Privacy policy

DOCUMENT 1 — PRIVACY POLICY

Last updated: July 14, 2026

Riverwell is a brand operated by Media Magma LLC ("we", "us", "our"), 30 N Gould Street, Suite R, Sheridan, WY 82801, United States. Media Magma LLC is the data controller responsible for your personal information.

We operate this store and website, including all related content, features, tools, products and services (the "Services"). Riverwell is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase using the Services, or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Consumer health data. Riverwell sells an oral care product. If you send us photos of your throat in connection with our money-back guarantee, or describe symptoms or oral health conditions when contacting us, that information is consumer health data and is governed by our separate Consumer Health Data Privacy Policy, not by this document. Consumer health data is never used for advertising, never sold, and never shared with advertising or analytics platforms.

Personal Information We Collect or Process

When we use the term "personal information," we are referring to information that identifies or can reasonably be linked to you. It does not include anonymous or de-identified information. Depending on how you interact with the Services and where you live, we may collect or process:

Contact details — name, billing address, shipping address, phone number, email address.
Financial information — payment card information, transaction details, form of payment, payment confirmation. Card numbers are processed by our payment providers; we do not store them.
Account information — username, password, preferences and settings.
Transaction information — items you view, add to your cart, purchase, return or cancel, and your past transactions.
Communications with us — the content of your emails and support requests.
Device information — device, browser, network connection, IP address and other unique identifiers.
Usage information — how and when you interact with or navigate the Services.

Where It Comes From

Directly from you — when you place an order, create an account, or contact us;
Automatically through the Services — from your device, via cookies and similar technologies;
From our service providers — when they process information on our behalf;
From our partners — including advertising and analytics partners.

How We Use Your Personal Information

Provide and improve the Services. To perform our contract with you, process payments, fulfil and ship your orders, handle returns, refunds and guarantee claims, manage your account, and improve how the Services work.
Marketing and advertising. To send you marketing communications by email, and to show you online advertisements, including based on your activity on our site. We do not use consumer health data for marketing or advertising.
Security and fraud prevention. To authenticate your account, secure payments, and detect or investigate fraudulent, unsafe or abusive activity — including abuse of our refund and guarantee policies.
Communicating with you. To provide customer support and respond to your requests.
Legal reasons. To comply with applicable law, respond to valid legal process, and establish, exercise or defend legal claims.

How We Disclose Personal Information

With Shopify and other service providers acting on our behalf (payment processing, fulfilment and shipping, email and customer support, cloud storage, analytics).
With advertising and marketing partners, to advertise to you. We use Shopify to support personalized advertising with third-party services based on your activity across merchants and websites. These partners use your information under their own privacy notices. Consumer health data is excluded from this sharing. Depending on where you live, you may direct us not to share your information for targeted advertising.
When you ask us to, for example to ship your order.
In connection with a business transaction such as a merger, acquisition or bankruptcy; to comply with legal obligations; to enforce our terms; and to protect our rights and the rights of others.

We do not sell your consumer health data.

Relationship with Shopify

The Services are hosted by Shopify Inc., which collects and processes personal information about your use of the Services in order to provide and improve them. Information you submit may be transmitted to Shopify and to third parties located in countries other than where you live. We also use Shopify enhanced features that draw on data from your interactions with our store, other merchants, and Shopify. In those circumstances Shopify is responsible for the processing of your personal information, including responding to requests about it. To learn more, see the Shopify Consumer Privacy Policy (shopify.com/legal/consumer-privacy-policy) and the Shopify Privacy Portal (privacy.shopify.com/en).

Third-Party Websites and Links

The Services may link to websites operated by third parties. We do not control them and are not responsible for their privacy practices, security, or the accuracy of their content. Review their policies before providing information. Our inclusion of a link does not imply endorsement.

Children's Data

The Services are not intended for children, and we do not knowingly collect personal information from anyone under the age of majority in their jurisdiction. If you are the parent or guardian of a child who has provided us with personal information, contact us using the details below and we will delete it. As of the effective date of this policy, we do not have actual knowledge that we sell or share the personal information of individuals under 16 years of age.

Security and Retention

No security measures are perfect. Information you send us may not be secure in transit — please do not use unsecured channels to send us sensitive or confidential information.

We keep your personal information for as long as we need it:

Order and transaction records — as required by tax and accounting law;
Account information — while your account is open;
Support communications — up to 24 months;
Photos submitted with a guarantee claim — deleted within 30 days of the claim being closed (see our Consumer Health Data Privacy Policy);
Marketing data — until you unsubscribe or object.

Your Rights and Choices

Depending on where you live, you may have some or all of these rights. They are not absolute and may not apply in all circumstances.

Access / know — request access to the personal information we hold about you.
Delete — request that we delete it.
Correct — request that we correct inaccurate information.
Portability — receive a copy, and have it transferred to a third party, with certain exceptions.
Opt out of sale or sharing for targeted advertising — If you visit our website with the Global Privacy Control signal enabled, we will treat this as an opt-out request for that device and browser, and — where we can link it to a Shopify account — for that account. We do not recognize other "Do Not Track" signals.
Manage communication preferences — unsubscribe from marketing emails at any time via the link in any email. We may still send you non-promotional messages about your account and orders.

If you live in the UK or the European Economic Area, you may also object to or restrict processing, and withdraw consent where we rely on it (withdrawal does not affect processing carried out before it).

To exercise any right, email contact@useriverwell.com. We may need to verify your identity. You may appoint an authorized agent; we will require proof of authorization. We will respond within the time required by law, and we will not discriminate against you for exercising your rights.

Complaints

Contact us first, using the details below. Depending on where you live, you may appeal our decision, or lodge a complaint with your local data protection authority. In the EEA, the list of supervisory authorities is published by the European Data Protection Board.

International Transfers

We may transfer, store and process your personal information outside the country where you live. Where we transfer personal information out of the EEA or the UK, we rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses, or an equivalent, unless the destination country has been found to provide an adequate level of protection.

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or for operational, legal or regulatory reasons. We will post the revised version here, update the "Last updated" date, and provide notice where the law requires it.

Contact

Media Magma LLC 30 N Gould Street, Suite R, Sheridan, WY 82801, United States contact@useriverwell.com · +1 (307) 298-6948

For the purposes of applicable data protection law, Media Magma LLC is the data controller of your personal information.

DOCUMENT 2 — CONSUMER HEALTH DATA PRIVACY POLICY

Effective date: July 14, 2026

This Consumer Health Data Privacy Policy applies to the consumer health data we collect through useriverwell.com. It supplements our general Privacy Policy and is provided in accordance with the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law (SB 370), and other applicable state privacy laws.

Riverwell is operated by Media Magma LLC, 30 N Gould Street, Suite R, Sheridan, WY 82801, United States. Media Magma LLC is the controller of the consumer health data described below.

What Consumer Health Data We Collect

We collect consumer health data only in limited, specific situations:

Photos you send us. If you claim our 60-Day Money-Back Guarantee, you send us a "before" and an "after" photo of your throat. These images are consumer health data.
Information in your messages. If you describe symptoms, oral health conditions, or your experience with the product when you contact customer support, leave a review, or make a guarantee claim, that information is consumer health data.
Purchase information. The fact that you purchased the Riverwell Tonsil Stone Cleaner, an oral care product, may itself be treated as consumer health data under some state laws.

We do not collect biometric data, medical records, genetic information, precise location data, or data from any health app or device.

Where It Comes From

We collect this data directly from you — from the photos and messages you choose to send us, and from the orders you place with us. We do not purchase consumer health data, and we do not obtain it from data brokers or third-party sources.

Why We Collect It

We use consumer health data for these purposes only:

To verify and process your 60-Day Money-Back Guarantee claim;
To respond to your customer support requests;
To detect and prevent fraud or abuse of our guarantee;
To comply with the law and to establish, exercise or defend legal claims.

We do not use consumer health data for advertising, marketing, profiling, or targeted advertising of any kind. We do not use it to build customer profiles or to personalize what you see.

Consent

We ask for your explicit consent before you send us any photo. When you contact us to claim the guarantee, we reply with a notice explaining how your photos will be used, and we ask you to confirm your consent in writing before you send them. We do not process photos received before consent has been recorded.

You can withdraw your consent at any time by emailing contact@useriverwell.com. Withdrawing consent means we can no longer process a pending guarantee claim, since the photos are what the claim is based on.

Who We Share It With

We share consumer health data only with service providers who process it on our behalf, under contract, and only as needed to run the business:

Shopify Inc. — the platform that hosts our store and processes your orders;
Our email and customer support provider — which stores the emails and photos you send us;
Our payment processor — which processes the refund itself (it does not receive your photos);
Legal and professional advisors, and law enforcement or regulators, where required by law or valid legal process.

We do not sell consumer health data. We do not share it with advertising networks, analytics providers, data brokers, or social media platforms. We will not sell your consumer health data without obtaining your separate, valid authorization first, as required by law.

Advertising and Tracking

We do not fire advertising or analytics pixels on the basis of consumer health data, and we do not transmit consumer health data to advertising platforms. Our advertising and analytics tools do not receive your photos, your support messages, or any inference about your health.

How Long We Keep It

Photos submitted with a guarantee claim are deleted within 30 days of your claim being closed.
Support messages containing health information are kept for as long as needed to handle your request, and no more than 24 months.
Order records are kept as required by tax and accounting law.

Your Rights

If you are a Washington or Nevada resident, or a resident of another state granting these rights, you may:

Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data;
Obtain a list of all third parties with whom we have shared it, with contact details;
Withdraw your consent to our collection and sharing of it;
Request deletion of your consumer health data from our records, including from our archived and backup systems.

We will not discriminate against you for exercising these rights. Withdrawing your consent or requesting deletion of your photos means we will no longer be able to process a pending guarantee claim, since the photos are what the claim is based on.

To exercise any of these rights, email contact@useriverwell.com with the subject line "Health Data Request". We will verify your identity, respond within 45 days, and may extend once by a further 45 days where reasonably necessary, with notice to you.

Authorized agents. You may designate an agent to act on your behalf. We will require proof of your authorization and may ask you to verify your identity directly.

Appeals

If we decline your request, we will tell you why in writing and explain how to appeal. To appeal, reply to our decision or email contact@useriverwell.com with the subject line "Health Data Appeal". We will respond within 45 days. If we deny your appeal, you may contact the Washington State Attorney General (atg.wa.gov/file-complaint) or your state's Attorney General.

Changes

We may update this policy. We will post the revised version here, update the effective date, and — where the law requires it — obtain your consent before applying material changes to data we already hold.

Contact

Media Magma LLC 30 N Gould Street, Suite R, Sheridan, WY 82801, United States contact@useriverwell.com · +1 (307) 298-6948