Privacy Policy

Phytovive Inc. ("Phytovive," "we," "us") respects your privacy. This policy explains what personal data we collect, how we use and share it, and the choices and rights you have.

1. Who we are

Phytovive Inc., a Delaware corporation with its principal place of business in St. Petersburg, Florida, is the controller of your personal data. Contact: hello@phytovive.com.

2. What we collect

• Contact & commerce account: name, email, phone, shipping/billing address, and any account credentials for shopping. The practitioner library and the team library use emailed sign-in codes instead of an account password.
• Order & payment: purchase and subscription history. Payments are processed securely by our payment provider; we do not store full card numbers.
• Communications & preferences: your messages to us and your marketing preferences.
• Health-related information you choose to share in customer messages or reaction reports. This is provided voluntarily and treated as sensitive.
• Usage & device: cookies, IP address, browser type, and how you interact with our site.

Library accounts. The practitioner library and the team library are by invitation only. When an authorised member of our team invites you, they provide your name and email address, and may add your practice or organisation and your country. We also keep which libraries your account opens, account status, whether you administer access, the date of your invitation and who sent it, session records, last sign-in and revocation times, and records of administrative changes.

We email one-time sign-in codes and, with your invitation, a personal sign-in link. A code works only in the browser that asked for it. Our library database stores hashes of personal sign-in links and sessions, and a protected representation of codes. The emails we send necessarily contain the usable code or link. Access to request logs is restricted. We use technical request information to limit abuse, operate the service and investigate security problems. The libraries do not ask for patient records, identifiable health information, bank details or tax information. Please do not send patient information through the libraries or their support channel. Health-related information you voluntarily share with our customer service team is handled separately from your library account.

3. How we use your data

• To process, deliver, and support your orders and subscriptions.
• To respond to you and provide customer service.
• To send transactional messages, and, with your consent where required, marketing (you can unsubscribe anytime).
• To operate, secure, and improve our site and products.
• To use usage information in anonymised and aggregate form to improve our services.
• To meet legal obligations, including adverse-event recordkeeping for dietary supplements.

We use library account details to invite eligible professionals and our team and affiliates, provide and secure access, and support you. These details are needed to provide access; without them we cannot open an account. Having a library account does not subscribe you to marketing. Account eligibility is decided by our team rather than solely by an automated decision.

4. Legal bases (EU / UK)

Where GDPR applies, we rely on: performance of a contract (fulfilling orders), your consent (marketing and, where required, health information you choose to share), our legitimate interests (securing and improving our services), and legal obligation.

For the practitioner library and the team library, providing access, invitations, access administration and proportionate security records rely on our legitimate interests in running secure, invitation-only libraries. Legal obligations may require certain records to be kept. Marketing relies on the separate basis described above. Having a library account does not opt you into marketing.

5. How we share your data, we do not sell it

We do not sell your personal data. We share it only with:

• Shopping and newsletters: Shopify supports shopping and checkout. Newsletter sign-ups are sent directly from your browser to Klaviyo using its subscription API. Payment and fulfilment providers receive the information needed to process and deliver orders. This site does not embed Google Analytics, the Meta pixel or Klaviyo's onsite tracking script.
• Hosting and library account providers: Vercel hosts this website; Neon provides the library account database and Resend sends account emails, including sign-in codes. These providers process information needed for their respective services under the applicable service and data-processing arrangements.
• Communications and other service providers: the providers of our business email and telephone services, and of any subscription or support app connected to our Shopify store, process the information needed for those services on our behalf, including customer messages and reaction reports.
• Account administration: authorised Phytovive administrators can manage invitations, accounts and the libraries each account opens. Authorised technical operators can maintain the service and handle erasure requests.
• Legal & safety: where required by law or to protect rights and safety.
• Business transfers: in a merger, acquisition, or similar transaction, subject to this policy.

The library's Shopify Collabs link is a link to a separate service. Clicking it does not send your library profile, sign-in details or library session to Shopify. If you join the referral programme, Shopify and Phytovive process programme information under the relevant notices and programme terms. Phytovive may see programme reporting as the merchant. The library itself does not collect Collabs login, banking or tax details.

6. Cookies

We use cookies and local storage for shopping, sign-in and preferences, as described in our Cookie Policy. The policy lists their purposes and durations and explains your browser controls. If we add tracking that requires consent, we will request it before use.

7. Data retention

We keep personal data only as long as needed for the purposes above, to meet legal, tax, and adverse-event obligations, and to resolve disputes.

We keep library account details while providing access and review them when access ends or the information is no longer needed. We retain identifiable security records only as long as reasonably needed for security, handling a dispute or meeting a legal obligation. A request to close an account is distinct from a request to erase personal data; tell us which you want, or ask for both.

Sign-in codes are valid for 10 minutes and work once. A personal sign-in link works until it is replaced or your access ends. Library sessions end after 30 days without use and after 90 days at most; administrators' sessions end after an hour without use and after 12 hours at most. Signing out or revocation ends a session sooner. These are access-validity periods, not promises that every copy is physically deleted at that moment. Expired codes and sessions are cleared through service housekeeping. Revoked accounts remain until an authorised operator erases them.

Erasing a library account removes its profile, codes, personal sign-in link and sessions from the active account database and replaces its email address in account, audit and library records. It does not recall an email already delivered or instantly remove provider logs, the email service's stored copies of sent messages, or backups. These follow the retention settings applicable to those services. Copies of emails kept by recipients remain under their control. Where information must be retained for a legal reason, we restrict its use to that reason and explain the exception where permitted.

8. Your rights & choices

Depending on where you live (including under GDPR and California's CCPA/CPRA), you may have the right to access, correct, delete, or port your data; to opt out of marketing; to opt out of "sale" or "sharing" (note: we do not sell your data); and to withdraw consent. You may also request full deletion of your profile. To exercise any of these, contact hello@phytovive.com. We will not discriminate against you for exercising your rights.

Depending on the law that applies, you may also request restriction of processing, object to processing based on legitimate interests, and complain to your local data protection authority. A withdrawal of marketing consent does not prevent essential account messages. We may need proportionate information to verify a request and will explain any lawful limit on fulfilling it.

9. International transfers

We operate from the United States. Personal data may be processed there and in the countries used by our service providers. Where transfer rules require safeguards, we use an applicable lawful transfer mechanism; contact hello@phytovive.com for information about the safeguards and how to obtain a copy.

10. Security

We use industry-standard measures to protect your data. No method of transmission or storage is completely secure, but we work to safeguard your information and to give you control over it.

11. Children

Our site and products are not directed to anyone under 18, and we do not knowingly collect data from children.

12. Changes

We may update this policy; the "last updated" date shows the current version.

13. Contact

Phytovive Inc. · hello@phytovive.com · 1-850-665-5506 · 7901 4th St N, Ste 300, St. Petersburg, FL 33702.