Privacy Policy of Mill Creek Life Sciences, Inc.

Effective: November 19, 2025

We at Mill Creek Life Sciences, Inc. (“Company”, “we”, “our”, or “us”) respect your privacy and are committed to protecting it through our compliance with this Privacy Policy (“Policy”). This Policy describes how we collect, process, retain, and disclose personal data about you when providing services to you through our website, products, and services that link to this Policy (our “Services”) and our practices for using, maintaining, protecting, and disclosing that information.

This Policy applies to information we collect:

• Through our Services.
• In communications, including email, text, and other electronic messages, between you and our Services.
• In live in-person meetings, seminars, or via phone communications.

This Policy does not apply to information collected by:

• Us offline or through any other means, including on any other website operated by the Company or any third party, including our affiliates and subsidiaries, that does not link to this Policy; or
• Any third party, including our affiliates and subsidiaries, including through any application or content that may link to or be accessible from or through our Services.

Please read this Policy carefully to understand our policies and practices regarding your information and how we treat it. By interacting with our Services or providing us with your information, you agree to the collection, use, and sharing of your information as described in this Policy. This Policy may change from time to time. Your continued use of our Services after we make changes as described here is deemed to be acceptance of those changes, so please check this Policy periodically for updates.

Children’s and Minors’ Data

Our Services are not intended for, and we do not knowingly collect any personal data from, children under the age of 18. If we learn we have collected or received personal data from a child under 18 years old without verification of parental consent, we will delete that information.

Information That We Collect and How We Collect It

“Personal data” is information that identifies, relates to, or describes, directly or indirectly, you as an individual, such as your name, email address, telephone number, home address, or payment information (for example, account information such as name, postal address, email address, credit card number, and any other identifier we may use to contact you online or offline.

The types and categories of personal data we collect or process include:

• Account and contact information, including name, address (such as home address, work address, or other address), email address, phone number, and other contact information you provide us.
• Account history, including information about your account, transactions, purchases, and order history.
• Location information, including general geographic location such as country, state or province, or city, and precise geolocation, if you have enabled and consented to this information.
• Device information, including your IP address, device identifiers, operating system and version, preferred language, hardware identifies, browser type and settings, and other device information.
• Content and information you elect to provide as part of your profile or in any reviews you make through our Services, emails or other communications sent to us.

If you are a California resident, please see our supplemental California privacy statement in the California Addendum below.

We also collect:

• Statistics or aggregated information. Statistical or aggregated data does not directly identify a specific person, but we may derive non-personal statistical or aggregated data from personal data. For example, we may aggregate personal data to calculate the percentage of users accessing a specific Services feature.
• Technical information. Technical information includes information about your internet connection and usage details about your interactions with our Services, such as clickstream information to, through, and from our Services (including date and time), products that you view or search for; page response times, download errors, length of your visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), or methods used to browse away from a page.

If we combine or connect non-personal statistical or technical data with personal data so that it directly or indirectly identifies an individual, we treat the combined information as personal information.

How We Collect This Information

• Directly from you when you provide it to us.
• Automatically as you navigate through, interact with, and utilize our Services. Information collected automatically may include usage details, traffic data, location data, IP addresses, operating system, browser type, and information collected through cookies, pixel tracking, web beacons, and other tracking technologies.
• From third parties, which may include your device manufacturer, your internet or mobile service provider, and our business partners through contractual relationships. In most circumstances, where the information we collect about you is held by a third party, we will obtain your permission before we seek out this information from such sources (such permission may be given directly by you or implied). From time to time, we may also receive data collected by third parties in the course of the performance of their services to us or otherwise. Where this is the case, we will take reasonable steps to ensure such third parties have represented to us that they have the right to disclose your information to us. When permitted by applicable law or regulatory requirements, we may collect information about you from other sources without your knowledge or consent.

The technologies that we use for automatic data collection may include:

• Cookies (or browser cookies). A cookie is a small file placed on your device when you interact with our Services. You may refuse to accept or disable browser cookies by activating the appropriate setting on your browser or device. However, if you select this setting, you may be unable to access certain parts of our Services. Unless you have adjusted your browser settings so that it will disable cookies, our system will issue cookies when you direct your browser to our Services.
• Web beacons. Some parts of our Services and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those parts or opened an email and for other related statistics (for example, recoding the popularity of certain website content and verifying system and server integrity).

The information we collect automatically is only statistical data and does not include personal information, but we may maintain it or associate it with personal information we collect in other ways or receive from third parties. It helps us improve our Services and to deliver a better and more personalized service, enabling us to:

• Estimate our audience size and usage patterns.
• Store information about your preferences, allowing us to customize our Services according to your individual needs and interests.
• Speed up your searches.
• Recognize when you return to our Services.

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal data, to:

• Provide you with our Services and any contents, features, information, products, or services we make available through our Services.
• Fulfill and manage purchases, order, deliveries, payments, and related transactions.
• Perform a contract with you or for your benefit.
• Fulfill any other purpose for which you provide it.
• Provide you with notices about your account, including transaction-related notices.
• Improve our services, including by analyzing your information and creating aggregated data derived from your information to develop, maintain, analyze, improve, optimize, measure, and report on our Services and how users interact with them.
• Carry out our obligations and enforce our rights arising from any contracts entered into between you and the Company, including for billing and collection purposes.
• Notify you when Service updates are available and about changes to any products.
• In any other way we may describe when you provide the information.
• For any other purpose with your consent.

Disclosure of Information

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We may also disclose personal data that we collect or you provide as described in this Policy:

• To our subsidiaries and affiliates.
• To contractors, service providers, and other third parties we use to support our organization.
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of the Company’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal data held by the Company is among the assets transferred.
• To fulfill the purpose for which you provide it.
• For any other purpose disclosed by us when you provide the information.
• With your consent.

We may also disclose your personal data:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
• To enforce or apply our Terms of Use and other agreements, including for billing and collection purposes.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of our organization, or customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

The categories of personal data we may disclose include:

• Account and contact information.
• Payment information.
• Account history, including information about your transactions, purchases, or order history.
• Location information, including general geographic location.
• Device information.
• Content and information you elect to provide to us.

Your Rights and Choices About Your Information

We strive to provide you with choices regarding the information you provide to us. This section describes mechanisms you can use to control certain uses and disclosures of your information and rights you may have under state law, depending on where you live.

Advertising, marketing, cookies, and other tracking technologies choices:

• Cookies and Other Tracking Technologies. You can set your browser to refuse all or some browser cookies or other tracking technology files, or to alert you when these files are being sent. If you disable or refuse cookies or similar tracking files, some Services features may be inaccessible or not function property. Some browsers include a “Do Not Track” (DNT) setting that can send a signal to the online services you visit indicating you do not wish to be tracked. Because there is not a common understanding of how to interpret the DNT signal, our Services may not respond to all browser DNT signals. Instead, you can use the range of other tools to control data collection and use, including the cookie controls described in this Policy.

Location data choices:

• Location Data. You can choose whether or not to allow our Services to collect and use real-time information about your device’s location through the device’s primary settings. If you block the use of location information, some Services features may become inaccessible or not function properly.

Your State Privacy Rights

Depending on your state of residency, you may have certain rights related to your personal data, including:

• Access and Data Portability. You may confirm whether we process your personal data and access a copy of the personal data we process. To the extent feasible and required by state law, depending on your state, data will be provided in a portable format. Depending on your state, you may have the right to receive additional information and it will be included in the response to your access request.
• Correction. You may request that we correct inaccuracies in your personal data that we maintain, taking into account the information’s nature and processing purpose.
• Deletion. You may request that we delete personal data about you that we maintain, subject to certain exception under applicable law.
• Opt Out of Personal Data for Targeted Advertising, Profiling, and Sales. You may request that we do not use your personal data for these purposes..

Important: The exact scope of these rights vary by state. There are also several exceptions where we may not have an obligation to fulfill your request. We also may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

To exercise any of these rights, please send us an email at info@millcreekls.com. Please know we do not currently sell data triggering any statute’s opt-out requirements.

Some browsers and browser extensions support the Global Privacy Control (“GPC”) that can send a signal to process your request to opt out from certain types of data processing, including data "sales" as defined under certain laws. When we detect such a signal, we will make reasonable efforts to respect your choices indicated by a GPC setting as required by applicable law.

If you are a California resident, additional information applies to you. To access our supplemental California privacy statement and learn more about California residents’ privacy rights, please see the California Addendum below.

Data Security

We use commercially reasonable administrative, physical, and technical measures designed to protect your personal data from accidental loss or destruction and from unauthorized access, use, alteration, and disclosure. However, no website, mobile application, system, electronic storage, or online service is completely secure, and we cannot guarantee the security of your personal data transmitted to, through, using, or in connection with the Services. In particular, email, texts, and chats sent to or from the Services may not be secure, and you should carefully decide what information you send to us via such communications channels. Any transmission of personal data is at your own risk.

The safety and security of your information also depends on you. You are responsible for taking steps to protect your personal data against unauthorized use, disclosure, and access.

How We Retain Your Personal Data

We keep the categories of personal data described in this policy for as long as reasonably necessary to fulfill the purposes described or for as otherwise legally permitted or required, such as maintaining the Services, operating our organization, complying with our legal obligations, resolving disputes, and for safety, security, and fraud prevention. This means that we consider our legal and business obligations, potential risks of harm, and nature of the information when deciding how long to retain personal data. At the end of the retention period, personal data will be deleted, destroyed, or deidentified.

If you are a California resident, please see our supplemental California privacy statement in the California Addendum below for more information about the retention periods that apply to the personal data categories we collect.

Changes to Our Privacy Policy

We may update this Policy from time to time, and we will post any changes we make to this Policy on this page with a notice that the Policy has been updated. The date the Policy was last updated is identified at the top of the page. If we make material changes to how we treat your personal information, we may notify you by email or otherwise communicate with you. You should check our Services periodically to see the current policy and any changes we made to it.

Contact Information

To exercise your rights or ask questions or comment about this Policy or our privacy practices, contact us at: info@millcreekls.com. 

DISPUTES ABOUT THIS POLICY OR RELATING TO OUR SERVICES GENERALLY MUST BE RESOLVED BY BINDING ARBITRATION AND ON AN INDIVIDUAL BASIS ONLY AS SPECICALLY SET FORTH IN THE TERMS OF USE.

California Addendum

Notice to Residents of California

When we collect personal information from residents of California, we become subject to, and those residents have certain rights under, California’s privacy laws including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”). This California Addendum (“Addendum”) supplements the Privacy Policy and applies solely to California residents.

Collection and Disclosure

We collect and use information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer of household (“personal information”). Personal information does not include:

• Publicly available information, including from government records, through widely distributed media, or that the consumer made publicly available without restricting it to a specific audience.
• Lawfully obtained, truthful information that is a matter of public concern.
• Deidentified or aggregated consumer information.

In the last 12 months, we have collected personal information from our consumers within the following categories:

• Identifiers such as your real name, alias, postal address, unique personal identifier (such as device identifier, cookies, beacons, pixel tags, and similar technology), online identifier, IP address, email address, and other similar identifiers;
• Commercial information, including products or services purchased, obtained, or considered, and other purchasing or consuming history;
• Internet or other similar network activity on our websites, mobile apps, or other digital systems, such as internet browsing history, search history, system usage, electronic communications with us, and postings on our social media sites.
• Precise geolocation, such as physical locations when visiting our Services.

We do not sell or share personal information of consumers under the age of 18 if we have actual knowledge of the individual’s age.

We do not use or disclose sensitive personal information for purposes other than those specified in the California Privacy Act Regulations § 7027(m).

We will store and retain your personal information in accordance with applicable law and for as long as necessary to carry out the purposes described in this Addendum in accordance with our internal data retention procedures. The criteria used to determine the retention periods includes:

• How long the personal information is needed in connection with the applicable purposes for which we use it;
• The type of personal information collected; and
• Whether we are subject to a legal, contractual, or similar obligation to retain the personal information (e.g., mandatory data retention laws, government orders to preserve personal information relevant to an investigation, or personal information that must be retained for the purposes of litigation or disputes).

Sources of Personal Information

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from you, such as from the forms or other information you provide the Company.
• Indirectly from you, such as your interactions with the Company’s website.
• From our service providers, such as order fulfillment and shipping orders, data analytics providers, advertising networks.

How We Use Personal Information

Personal Information Collection, Use, and Disclosure Purposes

We may use and disclose the personal information we collect to advance the Company’s business and commercial purposes, specifically to:

• Develop, offer, and provide you with our products and services.
• Meet our obligations to enforce our rights arising from any contracts with you including for billing and collections, or to comply with legal requirements.
• Fulfill the purposes for which you provided your personal information or that were described to you at collection, and as the CCPA otherwise permits.
• Improve our products or services, marketing, or customer relationships and experiences.
• Notify you about changes to our products or services.
• Administer our systems and conduct internal operations, including for troubleshooting, data analysis, testing, research, statistical, and survey purposes.
• Protect our Company, employees, and operations.
• Measure or understand the effectiveness of the advertising we serve to you and others, and to deliver relevant advertising to you.
• Administer and maintain the Company’s systems and operations, including for safety purposes.
• Engage in corporate transactions requiring review of consumer records, such as for evaluating potential Company mergers and acquisitions.
• Comply with all applicable laws and regulations.
• Exercise or defend the legal rights of the Company and its employees.
• Respond to law enforcement requests and as required by applicable law or court order.

Sensitive Personal Information Use and Disclosure Purposes

We may use or disclose sensitive personal information, such as geolocation, for the following statutorily approved reasons (“Permitted SPI Purposes”):

• Performing actions that are necessary for our customer relationship and that an average consumer in a relationship with us would reasonably expect.
• Preventing, detecting, and investigating security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information.
• Defending against and prosecuting those responsible for malicious, deceptive, fraudulent, or illegal actions directed at the Company.
• Ensuring physical safety.
• Short-term, transient use, such as non-personalized advertising shown as part of your current interactions with us, where we do not:
  • disclose the sensitive personal information to another third party; or
  • use it to build a profile about you or otherwise alter your experience outside your current interaction with the Company.
• Services performed for the Company, including maintaining or servicing accounts, processing or fulfilling transactions, verifying consumer information, processing payments, or providing financing, analytic services, storage, or similar services for the Company.
• Activities required to:
  • verify or maintain the quality or safety of a product, service, or device that we own, manufacture, had manufactured, or control;
  • improve, upgrade, or enhance the service or device that we own, manufacture, manufactured, or controlled.

We do not use or disclose sensitive personal information for purposes other than the Permitted SPI Purposes. Subject to your limitation rights, those additional sensitive personal information use purposes include all of the purposes described in the Personal Information, Collection, Use, and Disclosure Purposes section above. For more on your right to limit these additional personal information use purposes, see the section on Your Rights and Choices below.

Additional Categories or Other Purposes

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice. If required by law, we will also seek your consent before using your personal information for a new or unrelated purpose.

We may collect, process, and disclose aggregated or deidentified consumer information for any purpose, without restriction. When we collect, process, or disclose aggregated or deidentified consumer information, we will maintain and use it in deidentified form and will not to attempt to reidentify the information, except to determine whether our deidentification processes satisfies any applicable legal requirements.

Disclosing, Selling, or Sharing Personal Information

Business Purpose Disclosures

We may disclose the personal information, including sensitive personal information, we collect to third parties for the business purposes described in the Personal Information Collection, Use, and Disclosure Purposes section above, such as to engage third parties to support our business functions. For example, we may disclose information about: (a) your visits to the Company’s website to a cybersecurity consultant to help secure the website; or (b) your address to our shipping carrier to deliver your order.

We only make these business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the personal information confidential, prohibit using the disclosed information for any purpose except performing the contract, and meet the CCPA's other contract requirements for engaging service providers or contractors.

The chart below identifies the categories of entities to whom we have disclosed our consumers’ personal information for a business purpose over the preceding 12 months, along with the personal information categories disclosed and the disclosure’s business purpose.

Category of Business Purpose Disclosure Recipients	Personal Information Categories Disclosed	Sensitive Personal Information Categories Disclosed	Business Purpose Disclosures
Order Fulfillment and Shipping Orders	Identifiers. Customer Records. Commercial information.	None.	To deliver products you purchased from us.
Advertising Networks	Identifiers. Customer Records. Commercial information. Internet/network activity. Geolocation data.	Precise geolocation.	To deliver location-based advertising.

 

Selling or Sharing Personal Information

We do not sell your personal information, including sensitive personal information, to third parties and have not sold it in the preceding 12 months. We may share your personal information with third parties for cross-context behavioral advertising purposes but have not shared your personal information in the preceding 12 months. Our personal information sharing does not include personal information about consumers we know are under age 18.

We may share your personal information with marketing partners. Personal information shared includes: (a) identifiers; (b) customer records; (c) internet or similar network activity; and (d) geolocation data. We share this information with marketing partners to strategically advertise the Company.

Your Rights and Choices

If you are a California resident, the CCPA grants you the following rights regarding your personal information:

• Right to Know about what personal information we have collected about you.

• Right to Delete the personal information we collected about you.

• Right to Correct inaccurate personal information we maintain about you.

• Right to Opt Out of the Sale or Sharing of your personal information.

• Right to Not Receive Discriminatory Treatment.

These rights, and how you can exercise them, are described in greater detail below. You have the right to request the following information about the personal information we have collected about you:

• The categories and specific pieces of personal information we have collected about you;
• The categories of sources from which we collected the personal information;
• The business or commercial purpose for which we collected, sold, or shared the personal information;
• The categories of third parties with whom we disclosed the personal information; and
• The categories of personal information about you that we sold or disclosed for a business purpose, and the categories of third parties to whom we sold or disclosed that information for a business purpose.

Additionally, you have the right to request that we delete the personal information we have collected from you, subject to certain exceptions, or correct personal information that we maintain about you.

Exercising Your Rights

We will not deny, charge different prices for, or provide a different level or quality of goods or services if you choose to exercise these rights.

As stated above, we do not use or disclose sensitive personal information for purposes other than those specified in the California Consumer Privacy Act Regulations § 7027(l)(1).

You can exercise most of these rights by submitting a request to: info@millcreekls.com. 

Verification process and Authorized Agents

Only you, or someone legally authorized to act on your behalf, may make a request to know, delete, or correct related to your personal information. If your minor child is our consumer, you may also make a verifiable request on their behalf.

We cannot respond to your request to know, delete, or correct if we cannot verify your identity or authority to make the request and confirm the personal information relating to you. We will only use personal information provided in the request to verify the requestor's identity or authority to make the request.

For requests to limit or opt-out, we ask for the information necessary to complete the request, which may include, for example, the consumer’s name or email address.

Response and Timing on Rights

In response to your request to exercise your rights, including the right to opt-out, we will process your request as soon as feasibly possible, but no later than 15 business days from the date we receive the request. We will only use personal information provided from your request to comply with the request.

We may deny opt-out requests if we have a good-faith, reasonable, and documented belief that the request is fraudulent and will clearly explain our denial decision to the requestor.

Contact Information

If you have any questions or comments about this Addendum or the Policy, the ways in which we collect and use your information described here, or wish to exercise your rights under California law, please do not hesitate to contact us at: info@millcreekls.com. 

International Addendum

Notice to Consumers outside the United States

This International Addendum (“Addendum”) supplements the Company’s Privacy Policy and applies to individuals located outside the United States of America (“International Users”). If any provision of this Addendum conflicts with the Privacy Policy, this Addendum controls for International Users. Any capitalized terms used in this Addendum not otherwise defined herein shall have the meanings given to them in the Privacy Policy.

Cross-Border Transfer of Personal Data

Your personal information may be transferred to, stored in, and processed in the United States of America, where data protection laws may differ from those in your country. We implement appropriate safeguards for such transfers, which includes adequacy decisions, where applicable, or your express consent for cross-border transfers where permitted. By using the Services, you acknowledge that such transfers may occur.

International Privacy Rights

Depending on your country, you may have additional rights, including the right to:

• Access your personal data;
• Correct inaccurate information;
• Delete or request erasure of data;
• Restrict or object to processing;
• Withdraw consent (where processing is based on consent);
• Request data portability;
• Lodge a complaint with a local supervisory authority; or
• Limit certain uses of your information.

We will honor these rights to the extent required under local law.

Legal Basis for Processing

Where required by law, for example, under the General Data Protection Regulation of the European Union (“GDPR”), we process personal data on the following bases:

• Performance of a contract, including order processing and customer support.
• Legitimate interests, such as product improvement, security, fraud prevention, and direct business communications.
• Compliance with legal obligations, including safety, regulatory, and export controls.
• Consent, where applicable (e.g., certain cookies, marketing communications, or cross-borders transfers).

International Data Retention Requirements

We retain personal data as described in the Privacy Policy. However, if a specific jurisdiction imposes stricter retention or deletion rules, we will comply with those rules for affected International Users.

International Cookies and Tracking Technologies

Certain jurisdictions require explicit consent before using cookies or trackers that are not “strictly necessary.” Accordingly, users in the EU, UK, and other opt-in regimes will see a consent banner before any non-essential cookies are placed. Users in opt-out countries may also see a consent banner, but may also decline cookies through browser settings or other methods described in the Privacy Policy. We adjust our cookie practices based on a user’s geographic location to comply with applicable law.

International Sharing and Disclosure

We may share personal data of International Users with:

• Cloud-hosting providers;
• Shipping/logistics providers;
• Data analytics platforms;
• Customer support vendors; and
• Company affiliates.

Where required, we enter into data-transfer agreements or apply other safeguards to protect data transferred from your jurisdiction to the United States of America or other counties.

Governing Law

If any provision of the Privacy Policy or this Addendum conflicts with a privacy rule or data-protection right that applies to you in your country of residence, the local law controls and we will comply with that law.

Contact for International Privacy Requests

If you have any questions or comments about this Addendum or the Policy, the ways in which we collect and use your information described here, or wish to exercise your rights under this Addendum or the Privacy Policy, please do not hesitate to contact us at: info@millcreekls.com.