Balance Protocol Institute Privacy Policy

Effective date: September 15, 2026
Last updated: September 15, 2026

1. Overview

Balance Protocol Institute respects your privacy and is committed to handling personal information responsibly, transparently, and in accordance with applicable law.

This Privacy Policy explains how Balance Protocol Institute, referred to as "Balance Protocol," "we," "us," or "our," collects, uses, discloses, retains, and protects personal information when you:

• Visit BalanceProtocol.com, BalanceProtocolGPS.com, or BalanceProtocol.me, including their related subdomains;
• Use the Balance Nation community platform;
• Use a checkout, account, membership, course, community, live session, laboratory support, or customer support service that we operate;
• Enroll in Balance Protocol GPS;
• Purchase an optional Review of Findings;
• Join the dedicated Balance Protocol GPS Group;
• Join or purchase a Balance Nation membership;
• Communicate with us; or
• Otherwise interact with a Balance Protocol product, program, website, or service that links to this Privacy Policy.

This Privacy Policy does not apply to a third party's independent website, service, laboratory, payment platform, or privacy practices, even if that service is linked from one of our websites. Those parties may provide their own privacy notices.

Our separate Consumer Health Data Privacy Notice provides additional disclosures concerning consumer health data and genetic information. It is incorporated into this Privacy Policy and should be published as a separate, prominently linked notice.

2. Contact Information

Balance Protocol Institute
Attn: Privacy
1317 Edgewater Drive
Orlando, FL 32804
United States
Email: support@balanceprotocol.com

Privacy requests may be submitted by emailing support@balanceprotocol.com with the subject line "Privacy Request."

3. Personal Information We Collect

The information we collect depends on how you interact with us.

A. Identifiers and contact information

We may collect:

• First and last name;
• Email address;
• Telephone number;
• Mailing and shipping address;
• Account username;
• Date of birth;
• Customer, order, referral, or internal account identifiers; and
• Information you provide when communicating with us.

B. Enrollment and transaction information

We may collect:

• Products or services purchased;
• Order date, status, amount, discounts, and transaction history;
• Billing and shipping information;
• Coupon, referral, Ambassador, affiliate, and campaign attribution information;
• Enrollment status;
• Kit fulfillment and return status;
• Whether you elect an optional Review of Findings; and
• Records needed to provide customer support, address disputes, and comply with accounting, tax, or legal obligations.

Payment card information is processed by third-party payment providers, such as Stripe or PayPal. Balance Protocol does not intentionally store complete payment-card numbers or card security codes on its own systems.

C. Account, course, and community information

When you use a course, account, or community service, we may collect:

• Login and account information;
• Course enrollment and progress;
• Group membership and participation;
• Membership level, subscription status, and renewal information;
• Profile information;
• Comments, posts, questions, reactions, private messages, files, or other material you choose to submit;
• Participation in live sessions, including recordings when recording is disclosed;
• Support requests; and
• Records concerning moderation, security, and compliance with community rules.

Balance Nation and the GPS Group are monitored and moderated by Dr. Anthony G. Beck and authorized Balance Protocol team members. Information you choose to post may be visible to other members according to the applicable community, group, profile, or messaging settings. Private messages may be processed by the community platform and may be accessed when reasonably necessary for security, moderation, legal compliance, or support. Do not post laboratory reports, genetic results, medical records, payment information, or other sensitive information in a community area unless a specific private and secure method has been provided for that purpose.

D. Health, laboratory, and genetic information

Depending on the service you request, we or service providers acting for us may process:

• Health history or health-related questionnaire responses;
• Symptoms, goals, lifestyle information, environmental information, nutrition information, and other context you choose to provide;
• Specimen and kit information;
• Functional biomarker measurements;
• Laboratory reports;
• Targeted genetic results;
• Interpretive materials;
• Notes or questions connected with a Review of Findings; and
• Communications that contain health-related information.

We treat this information as sensitive. We do not intentionally use laboratory results, genetic results, symptoms, or medical details for interest-based advertising or disclose them to advertising platforms.

E. Website, device, and usage information

When you use our websites or online services, we and our service providers may automatically collect:

• Internet Protocol address;
• Browser and device type;
• Operating system;
• Approximate location derived from an Internet Protocol address;
• Referring and exit pages;
• Pages viewed and links selected;
• Dates, times, session duration, and interaction events;
• Cookie, device, analytics, and similar identifiers;
• Website performance and error information; and
• Referral, UTM, Ambassador, and campaign parameters.

We do not intentionally collect precise GPS location through our websites. The term "GPS" in Balance Protocol GPS is the name of the program and does not mean that the website tracks your geographic location through satellite positioning.

F. Communications and marketing preferences

We may collect the contents of communications you send us, your communication preferences, email engagement information, and records of consent or withdrawal of consent.

Purchasing a product does not, by itself, authorize marketing text messages. Where marketing consent is requested, it is handled separately and may be withdrawn as described in the communication.

4. Sources of Personal Information

We may collect personal information:

• Directly from you;
• Automatically from your browser or device;
• From our checkout and payment providers;
• From laboratory, fulfillment, shipping, course, community, customer-support, and communications providers;
• From a Balance Protocol practitioner when you request a Review of Findings;
• From an Ambassador or referral source through a referral code or campaign link;
• From service providers that help prevent fraud or protect the security of our services; and
• From public sources or other sources when permitted by law.

5. How We Use Personal Information

We may use personal information to:

• Operate, maintain, secure, and improve our websites and related services;
• Process enrollment and payment;
• Prepare, ship, track, and support the NutraCoreX collection kit;
• Coordinate laboratory processing and deliver program materials;
• Provide the GPS Educational Course and dedicated GPS Group;
• Provide Balance Nation memberships, community features, courses, live sessions, member messaging, and related benefits;
• Provide a Review of Findings when purchased;
• Authenticate accounts and preserve permanent course and group access;
• Respond to questions and provide customer support;
• Send transactional messages, service notices, and account communications;
• Send marketing communications when permitted by law and consistent with your choices;
• Attribute referrals, Ambassador activity, and advertising campaigns;
• Measure website performance and understand how visitors use our services;
• Prevent fraud, abuse, security incidents, and prohibited activity;
• Enforce our agreements, community rules, and legal rights;
• Meet legal, regulatory, accounting, tax, and recordkeeping obligations;
• Investigate and respond to disputes, claims, or lawful requests; and
• Complete a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the business, subject to applicable law.

We may create aggregated or deidentified information that cannot reasonably be linked to an individual. We will maintain deidentified information in deidentified form and will not attempt to reidentify it except to test whether our deidentification processes are effective or as otherwise permitted by law.

6. Cookies and Similar Technologies

We and our service providers may use cookies, pixels, tags, local storage, software development tools, and similar technologies.

Types of technologies we may use

• Strictly necessary technologies support navigation, security, checkout, account access, preferences, and core site functions.
• Analytics technologies help us understand traffic, page use, performance, and conversion activity.
• Functional and media technologies support features such as embedded video and remembered settings.
• Referral and attribution technologies preserve approved referral, Ambassador, affiliate, and campaign parameters.
• Advertising technologies, if enabled, help measure advertising or deliver relevant advertising, subject to applicable consent and opt-out requirements.

Our websites may use Google Analytics and Google Tag Manager and may embed video through Vimeo or comparable media providers. Enrollment, membership, and purchase links may connect to separate checkout or community services that use additional technologies for account access, checkout, fraud prevention, subscription administration, payment processing, and website analytics.

We do not intentionally send names, email addresses, laboratory information, biomarker values, genetic results, symptoms, questionnaire responses, or other health information to Google Analytics, Google Tag Manager, Vimeo, or advertising platforms.

You may control cookies through your browser. Where required, we will also provide a cookie-preference mechanism for nonessential technologies. Blocking some technologies may affect site functionality.

Some browsers and extensions transmit preference signals, including the Global Privacy Control. Where applicable law requires us to recognize such a signal, we will treat it as a request to opt out of sale or sharing for cross-context behavioral advertising for that browser or device.

7. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients for the purposes described in this Privacy Policy:

A. Laboratory and program service providers

We may disclose information needed to perform laboratory testing, process specimens, prepare reports, provide program materials, or fulfill related services. NutraCoreX testing is processed by Genova Diagnostics, an independent CLIA-certified laboratory. Genova's handling of information is also governed by its own privacy and legal obligations.

B. Practitioners and authorized team members

If you purchase a Review of Findings or request applicable support, authorized Balance Protocol practitioners and team members may access information reasonably necessary to provide that service.

C. Payment and checkout providers

Stripe, PayPal, banks, card networks, fraud-prevention providers, and checkout operators may process transaction and payment information.

D. Fulfillment and delivery providers

We may disclose contact, order, and shipping information to fulfillment providers, carriers, and others involved in delivering or returning a kit or other material.

E. Technology and business service providers

We may use providers for hosting, content delivery, analytics, email, customer relationship management, account administration, course delivery, community operations, customer support, cybersecurity, data storage, professional services, and referral attribution. These providers may process personal information on our behalf under contractual or legal restrictions.

F. Legal, safety, and compliance recipients

We may disclose information when we reasonably believe disclosure is required by law, regulation, court order, subpoena, or other valid legal process, or is necessary to protect rights, safety, property, security, or the integrity of our services.

G. Business transfers

Personal information may be transferred as part of a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction. Any recipient will be required to handle personal information in accordance with applicable law.

H. At your direction or with your consent

We may disclose information to another person or organization when you direct us to do so or provide valid consent.

8. Sale, Sharing, and Targeted Advertising

Balance Protocol does not sell laboratory results, genetic results, consumer health data, or personal information for money.

We do not use laboratory results, genetic results, symptoms, or medical information for targeted advertising.

Certain analytics, advertising, or referral technologies can be classified as a "sale," "sharing," or "targeted advertising" under some state privacy laws even when no money changes hands. Where those laws apply, you may exercise applicable opt-out rights by using the site's cookie-preference mechanism when available, transmitting a legally recognized browser preference signal, or contacting us at support@balanceprotocol.com.

We do not knowingly sell or share the personal information of individuals under 18 for cross-context behavioral advertising.

9. Laboratory and Genetic Information

Balance Protocol does not use laboratory or genetic information to build advertising audiences or sell downstream supplements, medications, peptides, pharmacy services, or therapeutic products based on an individual's results.

Balance Protocol does not maintain an indefinite marketing database of laboratory or genetic results. Information may nevertheless be retained for the period reasonably necessary to provide requested services, complete a Review of Findings, address support or legal matters, and meet applicable laboratory, tax, accounting, professional, and regulatory requirements.

The performing laboratory may be legally required to retain test reports or related records for a specified period. Its retention obligations and privacy practices are governed by applicable law and its own notices. Nothing in this Privacy Policy promises deletion of a record that another regulated entity is legally required to retain.

When results and program materials are delivered, you are responsible for maintaining the security of your own copies and login credentials.

10. HIPAA and Other Health Privacy Laws

Some third-party laboratories, practitioners, or providers involved in a service may be covered by the Health Insurance Portability and Accountability Act, commonly called HIPAA, or other health privacy laws. Their handling of protected health information may be governed by a separate Notice of Privacy Practices.

Balance Protocol Institute is not representing that every interaction with a Balance Protocol website, course, community, checkout, program, or customer-support service is subject to HIPAA. Consumer health information that is not protected by HIPAA may still be protected by other federal or state laws and by our Consumer Health Data Privacy Notice.

This Privacy Policy is not a HIPAA Notice of Privacy Practices and does not replace a notice provided by a covered laboratory or practitioner.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including:

• Providing the service and maintaining requested permanent course or group access;
• Completing transactions and maintaining tax, accounting, and business records;
• Honoring communication choices and maintaining suppression records;
• Protecting security and preventing fraud;
• Resolving disputes and enforcing agreements; and
• Satisfying legal, laboratory, professional, and regulatory obligations.

Retention periods vary by data type, purpose, service provider, and legal requirement. When information is no longer reasonably necessary, we will delete, deidentify, or securely dispose of it, subject to backup cycles and legal exceptions.

If you delete your account or request deletion, permanent access associated with that account may be lost and may not be restorable.

12. Data Security

We use administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. Safeguards may include access controls, encryption in transit, vendor management, account authentication, monitoring, and data-minimization practices.

No website, transmission, or storage system can be guaranteed to be completely secure. You are responsible for using a strong, unique password and for protecting your devices and account credentials.

If we are required by law to notify you of a qualifying data breach, we will provide notice in the manner and within the time required by applicable law.

13. Your Choices

A. Marketing email

You may unsubscribe from marketing email by using the unsubscribe link in the message or contacting us. We may continue to send transactional, account, safety, legal, and service-related communications.

B. Text messages

If you separately consent to marketing text messages, you may withdraw consent by following the instructions in the message. Consent to marketing texts is not a condition of purchase unless expressly and lawfully stated otherwise.

C. Cookies

You may use browser settings and, where available, our cookie-preference mechanism. Choices may apply only to the browser or device on which they are made.

D. Community information

You may edit or remove certain profile information or posts through available account controls. Copies may remain where another member quoted or independently retained material, or where retention is required for safety, legal, moderation, or backup purposes.

14. Privacy Rights

Depending on your state or country of residence and whether the applicable law covers Balance Protocol or the relevant processing, you may have the right to:

• Confirm whether we process your personal information;
• Access personal information;
• Correct inaccurate personal information;
• Request deletion;
• Obtain a portable copy of information you provided;
• Withdraw consent;
• Opt out of sale, sharing, targeted advertising, or certain profiling;
• Limit certain uses or disclosures of sensitive personal information;
• Appeal a denied privacy request; and
• Receive equal service and pricing without unlawful discrimination for exercising a privacy right.

To submit a request, email support@balanceprotocol.com with the subject line "Privacy Request." Describe the request and identify the email address associated with your interaction or account. Do not send a copy of a government identification document unless we specifically request it through a secure method.

We may take reasonable steps to verify your identity and authority. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and direct identity verification. We will respond within the period required by applicable law.

To appeal a decision, email support@balanceprotocol.com with the subject line "Privacy Appeal" and explain why you believe the decision should be reconsidered.

Certain information may be exempt from a request, including information that we must retain to comply with law, complete a transaction, protect security, exercise legal rights, or meet applicable professional or regulatory obligations.

15. Additional Notice for California Residents

If the California Consumer Privacy Act applies to Balance Protocol or to a particular processing activity, California residents may have rights to know, access, correct, delete, and obtain information about categories of personal information collected, sources, purposes, and recipients. They may also have rights to opt out of sale or sharing and to limit certain uses of sensitive personal information.

Categories of personal information that we may have collected are described in Section 3. Categories of sources are described in Section 4. Purposes are described in Section 5. Categories of recipients are described in Section 7.

We do not offer financial incentives in exchange for personal information unless the material terms are separately presented at the time of enrollment in such a program.

16. Additional Notice for Residents of the EEA, United Kingdom, or Switzerland

If applicable data-protection law covers our processing, Balance Protocol Institute acts as a controller for personal information it determines how and why to process.

Depending on the processing, our legal bases may include:

• Performance of a contract or steps requested before entering a contract;
• Consent;
• Compliance with a legal obligation;
• Protection of vital interests; and
• Legitimate interests, such as operating, securing, supporting, and improving our services, provided those interests are not overridden by your rights.

Where special-category health or genetic information is processed, we will rely on an applicable condition permitted by law, which may include explicit consent or processing connected with services requested by you.

Personal information may be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction. Where required, we use a lawful transfer mechanism.

You may have rights of access, correction, deletion, restriction, portability, objection, and withdrawal of consent, and the right to complain to a supervisory authority. Withdrawal of consent does not affect processing completed before withdrawal.

We do not use solely automated decision-making that produces legal or similarly significant effects without providing any notice and rights required by applicable law.

17. Children's Privacy

Our websites and services are intended for adults and are not directed to children under 18. We do not knowingly collect personal information online from a child under 13 without legally valid authorization. If you believe a child has provided personal information to us improperly, contact support@balanceprotocol.com.

18. Third-Party Websites and Services

Our websites may link to websites and services operated independently by third parties. Their privacy practices are governed by their own notices. We encourage you to review those notices before submitting information.

Third-party services used within the Balance Protocol ecosystem may include Google, Vimeo, Stripe, PayPal, Genova Diagnostics, email and customer relationship management providers, shipping carriers, course and community providers, livestream and video-conferencing providers, and referral-attribution providers.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology, legal obligations, or privacy practices. We will post the updated policy and revise the "Last updated" date. When required by law, we will provide additional notice or obtain consent before applying a material change to previously collected information.

20. Contact Us

Questions, complaints, and privacy requests may be sent to:

Balance Protocol Institute
Attn: Privacy
1317 Edgewater Drive
Orlando, FL 32804
United States
Email: support@balanceprotocol.com