1. Who We Are

Medical Saunas is a California-based wellness products company. We sell massage chairs, saunas, cold plunges, hot tubs, wearable devices, and related wellness products directly to consumers through our Sites. For purposes of this policy, “we” refers to Medical Saunas and any brands, subsidiaries, or product lines operating under the same corporate umbrella (for example, Medical Saunas and Frozen). We are the “business” responsible for the personal information described in this policy for purposes of the CCPA and comparable state laws.

2. Scope and Eligibility

Our Sites and products are intended solely for consumers located in, and shipping to, the United States, and solely for adults age 18 and older. By using our Sites, you represent that you are at least 18 years old and are accessing our Sites from within the United States. We make no representation that our Sites or this Privacy Policy comply with the laws of any country outside the United States, and use of our Sites from outside the United States is at your own risk and your own responsibility for compliance with local law.

3. Definitions

To make this Policy easier to read, we use the following terms:

• “Personal information” means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular individual or household.

• “Anonymous information” means information that does not identify you and cannot reasonably be used to identify you, standing on its own.

• “Aggregate information” means information about a group of individuals, or a group's characteristics or behavior, from which individual identities have been removed, such as aggregated Site-traffic statistics.

If we combine anonymous or aggregate information with personal information, we treat the combined data as personal information for as long as it remains combined.

4. Categories of Information We Collect

Using the terms defined in Section 3 above, in the preceding twelve (12) months we have collected the following categories of personal information, consistent with the categories defined in Cal. Civ. Code § 1798.140:

We do not use or disclose sensitive personal information for any purpose other than the limited business purposes permitted under Cal. Civ. Code § 1798.121 and its implementing regulations (for example, providing the goods or services you requested, and detecting security incidents), and we do not use sensitive personal information to infer characteristics about you.

More specifically, we collect:

• Transaction information you provide when you request information, contact customer service, or purchase, return, or exchange a product, such as your shipping/billing address, phone number, and payment information (payment card numbers are processed by our PCI-compliant payment processor and not stored on our servers).

• Warranty and product registration information, including product serial numbers and purchase date.

• Information you submit in reviews, surveys, or promotions, which may be publicly posted if submitted as a public review. Survey responses are voluntary; with your permission, we may also post survey information on our Sites to share information about our products with other users. You are solely responsible for the content of anything you choose to make public.

• Information you provide to customer service via phone, email, or chat, including call recordings or chat transcripts where legally permitted and disclosed to you at the time of collection.

• Location information derived from your IP address (general geographic area only — we do not collect precise GPS location).

• Usage, technical, and device data, including browser type, operating system, device identifiers, IP address, pages viewed, links clicked, time on page, and referring/exit URLs, collected when you visit our Sites or open our marketing emails. We use IP address information to diagnose server problems, administer and tune our Sites, log browser type and referring URL information, and anonymously track the date and duration of visits; your IP address itself is not distributed to third parties, though aggregate or statistical data derived from it may be shared with our partners.

• Information from third parties, including our advertising and analytics partners (see Section 7), shipping carriers (delivery status), fraud-prevention and identity-verification vendors, and our payment processor (fraud/verification signals).

• Still or video images captured by security cameras at our showrooms, warehouses, or offices, where applicable and where disclosed by on-site signage.

5. How We Collect Your Information

• Directly from you when you request or purchase products, participate in a promotion, submit a product review, register a warranty, or contact customer service.

• Automatically through technology — cookies, pixels, tags, SDKs, and similar tools — when you visit our Sites, whether or not you are logged in. This includes tools such as Google Analytics (GA4), Google Tag Manager, Meta (Facebook/Instagram) Pixel, and Triple Whale. See Section 7 for how these are used for advertising and Section 8 for how to control them.

• From analytics tools that help us understand aggregate Site traffic and behavior.

• From trusted third parties to verify or supplement information you've given us — for example, validating a shipping address, checking for payment fraud, or verifying your identity in connection with a privacy rights request.

6. How We Use Your Information

We use personal information only for the purposes disclosed in this Policy or as otherwise disclosed to you at the time of collection, including to:

• Provide the products, services, and experiences you request or purchase, including order fulfillment, shipping, installation guidance, and warranty support.

• Communicate with you about your account, orders, warranty claims, recalls, or customer service requests, and to request feedback.

• Send you offers and promotions for our products, where you have opted in (see Section 8).

• Personalize content and product recommendations on our Sites.

• Provide targeted (cross-context behavioral) advertising based on your activity on our Sites and on third-party sites (see Section 7, and Section 8 for your controls).

• Operate, secure, understand, audit, and improve our Sites, products, and business operations, including through survey research, quality assurance, and analytics.

• Detect, investigate, and prevent fraud, chargebacks, security incidents, or activity that violates our policies or applicable law, and to enforce our Terms of Sale and this Policy.

• Notify you of product recalls or safety issues.

• Comply with our legal and regulatory obligations, respond to legal process, and establish, exercise, or defend legal claims.

We will not use personal information for materially different, unrelated, or incompatible purposes without providing you notice consistent with applicable law.

7. How We Share Your Information

We do not sell your personal information for money. We will not disclose your personal information to third parties outside the Company except in the following circumstances:

• When you direct us to — for example, sharing your address with a shipping carrier to fulfill your order.

• Service providers and contractors who perform functions on our behalf (payment processing, order fulfillment, shipping, hosting, customer support, marketing platforms, and similar functions), who are contractually restricted from using your information for any purpose other than performing services for us, consistent with Cal. Civ. Code § 1798.140.

• Advertising and analytics partners — we use Google Analytics (GA4), Google Tag Manager, Meta Pixel, and Triple Whale to measure ad performance and deliver relevant advertising to you on other sites. This may involve disclosing limited identifiers (such as a hashed email address, device identifier, or cookie ID) to these partners. Under the CCPA and comparable state laws, this is legally considered a “sale” or “sharing” of personal information even though no money changes hands, and you have the right to opt out — see Section 8.

• Legal and safety reasons — to comply with a subpoena, court order, or other legal process; to enforce our Terms of Sale or this Policy; to protect against fraud or security threats; or to protect the rights, property, or safety of the Company, our customers, our personnel, or the public, as permitted or required by applicable law.

• Business transfers — in connection with, or during negotiations of, a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of our assets, personal information may be disclosed or transferred as part of that transaction, subject to this Policy or its successor.

• With your affirmative opt-in consent, for a purpose not otherwise described in this Policy.

We do not have actual knowledge that we sell or share the personal information of minors under 16 years of age.

Once your information is disclosed to a service provider acting on our behalf, that service provider is contractually limited in its use of the information. For any other third party listed above, that company's own use of the information is governed by its own privacy practices, and we are not responsible for that company's independent handling of your information once lawfully disclosed.

8. Your Privacy Choices and Controls

Please note that if you don't allow us to collect certain information, we may not be able to provide some experiences or services — for example, we can't ship an order without a shipping address. Where providing information is required to complete a purchase, we'll make that clear at the point of collection.

We honor opt-out preference signals, including the Global Privacy Control (GPC), as a valid request to opt out of sale/sharing where required by applicable law. We currently do not respond to browser “Do Not Track” signals that are not GPC-compliant, because no common industry standard for DNT has been adopted; if that changes, we will update this Policy.

9. SMS/Text Message Marketing (TCPA Consent)

By providing your phone number and opting in, you agree to receive recurring automated promotional and personalized marketing text messages (such as cart reminders, special offers, and order updates) from Medical Saunas at the number provided. Messages may be sent using an automatic telephone dialing system or similar technology where applicable. Your consent to receive text messages is not a condition of making any purchase. Message frequency varies, and message and data rates may apply. Reply HELP for assistance or STOP at any time to cancel. For additional information, please review our SMS Terms, which are incorporated into this Policy by reference.

10. Children's Privacy

Our Sites and products are intended for adults and are not directed at children. We do not knowingly collect personal information from children under 13 (or, under applicable state law, under 16 for purposes of sale/sharing without opt-in consent). If we learn we've collected personal information from a child under 13 without verifiable parental consent, we will delete it promptly. If you believe a child has provided us with personal information, contact us immediately at support@medicalbreakthrough.com.

11. Data Security

We use commercially reasonable technical, administrative, and physical safeguards designed to protect your information from unauthorized access, disclosure, use, alteration, or destruction — including TLS encryption for data in transit, restricted internal access controls, and PCI-DSS-compliant third-party payment processing (we do not store full card numbers on our servers). We regularly review our security practices.

12. Fraudulent Charge Protection

If a third party unlawfully obtains your payment information from a purchase made on our Sites and uses it to commit credit card fraud, and that unauthorized use resulted through no fault of your own from a purchase made on our secure server, we want you to shop with confidence. Under the federal Fair Credit Billing Act, your card issuer may hold you liable for up to $50 of fraudulent charges. In that circumstance, we will cover that liability, up to $50, so you are not out of pocket for fraud that was not your fault. You must still notify your card issuer of any unauthorized use in accordance with its own reporting rules and procedures; this is a courtesy benefit we provide and does not replace or limit your card issuer's own fraud protections, which are typically more comprehensive.

13. Data Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Policy, determined by the following criteria: (a) the length of time we have an ongoing relationship with you and provide products or services to you; (b) whether there is a legal, tax, accounting, warranty, or contractual obligation we must comply with; and (c) whether retention is advisable given our legal position (such as applicable statutes of limitation, litigation, or regulatory investigations). As a general matter, we retain transaction and warranty records for the duration of the applicable product warranty plus the period required by state tax and accounting law thereafter, and we retain customer service records and marketing opt-in/opt-out records for so long as necessary to demonstrate compliance with applicable law. When retention is no longer necessary, we securely delete, destroy, or de-identify the information.

14. US Residents' Rights

We sell to customers across the United States. Depending on where you live, you may have rights under your state's privacy law, including the California Consumer Privacy Act (CCPA/CPRA), Texas Data Privacy and Security Act, Colorado Privacy Act, Connecticut Data Privacy Act, Virginia Consumer Data Protection Act, and comparable laws in Utah, Oregon, Delaware, Minnesota, Maryland, New Jersey, Montana, New Hampshire, Nebraska, Tennessee, Iowa, Indiana, Kentucky, and Rhode Island. Subject to certain exceptions, verification requirements, and thresholds under your state's law, you may have the right to:

• Know/Access what personal information we've collected, used, and disclosed about you, including the categories of sources, purposes, and third-party recipients.

• Delete personal information we've collected from you, subject to applicable exceptions (e.g., completing a transaction, warranty administration, legal compliance, security, or internal lawful uses compatible with the context in which you provided the information).

• Correct inaccurate personal information.

• Opt out of the “sale” or “sharing” of your personal information, including for targeted/cross-context behavioral advertising through tools like Meta Pixel and Google Ads.

• Limit the use and disclosure of sensitive personal information, if applicable.

• Data portability, in a usable and, where feasible, readily transferable format.

• Request a list of the specific categories of third parties to which we have disclosed your personal information, where required by your state's law.

• Request that we restrict certain uses of your personal information, where required by your state's law.

• Non-discrimination for exercising any of the above rights. We will not deny goods or services, charge different prices, or provide a different level or quality of goods or services solely because you exercised a privacy right, except as expressly permitted by law (for example, where a financial incentive is reasonably related to the value of your data and is offered in compliance with applicable law).

• Appeal a denied request, where required by your state's law.

To submit a request to know, delete, or correct, or to opt out of sale/sharing, contact us at support@medicalbreakthrough.com, or click “Do Not Sell or Share My Personal Information” in our Site footer, or adjust your preferences via our cookie banner. Where required by law, we also honor the Global Privacy Control (GPC) browser signal as a valid opt-out request.

Verification. We will verify your identity before processing a request to know, delete, or correct, using a method reasonably calibrated to the sensitivity of the information requested, which may include matching information you provide against information we already have on file. You may designate an authorized agent to submit a request on your behalf, subject to our ability to verify that the agent has been authorized to act on your behalf and to verify your own identity directly.

Response timing. We will confirm receipt of your request within ten (10) business days and will endeavor to substantively respond within forty-five (45) calendar days, with one 45-day extension where reasonably necessary and permitted by law. We may limit the frequency of requests to know or delete to twice in a twelve-month period, consistent with applicable law.

Appeals. If we deny your request in whole or in part, you may appeal by replying to our denial with “Appeal” and a brief explanation. We will respond to your appeal within the time period required by your state's law.

Shine the Light (Cal. Civ. Code § 1798.83): California residents may request, once per calendar year and free of charge, information about any personal information we've disclosed to third parties for their own direct marketing purposes in the prior calendar year. As noted in Section 7, we do not do this without your affirmative opt-in consent, and accordingly no such disclosures are made absent that consent.

15. Notice at Collection

This Section serves as our notice at or before the point of collection, as required by the CCPA. The categories of personal information we collect, the purposes for which each category is used, and the categories of third parties to whom each category may be disclosed, sold, or shared, are described in Sections 3 through 7 above. We do not collect additional categories of personal information, or use personal information for additional purposes, materially different from those disclosed in this Policy, without providing updated notice as required by law.

16. Disclaimers

OUR SITES AND ALL CONTENT, PRODUCTS, AND SERVICES MADE AVAILABLE THROUGH OUR SITES ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND THAT OUR SITES WILL BE UNINTERRUPTED, TIMELY, SECURE, ERROR-FREE, OR FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS, EXCEPT WHERE SUCH DISCLAIMERS ARE PROHIBITED BY APPLICABLE LAW.

We are not responsible for the independent privacy, security, or data-handling practices of third-party advertising, analytics, or payment partners, or of any third-party site linked from our Sites; those parties' own policies govern their handling of your information, and your interactions with them are solely between you and that third party.

17. Limitation of Liability and Indemnification

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL THE COMPANY, OR ITS OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, OR AFFILIATES, BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL, ARISING OUT OF OR RELATED TO THIS PRIVACY POLICY, OUR SITES, OR OUR COLLECTION, USE, OR DISCLOSURE OF YOUR INFORMATION, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. TO THE FULLEST EXTENT PERMITTED BY LAW, OUR TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THIS PRIVACY POLICY WILL NOT EXCEED THE GREATER OF (A) THE AMOUNT YOU PAID TO US, IF ANY, IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED DOLLARS ($100). NOTHING IN THIS POLICY LIMITS ANY RIGHTS YOU MAY HAVE UNDER APPLICABLE LAW THAT CANNOT BE LAWFULLY LIMITED OR WAIVED, INCLUDING NON-WAIVABLE CONSUMER PROTECTIONS UNDER CALIFORNIA LAW.

To the extent permitted by applicable law, you agree to indemnify, defend, and hold harmless the Company and its officers, directors, employees, agents, and affiliates from and against any claims, liabilities, damages, losses, and expenses, including reasonable attorneys' fees, arising out of or in any way connected with your misuse of our Sites, your violation of this Policy, or your violation of any rights of a third party, except to the extent such claims arise from our own willful misconduct or gross negligence.

Some jurisdictions do not allow the exclusion or limitation of certain damages or warranties, so some of the above limitations may not apply to you to the extent prohibited by applicable law. If any provision of this Privacy Policy is found to be invalid, illegal, or unenforceable, that provision will be limited or eliminated to the minimum extent necessary, and the remaining provisions will remain in full force and effect.

18. Binding Arbitration and Class Action Waiver

PLEASE READ THIS SECTION CAREFULLY. IT AFFECTS YOUR LEGAL RIGHTS, INCLUDING YOUR RIGHT TO FILE A LAWSUIT IN COURT AND TO HAVE A JURY TRIAL.

Agreement to arbitrate. You and the Company agree that any dispute, claim, or controversy arising out of or relating in any way to this Privacy Policy, our collection, use, or disclosure of your personal information, or your use of our Sites (a “Dispute”) will be resolved exclusively through final and binding individual arbitration, rather than in court, except that either party may bring an individual claim in small claims court, or may seek injunctive or other equitable relief in a court of competent jurisdiction to prevent the actual or threatened infringement, misappropriation, or violation of a party's intellectual property or confidentiality obligations.

Class action and jury trial waiver. YOU AND THE COMPANY EACH WAIVE THE RIGHT TO A JURY TRIAL AND THE RIGHT TO PARTICIPATE IN A CLASS ACTION, CLASS ARBITRATION, PRIVATE ATTORNEY GENERAL ACTION, OR OTHER REPRESENTATIVE PROCEEDING. Disputes will be arbitrated only on an individual basis, and claims of more than one person or entity may not be arbitrated or consolidated with those of any other person or entity, except as otherwise required by applicable law. If a court or arbitrator determines that this class action and representative-action waiver is unenforceable as to a particular claim or request for relief, that claim or request for relief (and only that claim or request for relief) must be brought in court, and all remaining claims will be arbitrated.

Arbitration procedure. The arbitration will be administered by the American Arbitration Association (AAA) under its Consumer Arbitration Rules then in effect, and will be conducted before a single neutral arbitrator. The arbitration will be conducted in Los Angeles County, California, or, at your election, by telephone, video conference, or based on written submissions if the amount in dispute is under $10,000 and an in-person hearing is not required by the AAA rules. The arbitrator's decision will be final and binding, except for a limited right of appeal under the Federal Arbitration Act (FAA). Judgment on the arbitration award may be entered in any court having jurisdiction. This arbitration agreement is governed by the Federal Arbitration Act, 9 U.S.C. §§ 1 et seq.

Fees. Payment of arbitration filing, administration, and arbitrator fees will be governed by the AAA's Consumer Arbitration Rules, and, where required by applicable law or those rules, the Company will pay costs in excess of what you would have paid to file in court.

Right to opt out. You may opt out of this arbitration agreement by sending written notice to support@medicalbreakthrough.com, with the subject line “Arbitration Opt-Out,” within thirty (30) days of the date you first become subject to this Privacy Policy (i.e., the date you first use our Sites or provide us information after this Policy's Last Updated date). Your notice must include your name and a clear statement that you wish to opt out of arbitration. If you timely opt out, neither you nor the Company will be required to arbitrate Disputes, but all other provisions of this Policy, including the class action waiver to the fullest extent enforceable by law, will continue to apply.

Governing law and venue. This Privacy Policy, and any Dispute not subject to arbitration or that falls within the small-claims or injunctive-relief carve-outs above, will be governed by the laws of the State of California, without regard to its conflict-of-laws principles, and the exclusive venue for any such Dispute will be the state or federal courts located in Los Angeles County, California, and you consent to the personal jurisdiction of those courts.

Severability of this Section. If any part of this Section 18, other than the class action waiver, is found to be unenforceable, that part will be severed and the remainder of this Section will be enforced. If the class action waiver is found unenforceable, then the entirety of this Section 18 will be null and void, and the Dispute will proceed in court under the governing law and venue provisions above.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our products, or applicable law. When we do, we'll revise the “Last Updated” date at the top of this page. For material changes — such as a new use of your personal information or a change to how we disclose it to third parties — we'll provide additional notice, such as an email to registered customers or a prominent notice on our Sites, before the change takes effect. Your continued use of our Sites after any update constitutes your acceptance of the revised Policy to the fullest extent permitted by law. We encourage you to review this page periodically.

20. Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us at:

Medical Saunas

• 24971 Avenue Stanford,
  Santa Clarita, CA 91355

• support@medicalbreakthrough.com

• (818) 962-0774