Privacy Policy

This policy explains what peptides.io collects, why, who we share it with, and what you can ask us to do with it. It covers the website, your account, and buying our at-home blood test kit.

1. The short version

• We sell an at-home blood sample collection kit. To ship it we need your name, address, email and phone number.
• We do not receive your laboratory results. They go from the laboratory to you. Our system is built to refuse result data, and it does.
• We never sell your personal information, and we never sell or share health information.
• We do not see or store your full card number. Stripe handles payment.
• You can ask us to show you, correct, or delete what we hold. Email hello@peptides.io.

2. What we collect

When you create an account: your name and email address, and a password you set.

When you order a kit: your shipping address, phone number, what you ordered, the order status, the kit barcode and the tracking number. Payment is taken by Stripe, who give us a confirmation and the last four digits of the card. We never receive the full card number.

When you take a quiz or use a tool: the answers you choose, any note you type, and the result or reading we generate from them. Some of these answers are about your health habits, for example when you last had a blood test or what has stopped you from getting one.

When you subscribe to emails: your email address and which emails you have been sent, opened or clicked.

Automatically, when you browse: IP address, approximate location from it, browser and device type, pages viewed, how you got to us, and cookie identifiers.

3. Health information, specifically

This matters, so we will be exact about it.

Laboratory results do not come to us. Your sample is processed by CLIA-certified and CAP-accredited partner laboratories. Those laboratories, and the kit provider that fulfils your order, handle your results under their own HIPAA obligations and deliver them to you. peptides.io is not a covered entity or a business associate under HIPAA, has no business associate agreement in place, and our systems are configured to reject any attempt to send us your marker values. What we receive about your order is limited to its status, the barcode and the shipping tracking number.

What we do hold is the health-related information you choose to give us directly: quiz answers, anything you type into a note or a story, and the readings generated from them. We treat that as sensitive and use it only to show you your results, to improve the site, and to send you the emails you asked for.

4. How we use what we collect

• To take your order, ship your kit and keep you updated about it.
• To run your account and show you your orders, readings and downloads.
• To bill the monthly plan and to tell you before a renewal charge.
• To answer your emails and provide support.
• To send you the emails you signed up for. Every one has an unsubscribe link.
• To measure and improve the site, and to measure our advertising.
• To prevent fraud and abuse, and to meet legal obligations.

5. Who we share it with

We share only what each company needs to do its job, and only with these kinds of recipients.

• Our fulfilment partner and its laboratories, to make and ship your kit and process your sample. They receive your name, address, phone, email and order details.
• Stripe, to take payment and run the subscription.
• Our hosting and database providers, who store the site and your account.
• Our email provider, to deliver transactional and marketing email.
• Advertising and analytics providers, described in the next section.
• Authorities, where the law requires it, and a buyer, if the business is ever sold, in which case this policy follows your information.

We do not sell your personal information. We do not sell or share health information for advertising.

6. Cookies, analytics and advertising

We use cookies and similar technologies to keep you signed in, remember preferences, measure how the site is used, and measure our ads.

• Google Analytics, for aggregate traffic and page statistics.
• Microsoft Clarity, which records anonymised page interactions so we can see where the site is confusing. Pages that could display health information, and all staff pages, are excluded from recording.
• Meta (Facebook and Instagram) advertising tools, including the Meta pixel and the Conversions API, so we can measure which ads lead to sign-ups and orders. Where we send Meta a match signal, your email address is hashed with SHA-256 first, so Meta does not receive it in readable form. We never send Meta your quiz answers, your readings, or anything about a laboratory result.

You can block cookies in your browser, opt out of Google Analytics with Google's browser add-on, and change your Meta ad settings in your Facebook or Instagram account. Blocking some cookies may stop parts of the site working.

7. Your choices and your rights

Wherever you live in the United States, you can ask us to:

• tell you what personal information we hold about you,
• give you a copy of it,
• correct anything that is wrong,
• delete it, and
• stop using it for marketing.

Residents of California, Colorado, Connecticut, Virginia, Washington, Nevada and other states with privacy or consumer health data laws have these rights by statute, including the right not to be discriminated against for using them. Because we do not sell personal information or share it for cross-context behavioural advertising in the sense those laws define, there is nothing to opt out of on that front, but you can still ask us to stop any processing described here.

To make a request, email hello@peptides.io from the address on your account, or write to us through our contact page. We will confirm your identity before we act, and reply within the time the law allows, normally well under 45 days. You can also delete your account yourself at any time from your account settings, and unsubscribe from any email using the link at the bottom of it.

8. How long we keep it

Account and order records are kept while your account is open and afterwards for as long as tax and accounting rules require. Quiz answers and readings are kept while your account is open. Analytics data is kept in aggregated form. When you ask us to delete your information we remove it from our live systems and from backups on their normal rotation.

9. Security

Traffic to and from peptides.io runs over encrypted connections, and our databases are encrypted at rest with access limited to the people who need it. Payment card data never touches our servers. No system is perfectly secure, so we cannot promise absolute security, but we will tell you and the authorities if a breach affects you and the law requires notice.

10. Children

peptides.io is for adults. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, email hello@peptides.io and we will delete it.

11. Where we operate

We are based in the United States and sell only to United States addresses. If you use the site from elsewhere, your information will be processed in the United States.

12. Changes to this policy

If we change this policy we update the date at the top. If a change is significant we will tell account holders by email.

13. Contact

Privacy questions, or to make a request about your information: hello@peptides.io. We usually reply within 1 to 2 business days.