Privacy Policy

Last updated: May 12, 2026

MNLY, Inc. ("MNLY", "we", "us") cares about your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have. It applies to getmnly.com, our mobile and web applications, and the MNLY lab testing program (the "Service").

1. Information we collect

1.1 Information you give us directly

  • Account info - name, email address, phone number, password (stored as a hash by AWS Cognito; we never see your plaintext password).
  • Shipping address - used to ship kits and supplements.
  • Demographics - date of birth and biological sex, required by the lab to interpret your biomarker results against the right reference ranges.
  • Health survey responses - answers you provide about your habits, goals, and symptoms. Used by our recommender to personalize your supplement and lifestyle plan.
  • Kit ID - the barcode on your physical kit, used to match your sample to your account.
  • Consents - your acknowledgement that you are the test taker and have accepted these Terms and this Privacy Policy.

1.2 Information we receive from the lab

  • Biomarker results - the panel of blood, hormone, and metabolic markers measured by our lab partner from the sample you mail in. Results are returned to MNLY in JSON form and stored against your account.
  • Kit status events - when your kit was shipped, activated, received, processed, and resulted.

1.3 Information collected automatically

  • Device and usage - browser type, OS, IP address, pages viewed, time spent, referrer.
  • Cookies and similar technologies - see §5 below. Used for session management, fraud prevention, and (with your consent where required) analytics.
  • Error and performance telemetry - when something goes wrong in the Service, we collect a stack trace and limited context (sent to Sentry) so we can debug and fix it. Does not include lab results or sensitive form data.

1.4 Information we receive from third parties

  • Payment processors - Shopify and Recharge provide us with transaction status, last four digits of the card on file, and billing address. We never see your full card number.
  • Shipping carriers - we receive tracking events from the carrier (e.g. USPS, UPS) so we can show you the status of your shipment.

2. How we use information

  • To operate the Service - process orders, ship kits, register kits with the lab, deliver results, generate your plan.
  • To bill you and process payments through our processors.
  • To communicate with you about your account, orders, results, and (with your consent) marketing.
  • To improve the Service - analyze usage in aggregate, debug errors, refine recommendations.
  • To detect and prevent fraud, abuse, and security incidents.
  • To comply with legal obligations.

3. Who we share information with

We do not sell your personal information. We share information with the following categories of recipients:

  • Lab partner - your name, address, date of birth, sex, kit ID, and email are sent to our third-party laboratory partner so they can ship your kit, process your sample, and return results. The lab partner is HIPAA-covered for this processing. See the lab partner's privacy policy.
  • Payment processors (Shopify and Recharge) - name, email, shipping address, and order details so they can charge your payment method and recurring subscription.
  • Supplement fulfillment (OK Capsule) - name, shipping address, and the list of supplements in your plan so they can manufacture and ship your monthly pack. OK Capsule does not receive your lab results or survey responses.
  • Cloud infrastructure - Amazon Web Services hosts our application, database (encrypted at rest and in transit), and authentication system (Cognito). Sentry receives error telemetry. These providers process data on our behalf under contractual privacy obligations.
  • Shipping carriers - name and shipping address.
  • Marketing platforms - only if you have opted in to marketing communications.
  • Legal and safety - when required by law, valid legal process, or to protect the rights, property, or safety of MNLY, our customers, or others.
  • Business transfers - if MNLY is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction (subject to standard confidentiality protections).

4. How long we keep information

We keep your information for as long as your account is active and as needed to provide the Service. After you close your account, we retain certain information for as long as required by law (e.g. tax records, fraud prevention) or to defend ourselves in legal proceedings. Anonymized and aggregated data, which can no longer be linked back to you, may be retained indefinitely.

5. Cookies and tracking

We use cookies and similar technologies to keep you logged in, remember your preferences, and (where you have consented) measure how the Service is used. You can disable cookies through your browser settings, but parts of the Service may not work correctly without them. We do not currently respond to "Do Not Track" browser signals.

6. Your rights and choices

Subject to applicable law (including the California Consumer Privacy Act), you have the following rights:

  • Access - request a copy of the personal information we hold about you.
  • Correction - request that we correct inaccurate information.
  • Deletion - request that we delete your information. Note that we may retain certain information where legally required.
  • Portability - request your information in a portable format.
  • Opt-out of marketing - unsubscribe from marketing emails using the link in any marketing message.
  • Right against discrimination - California residents have the right not to receive discriminatory treatment for exercising their privacy rights.

To exercise any of these rights, email privacy@getmnly.com. We will verify your identity before responding and will respond within the timeframes required by law.

7. Children

The Service is intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn we have inadvertently collected personal information from a minor, we will delete it. If you believe a child has provided us with information, please contact us at privacy@getmnly.com.

8. Security

We protect your information using industry-standard safeguards, including encryption in transit (TLS) and at rest (AES-256), least-privilege access controls, audit logging, and regular security review. No system is perfectly secure. If we become aware of a breach affecting your information, we will notify you in accordance with applicable law.

9. International users

The Service is currently offered only in the United States, and all information is processed in the United States. If you access the Service from outside the United States, please be aware that your information will be transferred to and processed in the United States, which may have different data protection laws than your country.

10. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service before the changes take effect. Your continued use of the Service after the changes take effect constitutes your acceptance of the updated Policy.

11. Contact

Questions about this Privacy Policy or your data? Email privacy@getmnly.com. For general support, email support@getmnly.com.