Wholesale Privacy Notice.

This Wholesale Privacy Notice describes how AminoVita Research LLC (“AminoVita Research,” “we,” “us”) collects, uses, and shares information relating to an approved business account (the “Account”) and the individuals who order on its behalf. It applies only to AminoVita Research; AminoVita Wellness LLC publishes a separate policy.

1. What We Hold Against an Account

• Account record — company name, the ordering channels the Account is approved for, and the account status and approval history.
• Business-contact details — the name, work email, and phone number of the people who request the account and place orders on it. We hold these in a business capacity, not as consumer contact details.
• Sign-in records — the email address the account signs in with, the credential record behind it, and the tokens issued to establish a session. We never see or store a password in readable form.
• Order and invoice history — order contents, wholesale prices charged, ship-to addresses, purchase-order numbers you supply, invoice and payment status, and shipment tracking.
• Research-use affirmations — for each order containing research-channel material, the fact of the affirmation, who made it, when, and the version of the Wholesale Terms then in effect.
• Technical information — the usual server request data (IP address, user-agent, referrer) kept by our host, and the anti-automation check on the sign-in and password screens. Used for security and abuse prevention, not for advertising.

This list describes the categories we hold in the ordinary course. It is not a representation that we hold every category for every Account, or that we hold nothing else incidental to operating the portal.

We do not ask for, and do not want, patient information, clinical records, or any individual’s health information in connection with a wholesale order. See Section 6.

2. No Advertising or Analytics on the Portal

The signed-in business portal runs no advertising tags, no identity-resolution technology, and no analytics trackers. The technologies described in the retail policy’s Sections 3 and 6 — the identity-resolution tag, the Meta advertising pixel, Google Analytics — are not present on these pages.

Wholesale orders are excluded from advertising measurement entirely. The retail policy describes sending a record of a completed order for advertising measurement; we do not do that for any order placed through a business account, regardless of what any consent choice recorded in your browser says. There is nothing to opt out of here because it does not happen.

The storage the portal does use is strictly necessary: your cart, your sign-in session, and your preference for whether the navigation rail is expanded or collapsed. None of it is read by a third party.

3. How We Use It

• To approve and maintain the Account and decide which ordering channels it is eligible for.
• To price, take, fulfil, invoice, and ship orders.
• To record and substantiate the research-use affirmation attached to each order.
• To send account and order messages — approval, sign-in and password links, order confirmations, invoices, shipment notices, and back-in-stock notices for a SKU you tried to order. These are transactional and continue regardless of marketing preferences.
• To prevent fraud and misuse, and to meet our own legal and record-keeping obligations.

4. Who We Share It With

We share account information only with the service providers that operate the portal and fulfil orders:

• Hosting and application platform — Netlify (Netlify, Inc.) serves the portal and runs the functions that process orders.
• Database and authentication — Supabase (Supabase, Inc.) holds the account, order, and affirmation records, and operates portal sign-in.
• Anti-automation — Cloudflare Turnstile (Cloudflare, Inc.) on the sign-in and password screens.
• Payment processing — our card processor for card-tender orders, and PayPal (PayPal, Inc.) where an order is invoiced. The processor receives what it needs to route the payment. We do not store card numbers.
• Account messaging — GoHighLevel (LeadConnector LLC) stores the business-contact record and sends the transactional messages listed in Section 3.
• Shipping carriers — receive the ship-to name and address to deliver the order.
• Address autocomplete — Google Places (Google LLC) receives the characters you type while entering a ship-to address, and only while you are typing one.
• Authorities when required by law, by subpoena, court order, or lawful request, or where we judge disclosure necessary to investigate suspected fraud or misuse, to protect our rights or property, or to protect the safety of any person. We are not obliged to notify you before responding to a lawful request unless the law requires it.
• Professional advisers — counsel, accountants, auditors, and insurers, where they need it to advise or represent us.
• A successor — if we are party to a merger, acquisition, financing, reorganisation, or sale of all or part of our assets, account and order records may transfer to the counterparty or the successor entity as part of that transaction or its due diligence.

We do not sell personal information, and — as Section 2 says — we do not share wholesale account or order information for advertising.

Each service provider named above operates under its own terms and privacy policy and is responsible for its own handling of the information it receives. We select providers in good faith but do not guarantee, and are not liable for, the acts or omissions of any third party, including any security incident originating with one. This list may change as we change providers; the current list is the one published here.

5. Where Information Is Processed

We operate in the United States, and information is processed and stored in the United States and in any other jurisdiction where a provider named in Section 4 operates. By opening an Account or placing an order you consent to that processing. The portal and our products are not offered to, and are not intended for, individuals or entities in the European Economic Area, the United Kingdom, or Switzerland, and we make no representation that this notice satisfies the requirements of any non-U.S. data-protection regime.

6. No Protected Health Information — We Are Not a HIPAA Covered Entity

AminoVita Research LLC is not a HIPAA covered entity and is not acting as a business associate of any Account. We do not perform any function on behalf of a covered entity, we do not require protected health information to take or fulfil a wholesale order, and we do not and will not execute a business associate agreement. Any such agreement, or any provision purporting to impose business-associate obligations on us, is of no effect whether or not we countersigned it.

You must not transmit to us, or enter into any portal field, email, purchase-order reference, or shipping instruction, any patient name, patient identifier, prescription, clinical record, diagnosis, or other individually identifiable health information. If you do so, you do it in breach of the Wholesale Terms and without our consent, and you are solely responsible for that disclosure, including for any notification obligation it triggers. You agree to indemnify and hold us harmless against any claim, penalty, assessment, or cost arising from your transmission of such information to us. We may delete it on discovery without notice.

7. Account Credentials Are the Account’s Responsibility

The Account is responsible for keeping its sign-in credentials confidential, for who it lets use them, and for removing access when a person leaves. Any order placed, affirmation made, address changed, or information accessed through a session authenticated with the Account’s credentials is deemed authorised by the Account, and the Account is bound by it. Tell us immediately at info@aminovitaresearch.com if you believe a credential has been compromised; until we receive that notice and act on it, we are not responsible for activity on the Account.

8. Security

We use administrative and technical safeguards we consider reasonable for the information we hold, including encrypted transport, hashed credentials, scoped database access, and an anti-automation check on the sign-in screens. No method of transmission or storage is completely secure, and we do not warrant or guarantee that the portal, our providers’ systems, or any information held in them will be free from unauthorised access, loss, or alteration. You use the portal at your own risk, and transmit information to us at your own risk. Nothing in this notice creates a duty or standard of care beyond what applicable law imposes, and our liability for any security incident is subject to the limitation of liability in the Wholesale Terms.

9. Portal Activity Is Logged

We log activity on the portal — sign-ins, orders, affirmations, address and profile changes, and the request data described in Section 1 — for security, fraud prevention, and compliance record-keeping. We may rely on those logs, and on our providers’ logs, as evidence in any dispute, chargeback, audit, or regulatory inquiry, and may disclose them to a processor, acquirer, card network, insurer, or authority for that purpose.

10. Aggregated and De-identified Information

We may create aggregated, statistical, or de-identified information from account and order records — information that does not identify an Account or any individual — and may use, retain, and disclose it for any lawful purpose without restriction, including after an Account closes or a deletion request is honoured. Such information is not personal information and is not subject to this notice.

11. Retention

Order records, invoices, and research-use affirmations are retained as evidentiary and accounting records for the longer of seven years or the duration of any applicable statute of limitations. That is the same retention the retail policy applies to affirmations, and it is why a deletion request cannot reach a completed order. Account and contact records are kept while the Account is open and for that same period afterwards.

We may retain information longer where we are required to, or where it is reasonably necessary to resolve a dispute, enforce the Wholesale Terms, investigate suspected fraud or misuse, or comply with a legal hold or regulatory obligation. Deletion does not reach backups, archives, disaster-recovery copies, or transaction logs held by a payment processor, which expire on their own schedules, and we are not required to restore or search them to honour a request.

12. Your Rights

Where a privacy right applies to you under applicable law, we honour it. The access, deletion, and correction rights described in the retail policy’s Section 5 are extended to the individuals whose details we hold against an Account, subject to the retention above and to every exception, limitation, and exemption the applicable statute allows. Email info@aminovitaresearch.com. We verify identity and, for an agent, authority before acting, may decline a request we cannot verify or that is manifestly unfounded or excessive, and respond within the period the applicable law requires.

Three points specific to a business account:

• Several U.S. state privacy laws exclude information held purely in a business-to-business or employment context. We reserve every such exclusion and exemption available to us, including as to information held about a business contact in that capacity.
• A request from an individual cannot delete the Account’s order history, and removing a person as a contact does not remove the affirmations they made on the Account’s behalf. Those records describe the Account’s orders, not the individual.
• A right to delete does not entitle you to a refund, to cancel an order, or to have us disregard a record we are required to keep. Closing an Account does not cancel an order already placed.

The Do Not Sell or Share control described in the retail policy applies to the consumer storefront. It has no effect on the portal because, per Section 2, nothing on the portal shares information for advertising.

13. Not for Individuals or Children

The portal is offered only to approved business entities acting through authorised personnel aged 18 or over. It is not directed to consumers or to children, and we do not knowingly collect information from anyone under 18. If you are not ordering on behalf of an approved business, do not use the portal.

14. Liability

This notice is a description of our information practices. It is not a warranty, guarantee, or contractual undertaking, and nothing in it is intended to create any right or remedy in any person beyond what applicable law provides. To the fullest extent permitted by law, any claim relating to our handling of information is subject to the limitation of liability, indemnification, governing-law, and exclusive-venue provisions of the Wholesale Terms, and must be brought within the period those Terms specify. If any provision of this notice is held unenforceable, the rest continues in effect.

15. Changes

We may update this notice at any time, and the current version is the one published at this address. The version in effect when you place an order governs that order. Continued use of the portal after a change is acceptance of the updated notice; we are not obliged to notify you of a change individually.

16. Contact

• Registered agent: 30 N Gould St Ste N, Sheridan, WY 82801, USA
• Correspondence: 30 N Gould St Ste N, Sheridan, WY 82801, USA
• Email: info@aminovitaresearch.com