ORABIO LABS - PRIVACY POLICY

Effective Date: 09/15/2026
Last Updated: 09/15/2026

1. Who We Are and What This Policy Covers

ORABIO LABS LLC, a Wyoming limited liability company (“Orabio Labs,” “we,” “us,” or “our”), operates orabiolabs.com (the “Site”).

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit our Site, purchase products, create an account, subscribe to email or text messages, or communicate with us.

Our online store uses Shopify, and payments are handled through Whop and its payment partners.

“Personal information” means information that identifies, relates to, or can reasonably be linked to an individual or household, as defined by applicable law.

Our business serves the United States market. Privacy rights may depend on your state of residence, the nature of the information, and whether a particular law applies to our business.

This Policy provides information about our practices. Visiting the Site, making a purchase, or accepting our Terms of Service does not, by itself, constitute consent to marketing messages, advertising tracking, or another activity requiring separate consent.

2. Personal Information We Collect

The information involved depends on how you interact with us and which services you use.

Payment details entered during a Whop transaction are processed by Whop or its payment partners. Depending on the payment method and integration, we receive transaction information needed to administer the order, which may include a payment reference, payment status, billing information, and limited payment-method details.

Do not send full payment-card numbers, security codes, passwords, or unnecessary identity documents through ordinary email or customer support messages.

Additional collection practices:
[INSERT WHETHER THE BUSINESS OR ITS INTEGRATIONS COLLECT GOVERNMENT-ID IMAGES, SELFIES OR BIOMETRIC DATA, PRECISE LOCATION, CALL RECORDINGS, SESSION REPLAYS, OR CREATE CUSTOMER PROFILES OR INFERENCES. IDENTIFY THE DATA, PURPOSE, AND PROVIDER FOR ANY SUCH PRACTICE; STATE “NONE” WHERE APPLICABLE.]

Where information is necessary to complete a purchase or a reasonable eligibility check, we will identify that requirement. Without the necessary information, we may be unable to provide the requested service.

3. Where Information Comes From

We obtain personal information:

• Directly from you, including through checkout, account features, subscription forms, privacy requests, and customer support.

• Automatically through the Site, including through Shopify, server logs, cookies, and the technologies described in Section 7.

• From Whop and payment partners, including transaction confirmations, payment status, refunds, and information relevant to payment disputes or fraud prevention.

• From shipping and fulfillment providers, including delivery status and information needed to resolve shipping problems.

• From our communication providers, including subscription status, message delivery information, and unsubscribe requests.

• During eligibility reviews, from information you supply and, where reasonably necessary, relevant public business or institutional sources.

We combine information from these sources when reasonably necessary for the purposes described in this Policy.

4. How We Use Personal Information

We use personal information to:

1. Operate the Site and provide account features.

2. Process, fulfill, deliver, cancel, and refund orders.

3. Communicate about payments, delivery, support requests, recalls, and other product concerns.

4. Verify purchasing eligibility, including our minimum age requirement and legitimate laboratory research purpose.

5. Detect and investigate fraud, unauthorized access, security incidents, and suspected prohibited product use.

6. Maintain accounting, tax, transaction, and compliance records.

7. Send email and SMS marketing in accordance with your choices and applicable law.

8. Understand Site performance and marketing effectiveness through the practices disclosed in Section 7.

9. Respond to privacy requests and maintain records of consent and opt-out choices.

10. Comply with legal obligations, respond to valid legal process, and establish or defend legal claims.

Where consent is required, we obtain it before the relevant processing. We do not treat a general acceptance of this Policy as a substitute for that consent.

Before using information for a materially different purpose, we will provide any notice and obtain any consent required by applicable law.

5. Shopify, Whop, and Communication Providers

5.1 Shopify

Shopify provides the platform supporting our online store. Information about your visits, account activity, and purchases is processed through Shopify to operate the store and provide related services.

Shopify processes certain information on our behalf. Depending on the services used, Shopify may also process information for purposes for which it is independently responsible.

For more information, review the Shopify Consumer Privacy Policy.

Shopify Network Intelligence status: [INSERT ENABLED OR DISABLED].

When enabled, Shopify Network Intelligence allows Shopify to use information from interactions with our store together with information from interactions with other merchants and Shopify to provide enhanced services. These can include improvements, personalization, and advertising-related features. Information may be processed by Shopify and relevant third parties in other countries.

The enhanced services active for our store and any associated advertising disclosures are identified in Section 7. Shopify also provides information and privacy controls through its Privacy Portal.

5.2 Whop Payments

We use Whop to facilitate payments. When you complete a transaction through a Whop checkout or payment interface, Whop and its payment partners process the information needed to handle that transaction, provide payment services, prevent fraud, and meet their legal obligations.

We exchange relevant order and transaction information with Whop to confirm purchases, reconcile payments, provide support, process refunds, and address disputes.

Whop may process information for its own payment, security, compliance, and platform purposes. Its practices are explained in the Whop Privacy Policy.

A request to Orabio Labs concerns information under our control. Whop may need to address a separate request concerning information it controls independently. We will reasonably assist in identifying the appropriate contact.

5.3 Email and SMS Providers

We use the following provider or providers to administer email and text-message communications:

[INSERT EMAIL AND SMS PROVIDER NAME(S) AND PRIVACY POLICY LINK(S)].

These providers process information such as contact details, consent records, communication preferences, message content, delivery status, and unsubscribe requests to operate our communication programs.

Message engagement tracking:
[INSERT WHETHER EMAIL OPEN TRACKING, LINK-CLICK TRACKING, PURCHASE ATTRIBUTION, OR ABANDONED-CART EMAIL/SMS TRIGGERS ARE ENABLED, AND DESCRIBE THE DATA AND PURPOSES; STATE “NONE” WHERE APPLICABLE.]

6. Other Disclosures of Personal Information

We disclose relevant personal information in the following circumstances:

Operational services. To providers assisting with hosting, customer support, order management, shipping, fulfillment, fraud prevention, and other services described in this Policy. The information disclosed is limited to what is reasonably needed for the relevant function.

Professional advice. To legal counsel, accountants, auditors, insurers, and other professional advisers when reasonably necessary for their services.

Legal requirements and protection of rights. Where required by applicable law or valid legal process, or where disclosure is otherwise legally permitted and reasonably necessary to investigate fraud, address a security threat, protect safety, or establish or defend legal claims.

Business transactions. In connection with a proposed or completed merger, acquisition, restructuring, financing, or transfer of the relevant business or assets, subject to appropriate safeguards and applicable legal requirements. Such a transaction does not automatically authorize materially different uses of your information.

At your direction. Where you ask us to disclose information or separately authorize a clearly explained disclosure.

Disclosures involving advertising, sale, or sharing as defined by state privacy laws are addressed in Section 7. The protections for SMS subscription information in Section 8 also apply to disclosures under this section.

Where a provider acts on our behalf, we require appropriate contractual restrictions and safeguards. A provider acting independently may have its own privacy obligations and notices.

7. Cookies, Analytics, Advertising, and Privacy Signals

7.1 Cookies and Similar Technologies

The Site uses cookies and similar technologies to support functions such as shopping-cart operation, account sessions, security, and remembering preferences.

Additional technologies may support analytics, personalization, or advertising where identified below and permitted by your choices and applicable law.

Active analytics, advertising, and enhanced Shopify services:
[INSERT THE ACTUAL PROVIDERS AND FEATURES, THEIR PURPOSES, THE INFORMATION COLLECTED OR DISCLOSED, AND RELEVANT COOKIE DURATIONS OR A LINK TO A MAINTAINED COOKIE LIST. EXPRESSLY STATE IF NO OPTIONAL ANALYTICS OR ADVERTISING TOOLS ARE USED.]

You can adjust browser settings to limit or delete cookies. Blocking essential cookies may prevent parts of the Site from working correctly.

Where available or required, use our privacy controls:

Cookie Settings / Your Privacy Choices: [INSERT WORKING PRIVACY-CONTROLS URL].

Browser settings alone may not control information transmitted through server-side integrations or customer-list uploads. Applicable choices must also be implemented for those activities.

7.2 Sale, Sharing, and Targeted Advertising

Some state privacy laws define “sale” to include exchanges for valuable consideration other than money. “Sharing” can include disclosure for advertising based on activity across different businesses, websites, or services.

Certain advertising integrations and Shopify enhanced services can fall within these definitions.

Our actual practices:
[INSERT A VERIFIED STATEMENT CONFIRMING WHETHER ORABIO LABS SELLS PERSONAL INFORMATION, SHARES IT FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING, OR USES IT FOR TARGETED ADVERTISING. IDENTIFY THE INFORMATION CATEGORIES AND RECIPIENT CATEGORIES FOR EACH ACTIVITY. IF AN ACTIVITY DOES NOT OCCUR, EXPRESSLY STATE THAT.]

Where you have an applicable opt-out right, exercise it through:

Do Not Sell or Share My Personal Information / Your Privacy Choices: [INSERT WORKING OPT-OUT URL].

You may also contact us using Section 17. An advertising opt-out does not necessarily stop all advertising; it limits the particular uses covered by the request.

7.3 Global Privacy Control

Where required by applicable law, we recognize valid opt-out preference signals, including Global Privacy Control (GPC), as requests to opt out of covered sale, sharing, or targeted advertising.

We apply the signal to the browser or device sending it and, where required and reasonably identifiable, to the associated customer profile. You may need to enable the signal on each browser or device you use.

An opt-out request does not require you to create an account. We do not require identity verification for an opt-out where applicable law prohibits that requirement.

7.4 Do Not Track

Some browsers transmit a “Do Not Track” signal, which is distinct from GPC.

Our response to Do Not Track: [INSERT THE SITE’S ACTUAL RESPONSE].

This response does not limit our obligation to honor GPC or another legally recognized opt-out mechanism.

8. Email and SMS Marketing

8.1 Email Marketing

We use your email address to send marketing communications where permitted by law and consistent with your subscription choices.

You can unsubscribe using the link in a marketing email or by contacting us. We honor requests promptly and no later than 10 business days after receipt, or sooner if applicable law requires.

Unsubscribing from marketing does not prevent necessary nonpromotional communications about an order, a refund, a security issue, or a privacy request.

We retain a limited suppression record where necessary to avoid sending further marketing after you unsubscribe.

8.2 SMS Marketing

If you separately enroll in our SMS program, we use your telephone number and related subscription information to send the types of messages described at enrollment. Messages may be sent using automated technology.

Consent to marketing text messages is not a condition of purchase. Providing a telephone number for delivery or customer support does not, by itself, enroll you in SMS marketing.

We obtain any required prior express written consent through a separate enrollment process. The enrollment disclosure identifies Orabio Labs, the nature of the messages, and the applicable program terms.

Message frequency is disclosed at enrollment. Message and data rates may apply.

To stop marketing text messages, reply STOP to a message. You may also contact us or use another reasonable method that clearly communicates your request. For assistance, reply HELP or use the contact information in Section 17.

We honor revocation requests within applicable legal deadlines. You may receive a single nonpromotional confirmation of your opt-out where permitted by law. We will not use an unrelated subscription as a reason to disregard a legally effective revocation.

8.3 SMS Subscription Information

We do not sell, rent, or disclose SMS subscriber telephone numbers, opt-in records, or consent information to third parties or affiliates for their own marketing or promotional purposes.

We disclose this information only as necessary to providers supporting our messaging program, to honor your choices, or as otherwise legally required or permitted for a nonmarketing purpose described in this Policy.

This restriction applies even where another section describes general disclosure practices. A business transfer does not, by itself, authorize the purchaser to use SMS subscription information outside the scope of the applicable consent.

9. Research Eligibility and Sensitive Information

Our products are intended for lawful laboratory research and are not offered for human or veterinary administration.

Eligibility reviews may involve information about age, professional qualifications, institutional affiliation, purchasing authority, and intended research use. We use relevant records to assess eligibility, address suspected misuse, and document decisions where reasonably necessary.

An eligibility review does not justify collecting unrelated sensitive information.

Please do not submit medical records, prescriptions, diagnoses, treatment histories, patient information, or other unnecessary health information. Such information is not required to purchase research materials.

If you provide unsolicited sensitive information, we will restrict its handling and delete or redact it where appropriate, subject to a legitimate legal or operational need to retain it.

Where a planned verification process involves government identifiers, biometric information, or other legally defined sensitive information, we will provide any required additional notice and obtain any required consent.

Certain information or inferences may qualify as consumer health data under state law even when collected outside a healthcare setting. Where those laws apply to our actual processing, we will provide the required separate disclosures and choices. This general Policy does not replace a legally required consumer health data notice.

10. How Long We Keep Information

We retain personal information for periods reasonably necessary for the purposes described in this Policy, taking account of the category of information, legal requirements, and the need to resolve disputes or prevent fraud.

We do not retain information indefinitely merely because it might be useful.

When information is no longer needed, we delete it or deidentify it, subject to applicable law. Backup copies are subject to controlled retention and deletion processes and are not retained as a way to avoid a valid deletion obligation.

Where we retain information after a deletion request because an exception applies, we limit its use to the purpose supporting that exception.

11. Security

We use reasonable administrative, technical, and organizational safeguards appropriate to the information and risks involved.

These measures are intended to reduce unauthorized access, loss, misuse, alteration, and disclosure. Access is limited to people and providers who need the information for an authorized purpose.

No website, transmission method, or storage system can be guaranteed completely secure. This statement does not waive any security or notification obligation imposed by law.

Protect your login credentials and contact us promptly if you suspect unauthorized activity involving your account.

12. Your Privacy Rights and Requests

Depending on your state of residence and applicable law, you may have rights to:

• Confirm whether we process your personal information.

• Access information about our processing and obtain a copy of your information.

• Correct inaccurate personal information.

• Request deletion, subject to legal exceptions.

• Receive information in a portable format.

• Opt out of a sale, sharing, or targeted advertising.

• Opt out of certain profiling or automated decisions producing legal or similarly significant effects.

• Limit certain uses or disclosures of sensitive personal information.

• Withdraw consent where processing relies on consent.

• Appeal a refusal to act on a request.

• Exercise applicable rights without unlawful discrimination.

These rights are subject to the relevant law’s scope and exceptions.

How to Submit a Request

Email: [INSERT PRIVACY CONTACT EMAIL]
Privacy request form: [INSERT WORKING PRIVACY REQUEST FORM URL]

Describe the right you wish to exercise and provide enough information for us to locate the relevant records. We may ask for your state of residence to determine the applicable requirements.

We use proportionate verification measures where necessary to protect your information. We do not require unnecessary sensitive information or require a new account solely to submit a request.

Authorized agents may submit requests where permitted by law. We may require evidence of authority and any verification allowed by the applicable rules.

We respond within the applicable legal deadline. If an extension is permitted and necessary, we will explain the reason and expected response period.

Requests are generally free. We charge a fee or decline a request only where permitted by law and will explain the basis.

Appeals and Complaints

If we deny a request, we will explain the decision and any available appeal process.

To appeal, contact [INSERT PRIVACY CONTACT EMAIL] with the subject “Privacy Appeal” and identify the original request. We will review the appeal and respond within the applicable deadline.

You may also complain to your state attorney general or another competent privacy regulator.

13. Additional California Disclosures

Where the California Consumer Privacy Act, as amended, applies to our processing, California residents have the relevant rights described in Section 12, including rights concerning access, deletion, correction, sale or sharing, certain sensitive information uses, and nondiscrimination.

Sections 2 through 7 identify the information categories, sources, purposes, and recipient categories relevant to our practices.

Disclosures covering the preceding 12 months:
[INSERT THE VERIFIED CATEGORIES COLLECTED DURING THE PRECEDING 12 MONTHS; FOR EACH CATEGORY, IDENTIFY THE CATEGORIES OF RECIPIENTS TO WHICH IT WAS DISCLOSED FOR A BUSINESS PURPOSE, SOLD, OR SHARED. EXPRESSLY IDENTIFY CATEGORIES NOT COLLECTED AND ANY ABSENCE OF SALE OR SHARING. IF OPERATING FOR LESS THAN 12 MONTHS, IDENTIFY THE ACTUAL PERIOD COVERED.]

Sensitive personal information:
[INSERT THE CATEGORIES ACTUALLY COLLECTED AND THEIR USES, OR STATE THAT NONE IS COLLECTED. IDENTIFY WHETHER ANY USE TRIGGERS A RIGHT TO LIMIT AND PROVIDE THE REQUIRED CONTROL IF APPLICABLE.]

We do not knowingly sell or share personal information about individuals under 16 years old.

Where California’s “Shine the Light” law applies, you may contact us to request information about qualifying disclosures of personal information to third parties for their own direct marketing.

Nothing in this Policy or our Terms of Service requires you to waive a nonwaivable California privacy right.

14. Age Restrictions and Children’s Privacy

Our Site and purchasing services are intended for people aged 21 or older. Individuals under 21 are not eligible to purchase.

Our Site is not directed to children under 13. We do not knowingly collect personal information from children under 13 in circumstances prohibited by the Children’s Online Privacy Protection Act.

If we learn that information has been collected from a child contrary to applicable law, we will take appropriate steps to stop the processing and delete the information, subject to any legally permitted exception.

If you believe a child has provided personal information to us, contact us using Section 17.

Our purchasing age restriction does not replace legal obligations concerning children or other minors.

15. Processing Locations and External Services

Although we serve the United States market, personal information may be processed in the United States and other countries where Shopify, Whop, or our other providers operate.

Those countries may have different privacy laws. We apply any safeguards required by laws applicable to the processing. Serving U.S. customers does not mean that all information is stored exclusively in the United States.

The Site may link to external websites or allow you to interact with independent services. Their processing is governed by their own privacy notices.

Information you intentionally publish through a public review or similar feature may be visible to others. Avoid including sensitive personal information in public submissions.

16. Changes to This Policy

We may revise this Policy as our services, providers, practices, or legal obligations change. The updated version will display a revised date.

For material changes, we will provide additional notice where appropriate or required, such as a prominent Site notice or a message using available contact information.

Where a new use requires consent, we will obtain that consent before beginning the use. Posting a revised Policy or your continued use of the Site does not replace legally required consent.

Changes do not retroactively remove rights concerning information previously collected.

17. Contact Us

For questions about this Policy, personal information, privacy requests, or communication preferences, contact:

ORABIO LABS LLC
A Wyoming limited liability company
Website: orabiolabs.com

Privacy email: support@orabiolabs.com
Customer support email: support@orabiolabs.com
Mailing address: support@orabiolabs.com
Privacy request form: [INSERT WORKING PRIVACY REQUEST FORM URL]
Your Privacy Choices: [INSERT WORKING PRIVACY-CONTROLS URL]

Please do not include passwords, full payment-card details, medical records, or unnecessary identity documents in your request.