Privacy policy

This policy covers the PEPLUX website and anyone who visits it. Today the website is informational: it has no account sign-up, no intake, no checkout, and no mailing or sign-up list.

When the intake goes live, it will run on a separate intake service operated for PEPLUX by a telehealth technology provider, which will show its own privacy notice before you give any information. Clinical care will be provided by licensed providers in the Arora Health network, an affiliated clinical organization, and medication will be dispensed by independently licensed US pharmacies. Each of those is a separate organization with its own privacy obligations and notices. Before the intake goes live, this policy and those notices will be aligned so that they say the same thing.

This policy does not cover third-party sites we link to, such as FDA documents.

The website does not ask you for your name, email address, phone number, or any health information, and it has nowhere to send them. What it does collect is limited to:

• Request information. Like any website, the servers that deliver these pages receive your IP address, browser details, and the address of the page requested. The hosting provider uses this to deliver the site and protect it from abuse.
• Page analytics, described in analytics below.

The website uses Vercel Web Analytics, provided by Vercel Inc., to count page views and understand which pages are useful. It does not use cookies, and we do not use it to identify you or to follow you across other websites.

For each page view it records:

• the address of the page. A page address can name a product, for example a product page, a status page, or the /start page with a product selected;
• the site that referred you, if any; and
• general technical details such as browser, operating system, device type, and country.

When you click a button that we track, such as a button that leads toward the intake, it also records which button it was, the path of the page it was on, the website the button leads to, and whether the intake was live. It never records what you type into a form.

Google Analytics is not running on this website today. No Google tag is loaded and nothing is sent to Google.

If we turn it on later, it will work like this, and this policy will be updated before it starts:

• It will run only on the public production website, never on preview versions.
• The Google tag will load with every storage and advertising signal set to denied. Loading the tag is itself a request to Google’s servers, but no analytics event will be sent until you grant consent through a consent control on the site.
• Page addresses sent to Google will be reduced to their template (for example /peptides/[slug]), so no product name is sent. No product or condition will be sent in any field.
• It will never be linked to Google Ads or any other advertising platform.

The website does not set cookies of its own. Its use of your browser’s storage is limited to two things:

• Campaign parameters. If you arrive from a link that carries campaign tags (for example utm_source or a click identifier), those tags are held in your browser’s session storage so they can be added to the link when you go on to the intake, and for no other purpose. They are not sent to PEPLUX’s servers. They are kept for no more than 30 days, and session storage is normally cleared when you close the tab. This is switched off until the intake is live, so nothing is stored today.
• Analytics consent. If Google Analytics is turned on, the site will keep a record in your browser storage of whether you granted analytics consent. Nothing reads or writes that record today, because Google Analytics is not running and there is no consent control.

The /start page shows a summary of your selected product, or the product catalog if no product is selected. There is no form to complete. The page does not collect medical information, contact details, or payment, create an account, place an order, or sign you up for anything. The checkout button is inactive.

The page view itself is counted by the analytics described above, and its address can include a product name if you arrived from a product page.

The website has no advertising pixels or tags: none from Meta, TikTok, Snap, Google Ads, or any other advertising platform. We do not upload customer or visitor lists to any advertising platform. We do not use health information, or the pages you read, to target advertising to you.

The intake is not live, so no health information is collected today. When it is live, the intake will ask for the information a provider needs in order to decide whether treatment is appropriate. That is expected to include:

• your name, date of birth, contact details, shipping address, and the state you are in, because a provider must be licensed there and the service is for adults only;
• your medical history, current and past diagnoses, current medications and supplements, and allergies;
• height, weight, and relevant lifestyle information;
• whether you are subject to sport drug testing, because several substances are prohibited under the World Anti-Doping Code;
• laboratory results you provide or a provider orders, and documents you choose to upload; and
• messages you exchange with your care team.

Payment will be taken by a third-party payment processor at checkout. PEPLUX will not store full card numbers, and the payment processor will not be given your medical answers.

This information will be used to evaluate and treat you, to send a prescription to the dispensing pharmacy, to arrange delivery, to take payment, to contact you about your care and orders, and to meet legal and record-keeping obligations. It will not be used to target advertising, and it will not be used to train machine learning models.

Some health information is protected by the Health Insurance Portability and Accountability Act (HIPAA), and some is not. The difference turns on who holds it and why. The treating providers and the dispensing pharmacy are HIPAA covered entities for the care they provide.

PEPLUX’s own role under HIPAA, and the written agreements that go with it, depend on the final agreements between PEPLUX, the clinical organization, the pharmacy, and the intake service. They will be settled with counsel and stated here before the intake goes live. Until then, this policy does not describe PEPLUX as a HIPAA covered entity or business associate.

Whatever that role turns out to be, PEPLUX will not give any vendor access to intake health information without a written agreement that limits its use to providing the service.

Washington’s My Health My Data Act, and similar laws in other states such as Nevada and Connecticut, protect “consumer health data” that falls outside HIPAA. That can include information that reveals an interest in a health product, such as a request for a particular treatment.

Today the website does not collect consumer health data that identifies you: it collects no names or contact details, and the /start answers never leave your browser. The page analytics described above are not used to identify you.

Before the intake collects any consumer health data, PEPLUX will:

• publish a consumer health data privacy notice that lists the categories collected, the purposes, the categories shared and with whom, and how to exercise your rights;
• ask for your consent before collecting it, and separately before sharing it for any purpose other than providing the service you asked for;
• never sell it; and
• let you confirm whether we hold it, see it, delete it, and withdraw your consent.

Today, the information described above is shared only with:

• the hosting provider that delivers the website; and
• Vercel, for the page analytics described above.

Once the intake is live, health information will be shared only with the parties who need it to provide your care: the treating provider, the dispensing pharmacy, any laboratory a provider orders testing from, the intake service, the payment processor (payment details only), and shipping carriers (delivery details only). It may also be disclosed where the law requires it, such as in response to a valid court order or for mandatory public health or adverse event reporting.

We do not share health information with employers, insurers, data brokers, or advertising platforms.

We do not sell personal information, and we do not sell or share it for cross-context behavioral advertising as those terms are defined in US state privacy laws. Because there is no sale or advertising sharing to opt out of, there is nothing for a Global Privacy Control signal to switch off on this website today. We will not sell health information.

Page analytics and request logs are kept by the providers that run them for their standard retention periods.

Once the intake is live, medical records will be kept for the period required by the law of the state where the treating provider practices and by pharmacy record-keeping rules. Those periods are set by law, which is why closing an account does not delete a medical record. Retention periods for other intake information will be stated here before launch.

Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, to withdraw consent, and to appeal if we refuse a request. Health information held for your care also carries rights under HIPAA, including access to your medical record.

We will respond within the time the applicable law requires, verify your identity before acting on a request so that we do not disclose your information to someone else, and not treat you differently for making one. An authorized agent may act for you where the law allows it.

You may also complain to your state attorney general or, for health information covered by HIPAA, to the US Department of Health and Human Services Office for Civil Rights.

Withdrawing consent to telehealth is covered in the telehealth consent.

The website is served only over encrypted HTTPS connections. It holds no accounts and no health information, which is the most effective protection there is for information it never collects.

The safeguards for intake information will be described here before the intake goes live. No system is perfectly secure. If a breach ever affects your information, you and the relevant regulators will be notified as the law requires, with a plain account of what happened.

PEPLUX is for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it.

When we change this policy we will update the “last updated” date at the top. A change to what the website collects is made to this page before, or at the same time as, the change to the website. If a change materially affects how health information is handled, patients will be told directly.

Privacy questions, records requests, and complaints go to our privacy contact.

Registered entity

To be published before launch.

Postal address

To be published before launch.

Email

To be published before launch.

Please do not send health information by ordinary email. Once the intake is live, patients will be given a secure way to reach their care team, and that is the right channel for anything clinical.