1. Who are we?

We are Enhanced Ltd, a private limited liability company, incorporated in the Cayman Islands (Company No. HE-397900) with a registered office at 6th Floor Athena Tower, 71 Fort Street, George Town, P.O. Box 1569, Grand Cayman KY1-1110, Cayman Islands (E+).

When we refer to ‘we’, ‘us’, and ‘our’, we mean E+ and our affiliates meaning any entity that directly or indirectly controls, is controlled by or is under common control of E+.

This Privacy Policy (Privacy Policy) explains how we collect, process and use your personal data when you use our website www.enhanced.com or www.enhanced.org (collectively, the Website) or otherwise interact with us. 

Please read this Privacy Policy carefully to understand how we will treat your personal data.   

If you are a California resident, please see section 11c (“United States – California”) below for our California Notice at Collection and information provided pursuant to the California Consumer Privacy Act, including how to request that we not “sell” or “share” your personal data by clicking “Do Not Sell or Share My Personal Information”.

If you are a resident of Washington or Nevada, click here for our Consumer Health data policy.

If you are ordinarily resident in the EEA or the UK, please also see the country or region specific sections below.

For the avoidance of doubt, our athlete privacy policy is separate to this Privacy Policy and, if relevant, can be obtained upon written request by contacting us via the information provided in the Contact Us section of this Privacy Policy.

2. How do we collect data?

The information we collect depends on how you interact with us. You might be a casual visitor to our Website or someone who provides additional personal data by completing a contact form or making a transaction. We collect information submitted on the Website, to us directly, and passively as you visit the Website.

3. What information do we collect?

The following (non-exhaustive) categories of personal data may be processed by us or our vendors for the purposes described below in section 4: 

• identifiers (name, address, telephone number, email address);

• commercial and financial information (in order to process a transaction);

• Internet Protocol (IP) address and other device information;

• certain Internet and other network information about how you use the Website (for example, Website traffic data, web logs and other communication data);

• any other personal data not described above that you provide to us (e.g., information you include in any communications you send to E+); and

• inferences from the above information.

4. How do we use your information?

Data protection laws may require organizations to have a legal basis to collect, use, share and otherwise process your personal data.

We will only process your personal data if:

• we have obtained your consent;

• the processing is necessary to perform our contractual obligations towards you or to take pre-contractual steps at your request;

• the processing is necessary to comply with our legal or regulatory obligations; or

• the processing is necessary to safeguard our legitimate interests and does not unduly affect your interests or fundamental rights and freedoms. 

Below is a non-exhaustive list of the purposes for which we collect and process your personal data, along with the lawful bases for such processing:

We will not use your personal data for making any automated decisions having legal or similarly significant effects nor to profile you.

In certain circumstances, failure to provide us with personal data that we have requested may impact our operations or prevent us from performing any obligations we owe to you. For example, if you make a data subject access request, we may need to verify who you are before providing personal data to you. If you do not provide the information we reasonably need to verify your identity, we may not be able to comply with the data subject access request.

5. Cookies

This Website uses cookies and similar technologies. For more information on the cookies we use, please see our Cookie Policy. 

6. When do we disclose your personal data?

In the course of our activities and to achieve the purposes listed in section 4 of this Privacy Policy, your personal data can be accessed by or transferred to the following categories of recipients on a need-to-know basis:

• our relevant personnel (including personnel of affiliates of E+) who are responsible for making decisions or providing you with support in connection with your relationship with us; 

• our contracted service providers and advisors (including our accountants, law firms, IT systems providers, health insurance providers, cloud service providers, analytics software servers, database providers and other consultants); and

• governmental bodies, law enforcement, or regulatory authorities where required by applicable law, in the context of lawful requests, court orders, legal proceedings or investigations.

Where possible, we will ensure that there are contractual protections in place with the above recipient requiring them to keep your personal data secure.

Subject to applicable law, we may de-identify and aggregate the personal data you and others make available in connection with our services in a manner that is designed to remove the ability of recipients of such aggregated information to identify what personal data was provided by you as opposed to others. We may post such aggregated information publicly or share it with third parties. 

We may also transfer your personal data to third parties in the context of a sale or possible sale of the whole of or part of our business or the restructuring of our business.

International transfers. If you choose to enter into an agreement with us or provide information to us, you acknowledge and understand that your information may be transferred, processed and stored in multiple countries, which may include the Cayman Islands, any state in the United States of America, any Gulf Cooperation Council nation (Bahrain, Kuwait, Oman, Qatar, Saudi Arabia, and the United Arab Emirates), the United Kingdom, any country in Europe, or any other country where the recipients referred to in this section are located or where the data storage facilities used by them for the time being are located.

Whenever we transfer personal data internationally, we use legal mechanisms, including contractual provisions in agreements with recipients, to ensure data transfers comply with applicable law.

7. Legal requirements

We may preserve and share your personal data with third parties, including law enforcement, public or governmental agencies, or private litigants, within or outside your country of residence, if we determine that such disclosure is reasonably necessary to comply with the law, including to respond to court orders, warrants, subpoenas, or other legal or regulatory process, or otherwise permitted by law. We may also retain, preserve or disclose your personal data if we determine that this is reasonably necessary or appropriate to: (1) prevent any person from death or serious bodily injury; (2) to address issues of national security or other issues of public importance; or (3) to protect our operations or our property or other legal rights, including by disclosure to our legal counsel and other consultants and third parties in connection with actual or potential litigation.

8. How long do we keep your personal data?

Unless we state to you otherwise, we will retain your personal data:

• for as long as we have a reasonable business purpose, such as managing our commercial relationship with you or managing our business;

• for as long as we provide services to you and then for as long as someone could bring a claim against us; and/or

• to comply with legal and regulatory requirements, prevent fraud, collect fees, resolve disputes, troubleshoot problems, assist with investigations, enforce our Terms of Service and take other actions permitted by law.

Personal data that is no longer necessary and relevant to providing our services to you may be de-identified and aggregated with other non-personal data to provide insights that are valuable to E+. 

9. Changes to this Privacy Policy

We keep our Privacy Policy under regular review and will post any updates on this webpage. We encourage you to review this Privacy Policy regularly to stay informed about how we are using your personal data. This Privacy Policy was last updated on the date listed at the start of Privacy Policy.

10. Contact information

If you have questions, concerns or complaints about how your personal data is being used, please contact us at data@enhanced.com.

11. State, Country or Region-specific information

a. EA/UK

Your controller

If you are ordinarily resident in a member state of the European Economic Area (“EEA”) or the United Kingdom (“UK”), for the purposes of the European Union General Data Protection Regulation 2016/679 (“GDPR”) and the UK General Data Protection Regulation by virtue of the European Union (Withdrawal) Act 2018 (“UK GDPR”), the controller for your personal data is: 

Enhanced Ltd with a registered office at 6th Floor Athena Tower, 71 Fort Street, George Town, P.O. Box 1569, Grand Cayman KY1-1110, Cayman Islands.

International transfers

In addition to the information on international transfers in section 6 of the Privacy Policy, where your personal data is transferred outside of the EEA and the UK to countries whose laws do not provide equivalent data protection to that of your country of residence, we will make sure your personal data is adequately protected, for instance by implementing the EU and UK Standard Contractual Clauses where an adequate level of protection is not already guaranteed. 

Data security

We have implemented appropriate technical and organizational safeguards to protect the confidentiality, integrity and availability of your personal data. For more information on our security controls, please contact us at data@enhanced.org. 

Your rights

Under the conditions set out in the GDPR and the UK GDPR, you have the following rights in respect of your personal data:

• Right of access: You have the right to obtain from us a confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, to request access to the personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed. You have the right to obtain a copy of the personal data undergoing processing. For additional copies requested by you, we may charge a reasonable fee based on administrative costs.

• Right to rectification: You have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you have the right to have incomplete personal data completed. You may also update your personal data through your account settings.

• Right to erasure (right to be forgotten): You have the right to ask us to erase your personal data where possible.

• Right to restriction of processing: You have the right to request the restriction of processing your personal data. This will only apply if we have no lawful basis to process your personal data, your personal data is inaccurate, or to comply with an objection request.

• Right to data portability: You have the right to receive the personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format and you have the right to transmit those personal data to another entity without hindrance from us.

• Right to object: You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by us and we can be required to no longer process your personal data. If you have a right to object and you exercise this right, your personal data will no longer be processed for such purposes by us. Although please note that if we determine that our interests are sufficiently compelling we may continue to process your personal data. Exercising this right will not incur any costs. Such a right to object may not exist, in particular, if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded. You have an absolute right to stop your personal data being used for direct marketing.

• Right to withdraw consent: If you have declared your consent for any personal data processing activities, you can withdraw this consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal.  

Please note that the above rights are not absolute, and there may be exceptions or restrictions to the exercise of your rights. They may also be limited under applicable national data protection legislation.

You will not have to pay a fee to access your personal data or to exercise any of the other rights. We may charge a reasonable fee, however, if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is to ensure that your personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request. We try to respond to all legitimate requests within one calendar month, starting from the day after we receive your request. Occasionally, it could take us longer than a month, if your request is particularly complex or you have made a number of requests. We will notify you and keep you updated if this is the case.

To request the exercise of these rights, please contact us at data@enhanced.com.

In case of complaints, you also have the right to lodge a complaint with the competent supervisory authority, in particular in the EEA Member State of your habitual residence, or if you are ordinarily resident in the UK, the Information Commissioner’s Office.

You may find the contact details of the competent supervisory authority for EU Member States (including the EEA members Iceland, Lichtenstein and Norway) with the associated contact details under the following link:  https://www.edpb.europa.eu/about-edpb/about-edpb/members_en#member-no.

b. United Arab Emirates (“UAE”)

We may process the types of personal data described in this Privacy Policy above under section 4 (How do we use your personal data), for the purposes set out therein. 

E+ has also incorporated appropriate safeguards within its contracts with parties (including E+ affiliates) located outside of the UAE with whom it may share your personal data as described within this Privacy Policy at section 6 (When do we disclose your personal data) to ensure that your personal data is processed in line with applicable data protection laws, including those in force in the UAE from time to-time.  

If and to the extent to which E+ requires your consent to perform processing activities, by accessing or using our website, you hereby expressly consent to the collection, storage, use and disclosure of your personal data as described in this Privacy Policy. Where E+ relies upon your consent to process your personal data you can withdraw your consent at any time but this may impact your ability to continue to use our services.

c. United States – California

This California Privacy Notice applies to California residents and provides certain details regarding how we handle your personal data (Referred to as "personal information" under California law) and the rights you have as a California resident regarding your personal data.

We may collect or receive (and may have collected or otherwise received during the last 12-month period) the following categories of personal data as set forth in applicable California law:

For additional detail regarding the personal data we collect, see Section 3  of this Privacy Policy.

We collect and use these categories of personal data for the business and commercial purposes described in Section 4 of this Privacy Policy and as provided below:  

• Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, or providing similar services;

• Advertising and marketing;

• Auditing, including relating to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance;

• Short-term transient use, such as non-personalized advertising shown as part of a current interaction with us; 

• Security and fraud prevention purposes; 

• Undertaking activities to verify or maintain the quality or safety of our services;

• Debugging to identify and repair errors; 

• To conduct business analysis;

• To conduct research and development; and

• To fulfil our legal functions or obligations.

We collect personal data about you from various sources, directly and indirectly:

• We collect personal data directly from you. For example, we may collect information when you register an account, buy or return a product, sign up for an e-newsletter, enter a contest, or otherwise contact us.

• We collect personal data from your devices. We use technical tracking tools that work behind the scenes, like browser cookies, to automatically collect information from and about you and your devices. For more information, see our Cookie Policy. 

• We get personal data from vendors we hire to work on our behalf. For example, vendors that host or maintain our website and send promotional emails for us may give us information. 

• We combine information about you in a variety of ways. We combine information collected offline, such as information collected about you during a customer service call, with information collected online.

We may disclose each of the foregoing categories of personal data for our business and commercial purposes to the extent permitted by applicable law to the categories of parties as described in Sections 6 and 7 above. We also disclose categories of personal data as we may describe to you from time to time or as permitted or required by law.  We may “sell” or “share” (as such terms are defined in the California Consumer Privacy Act) the following categories of personal data, including for cross-context behavioral advertising: identifiers and contact information; personal records; personal characteristics or traits; commercial information; internet and other electronic network usage information; and inferences. We may “sell” or “share” these categories of personal data to or with the categories of third parties described in Section 6  above. We do so for the commercial or business purposes described in Section 4  above.

If you are a California resident, you can make the following requests with respect to your personal data subject to limitations and exceptions set forth in applicable law:

• Access – You can request that we disclose to you the following: (i) the categories of personal data that we have collected about you; (ii) the categories of sources from which we have collected personal data about you; (iii) the business or commercial purpose for collecting, sharing, or selling your personal data; (iv) the categories of personal data that we have sold or shared about you and the categories of third parties to whom the personal data was disclosed; (v) the categories of personal data that we have disclosed about you for our business purposes and the categories of vendors to whom the personal data was disclosed; and (vi) the specific pieces of personal data that we have collected about you.

• Deletion – You can request that we delete the personal data that we collected from you, subject to certain exceptions.

• Correction – You can request that we correct inaccurate personal data that we maintain about you, subject to certain exceptions. 

• Limit the Use/Disclosure of Sensitive Personal data – You can request that we limit the use or disclosure of your sensitive personal data to those purposes set forth in applicable California law, subject to certain exceptions. 

• Do Not Sell or Share My Personal data – You can request that we not sell or share your personal data to a third party by clicking “Do Not Sell or Share My Personal Information”. For purposes of this Section, “sell” means the sale, rental, release, disclosure, dissemination, availability, transfer, or other oral, written, or electronic communication of your personal data to an outside party for monetary or other valuable consideration, subject to certain exceptions in applicable law.  For purposes of this Section, “share” means transferring, making available or otherwise disclosing your personal data to another party for purposes of sending advertising to you based on your personal data obtained from your activities across distinctly-branded sites. Note that if you would like to opt-out of cookie-based tracking for our behavioral advertising purposes, you will need to separately set your cookie preferences by clicking on the Cookie Settings link  that may be in the footer of our site or broadcasting an opt-out preference signal recognized by E+, such as a Global Privacy Control signal, on the browser or browser extensions that support such a signal. You can also visit www.aboutads.info/choices  and https://optout.privacyrights.info  to opt out of certain uses of cookies for advertising purposes. Your selections are specific to the device, website and browser you are using. Your selections are also deleted whenever you clear your cookies or your browser’s cache. We do not knowingly sell or share the personal data of minors under 16 years of age.

We will not discriminate against you because you exercised any of these rights.

A California resident can exercise these rights by emailing us at data@enhanced.org. We may deny certain requests, or fulfil a request only in part, based on our legal rights and obligations. For example, we may retain personal data as permitted by law, such as for tax or other record keeping purposes, to maintain an active account, and to process transactions and facilitate customer requests.

We will take reasonable steps to verify your identity prior to responding to certain of your requests.  The verification steps will vary depending on the sensitivity of the personal data and whether you have an account with us.

You may designate an authorized agent to make a request on your behalf.  When submitting the request, please ensure the authorized agent is identified as an authorized agent.

In addition to the above, if you reside in California, you also have the right to ask us one time each year if we have disclosed personal data to third parties for their direct marketing purposes. To make a request, please email us at data@enhanced.com. Indicate in your message that you are a California resident making a “Shine the Light” inquiry.

d. United States – Other Jurisdictions

Depending on the state where you reside (including Delaware, Oregon, and other states with privacy laws), you may have the right to make the following requests with respect to your personal data in accordance with applicable law and subject to exceptions set forth in such applicable laws:

• Access: You may have the right to request to confirm whether we process your personal data. Subject to certain exceptions, you can also request a copy of your personal data. You may also request that we provide a list of third parties to which we disclosed personal data where provided under applicable law.

• Deletion: You may have the right to request that we delete personal data we have from or about you, subject to certain exceptions.

• Correction: You may have the right to request that we correct inaccurate personal data we maintain about you, subject to certain exceptions.

• Opt-Out of Sale: We may “sell” personal data as the term is defined under applicable state laws. You may have the right to request to opt out of the sale of your personal data to a third party. 

• Opt-Out of Targeted Advertising: We may use personal data obtained (or in some instances inferred) from your activities across unaffiliated sites to send more relevant advertising to you.  You may have the right to request that we stop using your personal data for such targeted advertising.  

You can request to exercise these rights by emailing us at data@enhanced.com. 

We may “sell” (as such term is defined in applicable state law) and process for targeted advertising purposes the following categories of personal data, including for cross-context behavioral advertising: identifiers and contact information; personal records; personal characteristics or traits; commercial information; internet and other electronic network usage information; and inferences. We may “sell” or share these categories of personal data to or with the categories of third parties described in Section 6  above. Please note that if you would like to opt out of sales or our targeted advertising through certain cookie-based tracking for advertising purposes, you will need to separately set your cookie preferences by clicking on the Cookie Settings link  that may be in the footer of our site or broadcasting an opt-out preference signal recognized by E+, such as a Global Privacy Control signal, on the browser or browser extensions that support such a signal. Please keep in mind that your settings are specific to the Site you were on when you set your preferences. You can also visit www.aboutads.info/choices  and https://optout.privacyrights.info  to opt out of certain uses of cookies for advertising purposes. Your cookie-related selections are specific to the device, website, and browser you are using. Your selections are deleted whenever you clear your cookies or browser’s cache.

We will take reasonable steps to verify your identity prior to responding to your requests. The verification steps will vary depending on the sensitivity of the personal data and whether you have an account with us. We may deny certain requests and will explain why your request was denied and how to appeal our decision, as required by applicable law. After receiving our explanation, if you would like to appeal our decision, you may do so as further detailed in our communication back to you. For questions, you may also contact us by emailing us at the contact information above.

You may have the right to designate an agent to submit an opt-out of sale and opt-out of targeted advertising request on your behalf. Proof to verify your identity and the authorized agent’s authority to submit requests on your behalf is required, or we may deny the request.  We use commercially reasonable efforts to authenticate your identity and the authorized agent’s authority through the written documentation provided in connection with the opt-out request in accordance with this Privacy Policy. 

From time to time, we or our vendors on our behalf may collect personal data in connection with a promotion, offer, program, discount or other benefits. We or our vendors may disclose such personal data to the categories of third parties described in Section 6 above.