Privacy policy

1. Introduction

KARM Wellness Group LLC, a Texas limited liability company doing business as Sunshine Herbs Health Store ("Sunshine Herbs", "we", "us" and "our"), operates sunshineherbs.com, our store at 1205 N. Saginaw Blvd., Suite H, Saginaw, Texas 76179, and the related content, features, tools, products and services (together, the "Services"). Our online store is powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy describes how we collect, use and disclose your personal information when you visit or use the Services, make a purchase in our store or online, use our shopping assistant, or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing and disclosure of your personal information.

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read it and understand how we collect, use and disclose your information as described here.

We are a retail store, not a healthcare provider. We are not a "covered entity" under HIPAA, and HIPAA does not apply to the information you share with us. This Privacy Policy, including section 4, governs that information instead.

2. Personal information we collect

When we use the term "personal information", we mean information that identifies or can reasonably be linked to you or another person. It does not include information collected anonymously or de-identified so that it cannot be linked to you. Depending on how you interact with us, where you live, and as permitted or required by law, we may collect or process the following categories of personal information, including inferences drawn from it:

Contact details, including your name, billing address, shipping address, phone number and email address.
Payment information. Payments are processed by our payment processors, such as Shopify Payments [and PayPal; confirm which processors you use]. We receive confirmation that a payment was made, the payment method type, the last four digits of a card, and transaction details. We do not see or store your full card number.
Account information, including your username, password, preferences and settings.
Transaction information, including the items you view, put in your cart, add to a wishlist, buy, return, exchange or cancel, and your past purchases online and in our store. In the store, we collect your name, email address or phone number only if you give it to us, for example for an emailed receipt, a return or a special order.
Communications with us, including what you include in emails, phone calls, text messages, contact forms, product reviews and conversations with our shopping assistant.
Shopping assistant conversations. The messages you type to our shopping assistant and the products it shows you. See section 5.
Device and usage information, including your device, browser and network connection, your IP address and other unique identifiers, and how and when you interact with the Services, collected through cookies and similar technologies. See section 8.
Age verification. For age-restricted products sold in our store, we look at your government-issued photo ID to confirm your age. We do not scan, copy or keep it. [Confirm this matches how your staff check ID.]

We do not ask for information about your health. If you choose to share it, section 4 explains how we handle it.

3. Where we get it

We may collect personal information from the following sources:

Directly from you, including when you create an account, place an order online or in our store, use the shopping assistant, communicate with us, or otherwise provide it to us.
Automatically through the Services, including from your device when you visit our website, through cookies and similar technologies.
From our service providers, including Shopify, our payment processors, shipping carriers and fraud prevention services, when they collect or process personal information on our behalf.
From our partners or other third parties, such as a shipping carrier that updates a delivery address.

4. Information about your health (Consumer Health Data Privacy Policy)

This section is our consumer health data privacy policy. It applies to every customer, and it also serves as the notice required by consumer health data laws in states such as Washington and Nevada.

What we mean by health information. Information that identifies you and relates to your past, present or future physical or mental health, such as a condition, symptom, pregnancy, medication, allergy or wellness goal you tell us about. It can also include a purchase or question that reveals a health interest, such as buying a product for blood pressure.

What we collect and where it comes from. We do not ask for information about your health. You may choose to share it with us: by telling an associate in the store or on the phone what you are shopping for, by typing it into the shopping assistant, by asking a question by email or text, or by posting a review. Your purchase history may also reveal a health interest. We collect health information only from you.

How we use it. Only to help you find and buy products, answer your questions, process your orders, returns and special orders, provide customer service, run and improve the shopping assistant, and comply with the law. Where practical, we improve the assistant using conversations that have been de-identified or aggregated.

What we do not do. We do not sell information about your health. We do not use it for targeted advertising or share it with advertising partners. We do not use it to make automated decisions that have legal or similarly significant effects on you. We do not collect it from third parties, and we do not use geofencing around healthcare facilities.

Who we share it with. Service providers that store or process it for us under contracts that restrict their use of it: Shopify (our store platform), the artificial intelligence provider that powers our shopping assistant (section 5), and our email and messaging providers. We have no affiliates with whom we share health information. We may also disclose it when the law requires, or with your consent.

Consent. By sharing health information with us in one of the ways described above, you consent to our collecting and using it for the purposes in this section. You can withdraw that consent at any time by contacting us (section 16), and we will stop using it for anything other than completing an order you have already placed and complying with the law.

Your rights. Wherever you live, you may ask us to confirm whether we hold health information about you, to give you access to it, to tell you who we have shared it with, to delete it, or to stop using it. Contact us using the details in section 16. We will respond within the time the law requires, and in any case within 45 days where practical. If we decline a request, we will tell you why, and you may appeal by replying to our response. See section 13.

Please share only what you need to. Never give us medical records, prescriptions, test results, insurance details or government ID numbers. An associate or the assistant can help you find a product without them.

5. Our shopping assistant and artificial intelligence

What it is. Our website may offer an automated shopping assistant that answers questions and suggests products we carry. It is software powered by artificial intelligence, not a person and not a healthcare professional. Our Terms of Service explain its limits. You must be 18 or older to use it.

What we collect. The messages you type, the products and answers it shows you, the date and time, device and usage information, and your account or contact details if you are logged in or provide them. Your messages may include health goals you choose to share; section 4 applies to that information.

How it is processed. To generate a response, your messages are sent to [our artificial intelligence provider, currently Anthropic, through our chat application vendor, (name)]. These providers process your conversations only to provide the service to us, under contracts that restrict their use of your information. [Confirm with each vendor's terms: our providers do not use your conversations to train their own models.] We may also review conversations ourselves to improve the assistant's answers, resolve a complaint, or investigate misuse.

Recording. By using the assistant, you consent to our recording, storing and processing your conversation as described in this section. If you do not want your conversation recorded, please call or visit us instead.

How long we keep it. We keep conversations for [12 months], then delete or de-identify them, unless we need to keep a conversation longer to resolve a dispute or comply with the law.

Your choices. You may ask us to delete your conversations by contacting us (section 16). If you were not logged in when you used the assistant, we may not be able to identify which conversations are yours.

No automated decisions. The assistant suggests products. It does not approve or deny anything, set prices, or make decisions that have legal or similarly significant effects on you.

6. How we use personal information

Depending on how you interact with us or which of the Services you use, we may use personal information for the following purposes:

Provide, tailor and improve the Services. To perform our contract with you, process your payments, fulfill your orders, arrange shipping and pickup, process returns and exchanges, remember your preferences and the items you are interested in, send you notifications about your account and orders, create and manage your account, enable you to post reviews, run the shopping assistant, and create a customized shopping experience, such as recommending products related to your purchases.
Marketing and advertising. To send marketing and promotional communications by email, text message or postal mail if you have opted in, and to show you advertisements for our products on the Services and other websites, including based on items you have viewed, bought or added to your cart. We never use information about your health for marketing or advertising (section 4).
Security and fraud prevention. To authenticate your account, provide a secure payment and shopping experience, and detect, investigate and act on possible fraudulent, illegal, unsafe or malicious activity. If you register an account, you are responsible for keeping your credentials safe, and we recommend that you do not share them with anyone.
Communicating with you. To provide customer support, respond to you, and maintain our business relationship with you.
Legal reasons. To comply with applicable law, including age-restriction and product safety laws, respond to valid legal process, notify you of a product recall, investigate or participate in litigation, and enforce our terms and policies.

7. How we disclose personal information

We may disclose your personal information to third parties for legitimate purposes, subject to this Privacy Policy, including:

With Shopify, vendors and other service providers that perform services on our behalf, such as IT and store hosting, payment processing, shipping and fulfillment, email and text messaging, data analytics, customer support, cloud storage, and the artificial intelligence provider that powers our shopping assistant (section 5). They may use your information only to provide services to us.
With business and marketing partners to provide marketing services and advertise to you. For example, we use Shopify to support personalized advertising with third-party services based on your online activity with different merchants and websites. These partners use your information under their own privacy notices. Depending on where you live, you may have the right to direct us not to share information about you for targeted advertising. You can exercise that right here and in section 13. Information about your health is never shared with these partners.
When you direct or consent to it, such as to ship you products, or through social media widgets or login integrations.
In connection with a business transaction such as a sale of the business, a merger or a bankruptcy; to comply with legal obligations, including subpoenas, search warrants and similar requests; to enforce our terms and policies; and to protect or defend the Services, our rights, and the rights of our customers or others.

We do not sell your personal information for money. Some state laws treat sharing data for targeted advertising as a "sale" or "share"; section 13 explains how to opt out. We will not sell sensitive personal information, including information about your health, without your consent.

Relationship with Shopify. The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve them for you. Information you submit to the Services will be transmitted to and shared with Shopify, as well as third parties that may be located in countries other than where you reside, in order to provide and improve the Services for you. In addition, to help protect, grow and improve our business, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our store, along with other merchants and with Shopify. To provide these enhanced features, Shopify may make use of personal information collected about your interactions with our store, along with other merchants, and with Shopify. In these circumstances, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights over use of your personal information for these purposes. To learn more about how Shopify uses your personal information and any rights you may have, you can visit the Shopify Consumer Privacy Policy. Depending on where you live, you may exercise certain rights with respect to your personal information through the Shopify Privacy Portal.

8. Cookies, analytics and advertising

Like most online stores, we use cookies and similar technologies, such as pixels and local storage, on our website. Some are necessary to run the store, such as keeping items in your cart, keeping you logged in, and preventing fraud. Others help us understand how the site is used and measure our marketing, including analytics and advertising tools provided by Shopify [and Google Analytics, Meta Pixel; list the tools you actually use, or delete the bracket]. Advertising cookies may be used to show you our ads on other websites based on your activity on ours.

You can control cookies through your browser settings, although blocking necessary cookies may stop parts of the site from working. You can opt out of our sharing of information for targeted advertising on our Your Privacy Choices page. If you visit our website with the Global Privacy Control opt-out preference signal enabled, depending on where you live, we will treat it as a request to opt out for the device and browser you are using, and we will apply it to your account if we can associate the device with one. We do not recognize other "Do Not Track" signals. Information about your health is never used for advertising, whatever your cookie settings.

9. Marketing emails and text messages

We send marketing emails only to customers who have opted in, and you can unsubscribe at any time using the link in any marketing email. We send marketing text messages only if you opt in at checkout or by text, and you can stop them at any time by replying STOP. Message and data rates may apply. If you opt out, we will still send you non-promotional messages about your account and orders, such as order confirmations, shipping and pickup notices, and recall notices.

10. Third-party websites and links

The Services may link to websites or platforms operated by third parties, including our Nature's Sunshine affiliate storefront at shop.sunshineherbs.com, which is operated by Nature's Sunshine Products and fulfills its own orders. Information you provide on that storefront is collected under Nature's Sunshine's privacy policy, not ours. [Confirm what, if anything, you receive back from Nature's Sunshine about those orders, such as commission reports, and whether they identify customers.]

If you follow links to sites we do not control, review their privacy and security policies and their terms. We are not responsible for the privacy or security of those sites, or for the accuracy or reliability of what you find there. Information you post on public or semi-public venues, including social media, may be viewed and used by others without limitation. A link is not an endorsement.

11. Children's data

The Services are intended for adults. You must be 18 or older to place an order or use the shopping assistant. We do not knowingly collect personal information from children under 13, and we do not knowingly collect personal information from anyone under the age of majority in their jurisdiction. If you are the parent or guardian of a child who has provided us with personal information, contact us using the details in section 16 and we will delete it. As of the date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell" (as those terms are defined in applicable law) the personal information of anyone under 16.

12. Security, retention and international transfers

We use reasonable administrative, technical and physical safeguards to protect your personal information, including the security features of Shopify and our payment processors. Payment card numbers are handled by our payment processors and are not stored by us. No security measures are perfect or impenetrable, and we cannot guarantee security. Information you send to us may not be secure while in transit, so please do not use unsecured channels to send us sensitive or confidential information.

How long we keep your personal information depends on why we have it. We keep order, payment and tax records for as long as accounting and tax rules require. We keep account information while your account is open. We keep shopping assistant conversations as described in section 5. We keep other information only as long as we need it to provide the Services, comply with legal obligations, resolve disputes and enforce our policies, and then we delete or de-identify it.

We serve customers in the United States. Our service providers, including Shopify and our artificial intelligence provider, may store or process personal information in other countries, with safeguards required by applicable law.

13. Your rights and choices

Depending on where you live, you may have some or all of the rights below. We honor these requests from customers in every state, whether or not a state law requires us to. These rights are not absolute, may apply only in certain circumstances, and in some cases we may decline a request as permitted by law.

Right to access and know. To request access to the personal information we hold about you and to know how we use and disclose it.
Right to delete. To request that we delete personal information we hold about you.
Right to correct. To request that we correct inaccurate personal information.
Right of portability. To receive a copy of the personal information you gave us in a usable format, and in some cases to have it sent to a third party.
Right to opt out of sale, sharing and targeted advertising. To opt out of the "sale" or "sharing" of your personal information, or its use for targeted advertising, as those terms are defined in state privacy laws. You can do this on our Your Privacy Choices page, or through the Global Privacy Control signal described in section 8.
Health information rights. The additional rights described in section 4, including withdrawing consent.
Communication preferences. To unsubscribe from marketing emails or texts as described in section 9.

To exercise these rights, use the options shown on the Services or contact us using the details in section 16. We may need to verify your identity before acting on a request, as permitted or required by law. You may designate an authorized agent to make a request for you; we will require proof that you authorized the agent, and we may still need to verify your identity with you directly. We will not discriminate against you for exercising any of these rights. We will respond within the time the law requires, and in any case within 45 days where practical. To learn more about how Shopify uses your personal information and the rights you may have over data Shopify processes, visit the Shopify Privacy Portal.

14. Complaints and appeals

If you have a complaint about how we handle your personal information, contact us using the details in section 16. If we decline a request you have made, you may appeal by replying to our response within 60 days; we will review the appeal and respond in writing with the reasons for our decision. Depending on where you live, you may also lodge a complaint with your state attorney general or data protection authority.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes in our practices or for operational, legal or regulatory reasons. We will post the revised policy on this website, update the "Last updated" date at the top, and provide any additional notice the law requires. If we want to use the health information you have already given us for a materially different purpose, we will ask for your consent first.