Privacy Policy — Durahuman Group

Last updated: October 1, 2026

This Policy describes personal information handled in connection with durahuman.com and the Durahuman Group services that link to it. It covers website and commerce functions and, where a particular feature is offered and used, information submitted to that feature. A category description does not mean that every service collects every listed type of information.

Durahuman Group is responsible for processing it determines for its own purposes. Where an organization engages us to process information on its instructions, its notices and the applicable processing agreement also apply. This Policy does not replace a feature-specific notice, consent, or safeguard required by law.

1. Information and sources

Account, transaction, and support information. We receive information supplied when registering, ordering, subscribing, or requesting assistance, including contact details, billing and shipping information, purchase history, subscription status, and correspondence. Payment information is processed through the applicable payment process, and relevant transaction, authorization, fraud-prevention, or payment-status information is used to administer the purchase. Do not send card credentials or passwords in ordinary email or chat.

Device and usage information. Interactions generate information such as IP address, browser and device characteristics, approximate location inferred from technical information, referring pages, session and interaction records, diagnostics, and cookie or similar identifiers. Collection depends on the service, settings, permissions, and applicable consent requirements.

Customer-submitted materials. A feature accepting prompts, files, assessments, or other inputs processes the information submitted, associated outputs, and related activity records. An authorized organization may provide account or access information. Providers assisting with a service may supply delivery, transaction, integration, or security information.

Sensitive information. Submit health-related, biometric, genetic, precise-location, or other sensitive information only when a particular feature expressly supports it for a disclosed purpose and you have authority to provide it. General account creation or acceptance of Terms is not blanket consent to unrelated sensitive-data processing. Restricted technical or institutional information requires a specifically authorized environment and appropriate agreements.

2. Purposes

Relevant information is processed to provide requested functions and support; administer accounts, orders, payments, delivery, returns, and subscriptions; communicate transaction and service information; maintain and troubleshoot services; investigate misuse and security incidents; comply with legal obligations; establish or defend legal claims; and carry out an additional specifically disclosed lawful purpose.

Where permitted and consistent with applicable choices, website and commerce information may support analytics, usability improvement, marketing, and advertising measurement. A materially incompatible use or a new sensitive-data purpose must satisfy any additional notice and consent requirements before implementation. Research participation may require a separate notice, consent, or agreement.

3. AI-assisted functions

Where used, AI-assisted functions process relevant inputs and context through the systems and providers supporting the feature. Review the feature's instructions and settings before submitting private information. Outputs can reproduce supplied information or contain inaccurate personal inferences. Avoid unnecessary sensitive details and verify consequential outputs.

This Policy does not grant a general right to publish private submissions, use sensitive information for unrelated advertising, or train general-purpose AI models on confidential customer materials. Any additional use must have an appropriate lawful basis and satisfy relevant notices, permissions, and agreements. Institutional confidentiality and handling requirements must be established in the applicable contract.

A general AI output is not an authoritative personal record or an authorization for a legally significant automated decision. Rights concerning qualifying automated processing apply where provided by law. Contact us about inaccurate personal information or applicable review and objection rights.

4. Service providers and other disclosures

Information may be disclosed as necessary for the stated purpose to providers of ecommerce infrastructure, hosting, storage, authentication, payment processing, shipping, communications, support, analytics, security, and AI-processing functions; professional advisers; authorized organizational administrators; and recipients you direct us to share with. Their permitted processing is subject to applicable requirements and arrangements.

Our storefront is hosted by Shopify, which receives and processes storefront information to provide ecommerce functions. Where enabled, Shopify also processes information for enhanced services such as analytics, personalization, and advertising, including functions using interactions with this and other stores. Its processing roles and applicable choices are described in the Shopify Consumer Privacy Policy and privacy portal. Information submitted to the storefront may be shared with Shopify and supporting providers located outside your country. This identifies an infrastructure provider; Durahuman Group remains the seller identified in its offers.

We may disclose information to comply with a valid legal requirement, protect lawful rights or safety, investigate fraud or misuse, or complete a legitimate business transaction such as a reorganization, subject to applicable confidentiality, notice, and data-protection requirements. A transfer does not eliminate existing legal rights.

5. Advertising, sale or sharing, and cookies

Cookies and similar technologies can support site operation, account and cart functions, preferences, security, analytics, and advertising. Nonessential uses are subject to applicable consent or opt-out requirements. Use the controls presented by the service where available and your browser or device settings. Blocking essential technologies may affect functionality.

Advertising and analytics disclosures can qualify as sale, sharing, or targeted advertising under particular laws even without payment for individual records. Depending on the actual configuration and your choices, relevant categories can include identifiers such as email address or online identifiers, internet or network activity, and commercial information. Recipients include advertising and analytics providers. This Policy does not authorize selling sensitive information or using health-related information for advertising without satisfying specific legal prerequisites.

To exercise an applicable opt-out, use an available privacy control or email support@durahuman.com. California residents may use the subject line “California Opt-Out Request.” Where law requires recognition of a valid universal opt-out preference signal, that requirement applies; a generic Do Not Track setting is not necessarily the same signal. An advertising opt-out does not prevent processing necessary for your requested transaction or otherwise permitted by law. We do not knowingly sell or share personal information of minors under 16.

Use the unsubscribe control in a marketing email or contact support@durahuman.com to stop that marketing. Necessary service, transaction, and security communications may continue. Browser or device controls may apply only to that browser or device.

6. Health-related and other sensitive information

Durahuman Group is not a medical or diagnostic facility. Health-readiness information is not automatically governed by the same rules as a clinician's medical record. The laws that apply depend on the information, entities, functions, and processing involved. We do not represent that every service is a regulated clinical-record system or has a particular privacy certification.

Applicable requirements for sensitive-data consent, purpose limitations, security, individual rights, processor arrangements, and breach notification remain in effect. Do not use a general consumer service to store records requiring a specialized legal or contractual arrangement unless that arrangement and an appropriate environment have been established. Do not submit another person's sensitive information without lawful authority.

7. Retention, security, and incidents

Information is retained for the purposes for which it was collected and applicable contractual, accounting, tax, fraud-prevention, security, dispute, and legal requirements. The period depends on the information, service, and obligation. A deletion request is subject to lawful retention exceptions. Information retained under an exception remains limited to its permitted purpose; backup information may be removed through an applicable retention cycle, subject to law.

Information must be handled with safeguards appropriate to its sensitivity, processing, and applicable legal requirements. No internet transmission or storage system can be guaranteed completely secure. This is not a waiver of security duties or remedies. Incident notifications and other required measures will be provided when an applicable legal obligation arises.

8. Individual rights and requests

Depending on applicable law, rights may include confirming processing; accessing, correcting, or deleting information; receiving a portable copy; withdrawing consent; restricting or objecting to processing; opting out of sale, sharing, targeted advertising, or qualifying profiling; and appealing a refusal. We will not unlawfully discriminate against you for exercising a right. Eligibility, exceptions, verification, and response periods are governed by applicable law.

Contact support@durahuman.com to submit a request. Identify the account and relevant service without sending unnecessary health information, passwords, or identification documents. We may request proportionate information to verify identity or an authorized agent's authority. Where we process solely for an institutional customer, we may coordinate the request with that customer as required.

For an eligible request under the Texas Data Privacy and Security Act, we will respond without undue delay and within 45 days, subject to a permitted additional 45-day extension with timely notice and an explanation. To appeal a refusal, reply to the decision or email support@durahuman.com with “Privacy Appeal” in the subject line. An appeal subject to that Act will be addressed within 60 days. A denial will explain how to submit a complaint to the Texas Attorney General. Other applicable laws may provide additional rights or different deadlines.

Where European or similar privacy law applies, processing requires an appropriate lawful basis, such as necessity for a requested contract, legal compliance, a legitimate interest assessed against your rights, or consent where required. Withdrawal of consent does not affect the lawfulness of earlier processing. Applicable supervisory-authority and other nonwaivable rights are not displaced by the Texas governing-law provision in the Terms of Service.

9. International processing

Providers and infrastructure may process information outside your state or country. A transfer requiring a recognized legal mechanism or additional safeguards must meet those requirements. This Policy does not claim participation in a certification or transfer framework not expressly identified for the relevant service. Contact us for information about safeguards applicable to your service.

10. Children and application-specific notices

General consumer services are not directed to children under 16, and paid purchases require an adult or a separately authorized lawful institutional arrangement. Do not create an account for a child or submit a child's information unless a specific service lawfully supports the use with necessary permissions and protections. Contact us if you believe information was collected contrary to these restrictions.

A mobile application or specialized service may provide a supplementary notice describing its functions and permissions. Review that notice before submitting information. External services may provide separate notices for their independent processing; Durahuman Group remains responsible for its own applicable duties.

11. Changes and complaints

Material changes require appropriate notice and any consent required by law before implementation. Posting a revised Policy does not by itself authorize a materially incompatible use of previously collected information.

Contact support@durahuman.com with a complaint or use the mailing address below. You may complain to the competent privacy or consumer-protection authority where applicable; first contacting us is not a waiver or precondition of that right.

Contact

For general privacy questions: info@durahuman.com.
For rights requests, advertising opt-outs, appeals, or complaints: support@durahuman.com.

By mail:
Durahuman Group
5900 Balcones Drive
STE 100
Austin TX 78731