Hiya Privacy Policy

Last update: 6/18/2026

Hiya Health Products LLC and its worldwide parent and affiliates, jointly and severally referred as to “Hiya”, "we", “us”, “our” and “ours”, are committed to protecting the privacy and security of your personal data.

This policy describes: (1) how and why we collect, hold, process and use your personal data; (2) your rights in relation to your personal data; and (3) how to contact us in the event you have a complaint, in accordance with data privacy and security laws applicable to you in your country, including the California Consumer Privacy Act (CCPA) (California), the Personal Information Protection and Electronic Documents Act in Canada, the United Kingdom General Data Protection Regulation (UK GDPR), and any other applicable laws, regulations and secondary legislations, as amended or updated from time to time, in the relevant jurisdiction to which the processing relates (collectively, the “Data Protection Legislation”).

Specific privacy and information practices may apply to some of our services in certain jurisdictions to reflect local practices and legal requirements. If you reside or use our services in a country or region specifically mentioned in Section 14 “Country / Region Specific Terms” below, those terms and conditions under the relevant country/region shall specifically apply to you. If there is any inconsistency between this policy and any of the special language versions, special language versions shall prevail for residents in the jurisdictions they cover.

This policy applies to you when Hiya processes your personal data, including when you:

• Visit our website or any microsites, online shopping websites, other websites provided and operated by us, or other website operated by third-parties on behalf of us that post a link to this policy (collectively, the “Hiya Website”)

• Buy our products online, or through Customer Services

• Create an account with us,

• Engage with our promotions, surveys or provide marketing response to our engagement activities,

• Elect to receive newsletters or product updates and offers, or

• Contact us in any other way.

California and Certain State Residents: This policy describes how we collect, use, disclose, and retain your personal data. For additional information relating to your rights and our processing of your personal data collected both online and offline, please navigate to Section 14.E below.

It is important the personal data Hiya holds about you is accurate and current. Please keep Hiya informed if your personal data changes. Any inaccurate or false information may prevent us from providing services to you or lead to a delayed service.

1. Who are we?

Hiya is an established leader in the health and wellness industry and develops, manufactures and sells nutritional supplements and related products. Hiya is incorporated in the state of Delaware in the United States, with the registered office at 7750 Okeechobee Blvd., Suite 4-769, West Palm Beach, FL 33411 USA. For the purpose of the Data Protection Legislation, we are the “data controller” or the similar concept. This means that we are responsible for deciding how we hold and use personal data about you. We are required under the Data Protection Legislation to notify you of the information contained in this policy.

2. How to contact us

Should you have any questions regarding this policy, you can contact our Customer Service by email at support@hiyahealth.com.

3. What personal data do we collect?

The personal data refers to any information you provide to us that relates to an identified or identifiable individual. The personal data we collect might include:

• Your personal details, such as when you use the Hiya Website, your IP address and traffic data,

• Location data, weblogs and other communication data, and

• The resources that you access; when you fill in forms on the Hiya Website, subscribe to any service, request further services, or contact us about Hiya products and services; when you contact us, we may keep a record of that correspondence.

In the event that you order any products or request services from Hiya, we may need to further process your first name, last name, email address, mobile number, domicile country, postal code, payment card details, delivery address, etc.

If you are or intend to become a Customer, or in any way interact with us, we will hold personal data about you relevant to our relationship with you, in accordance with applicable internal and statutory rules and policies.

We may collect personal data from you to provide an efficient, meaningful and customized experience for you on the Hiya Website. We may collect and use the following personal data:

• Personal details: Name (first, middle, last, or similar identifier), email address, phone number, mailing address, age, language, gender;

• Transaction details: bank account and payment/credit card details, and other details about payments to and from you and about products and services you have purchased or seem to prefer from us, etc;

• Technical details: includes IP address, geolocation data, your login data, traffic data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, account number, username and password, and other technology on the devices you use to access Hiya Websites, analytics, search history, website usage;

• Marketing and Communication details: your preferences in receiving marketing from us and your communication preferences, internet or other electronic network activity information such as browsing history, search history, date and time of visit, and information regarding a consumer’s interaction with an internet website, application, or advertisement;

• Commercial information: product wish lists, order history, products and services considered, reminder and notification preferences;

• Detail on personal devices: hardware model, device MAC address, operating system type, software list, unique device identification code, etc., that describe the basic status of the commonly used personal devices, etc.

If you fail to provide certain personal data when requested, it may delay or prevent us from providing our products and services to you, and/or we may be prevented from complying with our legal obligations. In short, we may have to terminate our business relationship with you.

The categories and scope of personal data we collect about you may vary from time to time, depending on your choice of and interaction with our products and services, as well as the country or region in which you live.

Some of the personal data we request from you in connection with providing you with products and services is mandatory. In the event that you elect to not provide such personal data to us, we may not be able to provide you with our products and services. In those circumstances, we may have to end our business relationship with you. We will seek to notify you if this is the case in due course.

Your personal data will be used and disclosed by Hiya only for the purposes for which it was provided, including the purposes set out in this policy, unless you agree otherwise or for other specific reasons such as if the use or disclosure of this information is required by law.

Sensitive personal data

Depending on the applicable Data Protection Legislation and the nature of the services provided by us, some of the information we collect may be sensitive personal data. For example, Hiya may process your bank card information to process your payment. We may also collect other sensitive personal data about you based on our local practice from time to time. We will only collect sensitive personal data about you in accordance with the applicable Data Protection Legislation, such as on the basis of your appropriate consent.

Minor’s personal data

We do not knowingly solicit or collect personal data from anyone under the minimum age of minors defined in your Country.

However, due to the technical limitations, we may not be able to identify the exact age of our users under certain circumstances. If you have not yet reached the minimum age defined in your jurisdiction, please do not use our service or disclose any of your personal data to us.

HIPAA

The information provided on this Site is not intended to serve as medical or other professional advice and is not to be used for diagnosis or treatment of any condition or symptom. You acknowledge and agree that we are not covered by, and therefore are not compliant with, The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and related regulations. The HIPAA privacy rules apply to health plans, health care clearinghouses to any health care provider who transmits health information in electronic form in connection with transactions for which the Secretary of HHS has adopted standards under HIPAA (the “covered entities”) and their service providers (“business associates”). You understand and agree that we are not an entity that is covered by HIPAA and we are not a medical provider and do not make clinical, medical, or other decisions related to your healthcare and any information provided on this Site does not constitute the provision or practice of medical or professional health care advice or services. This means that the information that you provide to us is not protected by the HIPAA privacy rules and regulations. You acknowledge that the Site may not be appropriate for the storage or control of access to sensitive data, such as medical or health information and “protected health information” (also known as PHI) as defined under HIPAA. We specifically disclaim any representation or warranty that the Site, as offered, complies with HIPAA. We do not sign “business associate agreements” and you acknowledge that we are not a business associate, subcontractor, or agent of yours pursuant to HIPAA.

4. Why do we process your personal data?

Where lawfully permitted, Hiya may process your personal data for the following purposes:

• Account creating, authentication, and management (managing user logins, passwords and profiles);

• Carry out our rights and obligations arising from any agreements entered into between you and us (including to process, fulfill and notify you of the status of your product order, to process one-time or recurring payments, to process your product return and exchange request, send you requested product information, and to provide you customer service);

• Administer your account;

• Prevent and detect fraud against you or us;

• Ensure business policies are adhered to and the confidentiality of commercially sensitive information;

• Allow you to participate in interactive features of our service when you choose to do so;

• Send you the latest marketing information about our company, events, product/service specials, where you have consented to be contacted for such purposes;

• Create promotional materials, statistical analysis, policies, marketing plans and strategies, company communications;

• Perform analytics in order to provide you with better services, to know your preferences and targeted communication;

• Improve existing products and services, research and develop new products and services;

• Facilitate and improve your use of the Hiya Website;

• Comply with applicable laws and regulatory requirements, including without limitation tax reporting requirements and compliance with information disclosure requests from governmental authorities, and assist with any governmental or police investigation; and

• Other purposes directly relating to any of the above.

Depending on the service, we may use machine learning, artificial intelligence (“AI”), generative AI, and other automated tools to accomplish these purposes. We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you, seek your appropriate consent, or we will explain the legal basis other than the consent which allows us to do so.

5. Our legal basis of processing personal data

If required by applicable Data Protection Legislation, we will seek to obtain your consent to process your personal data, and only process your personal data upon receiving such consent. When required and allowed by applicable Data Protection Legislation, we may process your personal data for a legitimate interest, for purposes necessary for the performance of a contract with you, for example for the processing or fulfilment of orders for our products or services, or for complying with our legal obligations.

6. Direct marketing communications

Subject to your consent, we may use your personal data to send you marketing updates (by email, text message, or post) about our services, including special offers, promotions, new products, incentives or other information in terms of our products/services we think may be of interest to you.

In connection with such marketing, we may use your name, contact details, products and services portfolio information, transaction pattern and behaviour, and demographic data held by us.

Where data are processed for the purposes of direct marketing, you have the right to opt out of receiving direct marketing communications at any time and we will arrange effective procedures accordingly allowing you at any time to “opt-out” from having your data used for such purposes.

Message and data rates may apply. We do not charge a fee for our text message programs and assume no responsibility for charges by your carrier that you may incur when you sign up to receive text messages from us.

You may choose to stop receiving our newsletter or marketing communications by following the unsubscribe instructions included in these emails, texting the “STOP” number in texts, or contacting us at support@hiyahealth.com. You may change any of your personal information in your account by editing your profile within your account or by sending an e-mail to us at the e-mail address set forth above.

We may ask you to confirm or update your marketing preferences if you instruct us to provide further services in the future, or if there are changes in the law, regulation, or the structure of our business.

7. To whom we may disclose or transfer your personal data

Why might Hiya share your personal data with third-parties?

Hiya will share your personal data with third-parties where required by law, where it is necessary to perform the contract we have entered into with you, based on your appropriate consent or other legal bases as legally permitted.

Which third-parties may receive and process your personal data?

Where applicable Data Protection Legislation permits, Hiya may share such data from time to time with the following third-parties, which will be bound by confidentiality and data protection obligations:

• USANA Health Sciences, Inc. (“USANA”), Hiya’s parent company, those USANA employees, directors, managers, and its local and foreign associated/affiliated companies who have a need to access your personal data to carry out their responsibilities, if necessary for (one of) the purposes listed in this policy. Such data access will strictly take place on a “need to know” basis in order for the recipients to fulfill the processing purposes in their capacity;

• Third-parties that help us deliver our products to you, e.g. payment service providers, third-party logistics companies;

• Third-parties that help us run our business, agent, contractor, supplier, vendor, or third-party service providers who provide administrative, IT, marketing, printing, fulfilment, web-tools, fraud prevention or other services to Hiya;

• Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, security, insurance and accounting services;

• Third-parties that help us collect surveys or feedback from you;

• Marketing and Advertising partners that assist us in serving, measuring the performance of, and optimizing our advertisements, such as marketing agencies, third-party advertising networks, social media networks, or other marketing and advertising partners;

• Internal Revenue Service, government agencies and regulators, and others who require reporting of processing activities in certain circumstances; and

• Law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.

Hiya third-party service providers are required by law to take appropriate security measures to protect your personal data. We also impose contractual obligations on service providers to ensure they can only use your personal data to provide services to us and to you in accordance with legal requirements and with our instructions, and that they will take appropriate security measures to help prevent unauthorized or accidental access, processing, erasure, loss or use of the data transferred to these service providers for processing. Hiya only permits them to process your personal data for specified purposes and with appropriate security measures in place.

Third-Party Payment Processing

Online payments made through our Site are handled by our third-party payment services provider. We do not process, record or maintain your credit card or bank account information. We will share transaction data with our payment services providers only to the extent necessary for the purposes of processing your payments, and dealing with complaints and queries relating to such payments and refunds. If you have any questions about payments or would like to dispute a charge, you can contact us at support@hiyahealth.com.

Third-Party Websites

Our Site may contain links to third-party websites. When you click on a link to any other website or location, you will leave our Site and go to another site, and another entity may collect personal data or anonymous data from you. We have no control over, do not review, and cannot be responsible for, these outside websites or their content, or how that party may use or disclose any information you may provide to them. As such, we urge that you exercise caution before providing them with your personal information. Please be aware that the terms of this Privacy Policy do not apply to these outside websites or content or to any collection of your personal information after you click on links to such outside websites. We encourage you to read the privacy policies of every website you visit. The links to third-party websites or locations are for your convenience and do not signify our endorsement of such third parties or their products, content or websites.

You should contact the site administrator for such third-party website if you have any complaints, claims, concerns or questions regarding such third-party website or its privacy practices.

What about other third-parties?

Hiya may also disclose your personal data to third-parties as a result of or in preparation for the possible sale, merger, consolidation, change in control, transfer of substantial assets, reorganization, or liquidation of Hiya or USANA. If any change happens to the original process purpose or method, then the new owners may notify you and request your consent in accordance with applicable law.

International Data Transfer

To deliver our products and services, it is sometimes necessary for us to share your personal data with parties outside the country where you are located. Specifically, our primary servers and head office are located in the United States, and many of Hiya’s agents, contractors, suppliers, vendors, and third-party service providers, are also situated worldwide, which may make it necessary to transfer, disclose, store or process your personal data outside of the country in which it is collected.

Whenever Hiya conducts any such international transfers of your personal data, we will ensure that such transfer is in compliance with applicable Data Protection Legislation.

8. Data security

Hiya endeavours to maintain appropriate physical, procedural and technical security over our IT systems and data centers so as to prevent any unauthorized access, disclosure, copying, use or modification of personal data. Hiya has put in place security measures appropriate to protect against the risk of personal data being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. For example, any personal data you provide will be processed on Hiya’s or its third-party vendors’ secure servers. Your personal data is encrypted in transit and your payment card information are encrypted to protect your personal data against unauthorized access.

Hiya has also put in place appropriate measures and procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. We will take commercially reasonable steps to ensure that any personal data held by us is protected against unauthorized or accidental access, processing, erasure, loss, or use.

9. How long your personal data will be kept

Hiya will only retain your personal data for as long as is necessary to fulfill the purposes for which it is collected. The retention period is determined by the category and type of data. This is subject to cases in which we may need to retain your data for longer than the retention period in order to comply with a legal requirement, such as a litigation hold or government investigation.

Different retention periods apply for different types of personal data and depending upon your country of residence. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances, Hiya may anonymize or take other similar technical methods related to the personal data so that it can no longer be associated with you, in which case Hiya may use such information without further notice to you.

10. Your data subject rights

We will respond to and honor when you exercise your data subject rights on a case-by-case basis in accordance with the applicable Data Protection Legislation. Under certain circumstances, as proscribed by applicable Data Protection Legislation in your geographic country/region, you may have the right to:

• Request access and copy to your personal data. This enables you to receive details of the personal data we hold about you and to check that we are processing it lawfully;

• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected;

• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing;

• Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example, if you want us to establish its accuracy or the reason for processing it;

• Withdraw consent to our processing of your personal information. You can exercise this option at any time by contacting us, using the contact details outlined above. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in accordance with applicable Data Protection Legislation;

• Object where we are processing your personal data for direct marketing purposes;

• Request the transfer of your personal data to another party;

• Make a complaint If you believe that Hiya has breached this policy or applicable Data Protection Legislation; and

• Other rights as authorized and permitted by the applicable Data Protection Legislation.

If you want to exercise any of the above rights, including the right to withdraw consent to the processing of your personal data, please email support@hiyahealth.com. We will deal with the foregoing request and provide a response thereto within 30 days unless the applicable Data Protection Legislation otherwise required, provided that we have all the necessary information. In cases where further information, assessment, or investigation is required, we will seek to agree on alternative time frames with you. When you request the erasure/restricted processing of your personal data or withdraw your consent to the processing of your personal data, please note that this may give rise to the termination of our relationship with you or prevent us from providing you with certain services/benefits. If you are not satisfied with our response or believe we are not lawfully processing your data you can also complain to a supervisory authority at any time.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if any request made by you is clearly unfounded or excessive if permitted by applicable Data Protection Legislation. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

11. Cookies and other tools

When you visit a Hiya Website, we may obtain information about your general internet usage by using cookies, tracking pixels, and similar technologies (collectively, “Cookies”). These tools typically collect information about how you use a website such as pages and content you view, information you submit, digital tools you use, and links you click.

Cookies help us improve the Hiya Website and provide you with a better and more personalized service. Some of the Cookies we use are essential for the Hiya Website to operate.

It is possible to switch off Cookies by setting your browser preferences. Turning Cookies off may result in a loss of functionality when using Hiya Website.

12. Changes to this policy

We may change this policy from time to time. Any changes we may make to this policy in the future will be posted on the footer of your Hiya market’s homepage. Where changes to this policy will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient advance notice, and/ or appropriate consent if required by applicable Data Protection Legislation.

13. Country / Region Specific Terms

A. United Kingdom

In the UK, you have certain rights under applicable data protection laws. These rights include:

• Right to Access: The right to be provided with a copy of your personal data;

• Right to Rectification: The right to require us to correct any mistakes in your personal data.

• Right to be Forgotten: The right to require us to delete your personal data—in certain situations. At your request, we will delete your personal data promptly if:

  • it is no longer necessary to retain your personal data;

  • you withdraw the consent which formed the basis of your personal data processing;

  • you object to the processing of your personal data and there are no overriding legitimate grounds for such processing;

  • the personal data was processed illegally; or

  • the personal data must be deleted for us to comply with our legal obligations.

We may decline your request for deletion if processing of your European Personal Data is necessary:

• To comply with our legal obligations;

• In pursuit of a legal action;

• To detect, predict and monitor fraud; or

• For the performance of a task in public interest.

• Right to Restriction of Processing: The right to require us to restrict processing of your personal data—in certain circumstances, e.g. if you contest the accuracy of the data, if your personal data was processed unlawfully and you request a limitation on processing, rather than the deletion of your personal data, we no longer need to process your personal data, but you require your personal data in connection with a legal claim, or you object to the processing pending verification as to whether an overriding legitimate ground for such processing exists. We may continue to store your personal data to the extent required to ensure that your request to limit the processing is respected in the future.

• Right to Data Portability: The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations. At your request, we will provide you free of charge with your personal data in a structured, commonly used and machine readable format, if you provided us with personal data, the processing of your personal data is based on your consent or required for the performance of a contract, or the processing is carried out by automated means.

• Right to Object: The right to object at any time to your personal data being processed for direct marketing (including profiling), and in certain other situations to our continued processing of your personal information, e.g. processing carried out for the purpose of our legitimate interests. We will comply with your request unless we have compelling legitimate grounds for the processing which override your rights and freedoms, or where the processing is in connection with the establishment, exercise or defense of legal claims. Please note that even if we stop all marketing communications, you may still receive administrative communications from us.

• Right Not to be Subject to Automated Individual Decision-Making: The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you, unless you have given us your explicit consent or where they are necessary for a contract with us.

• Right to Withdraw Consent: You have the right to withdraw any consent you may have previously given us at any time.

For further information on each of those rights, including the circumstances in which they apply, see the guidance from the UK Information Commissioner's Office (ICO) on individual rights under the General Data Protection Regulation.

We hope that we can resolve any query or concern you raise about our use of your information. However, the UK General Data Protection Regulation also gives you right to lodge a complaint with the ICO.

B. United States

If you live within the United States, you may have certain rights regarding our processing of your personal data under applicable local state law, including, for example, if you are a consumer in California. If our processing of your personal data is governed by such laws, the following provisions apply to our processing of your personal data, whether collected online or offline. These provisions supplement the information provided in Sections 1-13.

As may be required under applicable local law, the information below describes, for the 12 months preceding the date last updated, above, (a) the categories of personal data we have collected about you, (b) the sources of that personal data, (c) the business and commercial purposes for use, and (d) the categories of third-party recipients of your personal data.

Categories Of Personal Data Collected & Purposes for Using Personal Data

In the last 12 months, we collected the following categories of personal data depending on your interaction with us:

• Identifiers, including your name, address, email address, telephone number, or IP address.

• Internet or other electronic network activity information, including device information from website visits, and information regarding your interaction with website, application, or advertisement, such as search terms you enter and recordings of your session.

• Protected classifications, including your gender, age, marital status, nationality, and country of origin.

• Commercial information, including your purchase, registration, login, and service usage history.

• Geolocation data, including the general physical location of your device.

• Professional or employment-related information, including your occupation, employment history, professional contact information, education history, or other similar information provided by you in connection with Hiya’s services.

• Education information, including where you attended school.

• Inferences, such as those drawn to create a profile reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes.

• Sensitive data, including account credential, government identifiers, and financial account or payment card information.

In the last 12 months, Hiya collected the categories of personal data listed above from the following sources: (1) directly from individuals; and (2) automatically through use of Hiya resources. More information about how we use those categories of personal data can be found above in Section 4. We use and disclose sensitive data only for purposes expressly permitted under California law.

Disclosing Personal Data

In the last 12 months, we disclosed personal data to third parties for the business or commercial purposes described in Section 4. Certain disclosures we make may also be considered “sales,” “sharing” for cross-contextual behavioral advertising, or “targeted advertising.” In the preceding twelve (12) months, we may have sold, shared, or disclosed for targeted advertising your personal information, or disclosed it for a business purpose, to the following categories of third parties: 

We do not have actual knowledge that we sell or share personal information of minors under 16 years of age. 

Hiya Birthday Card Program

Parents that have active subscriptions to Hiya products have the option to opt-in to the Hiya Birthday Card Program, where Hiya will send their child a card in the mail on his or her birthday. Parents will be able to sign up in their account settings or during the enrollment process by providing the name of their child, and the day and month of the child’s birthday. Parents may opt-out of this program at any time through their account settings, and may make a data deletion request by contacting customer service as support@hiyahealth.com.  

Your Rights

Depending on where you reside, and subject to certain exceptions, you may have the rights described in Section 10. In addition to those rights, you also may have the right to:

• Know information about our processing of your personal data, including how we share it with third parties.

• Opt-out of the sale, sharing, or disclosure of your personal information for targeted advertising. To opt out of these activities, make the selection by clicking on the “Cookie Settings” button at the footer of the Hiya website, or use the Global Privacy Control signal. Note that if you clear your cookies on a particular browser or device, you may need to re-submit your opt-out request. Requests sent using the Global Privacy Control will apply to the device and browser from which they are submitted.  For more information about the Global Privacy Control, please visit https://globalprivacycontrol.org/. 

You may also have the right to appeal a refusal to take action on your request by emailing us at support@hiyahealth.com with the subject line “Appeal of Rights Request Decision.” 

For more information on how to exercise your rights, see Section 10. You/California residents may also submit a request by calling us at 1-888-950-9595. If you designate an authorized agent to make requests on your behalf, we may require you to provide the authorized agent with written permission to do so and to verify your own identity directly with us. If you choose to exercise any of your rights, you have the right not to receive discriminatory treatment by us. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.