Privacy Notice

Who we are

One Bio Inc., 2535 Capitol Oaks Dr. Ste 130, Sacramento, CA 95833. Contact: vitality@one.bio.

What we collect

Contact details. Your name, email, phone and shipping address, from your Vitality signup and the app. Needed to take part.

Daily dose log. Each time you tap “I took my fiber” or log an earlier dose, with the time. Needed to take part.

Weekly check-in answers and surveys. How you felt, energy, sleep quality, digestive comfort, bloating or gas, stool form and bowel movement frequency, hunger, mood and stress, doses missed, and any note you write about illness, travel, antibiotics or diet. Needed to take part. To submit a check-in you answer every question, but you can do it later. We may also send you short surveys, which are optional.

Device data (optional). Depending on the devices you connect: on iPhone, from Apple Health: heart rate, resting heart rate, heart rate variability, breathing rate, blood oxygen, sleeping wrist temperature, sleep, steps, active energy, workouts and VO2 max; heart rate and sleep from smartwatches through Health Connect on Android; glucose readings from Lingo, Stelo or Dexcom G7; weight and body fat from scales. It comes from Apple Health or Health Connect, only after you connect and approve. If you connect an Oura ring, the app checks its sleep, readiness, heart rate and battery on your phone to confirm the connection works. In this version of the app it does not send those readings to us. We receive only whether the connection is working and when it last delivered data.

Connection and app information. Which connected devices sent data recently and when, whether notifications are on, app version, phone model and operating system version, and crash reports that Apple or Google pass to us if you share them with developers. Needed for the app to work.

Consent records. Which versions of the Consent, Privacy Notice and Participation Terms you accepted, your optional choices, and when.

We do not collect your precise location, contacts, photos, advertising identifier or browsing activity. The app has no advertising and no third-party analytics.

How we use it

We treat two kinds of data differently.

Your answers (doses, check-ins, survey responses):

• To run the program: store your logs and check-ins, check that your devices are working, tell you if one stops sending data, and send reminders.
• To provide you personalized insights into how our products affect your lifestyle and the way you feel.
• To analyze data inside One Bio, including to understand how fiber relates to how people feel and to improve our products and services.
• To keep the app secure, fix problems and prevent misuse.
• To meet legal obligations.

After de-identifying them, we also may use your answers to develop, train and test machine-learning models, and use summaries made from de-identified, combined answers in marketing and in materials shared with investors and partners. We may also show investors and partners de-identified, combined measures of how people use the app, such as how consistently doses are logged, how many people complete check-ins and how long people stay in the program. These come from answers and app activity, never from device data. We cannot take back data already used to train a model.

Your device data (from Apple Health, Health Connect, Oura, WHOOP, Dexcom or any other device you connect):

• To give you personalized insights in the app.
• To analyze it inside One Bio, to check that the app and its insights work, to improve our app and products, and to understand how our fiber relates to your device readings and the way you feel.
• To keep the app secure and to meet legal obligations.

We do not use device data for marketing or advertising, and we do not use it to train or test machine-learning models. We do not show device data, or summaries, numbers or charts made from it, to investors, partners or anyone outside One Bio.

What we do not do

• We do not sell your information.
• We do not use your health, fitness or device data to target advertising to you or to anyone. We do not use device data for marketing at all. Marketing uses of your answers are limited to de-identified, combined summaries.
• We do not train or test machine-learning models on device data, and we do not put device data, or anything made from it, in material for investors, partners or marketing.
• We do not use your name, photo or an identifiable personal story anywhere, including in marketing, without your separate written permission.
• We do not use data from Oura, WHOOP or Dexcom, or data that reaches us through Apple Health or Health Connect, in ways those companies’ or platforms’ terms forbid. Where a device company requires shorter retention or faster deletion for its data, we follow that.

De-identified data

Where we say “de-identified”, we mean data from which we have removed your name, email, phone, address, account and device identifiers, and any code that links it back to you, and from which we do not think you could reasonably be identified. We also remove or scrub free-text notes and replace exact dates and times with less precise ones. We publicly commit not to try to re-identify de-identified data, and we require anyone we give it to (for example a service provider) to make the same commitment in writing. Detailed answers and notes can sometimes be linked back to a person when combined with other information, so a small risk remains.

Who we share it with

• Service providers that host or process data for us under contract and only on our instructions: cloud hosting, email and text messaging, support tools, and tools that help us analyze de-identified answers.
• The device companies you connect. They send data to us at your direction, and they have their own privacy policies. We do not send your program data back to them.
• Legal and safety. If the law requires it, such as a valid court order, or to protect someone’s safety, after we assess the request. Where allowed, we tell you first.
• A business transfer. If One Bio is sold or merged, your data may transfer to the new owner, who must honor this notice. We will tell you and let you delete your data before it transfers.
• Investors and partners receive only de-identified, combined summaries of your answers and of how people use the app (such as adherence and retention). They never receive device data, or anything made from it.

Your choices and rights

• Device data is optional. Skip it at sign-up, or later from the Devices tab, or turn off access in Apple Health or Health Connect. That stops new data.
• Leave the program (Settings, Your data, or email vitality@one.bio). We stop collecting. Within 45 days we de-identify the data we hold about you and keep the de-identified data, including anything already combined into analyses or models.
• Delete your data (Settings, Your data, or email vitality@one.bio). Within 45 days we delete the data we hold about you from our systems and from our service providers. We may extend once by 45 days if we tell you why. Backups are removed as they rotate out, within 35 days. We cannot remove data that was already de-identified or combined into analyses or models before your request.
• Access, correction and a copy. You can ask what we hold about you, ask us to correct it, and ask for a portable copy. We respond within 45 days, extendable once by 45 days with notice.
• Withdraw consent for device data at any time. It does not affect what we did before.
• If we decline a request, you can ask us to reconsider. We will answer in writing and tell you how to contact your state attorney general.
• You will not be treated worse for using these rights.
• Marketing from Vitality (emails and texts) is separate. Unsubscribing does not affect the program, and we do not use your individual health answers or device data to target that marketing.

Consumer health data

Some states give extra protection to “consumer health data”, which includes things like your heart rate, sleep, glucose, weight and symptoms.

• We collect it only from you and your devices, with your consent, as described above.
• We use it only for the purposes above, and share it only with the recipients above.
• You can withdraw consent, ask for access, ask us to delete it, and ask for a list of the third parties we have shared it with.
• We do not sell consumer health data, and we do not collect or share it to target advertising.

How long we keep it

We keep your data for as long as we run this program and develop our products, which may be indefinitely. It stays linked to you until you leave or ask us to delete it. We keep consent records for six years after you leave or ask us to delete your data, so we can show what you agreed to. Some device companies require shorter retention or faster deletion for their data, and we follow that. In this version of the app we do not receive readings from Oura’s service, and we do not receive data directly from Dexcom.

How we protect it

We use encryption in transit and at rest, and we limit access to people who need it. Device access tokens are kept in secure storage on your phone. No system is perfectly secure. If a breach affects your information we will tell you, and regulators where required, within the time the law allows.

Where it is stored

In the United States, on Amazon Web Services servers in Northern Virginia. The app is for people in the United States and is offered only there.

Children

The app is for adults 18 and older. We do not knowingly collect information from anyone younger. If you think a child has given us information, contact vitality@one.bio and we will delete it.

Android

The Android version of the app is experimental. This notice applies, but some devices may not connect or send data yet.

Changes to this notice

If we make a material change, we will tell you in the app or by email before it applies to data you have already given us, and where the law requires we will ask for your consent again. The version is shown in the app.

Contact

vitality@one.bio, One Bio Inc., 2535 Capitol Oaks Dr. Ste 130, Sacramento, CA 95833.