For laboratory research use only. Not for human or veterinary use.

Origin EOS

ORIGIN EOS — PRIVACY POLICY

Effective Date: 21 August 2026 | Last Updated: 2 October 2026

Origin EOS, a trade name of Origin Eos LLC (“Origin EOS,” “we,” “us,” or “our”), respects your privacy and is committed to protecting it through compliance with this Privacy Policy (this “Policy”). This Policy describes how we collect, use, process, retain, and disclose personal information when you visit https://origineos.com (the “Website”), create an account, place an order, communicate with us, or otherwise interact with our products and services (collectively, the “Services”), and the rights and choices available to you.

Origin Eos sells research-use-only (“RUO”) materials for lawful laboratory and research purposes only — not for human or animal consumption. By accessing or using the Services or otherwise providing us with your information, you agree to the collection, use, and disclosure of your information as described in this Policy and to our Terms and Conditions, which incorporate this Policy by reference. If you do not agree, do not use the Services.

1. Scope of This Policy

This Policy applies to personal information we collect:

  • Through the Website and our online storefront;
  • Through communications between you and us, including email, SMS, chat, phone, and contact forms;
  • When you interact with our advertising on third-party websites and services, where those materials link to this Policy; and
  • Through account registration, eligibility verification, and order screening processes.

This Policy does not apply to information collected by any third party, including through content or advertising that may link to or be accessible from the Services. We may provide additional privacy notices specific to certain features or jurisdictions, which supplement this Policy.

2. Age Restriction; No Data From Minors

The Services are intended solely for Qualified Researchers who are at least twenty-one (21) years of age. We do not knowingly collect personal information from anyone under 21. If we learn that we have collected personal information from an individual under 21, we will delete it promptly. If you believe a minor has provided us with personal information, contact us at [email protected].

3. Information We Collect

3.1 Information You Provide Directly

  • Account and contact information: name, email address, phone number, shipping and billing addresses, username, and password.
  • Eligibility and verification information: date of birth or age attestation, business or entity type, researcher/buyer category, field of qualified research, institutional or laboratory affiliation, a description of the research for which you are purchasing, and documentation you submit to verify age, identity, qualification, or affiliation.
  • Payment information: payment method details and transaction information. Full payment card numbers are handled by our PCI-compliant payment processors and are not stored on our servers.
  • Order information: items purchased, transaction amounts, order history, and discounts used.
  • Content you provide: messages sent via email, chat, contact forms, surveys, or SMS, including any information you choose to include.
  • Marketing preferences: your consent choices for email and SMS communications.

3.2 Information Collected Automatically

  • Device information: IP address, device identifiers, operating system, preferred language, and browser type and settings.
  • Usage information: clickstream data, pages and products viewed or searched, page response times, length of visits, and navigation patterns.
  • Cookies and similar technologies: as described in Section 7.
  • Approximate location: derived from IP address or shipping information. We do not collect precise geolocation.

3.3 Information From Third Parties

We may receive information about you from payment processors, fraud-prevention and risk-scoring providers, identity and age verification vendors, shipping carriers, analytics providers, and service providers that help us operate the Website and fulfill orders.

3.4 Compliance and Screening Records

Because we sell RUO materials, we may collect, generate, and retain records reasonably necessary to operate a compliant research supply business, including: records of eligibility verification and due diligence screening; records of refused sales, cancelled orders, and account restrictions; communications suggesting intended misuse of RUO products; chargeback and payment-dispute records; and related compliance events. Research account applications and order attestations: when you apply for a research account we record your application and our decision on it, and each time you confirm our research-use statements at checkout (and when you confirm your age on entering the Website) we record the date and time, your IP address and browser, the account used, and the exact wording you confirmed. These records may be retained even after account closure or a deletion request, to the extent permitted by law, to protect our business, our suppliers, our service providers, and the lawful distribution of our products.

3.5 Do Not Send Health Information

Do not submit medical records, prescriptions, treatment plans, dosage or administration questions, personal health conditions, or any other health-related information through the Website, account features, contact forms, or customer service channels. Origin Eos does not provide medical advice, prescribing services, or patient care, and our products are not for human or animal use. We do not ask for health information and have no need for it. If you voluntarily disclose health-related information despite this instruction, we do not use it to infer characteristics about you and do not use it for advertising or profiling; however, communications indicating intended misuse of RUO products may be retained as compliance records under Section 3.4 and may result in refusal of sale under our Terms and Conditions.

We do not knowingly collect Social Security numbers, government ID numbers beyond what verification requires, biometric identifiers, or genetic information.

3.6 Aggregated and De-Identified Data

We may derive aggregated or de-identified data from personal information (for example, the percentage of visitors who view a product category). If aggregated data is combined with personal information such that it identifies you, we treat the combined data as personal information.

4. How We Use Your Information

We use personal information to:

  • Provide, operate, and maintain the Services;
  • Create and manage customer accounts;
  • Verify age, identity, qualification, business or laboratory affiliation, and eligibility to purchase RUO products;
  • Conduct fraud prevention, risk review, order screening, and misuse screening, including screening orders against internal restricted-customer records;
  • Process and fulfill orders, payments, and deliveries;
  • Send transactional communications (order confirmations, shipping and delivery notices, verification requests);
  • Send marketing communications where you have consented or as otherwise permitted by law;
  • Respond to customer support inquiries;
  • Improve and analyze the Services, including through aggregated data analysis;
  • Maintain records relating to sales, refusals to sell, misuse concerns, chargebacks, and regulatory compliance;
  • Detect, investigate, and prevent fraud, abuse, and security incidents;
  • Enforce our Terms and Conditions, including for billing, collection, and chargeback rebuttal; and
  • Comply with legal and regulatory obligations and protect our rights and the rights of others.

We do not use personal information to train third-party machine-learning models. We may use de-identified or aggregated data to improve internal analytics.

Request screening: A person reviews wholesale inquiries and research account applications and makes every decision. When automated screening is enabled, we share request details with TypeSafe to help staff identify spam and requests that need closer review. Details may include organization, purchaser type, materials, cadence, destination, documentation requirements, notes, and research descriptions. Dedicated name, email, and phone fields are excluded, but personal information entered in these other fields is shared. Please keep contact details in the dedicated fields and avoid including sensitive personal information in free text. Automated screening does not approve or reject a request.

5. How We Share Your Information

We do not sell, rent, or lease your personal information, and we do not share it with third parties for their own marketing purposes. We may disclose personal information as follows:

  • Service providers: vendors who perform services on our behalf — payment processing, shipping and fulfillment, hosting, email/SMS delivery, customer support tools, analytics, fraud prevention, and identity/age verification. These providers are contractually bound to keep personal information confidential and use it only to provide services to us.
  • Verification providers: vendors or counterparties that help verify identity, age, business status, laboratory affiliation, lawful intended use, or order eligibility.
  • Professional advisors and affiliates: our corporate affiliates, attorneys, accountants, auditors, insurers, financing sources, and other professional advisors as reasonably necessary for business operations and compliance.
  • Legal compliance and protection: to comply with law, regulation, subpoena, court order, or governmental request; to enforce our Terms and Conditions, including billing, collection, and chargeback disputes; or where we believe in good faith that disclosure is necessary to protect our rights, property, customers, or the safety of others — including to investigate suspected misuse of RUO products, identity fraud, export-control or sanctions issues, or violations of our Terms and Conditions.
  • Business transfers: in the event of a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of our assets, personal information may be transferred as part of that transaction, subject to applicable law. We will notify you of any material change in ownership or use of your personal information and any choices available to you.
  • Aggregated/de-identified data: we may share data that cannot reasonably identify you, without restriction.

6. Consumer Health Data (Washington MHMDA and Similar Laws)

Certain laws, including Washington’s My Health My Data Act, broadly define “consumer health data” to include information linkable to a consumer that identifies health status. Origin Eos sells laboratory research materials, does not market products for human use, and does not intentionally collect consumer health data. To the extent any information you voluntarily provide could be characterized as consumer health data:

  • We do not sell consumer health data;
  • We do not use it for advertising, retargeting, or profiling;
  • We do not share it with third parties for their own purposes;
  • We use it only to respond to your inquiry, maintain compliance records under Section 3.4, or as required by law; and
  • We limit internal access to personnel who need it for those purposes.

We do not use geofencing technology around any health care facility to identify, track, or message consumers. Washington residents may exercise MHMDA rights (confirmation, access, withdrawal of consent, deletion, and appeal) by emailing [email protected] with the subject line “Washington Health Data Request.” If your appeal is denied, you may contact the Washington State Attorney General.

7. Cookies and Tracking Technologies

We and our partners use cookies, pixels, and similar technologies to keep you logged in, remember your cart, analyze how the Website is used, maintain security, and support marketing where permitted by law. You can control cookies through your browser settings or our cookie consent tool where available; disabling cookies may limit certain features.

  • Sensitive pages: We may limit or disable third-party analytics and advertising technologies on checkout, account, and verification pages where personal or compliance-related information is collected.
  • Do Not Track: Because there is no common industry standard for DNT signals, the Website may not respond to all DNT signals.
  • Global Privacy Control: Where required by applicable law, we make reasonable efforts to honor a detected GPC signal as a request to opt out of targeted advertising or the sale/sharing of personal information.

Third parties (including analytics providers and ad networks) may use tracking technologies on the Services independently of our control; contact those parties directly with questions about their practices.

8. Data Security

We implement commercially reasonable administrative, technical, and physical safeguards designed to protect personal information from accidental loss and unauthorized access, use, alteration, and disclosure — including encryption in transit, access controls, and PCI-compliant payment processing. No website or online service is completely secure, and we cannot guarantee absolute security. Email, SMS, and chat channels may not be secure; consider carefully what you share through them. You are responsible for protecting your own account credentials.

9. Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Policy, including operating the Services; complying with legal, tax, and accounting obligations; resolving disputes; defending chargebacks and legal claims; preventing fraud; and maintaining the compliance records described in Section 3.4. Retention periods vary by data type: transaction and verification records are generally retained for the period required by applicable law, while marketing preferences are retained until you opt out or request deletion. Research account applications, order attestations, and age confirmations are retained for as long as your account exists and for at least five (5) years after your last order. When retention is no longer necessary, data is deleted, destroyed, or de-identified. Even upon a deletion request, certain information may be retained to fulfill legal, regulatory, contractual, compliance, or dispute-defense obligations.

10. Your State Privacy Rights

Depending on your state of residence, you may have rights under comprehensive state privacy laws (including California’s CCPA/CPRA and similar laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states), which may include the right to:

  • Access/Know: confirm whether we process your personal information and obtain a copy in a portable format;
  • Correct: request correction of inaccurate personal information;
  • Delete: request deletion of personal information, subject to legal exceptions (including the compliance-record retention described in Sections 3.4 and 9);
  • Opt out: of targeted advertising, the sale of personal information, and profiling in furtherance of decisions with legal or similarly significant effects; and
  • Appeal: a decision we make on your request, and not be discriminated against for exercising your rights.

We do not sell personal information for money. Our use of certain advertising cookies may constitute “sharing” for cross-context behavioral advertising under the CCPA; you can opt out through the cookie controls described in Section 7, a “Your Privacy Choices” link where available, or by enabling Global Privacy Control on a supported browser.

How to exercise rights: email [email protected] with the subject line “Privacy Rights Request.” We will verify your identity before completing your request and respond within the time required by your state’s law (typically 45 days). You may designate an authorized agent, subject to verification. To appeal a denial, reply to our decision within 60 days; if your appeal is denied, we will provide information on contacting your state Attorney General or applicable regulator (California residents may contact the California Privacy Protection Agency at cppa.ca.gov).

California — additional disclosures: In the preceding 12 months, we have collected the following CCPA categories: identifiers; customer records information; commercial information; internet or other electronic network activity; approximate geolocation; and professional or eligibility-related information you provide for verification. We disclose these categories to service providers and the other recipients described in Section 5 for the business purposes described in Section 4. We do not use sensitive personal information for purposes beyond providing the Services, so no action is needed to exercise the right to limit its use. California’s “Shine the Light” law: we do not disclose personal information to third parties for their direct marketing purposes.

Nevada residents: we do not currently engage in sales of personal data that trigger Nevada’s opt-out right, but you may submit a request to [email protected].

11. SMS Data

Your phone number and SMS opt-in data are handled in accordance with this Policy and our SMS Terms. We do not sell, rent, lease, or share your mobile phone number or SMS consent data with any third party or affiliate for their marketing purposes. Text-message opt-in data is used solely to deliver the messages described at opt-in.

12. International Data Transfers

We are based in the United States, and personal information may be processed and stored in the United States or other countries where our service providers operate, which may have different data protection laws than your jurisdiction. Where required, we use appropriate safeguards for cross-border transfers.

13. Third-Party Links

The Website may contain links to third-party websites or services not operated by us. We are not responsible for their privacy practices and encourage you to review their policies before providing any information.

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated Policy with a revised “Last Updated” date and, where required by law, provide additional notice of material changes. Your continued use of the Services after changes are posted constitutes acceptance of the revised Policy.

15. Contact Us

To exercise your rights or with questions about this Policy or our data practices, contact:

Origin EOS
Email: [email protected]