PRIVACY POLICY

Beyond One-Size-Fits-All

Effective date: 19 July 2026

1. Who We Are

This Privacy Policy explains how personal data is processed in connection with the Beyond One-Size-Fits-All website and the purchase and use of the Methylation Patterns Atlas.

The data controller is:

Elene Gordeeva, operating the Beyond One-Size-Fits-All project in Portugal

Contact email:
support@beyondonesize.health

2. Scope of This Policy

This Policy applies to personal data processed when you:

• visit the Beyond One-Size-Fits-All website;
• purchase the Methylation Patterns Atlas;
• create or use a Members Area account;
• contact us regarding your purchase or access;
• use functions made available within the Atlas.

A separate newsletter subscription through Substack is not part of the Atlas purchase and is addressed separately in Section 7 below.

3. Personal Data We Collect

Depending on how you interact with the website, we may process:

• your name, where provided;
• your email address;
• billing information where required for the transaction;
• the product purchased, price, date, payment status and order status;
• Members Area account and access information;
• messages sent to customer support;
• technical information required for website security and operation, such as IP address, browser type, device information and access logs;
• text voluntarily entered into interactive functions of the Atlas.

Payment card information is processed through Stripe. You should not send card information directly to us by email or through customer support.

4. How We Use Your Data

Personal data associated with an Atlas purchase is used only to:

• process and confirm the purchase;
• create and manage access to the Members Area;
• provide the purchased three-month access period;
• send access instructions, password-related messages and essential account communications;
• notify you about matters directly affecting your purchased access;
• respond to support requests;
• maintain the security and proper functioning of the website and Members Area;
• prevent misuse, fraud or unauthorised access;
• comply with accounting, tax, consumer-protection and other legal obligations;
• establish, exercise or defend legal claims where necessary.

5. Legal Bases for Processing

We process personal data on the following legal bases:

Performance of a contract

Processing is necessary to complete your purchase, create your account and provide access to the Methylation Patterns Atlas.

Compliance with legal obligations

Certain order, payment and accounting records may need to be retained to comply with applicable tax, accounting and consumer-protection requirements.

Legitimate interests

We may process limited personal data where necessary to:

• maintain website and account security;
• prevent fraud and abuse;
• respond to support requests;
• document transactions and resolve disputes;
• protect our legal rights.

Consent

Consent is used only where it is specifically requested, such as for optional cookies or a separate newsletter subscription. Purchasing the Atlas does not constitute consent to receive marketing communications.

6. Transactional Emails

The email address provided when purchasing the Atlas will be used only for communications directly connected with:

• order confirmation;
• payment or access issues;
• account creation and login;
• the active access period;
• security or essential service information;
• customer support.

Atlas customer email addresses are not used for advertising, promotional campaigns or unrelated product marketing.

We do not sell personal data.

7. Separate Substack Newsletter

Purchasing the Methylation Patterns Atlas does not subscribe you to a Beyond One-Size-Fits-All newsletter.

Email addresses collected through the Atlas checkout or Members Area are not added to Substack and are not transferred to a Substack mailing list for marketing purposes.

A person will receive a newsletter only if they separately choose to subscribe through a Substack subscription form.

The Substack subscription is a separate processing activity and is subject to the privacy information presented during that subscription and to Substack’s applicable privacy terms.

Unsubscribing from a Substack newsletter does not affect Atlas access.

Similarly, purchasing the Atlas does not create a Substack subscription.

8. Service Providers and Recipients

We use service providers where necessary to operate the website, process payments and provide access.

These may include:

• Tilda Publishing, for website hosting, checkout forms, order processing and the Members Area;
• Stripe, for secure payment processing;
• our email service provider, for transactional and support communications;
• Google services, where used for internal order administration;
• hosting and technical service providers used to operate website or Atlas functions;
• professional advisers, accountants or public authorities where disclosure is legally required.

These providers receive only the information necessary to perform their respective services and process data under their own contractual and legal obligations.
Tilda’s data-processing documentation expressly covers data collected through forms, online stores, shopping carts and personal accounts, including names, email addresses and order information. Stripe separately processes payment and transaction data.

9. Data Retention

Members Area account data and the operational copy of your email address are retained while your Atlas access is active and for as long as reasonably necessary to resolve any related access or support issue.

After the access period ends, the account may be deactivated and personal data that is no longer required will be deleted or anonymised.

Some information may need to be retained for a longer period, including:

• order and payment records;
• invoices and accounting documentation;
• records required for tax or consumer-protection purposes;
• information required to manage refunds, chargebacks or disputes;
• information required to establish, exercise or defend legal claims.

Such records are retained only for the period required by applicable legal obligations or limitation periods.

Support correspondence is deleted when the matter has been resolved and the correspondence is no longer reasonably required, unless continued retention is necessary for a legal obligation or dispute.

10. International Data Transfers

Some service providers may process personal data outside Portugal or outside the European Economic Area.

Where applicable, such processing must be supported by a lawful transfer mechanism, such as:

• a European Commission adequacy decision;
• Standard Contractual Clauses;
• another safeguard recognised under applicable data-protection law.

11. Cookies and Technical Data

The website may use cookies or similar technologies that are necessary for:

• checkout operation;
• Members Area login;
• account security;
• session management;
• fraud prevention;
• essential website functionality.

Optional analytics or marketing technologies will be used only where the required notice and consent mechanism have been provided.

12. Health, Genetic and Other Sensitive Data

The checkout and customer-support channels are not intended for the collection of genetic reports, laboratory results, medical records or other identifiable health information.

Please do not submit:

• genetic data;
• laboratory reports;
• medical records;
• full names together with health information;
• other special-category personal data

through the checkout form, ordinary email or interactive Atlas functions.

Where using an interactive tool, questions should be phrased without names or other information that could identify a particular person.

13. Data SecurityReasonable technical and organisational measures are used to protect personal data against unauthorised access, alteration, disclosure, loss or misuse.
However, no online system or electronic transmission method can be guaranteed to be completely secure.

14. Your Data-Protection Rights

Subject to applicable law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate data;
• request deletion of data;
• request restriction of processing;
• object to certain processing;
• receive eligible data in a portable format;
• withdraw consent where processing is based on consent.

A request may be sent to:
support@beyondonesize.health

We may need to verify your identity before completing a request.

Some data cannot be deleted immediately where retention is required by law or necessary for an unresolved transaction, dispute or legal claim.

CNPD confirms that these rights are exercised directly with the controller, normally through the contact channel identified in the privacy policy.

15. Right to Complain

You have the right to submit a complaint to the Portuguese supervisory authority:
Comissão Nacional de Proteção de Dados CNPD

You may also contact the data-protection authority in the EU or EEA country where you live or work, where applicable.

16. Changes to This Policy

This Policy may be updated where necessary to reflect changes in:

• website functionality;
• service providers;
• legal requirements;
• data-processing practices.

The current version and effective date will always be published on this page.

17. Contact

For questions about this Privacy Policy or the processing of personal data, contact:
support@beyondonesize.health