Privacy Policy

This policy explains how Research Info Group, LLC, doing business as Peptide Help ("we", "us"), collects, uses, and protects personal information when you use Peptide Help (the "Service"). It is part of our Terms of Use. Questions: legal@peptidehelp.com.

We collect only what the Service needs to work:

• Account data: name, optional display name, email address, password (stored hashed, never in plain text), profile picture, language, and theme.
• Consent records: when you accepted the Terms and which version, and when you acknowledged the tracker notice.
• Tracker and protocol data (health information): the peptides, vials, reconstitution amounts, doses, schedules, reminders, dose logs, adherence, check-ins, symptoms, side effects, body metrics, lab results, progress photos, supplies, and notes you choose to enter.
• Community content: experiences, updates, comments, likes, reports, and reputation points.
• Payment data: your Premium plan and billing status. Card details go directly to Stripe; we never see or store full card numbers.
• Referral and contributor data: referral codes, invite codes, contributor tier, and, for paid contributors, the payout method and handle you give us.
• Vendor tools data: for vendors, product and brand details; for customers of a partner vendor, the email address and order details (products, quantities, order number and date) that vendor sends us so we can send you a guide for that order; for customers who use a vendor's hosted link, the email address you enter to receive a product guide. We never pass this to other vendors.
• Technical data: IP address, browser and device type, pages visited, push-notification subscription tokens, and server logs, collected automatically to keep the Service secure and working.

We do not knowingly collect information from anyone under 18.

• To run the Service: show your tracker, send the reminders you set, calculate doses, keep your schedule in sync across devices, and process payments.
• To keep a record of your legal consent.
• To moderate the community and enforce our Terms, including holding or removing content and acting on reports.
• To send transactional email: verification codes, password resets, receipts, moderation notices, and product-education emails you or a vendor requested.
• To grant free Premium time, points, badges, and contributor payouts you have earned.
• To improve the Service using aggregated, de-identified usage statistics that cannot be tied back to you.
• To comply with law and protect our rights, users, and the public.

We do not use your tracker or health data for advertising, do not build advertising profiles, and do not sell or rent personal information. We do not share your tracker data with vendors. A vendor who sends you a product guide through our tools sees only that their email was delivered, not anything you log.

We are not a healthcare provider and are not covered by HIPAA. We nonetheless treat tracker, check-in, lab, photo, and symptom data as sensitive health information. We use it only to provide the Service to you, restrict staff access to what is needed for support and security, and never disclose it to third parties for their own purposes.

Where state consumer-health-privacy laws apply, including the Washington My Health My Data Act and similar laws, this policy serves as the required notice, and you may exercise the rights in Section 8.

Progress photos are stored in a private bucket with unguessable addresses and are shown only to you. Please avoid including your face or identifying marks if you want them to stay anonymous.

We share personal information only with service providers that help us run the Service, under contracts that limit them to that purpose:

• Stripe, for Premium billing.
• Cloudinary, for storing uploaded images including progress photos.
• A transactional email provider, for verification codes, receipts, and the emails described above.
• Our hosting and database infrastructure providers.
• Browser push-notification services (operated by Apple, Google, and Mozilla) to deliver the reminders you set. The notification payload contains only what you would see on screen.

We may also disclose information if required by law, subpoena, or court order, to protect someone's safety, or as part of a merger or sale of the business, in which case this policy continues to apply.

Community posts, your display name, contributor badge, and points are public by design.

We use a small number of first-party cookies and browser storage: a session token to keep you signed in, your language and theme choice, offline copies of your tracker so it works without a connection, and a queue of dose logs made while offline. We do not use third-party advertising or tracking cookies.

We keep your data while your account is active. When you delete your account we delete or de-identify your personal information and tracker data within 30 days, except what we must keep for legal, accounting, security, or dispute reasons, such as consent records and payment history. Community posts may remain in anonymised form. Backups are purged on a rolling basis.

Depending on where you live you may have the right to:

• Access and receive a copy of your data. You can export your tracker data from the dashboard at any time.
• Correct inaccurate data. Most of it you can edit directly.
• Delete your account and data. Available from your dashboard, or by emailing us.
• Withdraw consent for processing health data by deleting the relevant entries or your account.
• Object to or restrict certain processing, and not be discriminated against for exercising your rights.
• Appeal a decision we make about your request, and lodge a complaint with your local data-protection authority.

To exercise a right you cannot complete in the dashboard, email legal@peptidehelp.com from your account address. We respond within 30 days, or sooner where the law requires.

California residents: we do not sell or share personal information as defined by the CCPA/CPRA, and we honour browser Global Privacy Control signals as an opt-out request.

We protect data with encryption in transit, hashed passwords, access controls, and monitoring. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the relevant authorities as the law requires.

The Service is operated from the United States and your data is processed there. If you use it from elsewhere, you consent to that transfer. Where the GDPR or UK GDPR applies, our legal bases are performance of our contract with you (running the Service), your explicit consent (health data, which you can withdraw), and our legitimate interests in security, moderation, and improvement.

We will post changes here and update the date above. Material changes will be announced in the app or by email and, where they affect health data, we will ask for your consent again.

Research Info Group, LLC · legal@peptidehelp.com