items you add to your cart.
From service providers acting on our behalf, such as our e-commerce platform, checkout provider, payment processors, fulfilment partners and customer support tools.

3. Why we collect and use consumer health data

To sell, deliver and support the products you order, including processing payments, shipping, returns, warranty claims and subscriptions.
To respond to your questions and provide customer support.
To personalise product recommendations and content on our website.
To send marketing communications you have consented to receive.
To measure the performance of our website and advertising.
To detect fraud, enforce our Terms of Service and comply with legal obligations.

We do not use consumer health data to make decisions that produce legal or similarly significant effects on you.

4. Sharing consumer health data

We share consumer health data only as described here and, where the law requires it, only with your consent.

Service providers and processors. Our e-commerce platform (Shopify), our checkout and subscription provider (Checkout Champ), payment processors (including Shopify Payments, PayPal and Solidgate) and acquiring banks, fulfilment and shipping partners (ShipBob and the carriers who deliver your order), customer support tools (Commslayer), email and text messaging providers (Klaviyo), review platforms (Yotpo), and affiliate tracking providers (Everflow). These parties process the data under contract on our behalf and may not use it for their own purposes.

Session replay. Microsoft Clarity records how visitors use our pages. It is configured to mask the text you type, so it does not capture what you enter into form fields, payment card details or passwords. Microsoft may also use that data to improve its own services under its terms, so we treat Microsoft Corporation as a third party for consent purposes.

Advertising partners. Meta Platforms, Inc. (Facebook and Instagram) and Google LLC (Google Ads and Google Analytics), and Microsoft Advertising, may receive limited data about your interaction with our website through pixels and similar technologies. Because our product names and web addresses describe what the products are for, this can include the health-related products you view or buy. Where consumer health data law applies to you, we do this only with your consent, which you give through a specific consent request on our website that names the health-related data involved, separately from your consent to our collecting it, and which you can withdraw at any time as described in Section 6. When you withdraw consent we stop sharing consumer health data with advertising partners from that browser or device and, where we can link the device to your account, from your account.

We do not send symptom descriptions, photographs, support conversations or any diagnosis to advertising partners.

Affiliates. Prolong Lab, UAB is the only entity in our corporate group that receives consumer health data. We will update this policy if that changes.

Legal and business reasons. We may disclose consumer health data to comply with the law, respond to lawful requests, protect our rights or the safety of others, or in connection with a merger, acquisition or sale of assets, subject to the same protections.

We do not sell consumer health data. We do not share consumer health data with third parties for their own marketing purposes. We do not use geofencing around any facility that provides health care services.

Washington's My Health My Data Act requires a separate, signed authorisation before any sale of consumer health data. We will not sell your consumer health data unless you first give us that written authorisation, which you could revoke at any time. We have no plans to seek one.

5. Your rights

If you are a resident of Washington, Nevada or Connecticut, or another state that gives you comparable rights, you may:

Confirm and access. Confirm whether we collect, share or sell your consumer health data, access that data, and receive a list of the third parties and affiliates with whom we have shared it, with a contact address for each of them.
Withdraw consent. Withdraw your consent to our collection or sharing of your consumer health data.
Delete. Have your consumer health data deleted, including from our service providers and processors, and from any third party we shared it with, as far as the law requires.
Appeal. Appeal a decision we make about your request.

These rights are not absolute and may be limited where the law allows, for example where we need to keep order records to comply with tax or accounting rules.

We will not discriminate against you for exercising your rights.

6. How to exercise your rights

Email support@onyguard.com with the subject line "Consumer Health Data Request" and tell us which right you are exercising.
Call +1 (888) 530-7470 (toll-free, United States).
Write to Prolong Lab, UAB, Dominikonų g. 11, LT-01131 Vilnius, Lithuania.
To withdraw consent to sharing with advertising partners, use our Your Privacy Choices page, or turn on the Global Privacy Control signal in your browser, which we honour as an opt-out of sharing for that browser.

We will confirm receipt of your request within 10 business days and respond within 45 days. If we need more time, we will tell you why and may extend the deadline by up to 45 additional days. We will need to verify your identity before acting on your request, usually by matching the email address on your order, and we will not ask for more information than we need to do so. You may authorise an agent to act for you; we will ask the agent for proof of your authorisation.

Appeals. If we decline your request, you may appeal by replying to our decision or by emailing support@onyguard.com with the subject line "Consumer Health Data Appeal" within 60 days. We will respond in writing within 45 days.

7. Retention and security

We keep consumer health data only as long as we need it for the purposes above, then delete or de-identify it. Order records are kept for the period required by tax and accounting law. Support messages are kept for 36 months, and photographs submitted with a claim for 12 months after the claim is closed. Marketing, analytics and advertising data is kept for the periods stated under "How long we keep your information" in the Privacy Policy: analytics and advertising data no longer than 24 months, and marketing contact details until you opt out or 24 months after your last interaction with us.

We protect consumer health data with the administrative, technical and physical safeguards described in the Privacy Policy, and we require our processors to do the same.

8. Changes to this policy

We will post any changes on this page and update the effective date. If a change materially reduces your rights, we will give you notice and, where the law requires, ask for your consent before applying it to data we already hold.

9. Contact

Prolong Lab, UAB, trading as OnyGuard Dominikonų g. 11, LT-01131 Vilnius, Lithuania support@onyguard.com +1 (888) 530-7470