Privacy policy.

1. Who We Are

This Privacy Policy describes how OS Reboot, operated by Ambiguous Inc., a California corporation with its principal place of business at 1804 Union Street, San Francisco, CA 94123 ("OS Reboot," "Ambiguous Inc.," "we," "us," or "our"), collects, uses, and shares information when you interact with osreboot.com, our wellness program, and related services (collectively, the "Service").

2. Information We Collect

2.1 Information you provide directly

• Account information: name, email address, phone number, password, mailing address.
• Profile information: goals, lifestyle preferences, communication preferences.
• Communications: messages you send to coaches, the support team, or our affiliated medical care team.
• Affiliate account information: banking/payout details, tax forms (W-9 or W-8), referral activity.
• Mailing-list and promotion signups: if you enter your email address to receive a promotion code or join our list, we record your email address, the code issued, which page you signed up from, the date and time, and your browser type and referring page. These signups are stored in a Google Workspace spreadsheet we control. We do not record your IP address or your location with a signup. Signing up is optional and is never required to browse the Site, use the free tools, or pursue the Medical Track.
• Medical Track intake (if elected): medical history, current medications, allergies, lab results you provide, height, weight, age, goals, and any other information requested by the prescribing medical group. See Section 5 for how this information is handled.

2.2 Information collected automatically

• Device and usage data: browser type, operating system, device type, screen and window size, language, time zone, pages visited, time on page, scroll depth, page load speed, and referring URL. Your IP address is used to derive your country and is then discarded — we do not store it. See Section 7.
• Cookies and similar technologies: see Section 6.
• Analytics and performance data: collected by our own first-party analytics and held on infrastructure we control. No third-party analytics or advertising tracker runs on this Site. See Section 7.

2.3 Information from third parties

We may receive information from the Medical Entity that operates the Medical Track, advertising platforms, affiliate payout processors, and other partners — limited to what is necessary to provide the Service.

3. How We Use Information

We use the information we collect to:

• Provide, operate, and improve the Service;
• Communicate with you about your account, the program, and customer support;
• Process the optional Medical Track intake and route it to the affiliated medical services organization;
• Process payments, refunds, and affiliate payouts;
• Send marketing emails (which you can unsubscribe from at any time), and measure whether they were delivered and clicked;
• Detect, prevent, and respond to fraud, abuse, or security issues;
• Comply with legal obligations and enforce our Terms of Use.

4. How We Share Information

We do not sell your personal information. We share information only as follows:

• Service providers who help us operate the Service — including hosting (Render), email (Brevo), scheduling for coaching and membership calls (Calendly), payment processing for the optional Coaching Membership (Stripe), spreadsheet storage for mailing-list signups (Google Workspace), and affiliate payout processing. Analytics is not in this list: we operate it ourselves and no analytics data is sent to a third party. These providers are bound by contractual obligations to handle data securely and only as instructed.
• Medical services organization, prescribing physicians, and 503A pharmacy — if you elect the Medical Track, your intake information is transmitted to the independent medical entities so they can provide care. These entities are independent third parties and process your health information under their own privacy policies and applicable laws, including HIPAA where applicable.
• Legal requirements — if required by law, subpoena, court order, or to protect rights, property, or safety.
• Business transfers — if OS Reboot is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any material change in ownership or use of your information.

5. Medical Track and Health Information

If you elect to pursue the Medical Track, you will submit health information through a secure intake form. This information is transmitted directly to the independent licensed medical services organization (the "Medical Entity") that contracts with the prescribing physicians and the 503A pharmacy. The Medical Entity and its affiliated medical group are independent covered entities or business associates under HIPAA, as applicable, and handle Protected Health Information ("PHI") under their own Notice of Privacy Practices.

Ambiguous Inc. and OS Reboot are not HIPAA-covered entities. The Medical Entity is the covered entity (or business associate) that maintains your Protected Health Information under its own Notice of Privacy Practices. To the extent OS Reboot's systems route intake form submissions to the Medical Entity, we do so under contractual obligations to protect the confidentiality and security of that information consistent with applicable law. We do not store PHI longer than necessary to route it to the Medical Entity.

See our HIPAA Notice of Privacy Practices for more information on how PHI is handled.

6. Cookies and Tracking

We do not use cookies for analytics or advertising, and we do not run any third-party tracker on this Site. Google Analytics, Microsoft Clarity and the Meta Pixel were removed in August 2026 and are not used.

Our analytics identifier is stored in your browser's local storage rather than in a cookie. Clearing your browsing data removes it. You can also opt out entirely — see Section 7.

Marketing-email link tracking. Links in marketing emails we send pass through our own click-measurement service before reaching this Site. When you click one, we record that your email address clicked and which email it was, so we can measure what works and stop contacting people who are not interested. This click record is kept separate from the Site's anonymous browsing identifier and is never joined to it: we know that you clicked; we do not know what you read afterward. To have your click history erased, email privacy@osreboot.com or unsubscribe from any email.

We honor "Do Not Track" and Global Privacy Control signals. If your browser sends either, no analytics data is collected from you at all — not reduced, not anonymized: nothing is sent.

7. Analytics and Advertising

We run our own analytics on infrastructure we control. Analytics data about your visit is not sent to Google, Meta, Microsoft, or any other third party, and is never sold or shared for advertising.

What we record. When you visit a page we record the page address, the page title, the site that referred you, campaign tags in the link you followed, your country, your device type, browser, operating system, screen and window size, language, time zone, how long you were actively on the page, how far you scrolled, how quickly the page loaded, and any errors the page produced. We also record certain actions: opening a treatment program, clicking a link off the Site, downloading a file, playing a video, and choosing an option in a product selector.

We do not record what you type. We record that a form field was used, never its contents. We do not record text you select, copy, or enter anywhere on the Site.

We do not store your IP address. It is converted into a country and immediately discarded. We do not keep it, and we cannot recover it.

Visits are linked together. A random identifier is stored in your browser so we can see the sequence of pages in a visit and recognize a returning browser. It is not derived from anything about you, it is not linked to your name or email, and it means nothing on any other website. Because the pages you view here can indicate a health interest, we treat this as sensitive information: it stays on our own systems, it is not shared, and it is deleted on the schedule in Section 8.

How to opt out. Any of these stops collection completely:

• Turn on "Do Not Track" or Global Privacy Control in your browser.
• Use the button below, which also deletes the identifier already stored on this device.
• Email privacy@osreboot.com and ask us to erase your analytics history. We will delete every record associated with your identifier.

Opt out of analytics on this device

We may run advertising campaigns based on aggregated, non-identifiable audience characteristics. We do not share identifiable health information for advertising purposes, and we do not send analytics data to advertising platforms.

8. Data Retention

We retain personal information as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Account information: For the life of your account, plus up to 7 years thereafter for tax, accounting, and legal purposes.
• Marketing email lists: Until you unsubscribe; thereafter your record is suppressed but minimal information is retained to honor your opt-out.
• Analytics data (our own, first-party): Up to 400 days, after which records are deleted automatically. This includes the page-by-page detail described in Section 7, not only aggregate totals. You may ask us to erase your analytics history at any time.
• Medical Track intake data routed to the Medical Entity: Retained only as long as necessary to complete routing (typically less than 72 hours); thereafter retained only by the Medical Entity under its own retention policy.
• Payment and refund records: 7 years, in accordance with IRS and applicable financial regulations.
• Customer support communications: 3 years.

Medical Track health information held by the Medical Entity and pharmacy is retained under their own retention policies and applicable medical records laws (typically 7–10 years depending on the state).

9. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, and destruction. These include SSL/TLS encryption in transit, encrypted storage where applicable, and access controls. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Your Privacy Rights

You have certain rights regarding your personal information, including the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Delete your information (subject to legal and operational retention requirements);
• Opt out of marketing communications;
• Request a portable copy of your information.

To exercise these rights, contact hello@osreboot.com (with subject: Privacy Request). We will respond within the timeframes required by applicable law.

For Medical Track health information, requests should be directed to the medical services organization. We will assist in routing your request.

11. California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know what categories of personal information we collect, use, disclose, or sell.
• Right to delete personal information we hold about you, subject to certain exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing of personal information. OS Reboot does not sell personal information.
• Right to limit use of sensitive personal information.
• Right to non-discrimination for exercising your privacy rights.

To exercise these rights, contact hello@osreboot.com (with subject: Privacy Request). We will verify your identity before responding to substantive requests.

12. Other State Privacy Laws

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have similar rights. Contact hello@osreboot.com (with subject: Privacy Request) to exercise these rights.

13. International Users

OS Reboot operates in the United States, and the Service is intended for U.S. residents only. The Medical Track is further limited to U.S. states where the affiliated medical practice is licensed and the affiliated pharmacy is authorized to dispense. See our State Disclosures·Providers page for current coverage. If you access the Service from outside the U.S., you consent to the transfer and processing of your information in the U.S., which may have different data protection laws than your country of residence.

14. Children's Privacy

The Service is not directed to children under 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18 without parental consent, we will delete it.

15. Third-Party Sites

The Service may contain links to third-party sites (including npiregistry.cms.hhs.gov and others). We are not responsible for the privacy practices of those sites. Review their privacy policies before submitting information.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "Effective" date at the top and, where appropriate, by email or in-product notice.

17. Contact

Privacy questions or requests:

OS Reboot
Operated by Ambiguous Inc.
1804 Union Street, San Francisco, CA 94123
Email: hello@osreboot.com
Please use a subject line to route your message (e.g. "Privacy Request" or "Legal Inquiry")