Consumer Health Data Privacy Policy

Last updated: October 12, 2026

This policy explains how PROTOKODE, operated by MMMK Vista LLC ("PROTOKODE", "we", "us"), collects, uses and shares consumer health data. It is written for residents of Washington (My Health My Data Act), Nevada (SB 370) and Connecticut, and we apply it to all US customers. It adds to our Privacy policy.

The short version

• PROTOKODE products are cosmetics. We don't ask for health information to sell them to you.
• We only collect health information if you choose to send it to us, for example when you report a product reaction or ask about an allergy, pregnancy or a skin or scalp condition.
• We only use it to answer you, look into the product and meet our legal duties.
• We never sell consumer health data, and we never use it for advertising.
• You can ask to see it, delete it or withdraw your consent at any time.

What we mean by consumer health data

Consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health. For PROTOKODE, that can include details about a reaction to a product, symptoms, allergies or sensitivities, pregnancy or breastfeeding, skin or scalp conditions, medications, and whether you saw a doctor.

Consumer health data we collect

• Reaction reports: what happened, when, the product and batch code, any symptoms, whether you saw a doctor, and photos you choose to send.
• Health details in your messages: anything you choose to tell our support team about allergies, sensitivities, pregnancy or breastfeeding, skin or scalp conditions, or medications.

We don't ask for health information at checkout, in our sign-up forms or in reviews. We don't collect precise location, biometric or genetic data.

Where it comes from

Only from you, when you email us or reply to our support team.

Why we collect and use it

• To answer your question or report.
• To look into the product and batch involved, for product safety.
• To meet our legal duties as a cosmetics company, including keeping records of reactions and reporting serious reactions to the US Food and Drug Administration (FDA).

We collect and use it only as needed to provide what you asked for and to meet our legal duties. If we ever wanted to collect or use it for any other purpose, we would ask for your consent first. We don't use it for marketing, advertising, profiling or ad measurement.

Who we share it with

We share consumer health data only as needed for the purposes above, with:

• Service providers (processors) that host our support inbox and business email, under contracts that only let them use it to provide their services to us.
• Our service providers, so they can look into the product and batch involved in a reaction report.
• The US Food and Drug Administration, when the law requires us to report a serious reaction.
• Others when the law requires it, for example to respond to a valid legal request.

We don't have affiliates that receive consumer health data. We don't share it with advertising or analytics partners.

We don't sell it

We don't sell consumer health data, and we don't share it for targeted advertising.

No geofencing

We don't use geofences around health care facilities, or anywhere else, to identify, track, collect data from or send messages or ads to anyone.

How long we keep it

Reaction reports are kept for 6 years, as cosmetics law requires. Other support messages are kept for 3 years.

Your rights

• Confirm and access: ask whether we collect, share or sell your consumer health data, get a copy of it, and get a list of the third parties we've shared it with, with a way to contact them.
• Delete: ask us to delete it. We will also tell our service providers and the third parties we've shared it with to delete it. We may keep what the law requires us to keep, such as reaction records we must hold for 6 years, and we'll tell you if we do.
• Withdraw consent: where we rely on your consent, you can withdraw it at any time.
• Fair treatment: we won't treat you differently for using these rights.

How to make a request

Email support@tryprotokode.com with the subject "Consumer health data request". We'll ask you to confirm the request from the email address you used with us, or to give details that match our records, so we can check it's you. You can ask someone to make a request for you; we'll ask for your signed permission.

We respond within 45 days. If we need more time, we'll tell you why and take up to 45 more days.

Appeals

If we decline your request, you can appeal by replying with the subject "Consumer health data appeal". We'll answer within 45 days and explain our decision. If you're not satisfied, you can contact your state Attorney General. Washington residents can file a complaint with the Washington State Attorney General at www.atg.wa.gov.

Changes to this policy

We may update this policy. We'll change the date at the top and, for important changes, tell you by email or with a notice on our site. We won't use consumer health data in a new way without your consent.

Contact us

Email support@tryprotokode.com. We answer every email. Or write to MMMK Vista LLC, 1914 Thomes Ave Ste 2 #3430, Cheyenne, WY 82001, United States.