Privacy Policy

Effective Date: March 28, 2026.

Last Updated: March 28, 2026.

1. Introduction & Scope
2. Summary Table (Layered Notice)
3. Information We Collect
4. How We Collect Your Information
5. How We Use Your Information
6. How We Share Your Information
7. Sensitive Personal Information
8. Data Retention
9. Data Security
10. Your Rights & Choices (General)
11. State-Specific Privacy Rights
12. Automated Processing & the Correlation Engine
13. Cookies, Tracking Technologies & Analytics
14. Third-Party Links & Services
15. Children's Privacy
16. International Users
17. Changes to This Privacy Policy
18. Contact Us
19. Governing Law & Jurisdiction
20. Final

Section 1: Introduction & Scope

QuantumOne ("Company," "we," "us," or "our") is a technology company. We are not a healthcare provider, laboratory, medical facility, or clinical service.

This Privacy Policy describes how we collect, use, disclose, retain, and protect your personal information when you use the QuantumOne website, mobile application (iOS and Android), correlation engine, advice engine, 3D hologram dashboard, and all related features, content, and services (collectively, the "Services").

By accessing or using the Services, you agree to this Privacy Policy. If you do not agree, do not use the Services. Your use of the Services is also governed by our Medical Disclaimer and Terms of Service.

Privacy by design. QuantumOne deliberately does not collect or store your full name, physical address, or phone number. The only personal identifier we hold is your email address. This means your data within QuantumOne is near-anonymous by default — your health, biometric, genetic, and lifestyle data is not linked to traditional personally identifying information.

United States Only. The Services are designed for and directed at users physically located in the United States. We make no representation that the Services comply with the laws of any other jurisdiction.

QuantumOne Is Not a Covered Entity Under HIPAA. We are not a covered entity or business associate under the Health Insurance Portability and Accountability Act (HIPAA). Your data held by QuantumOne is not protected by HIPAA's privacy and security rules. Your data is instead governed by this Privacy Policy and applicable federal and state privacy laws, including the California Consumer Privacy Act (CCPA/CPRA) where applicable. You should understand this distinction before providing personal health, biometric, or genetic information to QuantumOne.

Data within QuantumOne does not constitute an Electronic Health Record (EHR), Electronic Medical Record (EMR), or Protected Health Information (PHI) as defined by HIPAA. While you may upload clinical documents (blood tests, DEXA scans, pathology reports, genetic files) to the Services, the data stored and processed within QuantumOne is consumer wellness data governed by this Privacy Policy, not a medical record governed by HIPAA or state medical records laws.

Section 2: Summary Table (Layered Notice)

This summary is for quick reference. Full details are in the sections below.

We do not sell your personal information. We do not share identifiable health, genetic, or biometric data for marketing or advertising purposes.

Section 3: Information We Collect

a. Account Information

We collect your email address to create and manage your account. You may register using an email address and password, device biometrics or PIN, or by signing in through a third-party authentication provider (Apple or Google). When you sign in through a third-party provider, we receive only your email address from that provider. If you use device biometrics (such as Face ID, Touch ID, or fingerprint) or a device PIN to authenticate, this data is processed entirely on your device and is never transmitted to, received by, or stored by QuantumOne. We receive only the authentication confirmation — not the biometric data itself. We deliberately do not collect or store your full name, physical address, or phone number — even if a third-party authentication provider makes this information available, we do not request, access, or store it. Your email address is used for account authentication, service communications, and, if you opt in, occasional product updates.

Providing your email address is mandatory to use the Services.

b. Health & Biometric Data

We collect health and biometric data from connected wearable devices and health platforms via the Open-Wearables integration layer. This includes but is not limited to:

• Sleep data: HRV (heart rate variability), sleep score, sleep stages, sleep duration, sleep factors and variables
• Cardiac data: Resting heart rate, heart rate zones, heart rate variability trends
• Activity data: Step count, activity levels, exercise sessions, workout data, calories burned
• Blood glucose: Continuous glucose monitoring data (from Dexcom, Abbott CGM)
• Blood oxygen: SpO₂ readings
• Other physiological data: Respiratory rate, body temperature, readiness/recovery scores, and other metrics as provided by connected devices

Sources: Oura, Apple Watch, Samsung Watch, Google Watch, Fitbit, Garmin, Wahoo, Withings, Ultrahuman, Whoop, Dexcom, Abbott CGM, Peloton, Strava, Cronometer, MyFitnessPal, Apple HealthKit, Google Fit, Android Health Connect, EightSleep, Chilipad, and other compatible devices and platforms.

This data is collected automatically once you connect a device or platform. You choose which devices to connect, and you may disconnect them at any time.

c. Clinical & Genetic Data

We collect clinical and genetic data from files and reports you upload directly to the Services:

• Blood test results: Parsed from uploaded PDFs using automated text extraction (Amazon Textract, Amazon Comprehend, Tesseract). Includes biomarker values, reference ranges, and test metadata.
• Pathology reports: Parsed from uploaded PDFs using the same automated text extraction tools.
• DEXA scan results: Body composition, bone density, and related metrics parsed from uploaded scan reports.
• Raw genetic data files: Files uploaded from third-party genetic testing providers such as 23andMe, AncestryDNA, MyHeritage, or whole genome sequencing providers. Accepted in JSON or PDF format.

No licensed healthcare professional at QuantumOne reviews, validates, or clinically interprets your uploaded data. Automated parsing is not clinical interpretation, medical review, or diagnosis. See our Medical Disclaimer for full details.

Uploading clinical and genetic data is optional. However, certain features of the Services depend on this data to function.

d. Supplement, Nootropic & Biohack Data

We collect data you manually log about:

• Supplements and nootropics: Compound names, dosing schedules, timing, and self-reported effects. This data is referenced against the NIH Dietary Supplement Label Database and internal reference lists for identification and labeling purposes.
• Biohacks: Interventions being trialed, protocols, and outcomes. Referenced against an internal curated list of biohacking interventions.

This data is entered by you directly in the app. Providing it is optional.

e. Nutrition, Habits, Measurements & Self-Reported Data

We collect data you manually log about:

• Dietary intake: Foods, macronutrients, calories, and related nutritional data.
• Habits and behaviors: User-defined habits and tracking data.
• Body measurements: Weight, body composition, and other physical measurements.
• Self-reported surveys: Mood, cognition, energy levels, and other subjective assessments.

This data is entered by you directly in the app. Providing it is optional.

f. Environmental Data

We automatically collect environmental data for the continental United States from public APIs and datasets, then assign it to your account based on your approximate location. Location accuracy is approximately 25 kilometers. No precise GPS coordinates are stored. No manual input from you is required.

This data represents regional estimates, not measurements taken at your specific location. Actual conditions at your location may differ from the data displayed. See our Medical Disclaimer (Section 9) for further details on environmental data accuracy.

Environmental variables collected include:

• Weather and climate: Temperature, barometric pressure, humidity, overnight wind gusts, overnight rain, lightning (Sources: NWS forecast, GHCNh)
• Solar and UV: UV index, shortwave solar radiation, direct solar radiation, diffuse solar radiation, direct normal irradiance, global tilted radiation (Source: NSRDB)
• Air quality and atmospheric: Air quality index (Source: AirNow), tropospheric NO₂, HCHO, CHOCHO, SO₂, total CO, O₃ (lowest 0–6 km), CH₄, aerosol index, cloud fraction, cloud optical thickness (Source: TROPOMI Sentinel-5)
• Biological environmental: Pollen (Source: weatherapi.com), mold risk index (calculated internally using GHCNh data)
• Water: Tap water quality (Source: EPA and state service portals)
• Astronomical: Moon phase (calculated internally)

g. Device & Usage Information

We automatically collect:

• Device information: Device type, operating system, app version
• Usage data: Session data, feature usage patterns, interaction data
• Crash reports: Error logs, stack traces, and diagnostic data sent to Sentry (our error monitoring service)

Sentry receives app navigation data, crash logs, and page timing data only. No personal health data, genetic data, biometric data, or other sensitive personal information is included in data sent to Sentry.

h. Payment Information

Payment processing is handled entirely by Stripe (for web and Android) and Apple In-App Purchase (for iOS). We receive and store your subscription status and a payment token. We do not receive, process, or store your full credit card number, bank account details, or other financial account information. For details on how your payment data is handled, refer to Stripe's Privacy Policy and Apple's Privacy Policy.

i. Inferred Data & Correlations

The correlation engine generates new data by analyzing your existing data across categories. This inferred data includes:

• Cross-source correlations (e.g., the relationship between your sleep metrics and a specific supplement)
• Quantified impact estimates (e.g., estimated percentage improvement from a behavior change)
• Trend analyses across time periods
• Personalized advice and recommendations

Under the CCPA, inferences drawn from personal information are themselves personal information. Inferred data is treated with the same protections as the source data from which it was derived.

Section 4: How We Collect Your Information

We collect information through the following methods:

Direct collection. You provide data by manually entering it in the app (supplements, nootropics, biohacks, habits, nutrition, measurements, surveys) or by uploading files (blood tests, DEXA scans, pathology reports, genetic data files).

Third-party authentication. If you register or sign in using Apple or Google, your email address is provided to us by that authentication provider. We do not receive or store your name, profile photo, or any other information from these providers — only your email address.

Automatic collection via third-party integrations. When you connect a wearable device or health platform through the Open-Wearables integration layer, data flows automatically from that device or platform to QuantumOne. This is a bidirectional connection: by connecting a device, you authorize data to flow between that device's platform and QuantumOne.

Automated back-end collection. Environmental data is collected for the continental United States from public APIs and datasets (NWS, GHCNh, NSRDB, AirNow, TROPOMI Sentinel-5, weatherapi.com, EPA/state service portals) and assigned to your account based on your approximate location (~25 km accuracy). No manual input from you is required.

File parsing. When you upload documents (blood test PDFs, DEXA scan reports, pathology reports, genetic files), we use Amazon Textract (OCR and structured data extraction), Amazon Comprehend (natural language processing and entity extraction), and Tesseract (open-source OCR) to automatically parse and extract structured data from your uploads. This processing occurs within the AWS environment.

Automated inference. The correlation engine processes your existing data to generate new inferred data — correlations, impact estimates, trend analyses, and personalized advice.

Device and usage data. Collected automatically during your use of the Services. Crash data and error reports are captured via Sentry (app navigation, crash logs, and page timing only — no personal health data).

Data accuracy. You are responsible for the accuracy of all data you enter, upload, or connect to the Services. Inaccurate, incomplete, or erroneous input data — whether from manual entry, uploaded reports, or connected wearable devices — may result in inaccurate correlations and advice. See our Medical Disclaimer (Section 9) for full details on data accuracy limitations.

Section 5: How We Use Your Information

We use your information for the following purposes:

Core functionality. Powering the correlation engine; generating personalized advice with quantified impact estimates; producing the 3D hologram dashboard health status visualization; delivering insights, trend analyses, and longitudinal tracking; and supporting self-experiment tracking (Experiments tab). These uses are necessary to deliver the Kaizen cycle of continuous self-optimization that is the core function of the Services.

Communications. We send transactional emails including account confirmation, security alerts, subscription status changes, and product updates. We may also send occasional marketing emails about the Services. Marketing emails are infrequent and every marketing email includes an unsubscribe link. You can opt out of marketing communications at any time via the unsubscribe link or through Settings in the app. Transactional communications (account security, subscription status) are not affected by unsubscribing.

Product improvement. We use aggregated and anonymized analytics data, debugging data, and performance monitoring data to identify and fix issues, improve performance, and develop new features. Individual-level health data is not used for product improvement purposes.

Aggregate research and model improvement. We use anonymized and aggregated data for internal research and to improve the correlation engine. This data has been stripped of your email address — the only personal identifier we hold — and cannot be re-identified to any individual. Because QuantumOne does not collect names, physical addresses, or phone numbers, de-identified data within our systems is anonymous by default. Anonymized data is not personal information and is retained indefinitely.

Safety, security, and fraud prevention. Detecting and preventing unauthorized access, fraud, abuse, and other security threats.

Legal compliance. Responding to lawful requests from law enforcement or regulatory bodies, complying with applicable laws, and enforcing our terms.

We do not use your data for advertising or ad targeting. We do not sell your personal information. These are firm commitments, not aspirational statements.

Section 6: How We Share Your Information

We share your information only in the following circumstances:

Service Providers (Processors)

These companies process data on our behalf, under our instructions, and subject to data processing agreements:

Third-Party Integrations Initiated by You

When you connect a wearable device or health platform (such as Oura, Apple Watch, Garmin, Fitbit, Whoop, Dexcom, Apple HealthKit, Google Fit, or others listed in Section 3b), data flows bidirectionally between that platform and QuantumOne. By connecting a device, you authorize this data exchange. Each third-party platform is governed by its own privacy policy. We encourage you to review the privacy practices of any service you connect.

Apple and Google

App distribution. We share limited data with Apple (for App Store distribution and In-App Purchase processing on iOS) and Google (for Play Store distribution). The data shared is limited to what these platforms require for app distribution, subscription management, and crash reporting through their respective developer consoles. This includes crash and performance data shared through the Apple Developer and Google Play consoles, which may include device identifiers, app version, and crash metadata. No personal health, genetic, biometric, or other sensitive personal information is included in crash data shared with Apple or Google.

Authentication. If you choose to sign in using Apple or Google, your email address is exchanged with the selected provider as part of the authentication process. We receive only your email address — we do not request or receive your name, profile photo, contacts, or any other data from these providers. Each provider is governed by its own privacy policy: Apple, Google.

Legal Requirements

We may disclose your information if required by law, subpoena, court order, or government or regulatory request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a regulatory inquiry.

Business Transfers

In the event of a merger, acquisition, asset sale, reorganization, or bankruptcy, your personal information may be transferred as part of that transaction. We will notify you by email and prominent in-app notice before your personal information is transferred and becomes subject to a different privacy policy. You will have the opportunity to delete your account and data before any such transfer.

Any successor entity that acquires QuantumOne or its assets will be bound by the terms of this Privacy Policy as it applies to personal information collected before the transfer. This obligation applies with particular force to genetic data, which — as noted in Section 7 — is permanent, immutable, and cannot be changed if compromised. We will not transfer genetic data to any acquiring entity that does not agree in writing to honor the commitments in this Privacy Policy. In the event of a bankruptcy proceeding, we will advocate for the protection of user genetic data to the extent permitted by applicable bankruptcy law.

Anonymized and Aggregated Data

We retain and use anonymized and aggregated data — data from which your email address (the only personal identifier we hold) has been permanently removed and which cannot be re-identified to any individual — for internal research and to improve the correlation engine. This anonymized data is not personal information under the CCPA or other applicable privacy laws. We do not share anonymized data with external third parties.

What We Do Not Do

We do NOT sell your personal information as defined by the CCPA or any other applicable law.

We do NOT share identifiable health, genetic, or biometric data for marketing, advertising, or any purpose unrelated to providing the Services.

We do NOT provide your genetic, health, or biometric data to employers, insurance companies, or public databases.

We will NOT voluntarily disclose your personal information to law enforcement. We will only comply with law enforcement requests that are accompanied by a valid court order, subpoena, or search warrant that we determine to be legally valid.

We do NOT contribute your genetic data — whether identified or de-identified — to any public genetic databases, biobanks, or open-access research repositories.

We do NOT use your data for third-party advertising or ad targeting.

Section 7: Sensitive Personal Information

Under the CCPA/CPRA and other state privacy laws, certain categories of personal information are classified as "sensitive personal information" and receive enhanced protections. QuantumOne collects the following categories of sensitive personal information:

• Health data: Blood test results, pathology reports, DEXA scan results, wearable health metrics, supplement/nootropic logs, self-reported health surveys
• Genetic data: Raw genetic files from 23andMe, AncestryDNA, whole genome sequencing providers, and similar services
• Biometric data: Heart rate variability, sleep stages, blood oxygen, continuous glucose monitoring, and other physiological data from connected wearable devices. This does not include device-level authentication biometrics (such as Face ID, Touch ID, or fingerprint), which are processed entirely on your device and are never transmitted to or stored by QuantumOne.
• Location data: Approximate location (~25 km accuracy) used to assign environmental data. We do not collect or store precise geolocation (GPS coordinates).

Additional Protections for Sensitive Personal Information

We apply the following protections to all sensitive personal information:

• Purpose limitation. Sensitive personal information is used only for the purposes necessary to provide the Services as described in this Privacy Policy. It is not used for advertising, profiling for advertising, or any purpose beyond what is disclosed here.
• Explicit consent. We obtain your explicit consent before collecting and processing sensitive personal information. For wearable data, consent is obtained when you initiate the device connection. For uploaded clinical and genetic data, consent is obtained when you upload the file. For location-based environmental data, consent is obtained during onboarding. You may withdraw consent at any time (see Section 10).
• Enhanced security. Sensitive personal information is encrypted at rest (AES-256) and in transit (TLS 1.2+). Access is restricted to authorized personnel on a need-to-know basis.
• Minimal identification. Your sensitive personal information is associated only with your email address. We do not link it to your name, physical address, phone number, or other traditional identifiers.
• Right to limit use. Under the CCPA/CPRA, you have the right to limit the use and disclosure of your sensitive personal information. See Section 11 for details.

Genetic Data — Special Provisions

Genetic data is uniquely sensitive because it is permanent and immutable — unlike a password or credit card number, it cannot be changed, reset, or replaced if compromised. A breach of genetic data cannot be fully remedied. By uploading genetic data to QuantumOne, you acknowledge this inherent and irreversible risk.

How we process genetic data. Raw genetic files you upload are parsed and stored within the AWS environment. Genetic data is processed by the correlation engine to identify associations between your genetic variants and other health data (sleep, blood biomarkers, supplement responses, environmental factors, etc.) in order to generate personalized advice.

What happens if you delete your account. If you request account deletion, your email address is permanently deleted and your genetic data is anonymized — the association between the data and your identity is permanently removed. The anonymized genetic data is retained indefinitely for aggregate research and correlation engine improvement. It cannot be linked back to you.

Important limitation: While removing your email address — the only identifier QuantumOne holds — prevents us from linking the data back to you, you should be aware that genetic data is inherently unique to each individual. Unlike other data types, it may theoretically be re-identifiable through external means such as public genetic databases, genetic relatives' data, or advances in re-identification techniques. This risk exists regardless of what QuantumOne does, and is an inherent characteristic of genetic data. We encourage you to consider this before uploading genetic information.

GINA protections and their limits: The Genetic Information Nondiscrimination Act (GINA) provides federal protections against genetic discrimination by health insurers and employers. However, GINA does not cover life insurance, long-term care insurance, or disability insurance. State laws may provide additional protections that vary by jurisdiction. We strongly encourage you to understand your rights under federal and state genetic privacy law before uploading genetic information.

Familial implications: Your genetic data may reveal information about your biological relatives — including parents, siblings, and children — who have not consented to the processing of their genetic information through the Services. By uploading your genetic data, you acknowledge that the correlations and insights generated may have implications beyond your own health. You should consider the potential impact on your biological relatives before uploading genetic information, and you should not upload genetic data belonging to another person without their informed consent.

State genetic privacy protections: Several states, including California, Illinois, and Florida, have specific genetic privacy statutes that may provide additional protections beyond general privacy laws. See Section 11 for state-specific details.

Consistency with Medical Disclaimer: Our Medical Disclaimer (Section 7) contains additional important information about the limitations of genetic data interpretation, the probabilistic nature of genetic associations, and the distinction between consumer-grade and clinical-grade genetic testing. You should read both documents.

Section 8: Data Retention

Retention Periods

How Anonymization Works

When you delete your account, we permanently remove your email address — the only personal identifier QuantumOne holds. Because we deliberately do not collect or store your name, physical address, phone number, or other traditional identifiers, removing the email association renders your data anonymous. It cannot be linked back to you or to any identifiable individual.

When anonymized data is used for aggregate research and correlation engine improvement, it is combined with data from a sufficient number of other users to ensure that no individual's data can be isolated or re-identified from the aggregate dataset.

Anonymized data is not personal information under the CCPA or other applicable privacy laws. We retain anonymized data indefinitely to improve the correlation engine, conduct internal research, and strengthen the accuracy of advice for all users.

What Happens When You Delete Your Account

1. Your email address is permanently deleted within 30 days of your verified deletion request.
2. All other data categories are anonymized (email association permanently removed) within 30 days. The underlying data is retained in anonymized form as described above.
3. Backup copies are processed (email deleted, data anonymized) within 90 days of your verified deletion request.
4. Insights, correlations, or advice previously delivered to you during your use of the Services cannot be retroactively rescinded — they were already provided to you.
5. You will receive a confirmation email when the deletion and anonymization process is complete.
6. Third-party data retention. Data previously transmitted to third-party service providers — such as crash logs sent to Sentry, payment and subscription records held by Stripe or Apple, or data synced bidirectionally with connected wearable platforms — is subject to those providers' own retention and deletion policies and may not be deleted from their systems upon your account deletion request. We encourage you to review the privacy policies of any third-party service you have connected.

Section 9: Data Security

We implement technical and organizational measures to protect your personal information:

Technical measures:

• Encryption at rest (AES-256) and in transit (TLS 1.2 or higher)
• Access controls and authentication for all internal systems
• Network security and monitoring within the AWS environment
• Automated vulnerability detection

Organizational measures:

• Employee and contractor access to personal data is limited to those who require it for their job function
• Access logging and audit trails
• Security awareness practices for all team members

Third-party security:

• All user data is processed and stored within the AWS infrastructure, which maintains its own comprehensive security program (see AWS Security)
• Data processing agreements are in place with all service providers that handle user data

What we do not claim. We do not hold SOC 2, ISO 27001, or other third-party security certifications. We do not claim absolute security. No method of electronic transmission or storage is 100% secure. While we use commercially reasonable measures to protect your personal information, we cannot guarantee its absolute security. You should consider this before uploading sensitive information, particularly genetic data, which cannot be changed if compromised.

Data separation. Within our systems, your account identity (email address) and your health, biometric, genetic, and lifestyle data are stored with logical separation. Your email address serves as the account key but is not embedded within your health data records. This architecture is what enables our anonymization process: when your email is removed upon account deletion, the remaining health data cannot be traced back to any individual.

Breach Notification

In the event of a security breach affecting your unsecured personal health data, we will notify you in accordance with the FTC Health Breach Notification Rule (16 CFR Part 318) and applicable state breach notification laws. Notification will include:

• A description of what happened
• The categories of data that were affected
• The steps we are taking in response
• Steps you can take to protect yourself
• How to contact us for further information

Where required by law, we will also notify the Federal Trade Commission and, if more than 500 individuals are affected, prominent media outlets. We will provide notification without unreasonable delay and in no event later than the timeline required by applicable law.

Section 10: Your Rights & Choices (General)

Regardless of your state of residence, all QuantumOne users have the following rights:

Access. You can request a copy of the personal information we hold about you.

Correction. You can request correction of inaccurate personal information. For data you entered directly, you can also correct it yourself in the app.

Deletion. You can request deletion of your account. Your email address — the only personal identifier we hold — will be permanently deleted. All other data will be anonymized (email association permanently removed) as described in Section 8. Anonymized data that cannot be linked to any individual is not personal information and is retained indefinitely for aggregate research and correlation engine improvement.

Data portability. You can request an export of your data in a structured, commonly used format. Data exports are provided in JSON format (or CSV where applicable) and can be downloaded through Settings > Privacy in the app or by request to privacy@quantumone.app.

Withdraw consent. You can withdraw consent for optional data processing at any time. Withdrawing consent does not affect the lawfulness of processing performed before withdrawal.

Disconnect integrations. You can disconnect any third-party wearable, device, or platform integration at any time through Settings in the app. Disconnecting stops future data collection from that source but does not automatically delete or anonymize data already collected. To have previously collected data anonymized, submit a deletion request.

Opt out of marketing. You can opt out of marketing communications at any time via the unsubscribe link included in each email or through Settings in the app. Transactional communications (account security, subscription status) are not affected.

How to Exercise Your Rights

You may submit privacy requests by:

• Email: privacy@quantumone.app
• In-app: Through Settings > Privacy in the app

Verification. To protect your privacy, we will verify your identity before processing a request. For requests submitted via email, we will verify ownership of the email address associated with your account. For in-app requests, authentication through the app constitutes verification.

Authorized agents. You may designate an authorized agent to submit a privacy request on your behalf. Authorized agents must provide proof of authorization (a signed written authorization or a power of attorney). We may also require the account holder to verify their identity directly.

Non-discrimination. We will not discriminate against you for exercising any of your privacy rights. This means we will not deny you the Services, charge you different prices, provide a different quality of service, or retaliate in any way.

Response timeline. We will acknowledge receipt of your request within 10 business days and fulfill it within 45 calendar days. If we need additional time (up to an additional 45 days), we will notify you of the extension and the reason for it.

Appeal process. If we deny a privacy request, we will explain the reason for denial and provide instructions for how to appeal. You may appeal by emailing privacy@quantumone.app with the subject line "Privacy Request Appeal." We will respond to appeals within 60 days.

Section 11: State-Specific Privacy Rights

California (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Right to know. You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom we share it.

Right to delete. You may request deletion of your personal information. Upon a verified request, we will permanently delete your email address (the only personal identifier we hold) and anonymize all other data as described in Section 8. Anonymized data that cannot be re-identified is not personal information under the CCPA and may be retained.

Right to correct. You may request correction of inaccurate personal information.

Right to opt out of sale or sharing. We do not sell your personal information. We do not "share" your personal information for cross-context behavioral advertising as defined by the CPRA. Notwithstanding, we provide a "Do Not Sell or Share My Personal Information" mechanism accessible through Settings > Privacy in the app and via the "Do Not Sell or Share My Personal Information" link in the footer of our website.

Right to limit use of sensitive personal information. You may request that we limit our use of your sensitive personal information (health, genetic, biometric, and location data) to only those uses necessary to provide the Services. Since we already limit our use of sensitive personal information to these purposes, exercising this right will not change how we process your data — but the right is available to you.

Right to non-discrimination. We will not discriminate against you for exercising your CCPA/CPRA rights.

CCPA-mandated disclosures — past 12 months:

Financial incentive notice. Our free trial does not require you to consent to different data practices than our paid subscription. Data collection, use, sharing, and retention practices are identical regardless of your subscription status.

Data protection assessments. We conduct data protection assessments for our processing of sensitive personal information, including the health, genetic, and biometric data central to the Services, consistent with the CPRA's implementing regulations.

Submitting requests. See Section 10 for methods. CCPA requests will be responded to within 45 calendar days.

Virginia (VCDPA)

If you are a Virginia resident, you have the right to access, correct, delete, and obtain a copy of your personal data; to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects; and to appeal a denied request.

Sensitive data. We obtain your opt-in consent before processing sensitive data (health, genetic, and biometric data) as required by the VCDPA.

Data protection assessments. We conduct data protection assessments for our processing of sensitive data as required by the VCDPA.

Appeal process. If we deny your request, you may appeal by emailing privacy@quantumone.app with the subject line "Virginia Privacy Appeal." We will respond within 60 days. If the appeal is denied, you may contact the Virginia Attorney General.

Colorado (CPA)

If you are a Colorado resident, you have rights similar to those described above for Virginia residents, including the right to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising, the sale of personal data, and profiling.

Sensitive data. We obtain your consent before processing sensitive data as required by the Colorado CPA.

Universal opt-out mechanism. We honor universal opt-out preference signals (such as the Global Privacy Control) as required by the Colorado CPA.

Connecticut (CTDPA)

If you are a Connecticut resident, you have rights similar to those described above for Virginia and Colorado residents. We obtain your consent before processing sensitive data as required by the CTDPA.

Texas (TDPSA)

If you are a Texas resident, you have the right to access, correct, delete, and obtain a copy of your personal data, and to opt out of the sale of personal data, targeted advertising, and profiling. We obtain your consent before processing sensitive data, including health data and genetic data, as specifically required by the TDPSA.

Washington (My Health My Data Act)

The Washington My Health My Data Act applies broadly to "consumer health data" and covers the data QuantumOne collects and processes.

Consent. We obtain your consent before collecting, sharing, or selling consumer health data as required by this Act. We do not sell consumer health data.

Rights. Washington residents have the right to access and delete their consumer health data. We will respond to deletion requests within 30 calendar days.

Geofencing prohibition. We do not use geofencing technology to identify or track consumers seeking healthcare services at or in proximity to any healthcare facility, nor do we collect consumer health data through geofencing around healthcare facilities.

Consumer Health Data Privacy Policy. A separate Consumer Health Data Privacy Policy is available at quantumone.app/consumer-health-data.html and is linked from the footer of our website and within the app.

Illinois (BIPA)

The Illinois Biometric Information Privacy Act applies to the collection of "biometric identifiers" — specifically, fingerprints, retina or iris scans, voiceprints, and scans of hand or face geometry.

QuantumOne does not collect biometric identifiers as defined by BIPA. The health and physiological metrics we collect from wearable devices — including heart rate, heart rate variability, sleep stages, blood oxygen, and blood glucose — are biometric data but are not classified as biometric identifiers under BIPA. No fingerprint, face geometry, retina, or voiceprint data is transmitted from any connected wearable device to QuantumOne. Additionally, if you use device biometrics (such as Face ID, Touch ID, or fingerprint) to authenticate with the app, this biometric data is processed entirely on your device and is never transmitted to or stored by QuantumOne — we receive only the authentication confirmation. If our data collection practices change in the future to include biometric identifiers, we will update this policy and obtain the required written consent.

Oregon (OCPA)

If you are an Oregon resident, you have the right to access, correct, delete, and obtain a copy of your personal data, and to opt out of profiling, targeted advertising, and the sale of personal data. The Oregon Consumer Privacy Act classifies health data, genetic data, and biometric data as "sensitive data" requiring your opt-in consent before processing. We obtain your consent before processing sensitive data as required by the OCPA.

Right to know. You may request a list of the specific third parties to whom we have disclosed your personal data — not just categories of recipients.

Data protection assessments. We conduct data protection assessments for our processing of sensitive data, including the health, genetic, and biometric data central to the Services, as required by the OCPA.

Appeal process. If we deny your request, you may appeal by emailing privacy@quantumone.app with the subject line "Oregon Privacy Appeal." We will respond within 45 days. If the appeal is denied, you may contact the Oregon Attorney General.

Other States

Residents of other states may have additional privacy rights under their state's laws, including but not limited to laws enacted in Montana, New Hampshire, New Jersey, Delaware, Iowa, Tennessee, Indiana, Kentucky, Nebraska, Maryland, Minnesota, and Rhode Island. We will honor all valid privacy requests consistent with applicable law. Contact us at privacy@quantumone.app to exercise your rights.

Section 12: Automated Processing & the Correlation Engine

The Services use automated systems extensively. This section describes how.

Correlation Engine

The correlation engine is an automated system that analyzes your data across all categories (health, biometric, clinical, genetic, environmental, supplement, nutrition, habit, and measurement data) to identify statistical correlations and generate personalized advice with quantified impact estimates. The correlation engine engages in automated decision-making and profiling as those terms are used in state privacy laws.

What data is processed. All data categories described in Section 3 may be fed into the correlation engine.

How outputs are generated. Correlations are generated using statistical models that analyze patterns across your data and cross-reference academic literature. Quantified impact estimates are population-level statistical estimates, not individualized medical predictions. See our Medical Disclaimer (Section 6) for important limitations.

Human review. Correlation engine outputs are not individually reviewed by a human before being presented to you. The outputs are generated and delivered automatically.

All processing is internal. The correlation engine runs entirely within the AWS environment. Your data is not sent to any external third-party service for the purpose of generating correlations or advice.

Automated Document Parsing

When you upload clinical documents (blood test PDFs, DEXA scan reports, pathology reports, genetic files), automated tools (Amazon Textract, Amazon Comprehend, and Tesseract) extract and structure the data. This automated parsing is not clinical interpretation or medical review. No human reviews your uploaded documents. See our Medical Disclaimer (Section 7) for full details.

Limitations of Automated Outputs

Automated outputs — including correlations, quantified impact estimates, advice, and parsed clinical data — may contain errors, inaccuracies, or incomplete information. You should independently verify any automated output before acting on it. Automated outputs do not constitute medical advice. See our Medical Disclaimer (Section 6) for full details on the limitations of automated systems within the Services.

Profiling and Your Rights

The correlation engine engages in profiling — automated processing of your personal data to analyze or predict aspects of your health, behavior, and performance. Where required by applicable state law, you have the right to opt out of profiling. To exercise this right, contact us at privacy@quantumone.app or use the Settings > Privacy controls in the app. Opting out of profiling will significantly limit the functionality of the Services, as the correlation engine is the core feature.

The correlation engine does not make decisions that produce legal effects or similarly significant effects as those terms are used in state privacy laws. The outputs of the correlation engine — correlations, advice, and quantified impact estimates — are informational only and do not determine your access to services, pricing, creditworthiness, employment, housing, insurance, education, or any other legal or quasi-legal benefit.

Section 13: Cookies, Tracking Technologies & Analytics

Website

We use the following categories of cookies and tracking technologies on the QuantumOne website:

• Strictly necessary cookies. Required for the website to function (authentication, session management, security). Cannot be disabled.
• Functional cookies. Remember your preferences and settings.
• Analytics cookies. We use Sentry to monitor website performance and track usage patterns. Sentry collects page navigation data, timing, and error information. No personal health data is collected through analytics cookies.

Mobile App

The mobile app uses Sentry for error monitoring, crash reporting, and usage analytics. Sentry collects device information, app navigation data, crash logs, and page timing. No personal health, genetic, biometric, or other sensitive data is included in data sent to Sentry.

Managing Your Preferences

You can manage cookie preferences through your browser settings. You can manage in-app data collection preferences through Settings > Privacy in the app.

Global Privacy Control & Do Not Track

We honor the Global Privacy Control (GPC) opt-out preference signal as our universal opt-out mechanism, as required by the CCPA/CPRA and the Colorado CPA. When we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information for the associated browser or device.

We do not separately respond to the older Do Not Track (DNT) browser signal, as GPC has superseded DNT as the recognized universal opt-out standard.

Section 14: Third-Party Links & Services

The Services integrate with and link to third-party services, including wearable device platforms (Oura, Apple HealthKit, Garmin Connect, Fitbit, Google Fit, Whoop, etc.), genetic testing providers (23andMe, AncestryDNA, etc.), health data platforms, and environmental data sources.

QuantumOne is not responsible for the privacy practices, security measures, or content of any third-party service. We do not control how these third parties collect, use, or protect your data outside of what is transmitted to or from QuantumOne.

Once your data is received by QuantumOne from a connected third-party platform, it is governed exclusively by this Privacy Policy — regardless of what the third-party platform's own privacy policy permits. For example, even if a wearable manufacturer's privacy policy allows the use of your health data for advertising or product recommendations, QuantumOne will never use that same data for advertising or ad targeting. The protections in this Privacy Policy apply to all data within QuantumOne, regardless of its original source.

We encourage you to review the privacy policy of any third-party service before connecting it to QuantumOne or uploading data from it. Connecting a third-party service to QuantumOne does not merge our privacy practices with theirs.

References to third-party products, services, or providers within the Services are for informational and integration purposes only and do not constitute endorsement or recommendation.

Adverse event reporting. QuantumOne is not a supplement manufacturer, pharmaceutical company, or medical device maker. We are not obligated to report adverse events to manufacturers or regulatory agencies. If you experience a serious adverse reaction to any supplement, nootropic, or other product referenced in or logged through the Services, you should report it directly to the FDA MedWatch program (www.fda.gov/medwatch) and contact your healthcare provider immediately.

Section 15: Children's Privacy

The Services are NOT intended for anyone under 18 years of age. Use by anyone under 18 is strictly prohibited.

By creating an account, you represent and warrant that you are at least 18 years of age.

We do not knowingly collect personal information from children under 13 (as defined by COPPA) or from anyone under 18. If we discover that a user is under 18, we will immediately terminate their account and delete all associated personal information within 30 days.

If you believe that a person under 18 has created an account or provided us with personal information, please contact us immediately at privacy@quantumone.app.

Section 16: International Users

The Services are designed for and directed at users physically located in the United States. We make no representation that the Services comply with the laws of any other jurisdiction.

If you access the Services from outside the United States, you do so at your own risk and are solely responsible for compliance with your local laws.

All personal information collected through the Services is processed and stored in the United States, within the AWS infrastructure. By using the Services, you consent to the transfer and processing of your data in the United States.

Section 17: Changes to This Privacy Policy

We may update this Privacy Policy at any time.

Material changes. If we make material changes, we will notify you by (a) sending an email to the address associated with your account, and (b) displaying a prominent notice within the app. Material changes will take effect no sooner than 30 days after we provide notice. A "material change" includes but is not limited to: new categories of data collected, new third-party recipients of personal information, changes to how genetic data is handled, introduction of generative AI or conversational AI features, or changes to whether we sell or share personal information.

Non-material changes. For non-material changes (clarifications, formatting, updated links), we will update the "Last Updated" date at the top of this policy. Continued use of the Services after a non-material change constitutes acceptance.

Version history. This Privacy Policy is maintained in a public, open-source repository. A complete version history — including every change, its date, and its content — is transparently available through the repository's commit history.

If you do not agree with a material change, you must stop using the Services and delete your account before the effective date of the change.

Section 18: Contact Us

For privacy-related questions, requests, or concerns:

Email: privacy@quantumone.app

Mail: QuantumOne, Inc., Attn: Privacy Officer, 251 Little Falls Drive, Wilmington, DE 19808

Response timeline. We aim to respond to privacy inquiries within 10 business days. Formal privacy requests under state law will be processed within the timelines specified in Sections 10 and 11.

Section 19: Governing Law & Jurisdiction

This Privacy Policy is governed exclusively by the laws of the State of Delaware, USA, without regard to conflict of laws principles.

Dispute resolution. Disputes arising under or relating to this Privacy Policy are subject to the Dispute Resolution, Arbitration & Class Action Waiver provisions set forth in Section 8 of our Medical Disclaimer, which are incorporated into this Privacy Policy by reference in their entirety. This includes binding individual arbitration administered by the American Arbitration Association (AAA) under its Consumer Arbitration Rules, the waiver of jury trial, the class action waiver, and the thirty (30) day opt-out right.

Exclusive jurisdiction. For any claims not subject to arbitration, you consent to the exclusive personal jurisdiction and venue of the state and federal courts located in Wilmington, Delaware.

Statute of limitations. Any claim or cause of action arising out of or relating to this Privacy Policy must be filed within one (1) year after such claim or cause of action arose, regardless of any statute or law to the contrary. Any claim not filed within this period is permanently barred.

Entire agreement. This Privacy Policy, together with the Terms of Service and Medical Disclaimer, constitutes the entire agreement between you and QuantumOne regarding the collection, use, and protection of your personal information and supersedes all prior or contemporaneous agreements, communications, and proposals regarding the subject matter hereof.

Section 20: Final

Effective Date: March 28, 2026

Last Updated: March 28, 2026

By continuing to use QuantumOne, you acknowledge that you have read, understood, and agree to this Privacy Policy.

Please also read our Medical Disclaimer and Terms of Service.