2San Customer and Partner Privacy Policy

Last modified: 23th of June 2026

Who are we?

2San is a global consumer health and
wellbeing group, supplying personal care products and at-home testing products
together with related customer support and online services. We operate across
multiple countries, including the United States, the United Kingdom, Australia,
New Zealand, Denmark and Canada. In this policy, “2San”, “we”, “us” and “our”
refer to 2San LLC in the United States, 2San Global Holdings Limited in the
United Kingdom, and 2San Pty Ltd in Australia, and to other 2San group entities
where relevant.

What is in this
policy?

Welcome to 2San’s privacy policy. We
respect your privacy and are committed to protecting it through our compliance
with this policy and all applicable data privacy laws.

2San provides consumer health, wellbeing
and personal care products, related customer support, websites, online
platforms and partner channels (collectively, the “Services”). We operate in
Australia and are bound by the Privacy Act 1988 (Cth), including the Australian
Privacy Principles (APPs), as amended by the Privacy and Other Legislation
Amendment Act 2024. We are also subject to data protection laws in the other
countries where we operate, including the UK and EU GDPR, applicable United
States privacy laws, and Canadian and New Zealand privacy laws.

This privacy policy explains how 2San
collects, uses, stores, discloses and protects your personal information,
including sensitive information such as health information. It also describes
your rights regarding your personal information and the choices you have.

Who does this
policy apply to?

For the purposes of this policy, “you” and
“your” may refer to:

·        Individual consumers who
purchase or use 2San products;

·        People who contact our customer
support team about our products, including at-home test results;

·        Business contacts at retailers,
distributors, pharmacies, fulfilment partners and other organisations that work
with 2San;

·        Users of 2San.com, our online
forms and support channels, and the AU Partner Portal; and

·        Any other individual who
communicates with us or provides personal information to us.

Where this policy refers to a “consumer”,
it generally means an individual who purchases or uses our products, or who
contacts us for support about them. Where it refers to a “partner” or “business
contact”, it generally means an individual acting on behalf of a retailer,
distributor, pharmacy, fulfilment partner or other business customer.

This policy does not cover the large retail
and trade customers who buy from us under their own negotiated agreements.
Those relationships are governed by the terms of those agreements.

What does this
policy cover?

This policy applies to personal information
we collect:

·        Through our customer service
channels (email, phone and online chat);

·        When you contact us about our
products or services;

·        When you request assistance
interpreting test results from our at-home testing products;

·        Through our website and online
platforms;

·        Through third-party platforms
where our products are sold, such as Amazon or retail partners;

·        When you communicate with us as
a retailer, distributor, pharmacy, fulfilment partner or other business
partner; and

·        Where we receive limited
purchase-related, shipping-related, order-related or product-related
information from a third-party platform, retailer, distributor, pharmacy or
fulfilment partner.

The AU Partner Portal is used for pharmacy
and partner business contracts and order details. Orders placed through the AU
Partner Portal are passed through 2San briefly and forwarded to a third-party
distributor who holds 2San stock and handles fulfilment, shipping and payment.
We do not use that portal to collect patient-level information.

Please read this policy carefully to
understand our policies and practices regarding your information and how we
will treat it. If you do not agree with our policies and practices, your choice
is to not use our Services or contact our customer support team. By contacting
us or using our Services, you agree to this privacy policy. This policy may
change from time to time (see Changes to our Privacy Policy). Your continued
use of our Services after we make changes is deemed to be acceptance of those
changes, so please check the policy periodically for updates.

Children under
the age of 18

Our Services are not intended for children
under 18 years of age, and we do not knowingly collect personal information
from children under 18. We do not collect date of birth or age as part of our
ordinary customer support process. If we learn we have collected or received
personal information from a child under 18 without verification of parental
consent, we will delete that information. If you believe we might have any
information from or about a child under 18, please contact us using the details
at the end of this policy.

We are committed to protecting children’s
privacy and will comply with applicable children’s privacy laws to the extent
they apply to us. In Australia, this includes any Children’s Online Privacy
Code developed by the Office of the Australian Information Commissioner (OAIC)
under the Privacy and Other Legislation Amendment Act 2024, once registered. In
the United States, this includes the federal Children’s Online Privacy
Protection Act (COPPA) and the California Age-Appropriate Design Code Act, to
the extent enforceable.

What information
does 2San collect?

The types of personal information we
collect depend on how you interact with us, including whether you are a
consumer using or enquiring about our products, or a business partner
interacting with us through our partner channels. We may collect the following
types of personal information when you contact us or use our Services:

·        Contact Information, such as
name, email address, phone number and mailing address.

·        Health Information (Sensitive
Information), such as test results from our products, symptoms or health
concerns you share with us, medical history relevant to your inquiry, and
questions about your test results.

·        Transaction Information, such
as purchase history, product registration information and customer service
interaction records.

·        Technical Information, such as
IP address, browser type and version, device information and usage data related
to our website and online platforms.

In most cases, we collect information
directly from you when you contact us, use our Services, submit information
through our website or the AU Partner Portal, place or enquire about an order,
or otherwise communicate with us. We may also receive limited purchase-related,
shipping-related, order-related or product-related information from a
third-party platform or business partners through which our products are sold
and supplied. In addition, we may collect certain technical information
automatically through cookies and similar website technologies.

Contact information

When you contact customer support, we may
collect your name, email address, phone number, mailing address, and any other
contact information you provide when reaching out to us. If you choose to send
photos, screenshots, documents or other attachments, we may collect the
information contained in those materials.

Customer service interactions

We may keep records of your customer
support interactions for quality assurance, training, complaint, regulatory and
business record-keeping purposes. Phone calls or online chat interactions may
be monitored or recorded where permitted by law and where appropriate notice is
provided.

Product and test-related information

If you contact us about an at-home testing
product, you may choose to provide information such as product details, test
results, questions about your results, symptoms, health concerns, or relevant
medical history. We collect information only where you provide it to us, and we
will only use it to help respond to your inquiry within the limits described in
this policy.

Business contact and partner information

We may collect records of your account
activity within the AU Partner Portal and the content of communications you
have with us about the partner programme, product supply, orders, support,
marketing preferences, training, quality assurance, compliance or
record-keeping matters.

Payment information

We do not collect or store payment card
details. Online sales are processed by third-party payment or commerce
providers, including Amazon Pay. Those providers handle payment information
under their own terms and privacy policies.

Third-party platform information

For products sold through Amazon, we may
receive limited information such as shipping, address and product details. We
do not receive your name, email address or phone number from a third-party
platform for those purchases unless you separately provide that information to
us, for example by contacting our customer support directly. We may also
receive limited order-related or product-related information from retailers,
distributors, pharmacies or fulfilment partners where needed to support a
purchase, order, product enquiry, complaint or regulatory matter.

Website and technical information

When you visit 2San.com, use our online
platforms, or use the AU Partner Portal, we may automatically collect technical
and usage information through cookies, analytics tags and similar technologies,
including IP addresses, browser type, operating systems, device information,
pages visited, time spent on our website, usage patterns and cookie or consent
preferences.

Health
information

When you contact our customer support team
for assistance interpreting test results from our at-home testing products, you
may provide health-related information including:

·        Test results from our products;

·        Symptoms or health concerns;

·        Medical history relevant to
your inquiry; and

·        Questions about your test
results.

Health information is classified as
sensitive information under the Privacy Act 1988 (Cth) and is treated as
special category data under the UK and EU GDPR. It attracts heightened
protections under those laws. We collect health information only when:

·        You provide it to us
voluntarily when seeking customer support or assistance with test results;

·        It is reasonably necessary for
one or more of our functions or activities; and

·        We have obtained your explicit
consent to collect such information.

We collect health information with your
consent and for the purpose of providing customer support related to our
at-home testing products. By providing health information to us, you consent to
its collection, use and disclosure in accordance with this policy.

Before collecting health information, we
will:

·        Clearly explain why we need the
information;

·        Inform you how the information
will be used and disclosed;

·        Obtain your explicit consent;
and

·        Provide you with the option to
decline.

We will only use and disclose your health
information for the purposes for which it was collected, unless:

·        You have consented to another
use or disclosure;

·        We are required or authorised
by law to do so; or

·        The use or disclosure is
necessary to prevent or lessen a serious threat to life, health or safety.

2San takes the protection of your health
information seriously. We implement appropriate safeguards to protect health
information in accordance with applicable privacy laws. However, you should be
aware that:

·        Our customer support
representatives are not licensed medical professionals and cannot provide
medical advice or treatment;

·        Any support we provide is
limited to helping you understand the product, use the product as intended, and
interpret information within the scope of product guidance;

·        You should always consult a
qualified healthcare provider for medical advice, diagnosis, treatment, or any
questions about your health; and

·        We recommend using secure
communication channels when sharing health information with us.

How does 2San use
the information it collects?

We use your personal information for the
purposes for which it was collected and for related purposes you would
reasonably expect. This includes using your information to:

·        Respond to customer inquiries
and provide customer support;

·        Help customers interpret test
results from our products within the scope of product guidance, not medical
advice;

·        Set up, manage and administer
partner accounts and AU Partner Portal access;

·        Communicate with retailers,
distributors, pharmacies, fulfilment partners and other business partners about
our products, orders, supply arrangements, partner matters and support
requests;

·        Send marketing emails or other
marketing communications where you have opted in or where otherwise permitted
by applicable law, and allow you to withdraw consent or unsubscribe at any
time;

·        Investigate, manage and respond
to product complaints, adverse event reports, quality issues and regulatory or
compliance matters;

·        Maintain customer support,
partner support, quality assurance, training, compliance and business records;

·        Improve our products, services,
websites, portals, support processes and partner programme;

·        Comply with legal and
regulatory obligations; and

·        Fulfil obligations to retail,
distribution, fulfilment and other business partners where relevant to your
inquiry, purchase, order, account or business relationship with us.

Depending on your location and the
applicable law, we may rely on different legal grounds for handling your
personal information, including but not limited to:

·        Performance of a contract: we
use your information to provide the Services you request;

·        Legitimate interests: we
process your information for business purposes such as improving our Services,
maintaining records, providing the Services to you, and complying with our
business obligations;

·        Legal obligations: we may
process your information to comply with applicable laws and regulations; and

·        Consent: in some cases, we may
seek your explicit consent before processing certain types of information,
including health information.

Automated
decision-making

We do not currently use automated
decision-making processes that would have legal or similarly significant
effects on you. If we implement automated decision-making in the future, we
will update this policy and notify you of:

·        The existence of automated
decision-making;

·        The logic involved in such
decision-making;

·        The significance and envisaged
consequences of such processing;

·        Your right to request human
intervention;

·        Your right to express your
point of view; and

·        Your right to contest any
automated decision.

We do not sell
your personal information

We do not sell your personal information to
third parties. We may disclose aggregated or de-identified information about
our customers that does not identify any individual.

When does 2San
share information?

We may disclose personal information that
we collect, or that you provide, as described in the following circumstances:

·        Service Providers: we may
disclose information to contractors, service providers and other third parties
who help us operate our business and provide support (such as IT service
providers, customer service platforms, email and productivity providers, marketing
platform, CRM platform, hosting providers, data storage providers and other
business operations providers), who are bound by contractual obligations to
keep personal information confidential and use it only for the purposes for
which we disclose it to them.

·        Business Partners and
third-party platforms: we may share limited information with our retail
partners, distributors and marketplace platforms (such as Amazon) where
necessary to fulfil our business obligations and provide customer support for
products sold through these channels.

·        Legal Requirements: we may
disclose personal information to comply with any court order, law or legal
process, including to respond to any government or regulatory request,
particularly those relating to medical device safety and adverse event
reporting.

·        Protection of Rights: we may
disclose personal information where we believe disclosure is necessary or
appropriate to protect the rights, property or safety of 2San, our customers,
partners or others.

·        Business Transfers: we may
disclose personal information to a buyer or other successor in the event of a
merger, divestiture, restructuring, reorganisation, dissolution, or other sale
or transfer of some or all of 2San’s assets, whether as a going concern or as
part of bankruptcy, liquidation or similar proceeding.

·        With Your Consent: we may
disclose personal information with your explicit consent for specific purposes
not covered by this policy.

Where a product complaint or adverse event
involves an individual, any report we make for quality or regulatory purposes
is handled so that customer personal information is removed or replaced with an
internal reference where practicable.

How long does
2San keep my information?

We retain your information for as long as
necessary to fulfil the purposes outlined in this policy, unless a longer
retention period is required or permitted by law. When information is no longer
required, we take reasonable steps to destroy or de-identify it.

Factors we consider in determining
retention periods include:

·        The nature of the information
and the purpose for which it was collected;

·        Legal and regulatory
requirements applicable to medical device distributors;

·        Business record-keeping
requirements;

·        Protection of our legal rights
and obligations; and

·        Customer service quality and
training purposes.

Generally, we retain customer service
records and communications for one year from the last interaction, unless a
longer period is required or permitted by law.

For partner accounts and related business
communications, we generally retain information for three to seven years from
the date of the last interaction, unless a longer period is required or
permitted by law, or needed for the relevant business, legal, regulatory,
accounting or compliance purpose.

How does 2San
protect the information it collects?

We have implemented measures designed to
secure your personal information from accidental loss and from unauthorised
access, use, alteration and disclosure. These measures include:

·        Encryption of data in transit
and at rest;

·        Access controls limiting who
can view your information;

·        Regular security assessments
and updates;

·        Employee training on data
privacy and security; and

·        Secure storage systems with
backup and recovery capabilities.

However, the transmission of information
via the internet and email is not completely secure. Although we do our best to
protect your personal information, we cannot guarantee the security of your
personal information transmitted through our Services or to our customer
support team. Any transmission of personal information is at your own risk. We
are not responsible for circumvention of any privacy settings or security
measures.

In the event of a data breach that is
likely to result in serious harm or a high risk to your rights, we will take
immediate steps to contain and remediate the breach, notify affected
individuals as soon as practicable, and notify the relevant regulators as
required by law. Depending on where you are located, this includes the Office
of the Australian Information Commissioner under the Notifiable Data Breaches
scheme, the UK Information Commissioner’s Office or the relevant EU supervisory
authority under the UK and EU GDPR, the Office of the Privacy Commissioner of
Canada under PIPEDA, the Office of the Privacy Commissioner in New Zealand
under the Privacy Act 2020, and any notifications required under applicable
United States state data breach notification laws. We will also provide
information about the breach and the steps you can take to protect yourself.

Your privacy
rights

Depending on your location and the laws
that apply, you may have rights to request access to, correction of, deletion
of, or restrictions on the use of your personal information, and to object to
or opt out of certain processing activities regarding your personal
information.

United States residents:

If you are a resident of certain U.S.
states (such as California, Virginia, Colorado, Connecticut or Utah), you may
have specific rights under state privacy laws, including:

·        The right to know what personal
information we collect;

·        The right to access your
personal information;

·        The right to correct inaccurate
personal information;

·        The right to delete your
personal information (subject to certain exceptions); and

·        The right to opt out of certain
data sharing practices.

Australian residents:

If you are located in Australia, the
Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) give you
certain rights regarding your personal information, including:

·        The right to access your
personal information;

·        The right to correct your
personal information;

·        The right to make a complaint
about our handling of your personal information;

·        The right to withdraw your
consent to direct marketing communications at any time; and

·        Where practical and lawful, the
option of dealing with us anonymously or using a pseudonym.

Canadian residents:

If you are located in Canada, the Personal
Information Protection and Electronic Documents Act (PIPEDA) and applicable
provincial privacy laws give you certain rights regarding your personal
information, including:

·        The right to access the
personal information we hold about you;

·        The right to request correction
of inaccurate or incomplete information;

·        The right to withdraw your
consent to our collection, use or disclosure of your personal information,
subject to legal or contractual restrictions; and

·        The right to make a complaint
to the Office of the Privacy Commissioner of Canada.

New Zealand residents:

If you are located in New Zealand, the
Privacy Act 2020 and the Information Privacy Principles give you certain rights
regarding your personal information, including:

·        The right to access the
personal information we hold about you;

·        The right to request correction
of your personal information;

·        The right to make a complaint
to the Office of the Privacy Commissioner; and

·        Protections relating to how
your information may be disclosed outside New Zealand.

United Kingdom (UK) residents:

If you are located in the UK, the UK GDPR
provides you with certain rights, including:

·        The right to be informed about
data processing;

·        The right to access your
personal data;

·        The right to rectification of
inaccurate data;

·        The right to erasure (in
certain circumstances);

·        The right to restrict
processing;

·        The right to data portability;

·        The right to object to
processing;

·        The right to withdraw consent
at any time where our processing is based on consent;

·        Rights related to automated
decision-making; and

·        The right to lodge a complaint
with the Information Commissioner’s Office (ICO).

Residents of other countries:

If you are located in another country,
including in the European Economic Area, you may have additional rights under
your local data protection laws. Please contact us and we will respond to your
request as required by the laws that apply to you.

To exercise any of these rights, please
contact us using the contact information provided below. We may need to verify
your identity before processing your request.

Cross-border
transfers

2San operates in the United States, the
United Kingdom, Australia, New Zealand, Canada, Denmark, the European Union and
the Philippines. Our support staff, business teams and service providers may be
located in, or access personal information from, those countries and other
locations where we or our providers operate.

This means your personal information may be
accessed, transferred to, stored and processed outside your country of
residence in the course of providing support, operating our business and
meeting our legal and regulatory obligations.

Where we transfer personal information from
the United Kingdom or the European Economic Area to a country that has not been
recognised as providing an adequate level of data protection, we put in place
appropriate safeguards. These include the European Commission’s Standard
Contractual Clauses together with the UK Addendum issued by the Information
Commissioner’s Office, or another lawful transfer mechanism.

If you are located in Australia, Canada or
New Zealand, by using our Services or contacting our support team you consent
to the transfer of your personal information to other countries, which may have
different data protection laws than your country of residence. Where you are
located in the United Kingdom or the European Economic Area, transfers are made
under the safeguards described above rather than on the basis of your consent.

When we disclose personal information to
overseas recipients, we take reasonable steps to ensure that:

·        The overseas recipient does not
breach the Australian Privacy Principles;

·        We have contractual
arrangements in place requiring the recipient to protect your information; or

·        The recipient is subject to a
law or binding scheme that provides substantially similar protections to the
Australian Privacy Principles.

By providing personal information to us,
you consent to its disclosure to overseas recipients in the countries
identified above. You acknowledge that, where you consent to overseas
disclosure, we are not required to take reasonable steps to ensure the overseas
recipient complies with the Australian Privacy Principles, and you may not be
able to seek redress under the Privacy Act 1988 (Cth). If you do not consent to
overseas disclosure, please contact us to discuss alternative arrangements,
though this may limit our ability to provide certain services to you.

Cookies,
analytics and advertising

When you visit 2San.com or use our online
platforms, we and our providers may automatically collect technical and usage
information through cookies and similar technologies, including IP address,
browser type, operating system, device information, pages visited and usage
patterns.

Our website uses a consent banner with a
preferences centre that lets you control cookies by category. Strictly
necessary cookies are always on. Functionality, analytics and advertising
cookies are off by default and are only set if you opt in. The categories are:

·        Strictly necessary cookies,
which are essential for the website to function properly.

·        Functionality cookies, which
allow the website to provide personalised functionality and improved features.

·        Analytics cookies, which help
us understand and report on how visitors interact with our website.

·        Advertising cookies, which are
used to make advertising more relevant to you and may be set by third-party
providers.

You can manage your cookie preferences at
any time through the consent preferences centre on our website. The lawful
basis for setting strictly necessary cookies is our legitimate interest in
operating a functional and secure website. The lawful basis for all other
cookies is your consent. Some non-essential cookies are set by third-party
providers. We currently use Google Analytics and Google Tag Manager for
analytics, LinkedIn Insight Tag for advertising, and Mailchimp, Pipedrive and
Shopify tags for marketing and e-commerce. Retention periods vary by cookie and
provider, and details of the specific cookies in use are available through the
consent preferences centre. For any questions about our use of cookies, please
contact us using the details at the end of this policy.

Third-party
platforms

Our products are sold through various
third-party platforms, including Amazon and retail partners. When you purchase
our products through these platforms:

·        The platform’s privacy policy
governs the collection and use of information related to your purchase
transaction;

·        We may receive limited
information from the platform to fulfil our customer support obligations; and

·        If you contact us directly for
customer support, this privacy policy applies to the information you provide to
us.

We encourage you to review the privacy
policies of any third-party platforms through which you purchase our products.

Marketing
communications

We may send marketing communications to
business partners or other individuals where you have opted in or where we are
otherwise permitted to do so under applicable law. You can withdraw consent or
unsubscribe from marketing communications at any time by using the unsubscribe
link in the relevant email or by contacting us. We will still be able to send
you non-marketing communications, such as support, account, order, safety,
compliance or legal notices, where appropriate.

Changes to our
Privacy Policy

We may update this privacy policy from time
to time. The date the privacy policy was last revised is identified at the top
of this document. If we make material changes to how we handle personal
information, we will notify you by prominently posting a notice on 2San.com
before the changes take effect or by directly contacting you through
appropriate means. Please check this policy periodically for updates.

Contact
information

If you have any questions, comments or
concerns about this privacy policy or our privacy practices, or if you wish to
exercise your privacy rights, please contact us at:

2San LLC

Legal Department

1330 Avenue of the Americas, New York, NY
10019, United States of America

Email: legal@2san.com

Phone: +1 (857) 328 0036

 

For customers in the United Kingdom, you
may also contact:

2San Global Holdings Limited

The Guildhall, Oakwood Way, Carnforth LA5
9FD, United Kingdom

Email: legal@2san.com

 

For customers in Australia, you may also
contact:

2San Pty Ltd

Level 35, Tower One, 100 Barangaroo Avenue,
Sydney, NSW 2000, Australia

Email: legal@2san.com

 

2San’s Privacy Officer is responsible for
oversight of this policy and our privacy practices, and can be contacted at
legal@2san.com.