Privacy policy

RootFix Privacy Policy

Who we are

RootFix (rootfixstore.com) is the online supplement store of GrassRoots Functional Medicine, 89 South Main Street, West Lebanon, NH 03784. In this policy, "we," "us," and "our" mean GrassRoots Functional Medicine as the operator of RootFix.

This policy explains what personal information we collect when you visit the store, buy from us, or join our email list, and what we do with it. It covers the store only.

Shopping at RootFix isn't part of your medical care, and what you share with the store doesn't go into a medical record. If you're a patient of GrassRoots Functional Medicine, your clinical records are handled under our separate Notice of Privacy Practices. Please don't send health details or medical questions through store channels. Call the clinic instead.

What we collect

We collect three kinds of information.

What you give us. When you place an order, create an account, or contact us, we collect your name, email address, phone number, and billing and shipping addresses. If you take our product quiz, we keep your answers so we can suggest products. If you sign up for emails, we keep your email address and your subscription choices.

Order and payment details. We keep a record of what you bought, when, and what you paid. Card payments are handled by Shopify Payments. We never see or store your full card number.

What your browser sends automatically. Like most online stores, ours collects basic technical information when you visit: IP address, browser and device type, the pages you looked at, what you added to your cart, and how you got to the site. Shopify collects this through cookies so the store works and so we can see which pages people use.

How we use it and who sees it

We use your information to process and ship orders, send order and shipping updates, handle returns and refunds, answer your questions, prevent fraud, keep the store running, and, if you've opted in, send you product news and education.

We don't sell your personal information. We don't share it for targeted or cross-context behavioral advertising.

We share it only with the companies that help us run the store, and only what they need:

We'll also disclose information if the law requires it, to protect our rights or someone's safety, or if the business is ever sold or merged (in which case this policy would still apply to your information).

Cookies, email, and how long we keep things

Cookies. Shopify uses cookies to keep your cart, run checkout, and give us basic visit statistics. You can block or delete cookies in your browser settings, but the cart and checkout won't work without them. We honor Global Privacy Control signals from your browser.

Emails. Order and shipping emails are part of buying from us. Marketing emails only go to people who opted in. Every one has an unsubscribe link, or you can email us and we'll take you off the list.

How long we keep it. Order and payment records stay as long as tax and accounting rules require, which is generally seven years. Account information stays until you ask us to delete the account. Email list information stays until you unsubscribe.

Security. Shopify's checkout is PCI DSS compliant and encrypts your payment details. We limit store access to the few people on our team who need it. No system is perfectly secure, and if a breach ever affected your information, we'd tell you as the law requires.

Children. RootFix is for adults. We don't knowingly collect information from children under 13. If you think a child has given us information, email us and we'll delete it.

Your rights

Wherever you live, you can ask us to:

• show you the personal information we have about you
• correct anything that's wrong
• delete your information (we may need to keep order records for taxes)
• send you a copy in a usable format
• stop marketing emails

Email info@grassrootsfm.com with your request. We'll confirm who you are using the email address on your order or account, and we'll answer within 45 days. We won't charge you or treat you differently for asking. If we turn down a request, we'll tell you why and how to appeal, and you can contact your state attorney general if you disagree with the result.

California residents. In the past 12 months we've collected identifiers (name, email, phone, address), commercial information (purchase history), and internet activity (browsing on our site), from you and your browser, for the purposes listed above. We haven't sold or shared any of it for cross-context behavioral advertising, and we don't collect sensitive personal information to infer things about you. You can also make a request through an authorized agent. Under California's "Shine the Light" law, you can ask whether we disclosed information to third parties for their direct marketing. We don't. Our site doesn't change behavior based on "Do Not Track" signals, but it does honor Global Privacy Control.

Outside the United States. RootFix sells to customers in the U.S. If you visit from elsewhere, your information is processed in the United States.

Changes and contact

If we change this policy, we'll post the new version here with a new effective date. If a change is significant, we'll email customers who have accounts or are on our list.

Questions or requests go to:

GrassRoots Functional Medicine (RootFix) 89 South Main Street, West Lebanon, NH 03784 info@grassrootsfm.com

Effective October 20, 2026.