Privacy Policy.

Because MostFit Labs is a marketing and care-navigation platform, your data falls into two distinct buckets handled by two distinct parties:

• Account & navigation data (email, name, shipping address, payment receipt) is held by MostFit Labs.
• Clinical & pharmacy data (intake answers, clinical notes, prescriptions, dispensing records) is held by OLA Digital Health and its partner pharmacies under HIPAA. MostFit Labs may receive metadata about whether an intake was submitted, approved, or denied so we can coordinate fulfillment, but we do not store the clinical content of your intake or consultation.

From your interactions with this Site, we collect:

• Email address you provide to create an account; we verify it via a one-time code.
• Name, shipping address, and phone number you enter into the intake form.
• Cart contents and order history.
• Payment metadata (last 4 digits of card, billing zip, Stripe customer id). We never see or store your full card number.
• Standard server logs (IP address, user agent, request paths and timestamps) used for security and abuse prevention.
• Cookies needed to keep you signed in. We do not use third-party advertising cookies.

We use your information to:

• Authenticate you, fulfill your orders, and route you to the clinical and pharmacy partners.
• Send transactional email about your account, order status, prescription updates, and changes to these policies.
• Improve the Site, debug errors, and detect abuse.
• Comply with law (tax, audit, regulatory requests, court orders).

We do not sell your personal information. We do not share it with advertisers. We do not use it to train AI models.

We share information only with vendors who help us run the Site, and only what they need:

• Neon hosts our Postgres database.
• Stripe processes payments.
• Resend delivers transactional email.
• OLA Digital Health handles your intake, clinician review, and prescription routing under HIPAA.
• Dokploy / our hosting infrastructure serves the Site and stores server logs.

Each of these vendors is contractually limited to using your data to provide their service to us, and is required to protect it with industry-standard safeguards.

Information you submit through the telehealth intake (medical history, symptoms, photos, lab values) is protected health information (PHI) under HIPAA and is held by OLA Digital Health and the dispensing pharmacy as covered entities. MostFit Labs is not a covered entity; we do not retain the clinical content of your intake. To request a copy, correction, or deletion of your clinical records, contact OLA Digital Health support directly; their contact information is on the prescription label and the patient leaflet that ships with your order.

You can email hello@mostfitlabs.com to:

• Get a copy of the account data we hold about you.
• Correct inaccurate information.
• Delete your account and the navigation data tied to it (records we are required to retain by law are an exception).
• Opt out of non-transactional email.

Residents of California, Colorado, Connecticut, Utah, Virginia, Texas, and other states with comprehensive privacy laws have additional rights under those laws; we honor those rights for all users regardless of state.

Account data is kept for as long as your account is open and for a reasonable period after deletion to comply with tax and audit obligations (typically up to 7 years). Server logs are kept for 90 days. Payment receipts are kept for 7 years. Marketing email opt-outs are kept indefinitely so we don't accidentally email you again.

Data in transit is encrypted with TLS 1.2 or higher. Data at rest is encrypted on Neon, Stripe, and Resend infrastructure. Only the MostFit Labs employees who need access to do their job can read account records, and access is logged. We do not store your full payment card number on our servers; Stripe holds that under PCI DSS.

The Site is for adults 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has submitted information to us, email support and we will delete it.

MostFit Labs is a United States platform and only ships within the United States. If you access the Site from outside the US, your information will be transferred to and processed in the US.

We may update this policy. The current version is always at this URL with a “Last updated” date. Material changes will be announced via email to your account email.

Privacy questions? Email hello@mostfitlabs.com. Clinical-records or HIPAA questions go directly to OLA Digital Health support, contactable through the patient leaflet shipped with your order or the contact information on your prescription label.