Privacy policy

Last Updated: May 20, 2025

H.D. Nutrition, Inc., doing business as Health Direct (“Health Direct,” “we,” “us,” or “our”), is committed to protecting your privacy and the personal information you share with us. This Privacy Policy describes how we collect, use, and share your information when you interact with our websites, purchase products, subscribe to services, or otherwise engage with Health Direct across any online or offline channel.

1. Managing Your Privacy Preferences

You can manage your privacy settings at any time. To adjust your cookie preferences or opt out of the sale or sharing of your information, visit our U.S. Privacy Compliance Center. For individuals in the European Union or United Kingdom, please refer to our GDPR Compliance Center. You can opt out of the sale or sharing of your personal information at any time by clicking the “Necessary Cookies Only” button in our cookie banner. We also honor Global Privacy Control (GPC) signals. To view or manage your cookie preferences, please use the Cookie Settings link in our Consentmo banner.

This policy is governed by U.S. law, but we also recognize and comply with applicable privacy regulations for international users, including the EU General Data Protection Regulation (GDPR) and UK Data Protection Act.

2. Information We Collect

We collect and merge both personally identifiable information (“PII”) and non-personally identifiable information (“Non-PII”) from various sources as described in this policy. Personal information means anything that could identify you, such as your name, email address, phone number, billing or shipping address, and other contact or account details. Non-personal information is data that does not directly identify an individual, including browser type, device type, time zone, language preferences, demographic data (such as age or gender), and IP address. This information may be collected directly from you, from your interaction with our websites and services, or from third-party partners.

We collect the following categories of information:

A. Information You Provide Directly

  1. Name, email, phone, billing/shipping address
  2. Date of birth, gender, job title (if applicable)
  3. Login credentials (magic link only, no passwords stored)
  4. Payment details (processed via Authorize.net — healthdirectusa.com does not store full card numbers)
  5. Subscription and order preferences (via Appstle)
  6. Health information you provide (e.g., allergies or health interests)
  7. Marketing preferences and communications

B. Information We Collect Automatically

  1. Device and browser data
  2. IP address, geolocation (if permitted)
  3. Website usage data (page views, clicks, heatmaps)
  4. Session recording and replays (via Microsoft Clarity, using Strict masking)
  5. Cookie identifiers and tracking pixels

C. Information from Third Parties

  1. Affiliate data (via Social Snowball — used internally only)
  2. Analytics and advertising data (e.g., Quantcast Measure, Meta and TikTok, Klaviyo)
  3. Product review content (e.g., via Klaviyo Reviews)
  4. Publicly available or enriched data from third-party partners
  5. We may use this data to personalize recommendations, track marketing performance, or improve our user experience.

3. How We Use Your Information

We use your personal information to:

A. Fulfill Transactions & Provide Services

  1. Process payments, ship orders, and manage subscriptions
  2. Authenticate account access (via email magic link)
  3. Send transactional emails and status updates

B. Provide Customer Support

  1. Respond to inquiries, troubleshoot issues
  2. Manage your Health Direct account and preferences with platforms like Netsuite or Shopify

C. Conduct Marketing and Promotions

  1. Send email, SMS, or direct mail promotions
  2. Personalize content and recommend products
  3. Run digital ad campaigns, including retargeting
  4. Contact affiliate partners with program updates
  5. Use hashed customer data with platforms like Facebook or Google for custom audiences
  6. Make outbound telephone calls

D. Analyze and Improve Performance

  1. Run analytics tools (Google Analytics, Quantcast)
  2. Conduct A/B tests and session recordings (Microsoft Clarity)
  3. Segment subscription behavior (e.g., skips, cancellations)

E. Fulfill Legal Obligations

  1. Detect and prevent fraud
  2. Maintain records to comply with the law
  3. Enforce our Terms of Service

F. Anticipate Future Programs

  1. While we do not operate a loyalty program currently, we may use your data for such purposes in the future
  2. With permission, we may share anonymized testimonials (e.g., first name, last initial, city/state)

4. How We Share Your Information

A. With Service Providers

  1. Payment: Authorize.net (PCI-DSS certified)
  2. Subscriptions: Appstle
  3. Email/SMS: Klaviyo
  4. Analytics: Google Analytics, Quantcast Measure
  5. Session recording and replay: Microsoft Clarity
  6. Reviews: Klaviyo Reviews
  7. Shipping Carriers Like: FedEx, UPS, USPS, DHL and more
  8. Affiliates: Social Snowball (internal only)
  9. Telemarketing: Call centers
  10. CRM: Netsuite and Shopify

B. For Advertising

Hashed data shared with ad platforms (e.g., Meta and TikTok, Google)

C. In Corporate Transactions

We may, from time to time, expand, reduce, sell, or transfer parts of our business or assets. In such transactions, personal data provided by users may be transferred as part of the business assets to the acquiring party. The new owner or controlling party will, under the terms of this Privacy Policy, be permitted to use the data for the purposes for which it was originally collected. In the event your personal data is transferred in this way, you may not be notified in advance and will not have the option to opt out of the transfer. However, your personal data will remain subject to the safeguards outlined in this Privacy Policy.

D. For Legal & Security Purposes

We may share your personal information under specific circumstances, including to comply with legal obligations (such as subpoenas, court orders, or other legal processes), to protect our rights and those of our users, or to investigate suspected fraud, chargeback disputes, or safety threats.

F. International Transfers

If we engage processors outside the U.S. in the future, we will apply appropriate safeguards and update this policy accordingly

5. Your Privacy Choices and Rights

A. Marketing Preferences

You can opt out of marketing communications at any time by:

  1. Clicking the unsubscribe link in any marketing email
  2. Replying STOP to marketing SMS messages
  3. Contacting us at service@healthdirectusa.com

We also honor < >Global Privacy Control (GPC) browser signals as valid requests to opt out of the sale or sharing of your personal information.

B. Access, Correction, and Deletion Requests

You may request to:

  1. Access a copy of your personal information
  2. Correct inaccurate data we maintain
  3. Delete your personal information

To submit a request, email service@healthdirectusa.com.

We may request verification of your identity (such as confirming order details or prior interactions) before we can help with your request.

If we deny your request, you may appeal by replying with the subject line < >“Privacy Appeal.”

C. Authorized Agents (CPRA)

California residents may designate an authorized agent to make privacy requests on their behalf.

To do so, email service@healthdirectusa.com with documentation showing:

  1. Written permission signed by the consumer, or
  2. Proof of power of attorney under California Probate Code.

We reserve the right to verify the identity of the consumer and confirm authorization before fulfilling any request made by an agent.

6. Data Security and Retention

A. Security Measures

  1. Encryption, access controls, session masking, secure servers
  2. Physical safeguards for offline data
  3. Authorize.net is PCI-DSS compliant

B. Retention

We retain order history and related customer records indefinitely for operational, legal, and accounting purposes. For other categories of personal data, we retain information only as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law. Where no specific retention period is stated, we evaluate the purpose and sensitivity of the data to determine an appropriate duration. You may request deletion at any time (subject to exceptions)

C. International Data Transfers

Health Direct primarily stores and processes personal data within the United States. We do not knowingly transfer personal data internationally. If that changes in the future, we will implement safeguards consistent with applicable data protection laws, including the use of Standard Contractual Clauses or other approved mechanisms under GDPR.

7. Cookies and Tracking Technologies

Below, we outline the cookie and tracking technologies we use. This list is our best effort to disclose the tools we use transparently, but it may not include current information if this policy has not been updated.

A. Technologies Used:

  1. Cookies
  2. Pixels
  3. Web beacons
  4. Session Recording, Replay and Storage

B. Categories

  1. Strictly Necessary
  2. Functional
  3. Analytics
  4. Advertising
  5. Session Recording/Replay

C. Tools Used:

  1. Google Analytics
  2. Google Adwords
  3. Microsoft Clarity
  4. Meta
  5. TikTok
  6. Klaviyo
  7. Quantcast Measure

D. Cookie List

For a full list of cookies, please click the Consentmo Banner and then select a sub-category to display the full list.

8. Children’s Privacy

  1. Our Services are not directed to children under 18
  2. We do not knowingly collect from users under 18
  3. Parents may contact us to request deletion of any information collected inadvertently

9. CIPA Notice

We are committed to compliance with the California Invasion of Privacy Act (CIPA). CIPA prohibits the unauthorized interception or recording of conversations and communications. To comply:

  1. We do not record keystrokes, form field inputs, or other textual user content via session replay tools.
  2. Microsoft Clarity is configured in Strict Masking Mode, ensuring that any personal information typed by users is not visible in recordings.
  3. All session replays are fully anonymized, with masked IPs and redacted sensitive fields.
  4. Consent for session recordings is managed via our Consent Management Platform (Consentmo), and we default to opt-out unless a user provides affirmative consent.
  5. We honor Global Privacy Control (GPC) signals as valid opt-out requests and do not initiate analytics or tracking when such signals are received.

If you believe your privacy rights have been violated under CIPA or another law, you may contact us directly at service@healthdirectusa.com or using the methods described in the Contact section of this policy.

10. Automated Decision-Making and Profiling

We may use personal data for automated decision-making and profiling in order to improve our Services, including triggering product alerts, replenishment reminders, and tailored marketing based on your browsing behavior and purchase history. These processes do not produce legal or similarly significant effects. Where applicable under GDPR or similar regulations, you have the right to request human intervention, to express your viewpoint, and to contest any decision made solely based on automated processing.

11. Changes to This Policy

We may update this policy periodically. Material updates will be reflected by a new "Last Updated" date and may include site banners or email notices. By continuing to use our Services after an update is posted, you agree to the revised policy.

To view previous versions of our privacy policy, please visit:

12. Contact Us

  1. Email: service@healthdirectusa.com
  2. Phone: 1-800-520-3772 or 1-949-825-5370
  3. Mail: Health Direct, 16750 Hale Ave, Irvine, CA 92606