The short version: We collect only what we need to provide the wellness program. We don't sell your data. We share it only with the service providers that make the program work, and with the licensed medical entities if you elect the Medical Track. Health information you submit through the Medical Track intake is handled separately from regular site data and is subject to additional protections.
- Who We Are
- Information We Collect
- How We Use Information
- How We Share Information
- Medical Track and Health Information
- Cookies and Tracking
- Analytics and Advertising
- Data Retention
- Security
- Your Privacy Rights
- California Residents (CCPA/CPRA)
- Other State Privacy Laws
- International Users
- Children's Privacy
- Third-Party Sites
- Changes to This Policy
- Contact
1. Who We Are
This Privacy Policy describes how OS Reboot, operated by Ambiguous Inc., a California corporation with its principal place of business at 1804 Union Street, San Francisco, CA 94123 ("OS reboot," "Ambiguous Inc.," "we," "us," or "our"), collects, uses, and shares information when you interact with osreboot.com, the Wellpep application (the coaching platform also operated by Ambiguous Inc.), our wellness program, and related services (collectively, the "Service").
2. Information We Collect
2.1 Information you provide directly
- Account information: name, email address, phone number, password, mailing address.
- Profile information: goals, lifestyle preferences, communication preferences.
- Communications: messages you send to coaches, the support team, or our affiliated medical care team.
- Affiliate account information: banking/payout details, tax forms (W-9 or W-8), referral activity.
- Medical Track intake (if elected): medical history, current medications, allergies, lab results you provide, height, weight, age, goals, and any other information requested by the prescribing medical group. See Section 5 for how this information is handled.
2.2 Information collected automatically
- Device and usage data: IP address, browser type, operating system, device identifiers, pages visited, time on page, referring URL.
- Cookies and similar technologies: see Section 6.
- Analytics and performance data: aggregated usage metrics from Google Analytics, Microsoft Clarity, and similar services.
2.3 Information from third parties
We may receive information from the Medical Entity that operates the Medical Track, advertising platforms, affiliate payout processors, and other partners — limited to what is necessary to provide the Service.
3. How We Use Information
We use the information we collect to:
- Provide, operate, and improve the Service;
- Communicate with you about your account, the program, and customer support;
- Process the optional Medical Track intake and route it to the affiliated medical services organization;
- Process payments, refunds, and affiliate payouts;
- Send marketing emails (which you can unsubscribe from at any time);
- Detect, prevent, and respond to fraud, abuse, or security issues;
- Comply with legal obligations and enforce our Terms of Use.
4. How We Share Information
We do not sell your personal information. We share information only as follows:
- Service providers who help us operate the Service — including hosting (Render), email (Brevo), analytics (Google, Microsoft Clarity, Meta), affiliate payout processing, and the Wellpep platform. These providers are bound by contractual obligations to handle data securely and only as instructed.
- Medical services organization, prescribing physicians, and 503A pharmacy — if you elect the Medical Track, your intake information is transmitted to the independent medical entities so they can provide care. These entities are independent third parties and process your health information under their own privacy policies and applicable laws, including HIPAA where applicable.
- Legal requirements — if required by law, subpoena, court order, or to protect rights, property, or safety.
- Business transfers — if OS reboot is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any material change in ownership or use of your information.
5. Medical Track and Health Information
If you elect to pursue the Medical Track, you will submit health information through a secure intake form. This information is transmitted directly to the independent licensed medical services organization (the "Medical Entity") that contracts with the prescribing physicians and the 503A pharmacy. The Medical Entity and its affiliated medical group are independent covered entities or business associates under HIPAA, as applicable, and handle Protected Health Information ("PHI") under their own Notice of Privacy Practices.
Ambiguous Inc. and OS reboot are not HIPAA-covered entities. The Medical Entity is the covered entity (or business associate) that maintains your Protected Health Information under its own Notice of Privacy Practices. To the extent OS reboot's systems route intake form submissions to the Medical Entity, we do so under contractual obligations to protect the confidentiality and security of that information consistent with applicable law. We do not store PHI longer than necessary to route it to the Medical Entity.
See our HIPAA Notice of Privacy Practices for more information on how PHI is handled.
6. Cookies and Tracking
We use cookies and similar technologies to operate the Site, remember preferences, analyze traffic, and enable advertising. You can control cookies through your browser settings. Disabling cookies may limit functionality of the Site.
We honor "Do Not Track" signals where required by applicable law and offer opt-out mechanisms described in Sections 11 and 12.
7. Analytics and Advertising
We use:
- Google Analytics for aggregated usage analytics. You can opt out via the Google Analytics opt-out browser add-on.
- Microsoft Clarity for session recordings and heatmaps (aggregated behavior only).
- Meta Pixel for retargeting on Facebook and Instagram. You can adjust ad preferences in your Meta account settings.
We may run advertising campaigns based on aggregated, non-identifiable audience characteristics. We do not share identifiable health information for advertising purposes.
8. Data Retention
We retain personal information as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:
- Account information: For the life of your account, plus up to 7 years thereafter for tax, accounting, and legal purposes.
- Marketing email lists: Until you unsubscribe; thereafter your record is suppressed but minimal information is retained to honor your opt-out.
- Analytics data (Google Analytics, Microsoft Clarity, Meta Pixel): Up to 26 months, in aggregated form.
- Medical Track intake data routed to the Medical Entity: Retained only as long as necessary to complete routing (typically less than 72 hours); thereafter retained only by the Medical Entity under its own retention policy.
- Payment and refund records: 7 years, in accordance with IRS and applicable financial regulations.
- Customer support communications: 3 years.
Medical Track health information held by the Medical Entity and pharmacy is retained under their own retention policies and applicable medical records laws (typically 7–10 years depending on the state).
9. Security
We implement reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, and destruction. These include SSL/TLS encryption in transit, encrypted storage where applicable, and access controls. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
10. Your Privacy Rights
You have certain rights regarding your personal information, including the right to:
- Access the personal information we hold about you;
- Correct inaccurate or incomplete information;
- Delete your information (subject to legal and operational retention requirements);
- Opt out of marketing communications;
- Request a portable copy of your information.
To exercise these rights, contact hello@osreboot.com (with subject: Privacy Request). We will respond within the timeframes required by applicable law.
For Medical Track health information, requests should be directed to the medical services organization. We will assist in routing your request.
11. California Residents (CCPA/CPRA)
California residents have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:
- Right to know what categories of personal information we collect, use, disclose, or sell.
- Right to delete personal information we hold about you, subject to certain exceptions.
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing of personal information. OS reboot does not sell personal information.
- Right to limit use of sensitive personal information.
- Right to non-discrimination for exercising your privacy rights.
To exercise these rights, contact hello@osreboot.com (with subject: Privacy Request). We will verify your identity before responding to substantive requests.
12. Other State Privacy Laws
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have similar rights. Contact hello@osreboot.com (with subject: Privacy Request) to exercise these rights.
13. International Users
OS reboot operates in the United States, and the Service is intended for U.S. residents only. The Medical Track is further limited to U.S. states where the affiliated medical practice is licensed and the affiliated pharmacy is authorized to dispense. See our State Disclosures page for current coverage. If you access the Service from outside the U.S., you consent to the transfer and processing of your information in the U.S., which may have different data protection laws than your country of residence.
14. Children's Privacy
The Service is not directed to children under 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18 without parental consent, we will delete it.
15. Third-Party Sites
The Service may contain links to third-party sites (including npiregistry.cms.hhs.gov and others). We are not responsible for the privacy practices of those sites. Review their privacy policies before submitting information.
16. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "Effective" date at the top and, where appropriate, by email or in-product notice.
17. Contact
Privacy questions or requests:
OS Reboot
Operated by Ambiguous Inc.
1804 Union Street, San Francisco, CA 94123
Email: hello@osreboot.com
Please use a subject line to route your message (e.g. "Privacy Request" or "Legal Inquiry")