Privacy Policy

Updated: July 1, 2026

Data Controller Contact Information

Address: Health+Commerce

1619 Fourth Street, Santa Rosa, CA 95404

This Privacy Policy describes how Health+Commerce (“Health+Commerce,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you visit our website at https://healthandcommerce.com/ (the “Website”), access the Supreme Intelligence Artificial Intelligence Platform at app.supremegroup.ai (the “Platform” or “AIP”), use our other products or services, or otherwise interact with us. This Policy also describes your rights and choices regarding your personal information.

By accessing or using our Website, Platform, or Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our Website, Platform, or Services.

1. Supreme Group and Affiliated Brands

Supreme Group operates as a collective of affiliated portfolio brands (“Affiliates”) that work together to provide commercial, marketing, public relations, communications, and digital services to life science and healthcare organizations. By using our services, you acknowledge and agree that your personal information may be shared among Supreme Group and its Affiliates as described in this Policy.

This data sharing allows us to enhance our services, personalize your experience, and provide relevant communications. We will only process your personal information in compliance with applicable data protection laws, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable U.S. state privacy laws.

2. Information We Collect

We collect information from and about you in several ways, depending on how you interact with us.

2.1 Information You Provide Directly

Account and registration information (name, email address, company name, job title)
Contact form submissions and live chat communications
Payment and billing information when purchasing products or services
Content, data, or files you upload to or submit through the Supreme Intelligence AIP
Any other information you voluntarily provide to us

2.2 Information Collected Automatically

When you visit our website or use our services, we automatically collect certain technical information, including:

IP address and approximate geolocation
Browser type and version, device type, and operating system
Pages visited, links clicked, and time spent on our website
Referring and exit URLs
Usage data related to your interactions with the Supreme Intelligence AIP

2.3 Information from Third Parties

We may receive information about you from third-party sources, such as business partners, marketing partners, analytics providers, and publicly available sources. We may combine this information with other information we collect about you.

3. How We Use Your Information

We use the information we collect for the following purposes:

To provide, maintain, and improve our website and services, including the Supreme Intelligence AIP
To process transactions and send related information (confirmations, invoices, support messages)
To communicate with you about products, services, promotions, and events
To personalize your experience and deliver content relevant to your interests
To monitor and analyze usage trends, and to improve the functionality and security of our services
To detect, prevent, and respond to fraud, abuse, security incidents, and technical issues
To comply with legal obligations, enforce our terms of service, and protect our rights
To generate aggregated, de-identified analytics and insights that do not identify any individual

4. Artificial Intelligence and Data Processing

Health+Commerce operates the Supreme Intelligence AIP, a cloud-based artificial intelligence services platform. The following principles govern our AI-related data practices:

We do not train or fine-tune foundation AI models. We use enterprise-tier APIs from leading AI providers. The underlying models are pre-trained by their respective developers, not by Supreme Optimization. A current list of our AI foundation model providers is available upon request.
Client data submitted to the Supreme Intelligence AIP is used only to generate outputs specific to that client’s engagement. It is not shared across clients or incorporated into any model training.
Our enterprise-tier provider agreements include contractual commitments that client data will not be used by the provider to train or improve their generalized AI models.
We do not process Protected Health Information (PHI) through the AIP unless a Business Associate Agreement (BAA) and any additional required safeguards are in place.
AI-generated outputs are intended as decision-support tools only and should be reviewed by qualified personnel before use or deployment.
Health+Commerce may retain aggregated, anonymized, and de-identified insights derived from platform usage to improve service quality, but these insights never contain confidential or individually identifiable information.

5. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases:

Contractual necessity: where processing is necessary to perform a contract with you or to take steps at your request before entering a contract.
Consent: where you have given clear consent for us to process your personal data for specific purposes (e.g., subscribing to a newsletter).
Legitimate interests: where processing is necessary for our legitimate business interests (e.g., improving our services, security) and those interests are not overridden by your data protection rights.
Legal obligation: where processing is necessary for compliance with a legal obligation to which we are subject.

6. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies (web beacons, pixels, scripts) to collect information about your browsing activity. Cookies are small text files stored on your device when you visit our website.

6.1 Types of Cookies We Use

Strictly Necessary Cookies: Required for the website to function properly. These cannot be disabled.
Performance and Analytics Cookies: Help us understand how visitors interact with our website by collecting and reporting information anonymously.
Functional Cookies: Enable enhanced functionality and personalization, such as remembering your preferences.
Targeting and Advertising Cookies: Used to deliver advertisements relevant to you and to measure the effectiveness of advertising campaigns.

6.2 Managing Your Cookie Preferences

When you visit our website, a cookie consent banner will allow you to accept or decline non-essential cookies. You may update your cookie preferences at any time through the cookie settings link in our website footer. You may also configure your browser to block or delete cookies; however, doing so may affect website functionality.

6.3 Google Analytics

Our website uses Google Analytics to collect usage data. Google Analytics collects information such as how often users visit our website, which pages they visit, and what other sites they used prior to coming to our website. We use this information to improve our website and services. Google Analytics collects only the IP address assigned to you on the date you visit our website and does not link it to your name or other identifying information.

For more information on how Google collects and processes data, visit https://www.google.com/policies/privacy/partners/.

You can opt out of Google Analytics by installing the browser add-on available at https://tools.google.com/dlpage/gaoptout.

7. Sharing and Disclosure of Information

We do not sell your personal information. We may share your information in the following circumstances:

Affiliates: With Supreme Group and its Affiliates for the purposes described in this Policy.
Service providers: With third-party vendors who perform services on our behalf (payment processing, analytics, hosting, email delivery, customer support). These providers are contractually obligated to use your information only as directed by us and in accordance with this Policy.
AI foundation model providers: Data submitted through the Supreme Intelligence AIP may be transmitted to our enterprise AI foundation model providers solely for the purpose of generating outputs. These providers operate under enterprise agreements that prohibit the use of client data for model training. A current list of AI foundation model providers is available upon request.
Legal requirements: When required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
Business transfers: In connection with a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction.
With your consent: We may share your information with third parties when you have given us explicit consent to do so.

8. Your Rights and Choices

8.1 Rights Under the GDPR (EEA/UK Residents)

If you are located in the EEA or the UK, you have the following rights regarding your personal data:

Right of access: Request a copy of the personal data we hold about you.
Right to rectification: Request correction of inaccurate or incomplete personal data.
Right to erasure: Request deletion of your personal data, subject to certain legal exceptions.
Right to restrict processing: Request that we limit how we use your personal data.
Right to data portability: Request your personal data in a structured, commonly used, machine-readable format.
Right to object: Object to processing based on legitimate interests, direct marketing, or profiling.
Rights related to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you.
Right to file a complaint: You may file a complaint with your local data protection supervisory authority.

8.2 Rights Under the CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Right to know: Request information about the categories and specific pieces of personal information we have collected, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share information.
Right to delete: Request deletion of personal information we have collected, subject to certain legal exceptions.
Right to correct: Request correction of inaccurate personal information.
Right to opt out of sale or sharing: We do not sell your personal information. If we engage in “sharing” for cross-context behavioral advertising purposes, you may opt out.
Right to limit use of sensitive personal information: If applicable, you may request that we limit the use and disclosure of your sensitive personal information.
Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.

8.3 Rights Under Other U.S. State Privacy Laws

Residents of states with applicable comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as enacted) may have similar rights to access, correct, delete, and opt out of certain processing of their personal information. We will honor valid requests in accordance with applicable law.

8.4 Exercising Your Rights

To exercise any of these rights, please contact us at notifications@supremeopti.com. We will respond to verifiable requests within the timeframes required by applicable law (generally 30 to 45 days). We may need to verify your identity before processing your request.

9. International Data Transfers

Your personal information may be stored, processed, and transferred to or between any of the countries in which we operate, primarily the United States. If you are located in the EEA, UK, or another jurisdiction with data transfer restrictions, we will ensure that appropriate safeguards are in place before transferring your personal data, including:

Standard Contractual Clauses (SCCs) approved by the European Commission
The UK International Data Transfer Agreement or Addendum, where applicable
Adequacy decisions by the relevant authority, where available
Other lawful transfer mechanisms as provided under applicable law

By using our website or services, you consent to the transfer of your personal information as described in this section.

10. Data Retention

We retain personal information only for as long as is reasonably necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods vary depending on the nature of the information, the purpose for processing, and applicable legal requirements.

When personal information is no longer needed, we will securely delete, destroy, or anonymize it. For client data processed through the Supreme Intelligence AIP, data retention and destruction are governed by the applicable Master Services Agreement, Statement of Work, and AI Services Addendum.

11. Data Security

We implement and maintain industry-standard technical and organizational security measures designed to protect the confidentiality, integrity, and availability of your personal information. These measures include:

Encryption of data at rest (AES-256 or equivalent) and in transit (TLS 1.2 or higher)
Access controls and role-based authentication
Regular security assessments and vulnerability testing
Employee training on data protection and security practices
Incident response procedures, including notification of applicable supervisory authorities within 72 hours of becoming aware of a qualifying security incident, and notification of affected individuals as required by applicable law (timeframes for individual notification vary by jurisdiction)

No method of transmission over the Internet or electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee absolute security.

12. Subprocessors and Third-Party Services

We engage third-party subprocessors to help deliver our services. We maintain a current list of subprocessors that access or process personal data on our behalf. All subprocessors are contractually bound by data protection obligations that are no less protective than those described in this Policy. A list of current subprocessors is available upon request by contacting us at the email address provided above.

Our website and services may contain links to third-party websites or services that are not owned or controlled by Health+Commerce. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party site you visit.

13. Global Privacy Control and Do Not Track

We are committed to honoring the Global Privacy Control (GPC) signal. Where our systems detect a GPC signal from your browser, we will treat it as a valid opt-out request for the sale or sharing of personal information under applicable law. We are actively implementing GPC detection across our web properties and will update this section as implementation is completed.

With respect to other “Do Not Track” (DNT) browser signals, there is currently no uniform standard for how these signals should be interpreted. Accordingly, our website does not currently respond to DNT signals other than GPC.

14. Children’s Privacy

Our website and services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information as promptly as possible. If you believe that a child under 16 has provided us with personal information, please contact us using the information provided above.

15. Email and Marketing Communications

You may opt out of receiving promotional communications from us at any time by clicking the “unsubscribe” link in any promotional email, or by contacting us at info@healthandcommerce.com. Please note that even if you opt out of promotional communications, we may still send you transactional or service-related messages (e.g., confirmations, account notifications, security alerts).

We will not sell, rent, or trade your email address to unaffiliated third parties for their marketing purposes without your explicit consent.

16. Credit Card and Payment Information

If you purchase products or services from us, your payment information is processed by PCI-DSS compliant third-party payment processors. We do not store your full credit card number, expiration date, or security code on our servers. We use commercially reasonable efforts to ensure that your payment information is handled securely by our payment processing partners.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated Policy on our website with a revised “Effective Date” and, where required by law, by providing additional notice (such as an email notification).

Your continued use of our website or services after the effective date of a revised Privacy Policy constitutes your acceptance of the changes. We encourage you to review this Policy periodically.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Health+Commerce

1619 Fourth Street, Santa Rosa, CA 95404

Email: info@healthandcommerce.com

Website: https://healthandcommerce.com/

This Privacy Policy is protected under United States and foreign copyright laws. Unauthorized copying, redistribution, use, or publication is strictly prohibited.