PRIVACY POLICY

PepOS Health LLC ("PepOS," "we") makes a mobile app that helps people on provider-prescribed peptide/GLP-1 therapy track their own care and stay connected to their clinic. This policy explains what we collect, how we use it, and the choices you have. We are a tracking and communication tool — not a medical device. We do not diagnose, treat, or dose, and we never sell, source, or recommend any medication.

What we collect

• Account: your email address and, if you choose, your name and sex.
• What you log: meals (with optional photos), weight, injections you record, symptoms, and optional mood / "Life Signal" check-ins.
• Your clinic connection: the invite code that links you to your licensed provider's clinic.
• We do not collect location, contacts, advertising identifiers, or browsing activity.

How we use it

• To provide the app: show your own logs, trends, streaks, and reminders.
• To share your logged data with the clinic you connect to, so your care team can support you.
• Meal photos may be sent to an AI service to estimate protein and calories. The image is sent without your name or identifying details, is used only to return an estimate, and is not used to train models or for advertising.

What we never do

• We never sell your personal or health information, and never use health data for advertising.
• We use no third-party advertising or tracking SDKs. We do not track you across apps or websites.
• No health information is placed in analytics, logs, or crash reports.
• Your health data is scoped to your own clinic only — never visible to another clinic or patient.

Improving PepOS and supporting research

We may create de-identified, aggregate information — overall statistics and patterns that cannot reasonably be used to identify you or any individual — and use it to understand what is working, improve PepOS, and support health research. De-identified, aggregate information is not personal information, is never tied back to you, and is handled in line with applicable law. This never involves selling your personal or health information, and for clinic-connected data it follows the de-identification standards in the Business Associate Agreement.

Storage & security

Data is stored on managed, access-controlled infrastructure (Supabase), encrypted in transit and at rest, with database rules that make it technically impossible for anyone outside your own care relationship to read your records. PepOS is built to HIPAA standards — unique logins, role-based access, automatic session timeout, and permanent audit logging of who viewed or changed what. Real patient health data is only enabled once our HIPAA-eligible tier and provider agreements are in place.

How the law protects your data

• If you connect to a clinic, the information you share becomes Protected Health Information (PHI) under HIPAA. Your provider is the covered entity, and PepOS handles that data as a Business Associate under a signed Business Associate Agreement (BAA).
• If you use PepOS on your own (no clinic connected), your data is still protected — by the FTC Health Breach Notification Rule and applicable state privacy laws (such as California's CMIA and CPRA) — and by this policy.

Who else touches your data

The only outside services we use are the ones needed to run the app: our backend/storage provider and the meal-photo estimate service. Any vendor that could touch health data is required to sign a Business Associate Agreement with PepOS before it does. We share your data with no one else, and we place no health data in advertising or analytics tools.

Your rights

• Access & correction: view and update your information in the app.
• Deletion: permanently delete your account and all logged data at any time (below).
• Disconnect: leave a clinic at any time, which stops any further sharing.
• Revoke consent: withdraw your consent to processing by disconnecting or deleting your account.

How long we keep it

We keep your data while your account is active. When you delete your account, your logged data is removed. Clinic-connected records are retained and returned or destroyed as set out in the clinic's Business Associate Agreement.

Deleting your data

You can delete your account and all of your logged data at any time, right inside the app (Settings → Delete my account), or request it here: peposhealth.com/delete-account. Deletion is permanent and removes your meals, weights, injections, symptoms, mood entries, and profile.

Children

PepOS is intended for adults (18+) under the care of a licensed provider. It is not directed to children.

Changes & contact

We may update this policy and will change the date above. Questions or requests: contact@peposhealth.com.