Last updated 11/21/2024
This policy describes how and why we collect, hold, process and use the personal data of all our employees, interns, job applicants or any individuals supporting business operation of USANA (e.g. onsite external workers, part-time workers) (“you”) and your dependents, emergency contacts, and family members, your rights in relation to your personal data, and how to contact us in the event you have a complaint, whether electronically or manually, in accordance with data privacy and security laws applicable to you in your country, including the Personal Data Protection Law (PIPL) of the People’s Republic of China,the California Consumer Privacy Act (CCPA) (California), the Personal Information Protection Act of Korea, the Personal Information Protection and Electronic Documents Act in Canada, the Philippines’ Data Privacy Act of 2012 (DPA), the Privacy Act 1988 (Cth) (Privacy Act) and Australian Privacy Principles (APPs) in Australia, the Federal Law on Protection of Personal Data Held by Private Parties in Mexico, the Personal Data Protection Act 2012 of Singapore, the General Data Protection Regulation (GDPR), and any other applicable laws, regulations and secondary legislation, as amended or updated from time to time, in the relevant jurisdiction to which the processing relates (collectively, “Data Protection Legislation”).
USANA endeavors to maintain appropriate physical, procedural and technical security over our offices, IT systems and data centers so as to prevent any unauthorized access, disclosure, copying, use or modification of personal data. We are committed to ensuring that our handling of personal data is in compliance with Data Protection Legislation.
Specific data privacy and information practices may apply to you to reflect local practices and legal requirements of a country or region where you are employed, which will be specifically mentioned under the Section "Country / Region Specific Terms" below. If there is any inconsistency between this policy and any of the special language versions, special language versions shall prevail for residents in the jurisdictions they cover.
It is important the personal data USANA holds about you is accurate and current. If you become aware that the personal data we hold about you have become out of date or incorrect (for example, your residence or your bank account details change),please notify your human resources department as soon as possible so that USANA can amend or delete the relevant personal data. Any inaccurate or false personal data may delay or prevent us from providing you with certain employment benefits.
USANA is an established leader in the health and wellness industry and develops, manufactures and sells nutritional supplements,foods, energy, personal care and skincare products. USANA operates at worldwide offices. For purpose of this policy, USANA Health Sciences, Inc., as well as all and any of its worldwide subsidiaries and affiliates, would be jointly and severally referred as to “USANA”, "we", “us”, “our” and “ours”.
For the purpose of the Data Protection Legislation,we are the “data controller” or the similar concept. This means that we are responsible for deciding how we hold and use personal data about you. We are required under the Data Protection Legislation to notify you of the information contained in this policy.
Should you have any questions regarding this policy, you can contact our data protection officer by email: dataprivacy@usanainc.com (or dataprivacy@baoying.com for those located in China) or the local Data Protection Officer as follows. Please mark all correspondence with: “FAO Data Protection Officer”.
You may also contact the data protection officer using the contact details provided in “Contact Us” link at the bottom of our website homepage to the extent that a local data protection officer is required under the applicable Data Protection Legislation.
Personal data refers to any information which you provide to us or generated as a result of applying to, being recruited by, and working at the worldwide offices of USANA, that relates to you or an identified or identifiable individual. Where appropriate,personal data will be obtained directly from you. In the event personal data is obtained from any other source, you will be notified or your authorization will be obtained where legally required.
For the purposes of your employment with USANA, examples of types of personal data we may process include:
· Your personal data, such as full name (current and former); contact information (e.g., home address, home or mobile telephone numbers, personal email address, etc.); nationality;citizenship; ethnic origin, social security, driver’s license number, or other national identification numbers; passport information; gender; marital status or copy of the marriage contract; date of birth; height and weight; biometric information (e.g., fingerprints); medical history; travel information (e.g.,seating/meal/vendor preferences, disabilities necessitating special services,etc.); bank account and other financial information; photograph; educational background and qualifications; knowledge of foreign languages; prior employment history; credit records or medical records; criminal record or history.
· Your dependents, emergency contacts, and family members’ personal data, such as information regarding dependents(including name, gender, date of birth, relationship, and national identity information); emergency contact information (e.g., name, relationship, mobile phone numbers); spouse or domestic partner information (including date of birth, gender, contact information, occupation, and national identity information); national identification numbers; benefits information. If you provide USANA with personal data about foregoing individuals, it is your responsibility to inform them of this policy and their rights with respect to such data.
· Personal data related to your application,such as information regarding potential conflicts of interest; background checks of credentials, criminal history, credit history, etc.; prior applications to USANA; information obtained from you or others in connection with your job application, including your CV, application letter, and/or resumé; assessment reports from external recruiting companies, student records(including proof of graduation, information about degrees obtained),professional certification records, etc.
· Personal data collected through or developed during your working at USANA, such as job title;work location and email address; business unit and department; internal identification numbers; work-related passwords and access codes; work telephone numbers; employment terms, hire and service dates; IP address; supervisor; working status;employment status; payroll, tax, bonus, benefits and related information(including data regarding raises and salary adjustments); performance evaluations and assessments; information concerning internal disciplinary action, HR complaints, or in connection with a USANA internal or external investigation; photographs, images, and videos taken for work-related purposes or in work settings; absence, such as dates of authorized leave/holidays,maternity/paternity/shared parental leave, birth of a child, training/study leave, leave for family responsibilities, sick leave.
· Personal data on the control of working time and access to systems and buildings,such as CCTV images, magnetic card access data from working time recording software analytics, customer preferences; geolocation data; as well as data relating to the use of the Internet, computer tools and systems, devices, email and telephone. If you fail to provide certain information when requested, it may delay or prevent us from handling the job application, employing you, executing the employment contract with you, performing the employment contract we have entered into with you, providing certain benefits to you, and/or we may be prevented from complying with our legal obligations or continuing to employ you.
The categories and scope of personal data we collect about you may vary from time to time, depending on your employment status with us, as well as the country or region where you are employed. We will seek to notify you and obtain your consent as legally required, if this is the case in due course.
Depending on the applicable Data Protection Legislation, some of the personal data we collect may be sensitive personal data. For example, USANA may process identification information (e.g., national identification number and tax ID number) to administer the salary and other employment conditions; process health-related personal data (e.g., absence records associated with illness or accidents, including related to exposure to certain materials or contaminants; maternity leave; disabilities; work-related injuries or claims; etc.) to comply with labor, social security, or other legal obligations or to ensure a safe and healthy workplace, including, where legally permissible, health-related data necessary to assess workplace safety measures and precautions pursuant to guidance issued by public health authorities (e.g.,COVID-19 exposure, testing, or vaccination status). Health-related personal data will be processed and secured as required by Data Protection Legislation. USANA may process your biometric data for the purpose of identifying you to allow you to access USANA buildings and systems or to ensure a safe and healthy workplace.
We may also collect/process other sensitive personal data about, from time to time (e.g., where you choose to provide such information in a resume). We will only collect sensitive personal data about you in accordance with the applicable Data Protection Legislation, such as on the basis of your.
USANA will process your sensitive personal data only for the purposes for which you originally provided it to USANA, including the purposes set out in this policy, unless you agree otherwise or for other specific reasons such as if the use or disclosure of this information is required by law.
For the purpose of providing benefits for your dependents under certain circumstances, we may need to collect personal data (and sensitive personal data as necessary) of your dependents who have not yet reached the minimum age of minors defined in your jurisdiction.You are free to refuse to disclose any of such personal data to us and if so, we will not be able to provide corresponding benefits for your dependents.
Where lawfully permitted, the purposes for which USANA processes your personal data are,in part, specified below:
· Human resource management, including managing our employees, assessing the employment applicants; assigning managers and reporting lines; establishing job responsibilities; training; managing employee files; creating and entering into employment agreements (when applicable), processing working hours and monitoring sickness and other absences; administering performance assessments; administering and maintaining training; distributing internal notices and announcements, facilitating internal or external communication (via email, phone, video, or otherwise) for work purposes; ensuring the health and safety of employees and workplace, filing reports with government agencies, and facilitating attendance in any work-related cultural, and social events and activities;
· Provision of compensation and benefits, including administering and maintaining base pay, bonus, and any other compensation; providing health and welfare benefits, retirement benefits, statutory benefits, equity programs, and expatriate programs; employee product purchases; and disability accommodations;
· If you travel on USANA business, including facilitating travel and accommodation;
· Security and IT management, including providing access to USANA Information Systems; conducting IT security assessments,measures and procedures; maintaining USANA Information Systems; monitoring for suspicious, malicious, or unauthorized access or usage of IT systems and the internet;
· Compliance needs, including monitoring, investigating, and enforcing compliance with USANA’s internal policies and/o requirements under applicable laws; disclosing to governmental authorities or other entities in response to compulsory legal process; defending against any claim or defense before any jurisdictional, police, law enforcement, regulatory, and/or administrative authority, arbitration tribunal.
We will only use your personal data for the purposes for which we originally collected it,unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you, seek your appropriate consent if legally required, or explain the legal basis other than the consent which allows us to do so.
By submitting personal data to USANA, you agree that we may collect, use and disclose such personal data in accordance with this policy and as permitted or required by law. If required by applicable Data Protection Legislation, we will seek to obtain your special consent (express or separate) to process your personal data, and only process your personal data upon receiving such consent.
There are circumstances where collection, use, or disclosure may be justified or permitted by applicable Data Protection Legislation, or where we are obliged to disclose personal data without your consent. These circumstances could include,but are not limited to, our processing of your personal data for a legitimate interest, for purposes necessary for the performance of a contract with you, for purposes necessary for human resource management, or for complying with our legal obligations.
Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.
USANA will share your personal data with third parties where required by law, where it is necessary to perform the contract we have entered into with you, based on your consent or other legal bases as legally permitted.
Where applicable Data Protection Legislation permits, USANA may share such personal data from time to time with the following third parties, which will be bound by confidentiality obligations:
· Other entities within the USANA group (“USANA Organization”), those USANA employees, directors, managers, and its local and foreign associated/affiliated companies who have a need to access your personal data to carry out their responsibilities, if necessary for the purposes listed in this policy. Please visit the “Contact US” link on your market’s USANA homepage for a list of entities within the USANA Organization. Such data access will strictly take place on a “clear need to know” basis and only for authorized purposes, in order for the recipients to fulfill the processing purposes in their capacity;
· Third parties that help us offer additional benefits to you (for example, commercial medical insurance);
· Third parties that help us run our business, agent, contractor, supplier, vendor, or third party service providers who provide administrative, IT, marketing, payroll, recruiting, third-party logistics providers, printing, fulfillment, web-tools, fraud prevention, corporate travel or other services to USANA or its affiliated companies;
· Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, security, insurance and accounting services;
· Government tax authorities, regulators and other government agencies that require reporting of processing activities in certain circumstances; and
· Law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.
All USANA third-party service providers are required by law to take appropriate security measures to protect your personal data. We also impose contractual obligations on service providers to ensure they can only use your personal data to provide services to us and to you in accordance with legal requirements and with our instructions, and that they will take appropriate security measures to help prevent unauthorized or accidental access, processing,erasure, loss or use of the data transferred to these service providers for processing. USANA only permits them to process your personal data for specified purposes and with appropriate security measures in place.
USANA may also disclose your personal data to third parties as a result of or in preparation for the possible sale, merger,consolidation, change in control, transfer of substantial assets,reorganization, or liquidation of USANA. If any change happens to the original process purpose or method, or otherwise required by the applicable Data Protection Legislation, then the new owners may notify you and request your consent accordingly.
Under certain circumstances,it is necessary for us to share your personal data with parties outside the country where you are located. Specifically, our primary servers and head office are located in the United States, and many of USANA’s agents, contractors, suppliers, vendors, and third-party service providers, or competent supervisors are also situated worldwide, so it may be necessary to transfer, disclose, store or process your personal data outside of the country in which it is collected.
Whenever USANA conducts any such international transfers of your personal data, we will ensur that such transfer is in compliance with applicable Data Protection Legislation.
USANA endeavors to maintain appropriate physical, procedural and technical security measures over our offices and data centers so as to prevent any unauthorized access,disclosure, copying, use or modification of personal data. USANA has put in place security measures appropriate to protect against the risk of personal data being used, or accessed in an unauthorized way, or altered, or disclosed.
We use secure computer data networks protected by industry standard firewalls and password protection systems. We take security measures to protect your personal data against unauthorized access.
USANA has also put in place measures and procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. We will take commercially reasonable steps to ensure that any personal data held by us is reasonably protected against unauthorized or accidental access, processing, erasure, loss, or use.
Notwithstanding the foregoing, USANA shall comply with all the minimum required security measures provided by the relevant data privacy laws in your respective jurisdictions and follow the mandatory procedures for data breaches and investigations thereof. Nothing in this Policy shall be interpreted to mean that USANA shall offer data privacy and protection standards below those required under the data privacy laws in your jurisdiction.
USANA will only retain your personal data for as long as is necessary to fulfill the purposes for which it is collected, which retention period is determined by the nature and duration of your relationship with USANA. This is subject to cases in which we may need to retain your data for longer than the retention period in order to comply with a legal requirement, such as a litigation hold or government investigation.
Different retention periods apply for different types of personal data and also upon your country of residence. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances, USANA may permanently anonymize or take other similar technical methods related to the personal data so that it can no longer be associated with you, in which case USANA may use such anonymized data without further notice to you. When your personal data is no longer required, we will destroy, permanently anonymize, or take other similar technical methods to prevent unauthorized parties from gaining access to such data.
We will respond and honor your request as entitled to data subjects, on a case-by-case basis, in accordance with the applicable Data Protection Legislation. Under certain circumstances, as proscribed by applicable Data Protection Legislation in your country/region, you may have the right to:
· Request access and copy to your personal data. This enables you to receive details of the personal data we hold about you and to check that we are processing it lawfully;
· Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected;
· Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing;
· Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example, if you want us to establish its accuracy or the reason for processing it;
· Withdraw consent to our processing of your personal information. You can exercise this option at any time by contacting us, using the contact details outlined above. Once we have received notification that you have withdrawn your consent, we will no longer process your personal data for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in accordance with applicable Data Protection Legislation;
· Request the transfer of your personal data to another party;
· Make a complaint if you believe that USANA has breached this policy or applicable Data Protection Legislation; and
· Other rights as authorized and permitted by the applicable Data Protection Legislation.
If you want to exercise any of the above rights, including the right to withdraw consent to the processing of your personal data, please contact USANA at dataprivacy@usanainc.com. We will deal with the foregoing request and provide a response thereto within 30 days unless the applicable Data Protection Legislation otherwise requires/permits, provided that we have all the necessary information. In cases where further information, assessment,or investigation is required, we will seek to agree on alternative time frames with you. When you request the erasure/restricted processing of your personal data or withdraw your consent to the processing of your personal data, please note that this may give rise to the termination of our relationship with you or prevent us from providing you with certain employment benefits if permitted by the applicable Data Protection Legislation. If you are not satisfied with our response or believe we are not lawfully processing your data you can also complain to a supervisory authority at any time.
You will not have to pay a fee to access your personal data(or to exercise any of the other rights). However, we may charge a reasonable fee if any request made by you is clearly unfounded or excessive if permitted by applicable Data Protection Legislation. Alternatively, we may refuse to comply with the request in such circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information(or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
We may change this policy from time to time. Any changes we may make to this policy in the future will be posted on USANAverse. Where changes to this policy will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient advance notice, and/or appropriate consent if required by applicable Data Protection Legislation.
If you reside in China, BabyCare Ltd.and its subsidiaries, or sister companies in China (collectively, "BabyCare", "we", "us", "our" and "ours") as the data controller, is obliged to protect your personal data in accordance with the PIPL and other applicable regulations and disclose the following details about our collection and processing of your personal data. Should you have any questions regarding this policy or request to exercise your data subject rights, you can contact our China Data Protection Officer Haiqing Zhao by email at dataprivacy@baoying.com.
The copy of the ID card, bank account information, passport number, health record,marriage license, and credit history are considered sensitive personal data under the PIPL, and thus we will obtain your separate consent prior to any processing of such data, unless we have other legal bases (most commonly, if it is necessary for our human resources management in accordance with the legally adopted labor rules and regulations), and take strict protection measures during the period we retain such data.
We may share your personal information with USANA Health Sciences, Inc. (our parent company),other entities within USANA Organization, third-party vendors employed by us,within or outside the territory of China, if necessary for the above-mentioned purposes as permitted under applicable laws. Please visit the “Contact US” link on your market’s USANA homepage for a list of entities within the USANA Organization.
We would request your separate consent for the foregoing sharing of your personal information, unless we have other legal bases (most commonly, if it is necessary for our human resources management in accordance with the legally adopted labor rules and regulations), and have taken practicable steps to guard your personal information against any unauthorized, intentional, or accidental access, disclosure, modification, or destruction under such circumstances, per applicable legal requirements. In the event of an international transfer, we would pass the governmental security assessment, third-party certification or conclude a standard contract with the offshore recipient, and ensure the personal information protection level of such offshore recipient, as required by the applicable laws and regulations.
In certain circumstances, we would have to share your personal information (e.g., birth date, mailing address, personal ID number,telephone number, date employed, position held, salary information, etc.) to cooperate with governmental agencies, courts, or other public bodies for your benefit or to perform our obligations under the applicable laws and regulations, and keep such provision of your personal information confidential when required by the foregoing bodies.
You may contact dataprivacy@baoying.com to check the list of affiliates and third parties, within or outside of China, that may receive your personal information, and respectively their contact information, the purposes and methods of their personal information processing activities, the type of personal information they would receive, and request a copy of these appropriate guarantees by contacting us.
In relation to your rights, we will protect your data subject rights in accordance with this policy and the PIPL. Please contact us at dataprivacy@baoying.com. We will deal with your request and provide a response thereto within 15 working days,provided that we have all the necessary information. In cases where further information, assessment, or investigation is required, we will seek to agree on alternative time frames with you.
Your marital status, date of birth, gender, ethnic origin, biometric information, medical history, and identifying documentation issued by government agencies (tax ID number, ID cards, passport,etc.), as well as those of your dependents, emergency contacts, and family members, are considered sensitive personal data under the DPA, and thus we will obtain your separate consent prior to any processing of such data, unless we have other legal bases (most commonly, when processing is provided for by existing laws and regulations such as labor rules and regulations: provided,that said laws and regulations do not require the consent of the data subject for the processing, and guarantee the protection of personal data), and take strict protection measures during the period we retain such data.
In Australia, your personal data is collected, used or disclosed in accordance with the Privacy Act and the APPs by USANA Australia Pty Ltd. For the avoidance of doubt, reference to “process” or “processing” in this policy includes a reference to the collection, use or disclosure of personal data.
As mentioned above at ‘6. To whom we may disclose or transfer your personal data’, your personal data may be shared with our affiliates, subsidiaries and other third parties, who may be located in a different country to you (Overseas Recipients). These Overseas Recipients may be located in various jurisdictions, such as the United States,which may not afford the same protections as Australia. Where your personal data is transferred to Overseas Recipients, we will take reasonable steps to ensure that the Overseas Recipients will handle your personal data in accordance with the Privacy Act and APPs. These steps may include entering into contractual arrangements to safeguard your personal data where appropriate.
If you are located in Australia, you have the following rights in respect of your personal data that we hold:
· you may request access to personal information that we hold about you; and
· you may request the correction of your personal information if it is inaccurate, out-of-date,incomplete, irrelevant or misleading.
You can ask for access or correction of your personal data by contacting us at our One Trust Portal, which you can find on the USANA website. If we refuse to give you access to, or correct, your personal data, we must notify you in writing setting out the reasons.
If you have any queries or complaints about this policy or consider there has been any breach of the APPs, please contact us in writing. If you are dissatisfied with the outcome of the complaint or the way in which the complaint was handled, then you may contact the Office of the Australian Information Commissioner (OAIC).
(1) This Privacy Policy is considered a full Privacy Notice in terms of the data protection and privacy legal framework in Mexico.
(2) Your express, written consent is our legal basis to process your personal data.
(3) Data Controller: USANA Mexico, S.A. de C.V. (“USANA Mexico”), located at Av. Paseo de las Palmas 525, piso no. 8, Col. Lomas de Chapultepec, Del. Miguel Hidalgo, Mexico D.F. C.P 11000, is the controller of your personal data.
(4) Personal Data Collected. Health-related data and background checks mentioned in Section 3 are considered sensitive personal data in Mexico.
(5) Processing purposes: All the processing purposes mentioned in Section 4 are considered primary purposes. We may also process your personal data for the following ancillary purposes: sending you marketing communications, news and other information that USANA Mexico considers relevant. You may opt-out to ancillary purposes by sending us an email at dataprivacy@usanainc.com.
(6) Your Rights. In addition to the rights mentioned in Section 9, you have the following rights: i) object the processing of your personal information; and ii) limit the use or disclosure of your personal data.
If you want to exercise any of the rights set forth in Section 9 or the rights previously mentioned please send us an email at dataprivacy@usanainc.com. Your request must include: (i) full name; (ii) a copy of your official identification; (iii) a description of the personal data which is intended to be exercised; and (iv) any other element or document that facilitates the location of your personal data.We will respond to any complete request within 20 business days. The response will indicate whether the request is admissible. If it is admissible, we will make the determination within 15 business days from the date you communicate the response. The deadlines may be extended in accordance with the applicable law. If you exercise your right of access, we will provide digital documents.
The right to request the transfer of your personal data to a third party does not apply in Mexico.
(7) Data Transfers. Your consent is not required for the data transfers to“third parties” mentioned in Section 7. With your consent to this privacy notice you also consent the data transfers to “other third parties” mentioned in Section 7.
