Effective date: July 11, 2026
Last updated: July 11, 2026
1. Purpose and Scope
This Consumer Health Data Privacy Policy explains how POPA MARIA-SUSANA, trading as Keto Reset by Shine™ (“Keto Reset by Shine,” “we,” “us,” or “our”), collects, uses, processes, discloses, stores, and protects consumer health data.
This Policy applies when you:
Visit ketoshine.com
Purchase or access the Keto Reset Guide
Enroll in a Kickstart, Super, or Extra coaching program
Join Shine Monthly
Participate voluntarily in a corporate wellness program
Complete an intake form, questionnaire, check-in, progress form, or survey
Communicate with us through email, WhatsApp, Telegram, Zoom, website forms, or another approved channel
Otherwise provide health-related information to us
This Policy is intended to comply with applicable consumer health privacy laws, including the Washington My Health My Data Act.
It supplements our general Privacy Policy. Our general Privacy Policy applies to personal information that is not consumer health data.
2. Business Information
The business responsible for the consumer health data described in this Policy is:
POPA MARIA-SUSANA
Trading as Keto Reset by Shine™
Registered office:
Str. Virgil Madgearu, Nr. 25-27
Bl. Corp B, Et. 1, Ap. 215
Sector 1, Bucharest, Romania
Romanian Tax Identification Number — CUI: 54000506
Trade Register Number: F2026008899
Email: shine@ketoshine.com
Phone: +40 724 987 956
3. What Is Consumer Health Data?
For the purposes of this Policy, “consumer health data” means personal information that is linked or reasonably linkable to an individual and that identifies or may be used to infer that individual’s past, present, or future physical or mental health status.
Consumer health data may include information provided directly by you, information generated through your participation in our services, and health-related inferences derived from your program selection or communications with us.
4. Categories of Consumer Health Data We Collect
Depending on the service you request and the information you voluntarily provide, we may collect the following categories of consumer health data.
4.1 Body Measurements and Weight Information
This may include:
Current weight
Starting weight
Weight history
Weight-loss or weight-management goals
Height
Body measurements
Changes in weight or measurements
Progress photographs, if voluntarily provided
Other body-related progress information
We use this information to provide the educational program or coaching service you requested, understand your stated goals, monitor progress you choose to report, and adapt general educational guidance.
4.2 Health Conditions and Diagnoses
This may include information about:
Polycystic ovary syndrome — PCOS
Hashimoto’s thyroiditis
Insulin resistance
Diabetes or blood-sugar concerns
Perimenopause or menopause
Thyroid conditions
Hormonal concerns
Digestive conditions
Allergies
Food intolerances
Other diagnosed or suspected health conditions that you voluntarily disclose
We use this information to understand whether our educational wellness services may be inappropriate without medical clearance, to identify topics that require referral to a licensed healthcare professional, and to avoid providing general educational suggestions that conflict with information you have shared.
We do not diagnose health conditions.
4.3 Medication and Supplement Information
This may include:
Prescription medications
Non-prescription medications
Diabetes medications
Thyroid medications
Weight-management medications
Supplements
Medication-related dietary restrictions
Information about changes directed by your licensed healthcare provider
We use this information for safety screening, to remind you that medication changes must be handled by a licensed physician, and to determine when medical clearance should be requested before participation.
We do not direct you to start, stop, increase, decrease, or replace any medication.
4.4 Reproductive and Menstrual Health Information
This may include:
Menstrual-cycle information
Cycle regularity
Menstrual symptoms
PCOS-related reproductive information
Perimenopause or menopause information
Pregnancy status
Pregnancy plans
Breastfeeding or lactation status
Fertility-related information that you voluntarily provide
We use this information only to determine whether participation requires medical clearance, whether a service may be inappropriate, and whether general educational content should be limited.
Our programs are not intended to diagnose, treat, or manage reproductive health conditions.
4.5 Symptoms, Bodily Functions, and Wellness Information
This may include:
Hunger or appetite information
Energy levels
Sleep information
Digestive symptoms
Menstrual symptoms
Headaches
Dizziness
Hydration information
Bowel habits
Reactions to foods
Perceived stress
Other symptoms or bodily functions you voluntarily report
We use this information to provide the requested educational service, identify situations in which you should contact a healthcare provider, and respond to questions within the limits of our non-medical role.
4.6 Dietary, Lifestyle, and Behavioral Information
This may include:
Eating patterns
Dietary history
Ketogenic-diet experience
Food preferences
Food restrictions
Fasting practices
Meal timing
Exercise habits
Sleep habits
Alcohol use
Smoking status
Lifestyle routines
Wellness goals
Adherence and check-in information
We use this information to provide educational materials, support the program you selected, answer questions, and personalize general wellness coaching within the limits described in our Medical and Results Disclaimer.
4.7 Eating-Disorder and Safety-Screening Information
This may include information about:
A current or previous eating disorder
Disordered eating
Extreme dietary restriction
Underweight status
Pregnancy or breastfeeding
Medicated diabetes
Medical conditions that may make fasting or ketogenic eating inappropriate
Other safety-related circumstances
We use this information to determine whether participation should be refused, suspended, limited, or made conditional on written medical clearance.
4.8 Program Participation and Progress Information
This may include:
Program selected
Program start and completion dates
Check-in responses
Coaching questions
Goals
Reported adherence
Reported challenges
Session attendance
Educational resources accessed
Progress voluntarily reported by you
Notes created while providing the requested service
We use this information to administer and deliver the program, respond to you, manage appointments, document the service provided, and maintain continuity during your support period.
4.9 Communications Containing Health Information
Consumer health data may be contained in:
Emails
Website forms
Intake questionnaires
WhatsApp messages
Telegram messages
Zoom conversations
Coaching check-ins
Customer-support communications
Documents or images you voluntarily submit
Please do not send complete medical records, laboratory files, identity documents, or other unnecessary sensitive documents through ordinary email, WhatsApp, Telegram, or general website forms.
These communication channels are not medical-record systems.
4.10 Health-Related Inferences
In limited circumstances, we may infer that you are interested in ketogenic nutrition, weight management, hormonal wellness, or another wellness topic from:
The product or program you purchase
The form you complete
The questions you ask
The information you voluntarily provide during a coaching relationship
We do not infer a medical diagnosis from general website browsing.
We do not use health-related inferences for targeted advertising, advertising audiences, or data brokerage.
5. Purposes for Which Consumer Health Data Is Collected and Used
We collect and use consumer health data for the following specific purposes:
To provide a product or service you requested
To administer the Keto Reset Guide, coaching programs, membership, or corporate wellness participation
To review eligibility and safety considerations
To provide non-medical educational wellness guidance
To adapt general educational content to information you voluntarily provide
To answer coaching and support questions
To conduct program check-ins
To schedule and conduct Zoom sessions
To communicate with you through your selected communication channel
To identify circumstances in which medical clearance may be required
To determine when we must decline, suspend, or limit participation for safety reasons
To manage subscriptions, cancellations, complaints, and service records
To respond to consumer health-data requests
To prevent fraud, unauthorized access, abuse, and security incidents
To comply with applicable legal obligations
To establish, exercise, or defend legal claims
We do not use consumer health data to provide a medical diagnosis, medical treatment, psychotherapy, dietetic treatment, or disease-management service.
We do not use consumer health data for targeted advertising or cross-context behavioral advertising.
6. Sources of Consumer Health Data
We collect consumer health data from the following categories of sources.
6.1 Directly From You
We receive information when you:
Complete an intake form or questionnaire
Purchase or enroll in a program
Submit a check-in
Contact us by email
Communicate through WhatsApp or Telegram
Participate in a Zoom session
Submit a support request
Provide progress information
Send a testimonial, review, document, photograph, or other content
Exercise a privacy right
6.2 From Your Use of Our Services
We may generate limited participation information such as:
Program enrollment
Session attendance
Check-in completion
Communication history
Resource delivery
Subscription status
Program start and end dates
6.3 From Health-Related Inferences
We may derive a limited wellness interest from the program you select or from information you voluntarily provide.
We do not use automated systems to diagnose conditions or make medical decisions.
6.4 From Corporate Wellness Clients
A corporate client may provide limited information needed to confirm that you are eligible to participate in a corporate wellness program, such as:
Your name
Work email address
Eligibility status
Department or participant group, where needed for administration
Corporate clients must not provide us with your diagnosis, medication information, weight, menstrual information, or other individual health information without your knowledge and a valid legal basis.
Health information you choose to provide during a corporate wellness program must be provided directly to us voluntarily.
6.5 From Service Providers Acting at Your Direction
When you choose to use Zoom, WhatsApp, Telegram, or another communication platform, we may receive account identifiers, contact details, messages, or session information through that platform.
6.6 Sources We Do Not Use
We do not purchase consumer health profiles from data brokers.
We do not purchase lists of individuals based on diagnoses, medication use, fertility information, menstrual information, weight, or other health characteristics.
7. Consent for Collection and Use
Where consent is required, we request a clear, affirmative, informed, voluntary, and specific opt-in before collecting or using consumer health data for the stated purpose.
Health-data consent is separate from:
General website terms
Marketing consent
Cookie consent
Recurring-billing consent
Acceptance of the Refund and Cancellation Policy
Consent boxes must not be pre-checked.
You are not required to consent to unnecessary health-data collection in order to purchase a digital guide that does not require you to provide health information.
Where consumer health data is strictly necessary to provide a service you requested, we collect only the information reasonably necessary for that service.
We will not collect new categories of consumer health data or use existing consumer health data for materially different purposes without first updating this Policy and obtaining additional consent where required.
8. Categories of Consumer Health Data We Share
We may disclose only the consumer health data reasonably necessary for the following purposes.
8.1 Website and Program Administration
We may disclose identity, contact, enrollment, form-response, communication, and program-administration information to service providers that host or operate the systems used to deliver the service.
8.2 Payment and Order Processing
Our payment processor may receive:
Your name
Billing information
Transaction information
Product or program purchased
Refund or dispute information
Fraud-prevention information
Our payment processor does not require detailed coaching intake responses, diagnoses, menstrual information, medication information, or progress messages.
8.3 Video Meetings
When you participate in a Zoom session, Zoom may process:
Your name
Email address
Meeting identifiers
Connection information
Audio and video content transmitted during the meeting
Health information you voluntarily communicate during the session
Zoom sessions are not recorded by default.
8.4 WhatsApp and Telegram Communications
When you choose to communicate through WhatsApp or Telegram, the selected platform may process:
Your name or username
Telephone number, where applicable
Profile information
Message content
Files or photographs you send
Communication metadata
Health information you voluntarily include in messages
You may request communication through email instead, although ordinary email is also not a medical-record system.
8.5 Professional Advisers and Security Providers
Limited consumer health data may be disclosed to legal advisers, insurers, IT specialists, cybersecurity specialists, or other professional advisers when reasonably necessary to:
Investigate an incident
Respond to a legal complaint
Protect a consumer
Establish or defend a legal claim
Comply with law
Such recipients are subject to legal, professional, or contractual confidentiality obligations.
8.6 Public Authorities
We may disclose consumer health data where disclosure is required by applicable law, court order, or a valid request from an authority with legal jurisdiction.
We may also use or disclose limited information where reasonably necessary to prevent fraud, investigate unlawful activity, protect system security, or protect the rights and safety of individuals.
9. Processors and Service Providers
The following categories of processors may process consumer health data on our behalf, depending on the services and communication channels you use.
9.1 Wix
Wix.com Ltd. and relevant Wix group entities may process consumer health data in connection with:
Website hosting
Website forms
Customer accounts
CRM functions
Online-store administration
Program enrollment
Member pages
Email automations
Customer communications
Website security
Data storage
9.2 Stripe
Stripe group entities may process limited order, billing, transaction, fraud-prevention, refund, and dispute information where Stripe is the active payment processor.
Stripe is not authorized to receive detailed coaching intake responses or private coaching communications unless technically necessary to resolve a specific payment dispute or legal issue.
9.3 Zoom
Zoom Communications, Inc. and relevant affiliates may process meeting information and content transmitted during a Zoom session.
9.4 WhatsApp
WhatsApp and relevant Meta group entities may process messages and associated metadata when you choose WhatsApp as your communication channel.
9.5 Telegram
Telegram service entities may process messages and associated metadata when you choose Telegram as your communication channel.
9.6 Professional Service Providers
Accountants, lawyers, insurers, IT providers, or security professionals may process limited information where necessary to perform their services.
Processors are permitted to process consumer health data only for the contracted service, in accordance with our instructions and applicable law.
10. Affiliates and Third Parties
We do not currently have affiliated businesses with which we share identifiable consumer health data.
We do not disclose identifiable consumer health data to:
Advertising networks
Data brokers
Social-media advertising audiences
Lead-generation companies
Unrelated wellness businesses
Employers
Insurance companies
Banks
Credit providers
Recruitment providers
If this changes, we will update this Policy and obtain any consent or authorization required before the disclosure occurs.
11. Corporate Wellness Programs
Participation in a corporate wellness program is voluntary.
An employer or sponsoring organization will not receive individually identifiable consumer health data from us.
We do not provide an employer with:
Individual weight
Weight changes
Diagnoses
Symptoms
Medication information
Menstrual-cycle information
Pregnancy information
PCOS information
Hashimoto’s information
Insulin-resistance information
Individual coaching messages
Individual answers to health questionnaires
Individual attendance linked to health outcomes
Individual program results
A corporate client may receive only aggregated and appropriately deidentified engagement information, such as:
Total number of participants
Aggregate attendance
Aggregate resource usage
Aggregate satisfaction information
General program-engagement statistics
We take reasonable measures to prevent aggregated reports from identifying individual participants.
We do not attempt to reidentify deidentified information.
12. Sale of Consumer Health Data
We do not sell consumer health data.
We do not exchange consumer health data for money or other valuable consideration.
We do not condition access to our products or services on authorization to sell consumer health data.
If our practices change, we will not sell consumer health data without first obtaining a separate, valid authorization that satisfies applicable law.
13. Targeted Advertising and Geofencing
We do not use consumer health data for:
Targeted advertising
Cross-context behavioral advertising
Advertising audience creation
Lookalike audiences
Retargeting based on diagnoses, symptoms, weight, medication, menstrual information, reproductive information, or other health information
We do not authorize advertising pixels, session-replay tools, or marketing trackers to collect information entered into:
Health questionnaires
Coaching intake forms
Private coaching pages
Private member areas containing health data
Check-in forms containing health data
Private messages
We do not use geofencing around healthcare facilities to identify, track, collect information from, or advertise to individuals seeking healthcare services.
14. Your Consumer Health Data Rights
Subject to applicable law, you may have the following rights.
14.1 Right to Confirm Processing
You may ask whether we are collecting, using, sharing, or selling consumer health data concerning you.
14.2 Right of Access
You may request access to the consumer health data we maintain about you.
14.3 Right to Recipient Information
You may request a list of the third parties and affiliates, if any, with whom we have shared or sold your consumer health data, together with available contact information for those recipients.
14.4 Right to Withdraw Consent
You may withdraw consent to future collection or sharing of your consumer health data.
Withdrawal does not affect processing that occurred before your withdrawal.
Withdrawing consent may prevent us from continuing a coaching or membership service that cannot reasonably be provided without the relevant information.
Where possible, we will explain whether the service may continue with reduced data collection.
14.5 Right to Deletion
You may request deletion of consumer health data concerning you.
Where required, we will:
Delete the data from our active records
Notify relevant processors, contractors, affiliates, and third parties of the request
Instruct those recipients to delete the data
Remove the data from archived or backup systems when those systems are restored or accessed
Deletion from archived or backup systems may take up to six months after the request has been authenticated where applicable law permits that period.
Some information may be retained where a legal exception applies, including where retention is necessary for security, fraud prevention, legal claims, tax obligations, or compliance with another applicable law.
14.6 Right to Appeal
You may appeal a refusal to act on a consumer health-data request.
14.7 Right to Non-Discrimination
We will not unlawfully discriminate against you because you exercised a consumer health-data right.
15. How to Exercise Your Rights
To exercise a consumer health-data right, email:
shine@ketoshine.com
Use one of the following subject lines:
Consumer Health Data Request
Consumer Health Data Access Request
Consumer Health Data Deletion Request
Health Data Consent Withdrawal
Consumer Health Data Appeal
Include:
Your full name
The email address used for your purchase or account
The program or service concerned
A clear description of your request
Do not include detailed medical information in the initial request.
You may also submit a request by post to:
POPA MARIA-SUSANA
Trading as Keto Reset by Shine™
Str. Virgil Madgearu, Nr. 25-27
Bl. Corp B, Et. 1, Ap. 215
Sector 1, Bucharest, Romania
You are not required to create a new account to submit a request.
We may ask for information reasonably necessary to authenticate your identity and protect your consumer health data from unauthorized access or deletion.
If we cannot authenticate the request using commercially reasonable efforts, we may request additional information.
16. Response Times and Fees
We will respond to a valid consumer health-data request without undue delay and, where the Washington My Health My Data Act applies, within 45 days after receiving the request.
Where reasonably necessary because of the complexity or number of requests, we may extend the response period once by an additional 45 days.
If an extension is required, we will inform you during the initial 45-day period and explain the reason.
Responses are provided free of charge up to twice per year, where required by applicable law.
Where a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or decline to act, where permitted by law.
We bear the responsibility of demonstrating why a request is manifestly unfounded, excessive, or repetitive.
17. Appeals
If we refuse to act on your request, you may appeal by emailing:
shine@ketoshine.com
Use the subject line:
Consumer Health Data Appeal
Explain why you believe the decision should be reconsidered.
We will provide a written response to the appeal within 45 days where the Washington My Health My Data Act applies.
If the appeal is denied, we will explain the reason and provide information about how you may contact the Washington State Attorney General or another competent regulator.
18. Consent Withdrawal Procedure
You may withdraw consent to future collection or sharing at any time by emailing:
shine@ketoshine.com
Use the subject line:
Health Data Consent Withdrawal
Please identify:
The consent you wish to withdraw
The program or service concerned
The email address associated with your account
After verifying the request, we will stop the affected future collection or sharing unless continued processing is necessary and legally permitted for security, fraud prevention, legal claims, or another applicable exception.
Withdrawal from health-data processing does not automatically cancel a paid subscription or coaching agreement.
To cancel a paid service, you must also follow the cancellation procedure stated in our Refund and Cancellation Policy.
19. Retention of Consumer Health Data
We retain consumer health data only for as long as reasonably necessary for the disclosed purpose.
Our general retention periods are:
Active Programs
Consumer health data is retained while the program or membership is active.
Coaching and Program Records
Health intake information, check-ins, coaching communications, and related notes are generally retained for up to 24 months after the program or customer relationship ends.
Non-Customer Inquiries
Health information submitted through an inquiry that does not result in a purchase is generally retained for up to 12 months after the inquiry is resolved.
Consent Records
Records of health-data consent and consent withdrawal may be retained for as long as reasonably necessary to demonstrate compliance and honor your choices.
Legal and Security Records
Information relevant to complaints, disputes, chargebacks, fraud, security incidents, or legal claims may be retained until the applicable matter and legal retention period have expired.
Corporate Programs
Corporate participant health information is generally retained for the program duration and for up to 24 months afterward, unless a shorter period is agreed in the applicable contract or Data Processing Agreement.
When a retention period expires, we delete, deidentify, or securely isolate the information, unless continued retention is legally required.
20. Security Practices
We maintain administrative, technical, and organizational safeguards designed to protect the confidentiality, integrity, and accessibility of consumer health data.
These safeguards include, as appropriate:
Limiting access to persons and processors who need the data to provide the requested service
Using individual platform accounts
Using multi-factor authentication where available
Using secure passwords and access controls
Limiting the information collected
Reviewing service providers
Using processor agreements where required
Maintaining confidentiality obligations
Applying retention and deletion procedures
Using encryption in transit where provided by the platform
Maintaining incident-response procedures
Restricting advertising and analytics technologies on health-data collection pages
No online system, communication service, or storage platform is completely secure.
Please do not send unnecessary medical documents or identification documents through ordinary email, WhatsApp, Telegram, or general website forms.
21. Security Incident and Breach Management
If we become aware of a suspected security incident involving consumer health data, we will take reasonable steps to:
Investigate the incident
Contain and mitigate the incident
Restrict unauthorized access
Preserve relevant evidence
Determine the categories of information affected
Determine which individuals may be affected
Notify relevant processors or service providers
Require processors to assist with investigation and mitigation
Assess applicable notification obligations
Notify affected individuals, regulators, or authorities where required by law
Document the incident and the actions taken
Review safeguards to reduce the risk of recurrence
The timing and content of any notification will be determined by the applicable data-breach laws.
22. Changes to Consumer Health Data Practices
We will not collect, use, or share additional categories of consumer health data that are not disclosed in this Policy without first:
Updating this Policy
Clearly disclosing the new category or purpose
Obtaining affirmative consent where required
The current version will be published with an updated “Last updated” date.
Where a change materially affects the purpose for which consumer health data was collected, we will provide additional notice and obtain new consent where legally required.
23. Enforcement and Complaints
The Washington My Health My Data Act is enforced through the Washington Consumer Protection Act.
Violations may be investigated or enforced by the Washington State Attorney General and may also be subject to private consumer actions where applicable law permits.
You may submit a complaint to us first at:
shine@ketoshine.com
You may also submit a complaint to the Washington State Attorney General or another competent privacy or consumer-protection authority.
24. Contact Us
For questions about this Policy or our consumer health-data practices, contact:
POPA MARIA-SUSANA
Trading as Keto Reset by Shine™
Str. Virgil Madgearu, Nr. 25-27
Bl. Corp B, Et. 1, Ap. 215
Sector 1, Bucharest, Romania
CUI: 54000506
Trade Register Number: F2026008899
Email: shine@ketoshine.com
Phone: +40 724 987 956