Privacy Policy

1. Who we are and what this policy covers

Omi Health Inc. (“Omi”, “we”, “us”) is a Delaware corporation building a canine longevity platform: blood-based biomarker testing, saliva-based epigenetic testing (our “cellular aging test”), and an app that turns those results into wellness guidance for your dog.

This policy explains what we do with information when you:

• visit omihealth.com or join our waitlist;
• create an Omi account or use the Omi app;
• buy or use an Omi membership, including sample collection, laboratory testing, and your results;
• ask us to obtain your dog’s records from your veterinary practice;
• email us, subscribe to our newsletter, or take part in our referral program.

We call all of that “the Service”.

Omi is offered only in the United States. We do not currently market or sell to people outside the US, and this policy is written to US law. If we open other markets, we will publish the additional terms those markets require before we do.

Omi is not a healthcare provider for people. We provide wellness information about animals. We do not diagnose or treat disease, we do not provide medical advice for humans, and nothing in the Service replaces care from your dog’s veterinarian. The Terms of Service explain those limits in detail.

2. The standard we hold ourselves to

Your dog’s health data does not fall under the health-privacy laws written for human patients — those protect people, and our patient is your dog. We have chosen to protect it as though they did apply: no sale of results, samples destroyed after testing, de-identification for research, and deletion on request.

The information about you — your name, contact details, address, payment information, and your activity on our site and app — is personal information under the privacy laws now in force in twenty US states. Section 13 sets out the rights those laws give you, and we extend the same rights to everyone, in every state.

3. Information we collect

Information you give us

Account and identity. Your name, email address, phone number, and how you sign in — we use passwordless magic links and passwords, and we never see or store your password in readable form.

Your dog. Name, breed or mix, sex, date of birth or estimated age, spay/neuter status, weight and body condition, microchip details if you provide them, photographs, and the health history you enter: diagnosed conditions, medications and supplements, diet and feeding routine, activity, symptoms, stool and quality-of-life observations, and the goals you set.

Addresses and scheduling. Your billing and contact address, the address, access notes, and time window for a mobile blood draw, and a delivery address where we are sending you a kit.

Payment information. Payments are processed by Stripe. Stripe collects and holds your card number; we never receive or store full card numbers. We keep a Stripe customer reference, the last four digits, card brand, expiry, billing postcode, and your purchase and renewal history.

Veterinary records authorization. If you ask us to collect your dog’s records from a veterinary practice, we collect the practice’s name and contact details, your dog’s identifying details, and your electronic signature on the authorization form, together with the date, time, and the fact you signed it.

What you send us in the app. Messages you write to our AI companion or our team, and anything you attach — photographs, lab reports, discharge summaries, invoices, or other documents about your dog.

Support, surveys, and community. Emails and support tickets, survey and onboarding answers, reviews and testimonials, and any content you send us for use on our channels.

Waitlist and referrals. Your email address, which form you signed up from, your referral code, and the code of whoever referred you.

Samples and test results

The samples themselves. The saliva swab, taken at your blood draw or collected by you at home, and the blood sample drawn by an Omi veterinarian or veterinary technician.

What the laboratory produces. Epigenetic measurements including biological-age estimates, blood biomarker values, and the reference ranges they are read against.

What we derive from them. Scores, trends, flags, findings, comparisons over time, and the personalized guidance and protocols we generate for your dog.

Information from your veterinarian

Where you have authorized it, we receive your dog’s records from their practice: visit histories, examination notes, prior laboratory results, imaging reports, vaccination and parasite-prevention history, prescriptions, and invoices. These records sometimes contain information about you as the client — your address, phone number, and payment history with that practice.

Information we collect automatically

Device and connection. IP address, and the approximate city or region it indicates, browser and operating system, device type, device identifiers, app version, language, and time zone.

Usage. Pages and screens viewed, features used, buttons tapped, referring URL and campaign parameters, session timing, and — on our website — how you arrived and where you went next.

Diagnostics. Crash reports, error traces, and performance data, which may incidentally include fragments of the screen or request that failed.

Notifications. A push token for your device, if you allow notifications, and whether a notification was delivered and opened.

Information from other sources

Advertising and social platforms, which tell us in aggregate that a campaign produced signups, and, where you have interacted with our ads, may match your activity to a profile they already hold.

Our laboratory and logistics partners, who tell us that a sample or kit was collected, shipped, arrived, was processed, or failed.

Our veterinary staff, who record collection notes, sample quality, and any adverse event during a draw.

Publicly available sources, such as a social profile you have linked to us or content you have posted publicly and asked us to feature.

4. Cookies, pixels, and similar technologies

We use three kinds of technology on our website and in our app.

Strictly necessary. Session and security cookies that keep you signed in, protect forms against cross-site request forgery, and remember that you dismissed a popup. The site does not work without these, and they cannot be switched off.

Analytics. Mixpanel is our product analytics tool: it tells us which pages and features are used, where people drop out, and whether a change helped. It also records a sample of website sessions as a replay — a reconstruction of the pages as they appeared and where the pointer moved — so we can see where a page confuses people. Text you type is masked and never captured, and we do not record replays at all on our checkout, payment, or kit-registration pages. Mixpanel is loaded directly by our website rather than through a tag manager, and its data is sent to a path on our own domain. Google Analytics tells us which channels and campaigns bring people to the site; it is loaded through Google Tag Manager, as is our error monitoring.

Advertising. We run advertising pixels from Meta (Facebook and Instagram) and TikTok, loaded through Google Tag Manager. These let us measure which ads produce signups and show ads to people who visited us but did not sign up. Under California, Colorado, Connecticut, Texas and similar state laws, this is “sharing” personal information for cross-context behavioural advertising, or “targeted advertising” — even though no money changes hands. You can turn it off; see Section 12.

We honour Global Privacy Control. If your browser or extension sends a GPC signal, we treat it as an opt-out of advertising-related sharing for that browser, as required in California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas. You do not need to be a resident of those states for us to honour it. We go further than the law requires: a GPC signal switches off all of the above on our website — the advertising pixels, Google Analytics, and Mixpanel alike, including session replay — not only the advertising ones. Purchases are still recorded on our own servers, because we need them to bill you and to run the business.

You can also clear or block cookies in your browser, reset your advertising identifier on your phone, and turn off app tracking in iOS settings. Blocking strictly necessary cookies will break parts of the site.

5. How we use information

We use information to:

• Deliver the Service — set up your account, schedule and perform a blood draw, send you a kit where one is needed, get samples to the laboratory, generate your results, and build your dog’s protocol.
• Explain results and answer questions through the app’s AI companion and our team.
• Retrieve veterinary records you have authorized us to request, and read them into your dog’s timeline.
• Take payment, manage your membership and renewals, and handle refunds.
• Communicate with you — service and results notifications, kit and appointment logistics, billing notices, and, if you have asked for them, our newsletter and product news.
• Provide support and investigate problems you report.
• Keep the Service safe and working — authentication, fraud prevention, abuse detection, debugging, capacity planning, and backups.
• Improve the Service, including refining our reference ranges, scoring, and guidance (see Section 7).
• Understand our marketing — which campaigns and channels work, and how our referral program performs.
• Meet legal obligations — tax and accounting records, responding to lawful requests, enforcing our Terms, and establishing or defending legal claims.

We rely on your consent where the law requires it — for example, before sending marketing email, before accessing your dog’s veterinary records, and before enabling push notifications.

6. How we use AI

The Omi app uses large language models to summarize your dog’s results, answer your questions, and draft the protocols and action plans you see. Three things you should know:

What we send. To answer a question we send the relevant context — your dog’s profile, results, records, and the conversation itself — to the AI provider that runs the model. We send only what is needed to answer, and we will tell you which provider we use if you ask.

They work for us, not on their own account. We use AI providers under terms that limit them to processing your data in order to provide the service to us, on the same basis as every other provider in Section 8.

A machine writes it, and it can be wrong. AI output is generated automatically and is not reviewed by a veterinarian before you see it, unless we say otherwise on the screen. It is wellness information, not a diagnosis, and it can be incomplete or wrong. We do not use AI to make decisions that produce legal or similarly significant effects for you.

Veterinarians oversee it, in samples. Licensed veterinarians regularly review samples of the plans and chat answers the app produces, and what they flag is corrected in the system so it improves for everyone. That is quality assurance across the product — it is not a check on your dog’s individual plan or on any particular answer before it reaches you. Where a person does read your case — for example, when a concerning finding is escalated to our veterinary team — that is a human reading it, not a model deciding.

7. Research and product improvement, and how to opt out

Canine longevity is a young science, and the value of what we are building grows with the size of the dataset behind it. So, unless you tell us not to:

• We use your dog’s results, profile, and health history in de-identified form to refine our reference ranges, scores, models, and guidance.
• We may contribute de-identified or aggregated data to canine health and longevity research, including work with academic and veterinary research partners, and publish findings from it.

De-identified means we strip your name, email address, phone number, postal address, payment details, account identifiers, free-text you have written, and photographs, and we do not attempt to re-identify the result. We contractually require research partners not to attempt re-identification either.

We do not share identifiable results with research partners, and we do not provide your dog’s individual results to insurers, employers, breeders, breed registries, or data brokers.

You can opt out at any time by emailing hello@omihealth.com. Opting out costs you nothing — every part of your membership works exactly the same way. Opting out stops future research use; it cannot pull back analyses or publications that already exist, because de-identified contributions cannot be traced back and removed.

You will not receive payment for research use of de-identified data, or for any product or discovery that results from it.

8. How we share information

We share information in these situations, and no others.

Our service providers, who may only use it to do work for us under written contract, and may not use it for their own purposes. They fall into these categories:

What they do	What they receive
Cloud hosting and storage	Whatever is needed to run the Service and store your data
Database and authentication	Account records, your dog’s profile, results, and documents
Laboratories	Your dog’s sample and the details needed to process it
Shipping and courier partners	Your name and address, and the sample in transit
Payment processing	Your billing details and payment method
AI providers	The context needed to answer your question — see Section 6
Email delivery	Your email address and the message we are sending
Push notification delivery	Your device token and the notification
Product analytics and error monitoring	Usage events, device and diagnostic data
Advertising and tag management	Online identifiers and website activity — see Section 4

We name the providers you deal with or can see for yourself: Stripe handles payments, Mixpanel receives the product-analytics and session-replay data described in Section 4, and Meta, TikTok and Google receive the advertising and measurement data described there. For the rest we describe the category rather than the vendor, since the list changes as our infrastructure does — but the contractual limits above apply to every one of them, and we will tell you the specific provider for any category if you ask.

Veterinary professionals involved in your dog’s care — the Omi veterinarians and veterinary technicians who collect samples, and our veterinary team when a result needs a clinical eye.

Your own veterinarian, when you ask us to. You control this: you decide whether to authorize a records request, and whether to pass a report on to your vet yourself.

Anyone you choose to send a report to. Once you download or forward a report, what happens to it is outside our control.

Advertising and analytics platforms, as described in Section 4. These platforms receive online identifiers and activity data — never your dog’s test results, never your dog’s veterinary records, and never the contents of your chats.

Legal and safety. We disclose information when we are legally required to, and where we believe in good faith it is necessary to investigate suspected fraud, protect the rights, property, or safety of a person or an animal, or establish or defend a legal claim.

Corporate transactions. See Section 17.

9. We do not sell your information

We do not sell personal information for money. We do not sell, rent, or license your dog’s test results, epigenetic data, biomarker values, veterinary records, photographs, or chat content to anyone, for any price, in identifiable form.

We do share online identifiers for advertising. As Section 4 explains, our website’s Meta and TikTok pixels share online identifiers and browsing activity with those platforms for targeted advertising. Some state privacy laws define both “sale” and “share” broadly enough to include this even without payment, so we disclose it plainly and give you a way to switch it off, in Section 12.

We do not knowingly sell or share the personal information of anyone under 16.

10. What happens to your dog’s sample

Saliva swabs. Where the swab is taken at your blood draw, our staff collect it at that appointment and return it to our laboratory partner under the same chain of custody as the blood. Where we send you a kit instead, you collect the swab at home and post it to our laboratory partner in the prepaid packaging provided.

Blood samples. Every blood draw is performed by an Omi veterinarian or veterinary technician, either at your home or at one of our partner facilities, and transported to the laboratory under our chain of custody.

After processing. Samples are destroyed once they are no longer needed for the testing you asked for. Our laboratory holds a sample only long enough that a failed or ambiguous assay can be re-run without asking you to collect again.

Ask us to destroy sooner. Email us and we will instruct the laboratory to destroy your dog’s sample. Once destroyed, a sample cannot be re-run — results already produced from it stay in your account unless you also ask us to delete those.

Genetic material is never sold. We do not sell, transfer, or license physical samples or raw genetic data to third parties, including pharmaceutical companies, insurers, and data brokers.

11. How long we keep information

We keep information for as long as we need it for the purpose we collected it, and then delete it. In practice that means:

Information	How long we keep it
Physical samples	Until the testing you asked for is complete
Account, dog profile, results, records, and chats	While your account is open, and for a short period after you ask us to close it
Backups containing deleted data	Until they age out of our normal backup rotation
Payment and transaction records	As long as tax and accounting law requires
Waitlist signups	Until you unsubscribe or ask us to remove you
Marketing suppression list (people who opted out)	Indefinitely, so we can keep honouring your opt-out
Analytics, advertising identifiers, and diagnostic logs	For a limited period set in each tool, then deleted or aggregated
Records needed for a legal claim, dispute, or legal hold	Until the matter is resolved
De-identified research data	Indefinitely, because it is no longer linked to you or your dog

Ask us at any time to delete something sooner, and see Section 13 for your deletion rights.

12. Your choices

One address handles all of this: hello@omihealth.com. We are a small team and we would rather you reach a person than hunt for a toggle. Email us and we will action the request and confirm when it is done.

Marketing email. Unsubscribe from any marketing email, or email us. We will still send transactional messages — results, appointments, billing, security, and policy changes — because they are part of the Service.

Push notifications. Turn them off in the app or in your phone’s settings.

Advertising. Turn on Global Privacy Control in your browser, or email us with the subject “Do Not Sell or Share”. You can also opt out at the platforms directly through Meta’s and TikTok’s ad settings, and limit tracking in iOS under Settings → Privacy & Security → Tracking.

Research use. Email us and we will opt your dog’s data out. Nothing about your membership changes.

Your dog’s sample. Ask us to destroy it early, as described in Section 10.

Veterinary records. Withdraw a records authorization at any time by emailing us. Withdrawal stops future requests; it cannot recall records a practice has already sent us, though you can ask us to delete those.

Your data. Access, correct, export, or delete it — see Section 13.

13. Your privacy rights

Twenty US states now give residents statutory privacy rights, and more take effect over the next two years. We extend all of the following rights to every Omi customer, in every state, rather than making you check whether your legislature has got round to it:

• Know and access — what we hold about you and your dog, the categories we collect, why, and who we share it with.
• Correct inaccurate information.
• Delete your information, subject to the narrow exceptions below.
• Take it with you — ask us and we will send you a portable copy of your data and your dog’s results in a machine-readable format.
• Opt out of targeted advertising, of “sale” or “sharing” as those laws define them, and of profiling that produces legal or similarly significant effects. We do not carry out that kind of profiling.
• Withdraw consent you have given, including for research use and veterinary records.
• Be free from retaliation. We will not deny you service, charge you more, or give you a lower standard of service for exercising any of these rights.

How to exercise them. Email hello@omihealth.com. That is our designated method, and a person reads it. We will verify your identity by confirming control of the email address on the account, and may ask for more where a request is sensitive or high-risk. An authorized agent may act for you with written permission and verification.

How long we take. We acknowledge within 10 business days and respond within 45 days. If a request is complex we may take a further 45 days, and we will tell you why before we do.

If we say no, we will explain why, and you may appeal by replying to our decision. We will decide the appeal within 45 days and, if we still refuse, tell you how to complain to your state Attorney General.

When we may keep data despite a deletion request — where we need it to complete a transaction you asked for, comply with a legal obligation such as tax record-keeping, detect and prevent fraud or security incidents, or establish or defend a legal claim. We will delete everything else and tell you what we kept and why.

14. How we protect information

We use safeguards appropriate to the sensitivity of what we hold: encryption of your data in transit and at rest, access controls that stop one account from reaching another’s data, internal access limited to staff who need it for their work, and written data-protection terms with the providers who process data for us.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information, we will notify you and the regulators who require it, within the deadlines the law sets.

15. Children

The Service is for adults. You must be at least 18 to create an account, buy a membership, or join the waitlist. We do not knowingly collect personal information from anyone under 13, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has given us information, email hello@omihealth.com and we will delete it.

16. Where your information is stored

Omi is a US company and the Service is offered only in the United States. Your information is stored and processed on servers in the United States, and our service providers may process it in the United States and, for limited support and infrastructure functions, elsewhere under contractual protections. If you access the Service from outside the US, you are sending your information to the US, where privacy law differs from your home country’s.

17. If we are acquired, merge, or wind down

If Omi is acquired, merges, reorganizes, sells a business line, or enters bankruptcy or insolvency proceedings, customer information may be among the assets transferred. This policy continues to apply to your information until you are told otherwise.

If your information would become subject to a materially different privacy policy as a result, we will give you notice before that happens, so that you can delete your data or ask us to destroy your dog’s sample first if you would rather not continue.

18. Changes to this policy

We update this policy when the Service or the law changes. When we do, we change the “last updated” date at the top and keep the previous version available on request.

If a change is material — a new category of sharing, a new purpose for your dog’s data, a reduction in your rights — we will tell you before it takes effect, by email or in the app. Where a change requires your consent under applicable law, we will ask for it rather than assume it.

19. Contact us

Everything — privacy questions, rights requests, and general support: hello@omihealth.com

By post: Omi Health Inc., 55 Water Street, Brooklyn, NY 11201

If you are not satisfied with how we have handled a privacy matter, you may complain to your state Attorney General. California residents may also contact the California Privacy Protection Agency.

Appendix A — California disclosures

This appendix supplements the policy for California residents, under the CCPA as amended by the CPRA.

Categories of personal information

In the past 12 months we have collected the following categories, from the sources in Section 3, for the purposes in Section 5, and disclosed them to the categories of recipient in Section 8.

Statutory category	Do we collect it?	Disclosed for a business purpose	Sold	Shared for cross-context behavioural advertising
Identifiers (name, email, phone, address, IP, account and device IDs)	Yes	Yes	No	Yes — online identifiers only
Customer records (Cal. Civ. Code § 1798.80: name, address, phone, payment information)	Yes	Yes	No	No
Protected classifications	No	—	—	—
Commercial information (purchases, membership history)	Yes	Yes	No	No
Internet or network activity (pages viewed, app usage, referring URLs)	Yes	Yes	No	Yes
Geolocation	Coarse only, from IP and service address	Yes	No	No
Sensory data (photographs and documents you upload)	Yes	Yes	No	No
Professional or employment information	No	—	—	—
Education information	No	—	—	—
Inferences (preferences and product recommendations)	Yes	Yes	No	No
Sensitive personal information	See below	—	No	No

Sensitive personal information

The CCPA’s “sensitive personal information” category covers things like a consumer’s precise geolocation, racial or ethnic origin, contents of certain communications, and a consumer’s genetic data — meaning data from your biological sample. Your dog’s genetic and epigenetic data is not your genetic data, and is therefore not sensitive personal information under the CCPA. We nonetheless apply the protections in this policy to it, and we do not use it to infer characteristics about you.

We collect your account credentials, which are sensitive personal information. We use them only to authenticate you and secure your account — a use that does not trigger the right to limit under § 1798.121 — and we do not use or disclose sensitive personal information for any purpose other than those permitted by § 7027(m) of the CCPA regulations.

Notice of financial incentive — the referral program

Our referral program offers benefits, including early access and Founding Member status, in exchange for your participation. Because it gives you something of value in connection with the collection of personal information, the CCPA treats it as a financial incentive.

• What we collect: your email address and referral code, and the email addresses and codes of people who join through your link.
• How to join: sign up on our site and share your link. How to withdraw: email hello@omihealth.com and we will remove you and your code.
• The value of your data. We have estimated it, in good faith, as the cost we would otherwise pay to acquire a comparable signup through paid advertising. The benefit we offer is reasonably related to that value.
• Participation is entirely voluntary, and declining costs you nothing.

Shine the Light

California’s “Shine the Light” law (Cal. Civ. Code § 1798.83) lets residents request details of personal information disclosed to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

Requests

Because Omi operates exclusively online and deals with you directly, our designated method for submitting requests is email: hello@omihealth.com. We honour Global Privacy Control as a valid opt-out request, as described in Section 4.