PepSense Privacy Policy

PepSense, Inc. ("PepSense", "we", "our") operates the website at pepsense.ai and the PepSense mobile and web applications (together, the "Service"). This policy explains what data we collect, why we collect it, who receives it, how long we keep it, and the choices and rights you have.

We built the Service around a simple premise: the peptide research literature is hard to read and harder to keep current, so we summarize it with citations and give you a private place to track what you are doing. That means we hold information about your body and what you take. We treat that information as sensitive under every privacy law that recognizes the category, and we have designed the product so that it is never monetized, never sold, and never used to advertise to you.

Because that information is sensitive, we also publish a separate Consumer Health Data Privacy Policy at pepsense.ai/consumer-health-data-privacy. Section 2 below explains what it covers and how the two documents fit together. If you log anything about your body into PepSense, read both.

This policy is written to be read. Where a practice is limited, still developing, or dependent on a third party we do not control, we say so plainly rather than making a promise we cannot keep. We would rather publish a smaller set of commitments we can stand behind than a longer set we cannot.

1. Who we are and what this policy covers

PepSense, Inc. is a United States company. We are the controller of the personal data described here, and under United States state privacy laws we are the "business" or "controller" responsible for it.

This policy covers the pepsense.ai website, including the waitlist form; the PepSense iOS app, distributed through TestFlight and the App Store; and the PepSense web application. It does not cover third-party websites or services you reach from links we publish, including the research databases and journal pages we cite. Those services have their own privacy policies.

PepSense is a research and education product. We are not a health care provider, a health plan, a pharmacy, a compounding facility, a manufacturer, a prescriber, a peptide vendor, or a telehealth service. We do not diagnose, treat, prescribe, dispense, sell, source, or facilitate the sale of any compound, and we do not supply any compound or any diluent.

The Service includes a reconstitution calculator, and we want to describe exactly what it is. It is an arithmetic unit-conversion utility. You enter values you already have, such as the amount of compound in the vial, the volume of diluent you are adding, and the amount you want to measure out. The tool performs the arithmetic and returns the corresponding volume or syringe-unit equivalent. It performs arithmetic only on numbers you supply.

The calculator does not recommend, suggest, select, validate, verify, or approve any amount. It does not generate protocols, titration schedules, or frequency guidance. It does not know or evaluate whether any amount is appropriate for you or for anyone else. It is not medical advice, not dosing guidance, not a prescription aid, and not a substitute for a licensed clinician or a pharmacist.

Outputs may be wrong if inputs are wrong. The arithmetic reflects the numbers you typed, nothing more. You are solely responsible for the values you enter and for anything you do with the output, and you must independently verify any figure with a qualified professional before relying on it. We make no warranty that any output is accurate, complete, or fit for any purpose.

The limits that have always applied still apply. PepSense does not recommend doses, does not create dosing protocols, does not tell you what to take or when, and does not evaluate the appropriateness of any regimen.

Where the app displays an estimated-level chart, that chart is a rough research estimate drawn from half-life figures published in the literature. It is an illustration of what the research describes, not a measurement of anything in your body and not dosing guidance. Do not use it to decide what to take, when to take it, or how much.

What the Service otherwise provides is AI-generated summaries of published research with citations, plus a private log that you keep for yourself and that only you can see.

2. Read this first if you log health data: our separate Consumer Health Data Privacy Policy

In addition to this policy, PepSense publishes a standalone Consumer Health Data Privacy Policy at pepsense.ai/consumer-health-data-privacy.

We publish it because the Washington My Health My Data Act and Nevada SB 370 require a separate, distinct consumer health data privacy policy rather than a section buried inside a general privacy policy. It carries its own link in the footer of every page on pepsense.ai, listed on its own and not nested underneath the link to this policy, and it is linked from Settings inside the app.

That document contains the disclosures those laws specifically require: the categories of consumer health data we collect, the purposes for collecting each category, the sources we collect it from, the categories of consumer health data we share and the purpose of sharing, the categories of third parties and specific affiliates with whom we share it, and how you exercise your rights to confirm, access, delete, and withdraw consent.

This policy and that policy are written to say the same thing. If they ever differ on a point about consumer health data, the standalone Consumer Health Data Privacy Policy controls as to consumer health data, and we will correct the discrepancy here as soon as we find it.

Section 4 of this policy keeps the full detail on health data as well, so that you do not have to open two documents to understand what we hold. Section 4 also explains exactly how the reconstitution calculator is treated, and the answer has two parts: the values you type are computed on your device and are not saved by us, and the two calculated values you can optionally save onto one of your compounds, the concentration in mg per mL and the vial total in mg, are stored in your account as health data under the same protections as the rest of your protocol.

• Read the standalone policy: pepsense.ai/consumer-health-data-privacy
• Read the detailed health data section of this policy: Section 4 below
• Exercise a health data right, or withdraw consent: Settings inside the app, or email support@pepsense.ai

3. The data we collect

Almost everything we hold, you gave us on purpose. The table below maps each category to real examples, why we hold it, and whether it is health data that requires your separate opt-in consent before we collect it.

Health data appears in this table and is also treated separately in Section 4, because it carries additional protections and a separate consent step.

Two rows in the table describe the reconstitution calculator, because the calculator does two different things. The values you type are not collected by us. The two calculated values you can choose to save onto one of your compounds are collected, and they are stored in your account as health data. We list both rows so that the line between them is impossible to miss.

Data that stays on your device

Some of what you tell us during onboarding is stored only on your phone and is not transmitted to our servers. Your age, gender, height, journey stage, and the goals you select are held in the app's local storage. Display preferences, unit settings, and vial-open markers are local only as well. Of the onboarding answers, only your compound selections and your starting weight are copied into your account.

The reconstitution calculator is more transient than the items above, with one exception that is entirely under your control. The calculation is fixed arithmetic that runs on your device. The values you type, including the vial amount, the diluent volume, the amount you want to measure out, and your syringe size, are held in memory while the calculator screen is open, only for as long as it takes to display the result, and they are discarded when you leave the screen or close the app. They are not automatically transmitted to our servers, they are not saved anywhere by default, and we keep no persistent record of them.

The exception is the optional save action. If you select one of the compounds you already track and tap to save, the app writes two calculated values to that compound record in your account on our database: the concentration in mg per mL, and the vial total in mg. That is a deliberate action you take, it does not happen on its own, and it is the only path by which anything from the calculator reaches us. Once written, those two values are protocol health data under Section 4, retained under Section 9, and deleted under Section 10.

Your sign-in session tokens are stored in your device's app storage so that you stay signed in between launches.

If a goal metric or a weight entry cannot reach the server, the app buffers the full entry locally and uploads it the next time a connection succeeds. Until that upload happens, that entry exists on your device only.

We want to be accurate about one consequence of on-device storage. Data an app writes to its own storage on iOS can be included in a device backup, depending on how the app's storage is configured and on your own iOS backup settings, which are under your control and not ours. We do not send health data to iCloud ourselves, we do not use CloudKit, and we run no iCloud sync feature. If you do not want app data included in a device backup, you can turn off backups for PepSense in your device settings.

Removing the app, or using Reset onboarding in Settings, clears the on-device items described above, including the buffered entries and any cached email address held for the onboarding flow.

What we do not collect

We say this specifically because absence matters as much as presence. As of the effective date of this policy:

• No reconstitution calculator inputs. The values you type are computed on your device, are not automatically transmitted to us, are not saved by default, and are never sent to our AI providers. The only thing from the calculator that can reach us is the optional save action described in Section 4, which writes exactly two calculated values, the concentration in mg per mL and the vial total in mg, onto a compound you choose.
• No location data of any kind. The app does not request location permission and contains no location, geofencing, or geolocation code.
• No contacts data and no calendar data.
• No audio. The app contains no audio recording code and records nothing.
• No Apple Health or HealthKit data. We do not read from or write to HealthKit, and every weight entry is one you typed in yourself.
• No advertising identifier (IDFA) and no App Tracking Transparency prompt, because we do not track you across other companies' apps or websites.
• No advertising SDKs, attribution SDKs, analytics SDKs, crash reporters, session replay, heat mapping, or marketing pixels in the app, the web app, or the website.
• No payment card data. If you subscribe on iOS, Apple processes the payment and we never see your card number, expiry, or security code.
• No meal photos, nutrition data, or macro data.
• No newsletter or marketing email list.
• No purchase of personal data about you from data brokers, public databases, list vendors, or any other outside source. Everything we hold about you came from you.

4. Your health data: what we collect, how consent works, and your control over it

This section describes what the Washington My Health My Data Act, Nevada SB 370, and other state consumer health data laws call "consumer health data." It applies to every PepSense user, not only to residents of those states. Our standalone Consumer Health Data Privacy Policy at pepsense.ai/consumer-health-data-privacy covers the same ground in the separate document those laws require.

The specific health data we collect is listed below. This is the complete list, not a category label.

We collect this data from exactly one source: you. It comes from what you type, tap, or photograph inside the app. We do not receive health data about you from data brokers, advertising platforms, health care providers, insurers, wearables, Apple Health, pharmacies, laboratories, or compound vendors, and we do not infer or extrapolate health data about you from information you did not enter.

• Compounds in your protocol, including class, concentration, vial size, and the schedule you set
• The concentration in mg per mL and the vial total in mg, where you chose to save them onto a compound from the reconstitution calculator
• Dose events, including the amount, the units, the route of administration, and the body site for injections
• Weight entries over time
• Side effects you describe in your own words, with a severity rating from 1 to 5, optionally linked to a specific dose
• Goal metrics: waist measurement, appetite, energy, skin clarity, hydration, and breakout count
• Progress photos of your body, with the date and the weight recorded at that time
• The text of the research questions you ask, which can itself reveal health status, symptoms, or intent

The reconstitution calculator: what is computed on your device, and what you can choose to save

The reconstitution calculator is an arithmetic unit-conversion utility. You enter the amount of compound in the vial, the volume of diluent you are adding, the amount you want to measure out, and your syringe size, and it returns the corresponding volume or syringe-unit equivalent. It performs arithmetic only on numbers you supply. It does not recommend, suggest, select, validate, verify, or approve any amount, it does not create protocols, titration schedules, or frequency guidance, and it does not evaluate whether any amount is appropriate for you. It is not medical advice and it is not a substitute for a licensed clinician or a pharmacist.

Two distinct things happen in this feature, and we want the line between them to be unmistakable. Computing is local and transient. Saving is optional, user-initiated, and stored in your account. Earlier versions of this policy described only the first, and that was not the full picture, so here is both.

Computing, and what happens to the values you type. The calculation runs on your device. The raw values you enter, meaning the vial amount, the diluent volume, the desired amount, and the syringe size, are held in device memory only while the calculator screen is open, only long enough to display the result, and are discarded when you leave the screen or close the app. They are not automatically transmitted to our servers, they are not saved anywhere by default, and they are not written to your account or to any log we hold. We hold no copy of them, so there is nothing for us to retain and nothing for us to disclose.

Saving, and what happens if you use it. The calculator also offers an optional save action. If you select one of the compounds you already track and tap it, the app writes two calculated values to that compound record in your account on our database: the concentration in mg per mL, and the vial total in mg. That is all that is written. The diluent volume, the desired amount, and the syringe size you typed are not saved. This never happens on its own and never happens in the background. It happens only because you picked a compound and tapped save.

What saving means once it has happened. Those two values live in your compound record exactly like the rest of your protocol data. They are health data. Every protection in this section applies to them, and so does our standalone Consumer Health Data Privacy Policy. They are collected only after your separate opt-in consent to health data collection, they are stored by our database provider under the agreement described in Section 8, they are retained on the schedule in Section 9, and they are deleted when you delete that compound or delete your account under Section 10.

What is true of both paths. To the extent a value is health related, whether it is typed and discarded or calculated and saved, we treat it as consumer health data. It is never sold, never shared for advertising, marketing, audience building, or profiling, and never used to train, fine-tune, or evaluate AI models. Nothing from the calculator, typed or saved, is sent to Anthropic, to Voyage AI, or to any other AI provider.

How your health data is used

Your health data is used only to deliver the features you asked for: displaying the protocol you entered, charting your own history, scheduling the local dose reminders you enable, letting you review your own photo timeline, performing on your device the arithmetic you request in the reconstitution calculator, and storing the calculated concentration and vial total onto a compound when you choose to save them there.

It is not used for advertising, for marketing, for building audiences or segments, for profiling, or for any use-based data mining. It is not used to train, fine-tune, or evaluate AI models. It is not used to make decisions about you that produce legal or similarly significant effects. It is not sent to our AI providers along with your questions.

How we obtain your consent, and what does not count as consent

Before any health data is collected, we ask for your consent on a screen of its own. That screen appears in onboarding, before your first health entry, and it does one thing only: it asks whether you consent to PepSense collecting the health data described above.

The consent is separate and unbundled. It is not part of the Terms of Use, it is not part of the sign-up flow's acceptance step, and it is not bundled with any other permission or agreement. Accepting our Terms of Use is not how we obtain health data consent, and it never will be. Continuing to use the Service is not consent either. Consent requires an affirmative action from you on that screen.

The consent is opt-in. Nothing is pre-checked, nothing is pre-selected, and declining is presented as plainly as accepting.

The consent is informed. Before you decide, the screen tells you the categories of health data we would collect, what we would do with each, that it is never sold or used for advertising, the categories of parties that would process it on our behalf, and how to withdraw.

The consent is specific. It covers the categories and purposes described on that screen and nothing else.

Declining is a real option. If you decline, you can still use the research features, and you can still use the calculator to compute on your device, because computing does not send anything to us. You simply will not have a protocol log, weight history, side effect history, goal metrics, or progress photos, and there will be no compound record to save a calculated concentration or vial total onto, because those features are the thing consent is about.

We keep a record of the consent you gave: the consent type, the version of the notice shown to you, and the time. We keep the same record for a withdrawal. That record exists so that we can prove consent was given and so that we can honor a withdrawal reliably.

How to withdraw your consent

You can withdraw your health data consent at any time, and withdrawing is as easy as giving it was.

In the app: open Settings, find Health data consent, and turn it off. The app asks you to confirm, then records the withdrawal.

By email: write to support@pepsense.ai from the address on your account with the subject "Withdraw health data consent." We will confirm your identity and process it.

Withdrawing consent stops all further collection of health data, including any further saving of calculated values onto a compound. Existing entries stay in your account until you remove them, so that withdrawing does not silently destroy a log you may still want. To also remove what is already stored, delete the individual entries in the app or delete your account entirely, as described in Section 10. If you want both at once, tell us in your email and we will do both.

Withdrawal does not make earlier processing unlawful, and it does not undo anything that already happened, but it does end everything going forward.

If we ever want to collect a new category of health data, or use existing health data for a new purpose, we will ask for fresh, separate consent first. That includes any future change to how the calculator is handled. Today the values you type are computed on your device and discarded, and the only thing that reaches us is the two calculated values you deliberately save onto a compound. If we ever wanted to transmit or store the raw inputs themselves, or to save anything automatically without you asking, we would ask you first and update this policy and the standalone Consumer Health Data Privacy Policy before the change took effect. We will not quietly repurpose data you already gave us, and we will not treat old consent as covering a new use.

Sharing

We do not share your health data with third parties for their own purposes. The only companies that touch it are the processors named in Section 8, which hold or process it strictly on our instructions under written data processing agreements that prohibit any other use.

The values you type into the calculator are not shared with any of them, because they are not transmitted off your device. The two calculated values you choose to save onto a compound are stored by our database provider, Supabase, on our instructions and under that same agreement, exactly like the rest of your protocol data. No AI provider receives either.

Under Washington and Nevada law, disclosure to a processor that is contractually bound to the disclosed purpose is not "sharing," and we work to keep it that way.

We have no affiliates, parents, or subsidiaries with access to your health data. If that changes, we will update this policy and the standalone Consumer Health Data Privacy Policy before any access is granted.

We may disclose data if we are legally compelled to, or where necessary to protect against imminent harm. Section 5 lists those narrow exceptions in full.

Your consumer health data rights

Every user, in every state, has these rights over health data held in PepSense. There is no charge, and you can exercise them at least twice in any 12-month period:

• Confirm whether we collect, share, or sell your health data, and access the health data we hold about you
• Receive a list of all third parties and affiliates with whom we have shared or sold your health data, with contact information for each. Today that list is the processors named in Section 8, and there are no affiliates
• Review your health data and request corrections. In the app you can edit or delete individual doses, weights, side effects, metrics, and photos directly, and you can edit or clear the concentration and vial total on any compound
• Withdraw your consent to further collection or sharing, as described above
• Delete your health data. Live systems are cleared right away and backup copies cycle out within 30 days, as described in Section 9. When you delete, we ask our processors that hold copies on our behalf to delete theirs as well, and Section 10 states honestly which records are outside that reach
• Note on the calculator, which splits in two: the values you type are computed on your device and are not transmitted to us, so a confirmation request will show that we hold none of them and there is nothing for us to access, correct, share, or delete. The two calculated values you chose to save onto a compound, the concentration in mg per mL and the vial total in mg, are held in your account, and every right in this list applies to them in full

Nevada-specific disclosures

Nevada law asks for several items directly, and here they are. To review your health data or request a change, edit it in the app or write to support@pepsense.ai, and we will make the change or explain why we cannot. If we make a material change to how we handle health data, we will notify you by email at the address on your account and inside the app before the change takes effect, and we will not apply the change to previously collected data without asking you for consent first. The effective date of this policy appears at the top and always reflects the current version. As to third-party tracking: there is none. No advertising, analytics, attribution, or session replay technology runs in the app, on the web app, or on pepsense.ai. Our standalone Consumer Health Data Privacy Policy at pepsense.ai/consumer-health-data-privacy carries these disclosures as well.

Geofencing

We do not use geofencing. We do not build a virtual boundary around any health care facility, pharmacy, clinic, or provider, and we do not collect location data at all. Geofencing around health care facilities is prohibited by Washington, Nevada, and Vermont law, and it is also foreclosed by how the product is built, because there is no location capability in it to use.

5. How we use your data

We use personal data for the purposes below and for nothing else. If we ever want to use it for a new purpose, we will ask you first.

• Provide the Service: create and authenticate your account, store and display the protocol you entered, generate research answers with citations, keep your conversation history, and deliver the local reminders you enable
• Perform the arithmetic you request in the reconstitution calculator. The calculation happens on your device, using only the values you enter, solely to display the result to you, and we do not receive those values
• Store the two calculated values you choose to save from the calculator, the concentration in mg per mL and the vial total in mg, onto the compound record you selected, so that your protocol carries them and you do not have to recalculate them
• Personalize what you see inside your own account, which means showing you your own data. We do not build behavioral profiles
• Operate the free tier by counting your questions against the daily limit shown in the app
• Manage subscriptions and entitlements if you subscribe, and support restore-purchase requests
• Keep the Service secure and reliable: detect and prevent abuse, fraud, and automated scraping, diagnose errors, and monitor availability
• Improve the product using aggregate and statistical information, such as counts of questions asked or error rates. We do not use your identifiable health data for product research without asking you separately
• Communicate with you: transactional email about your account, security notices, service announcements, and responses to your support requests
• Contact waitlist signups about access to PepSense, by email, and by text only where you gave separate express written consent to texts
• Comply with law, respond to lawful requests, enforce our Terms of Use, and establish, exercise, or defend legal claims

When we disclose data outside our processors

Beyond the service providers listed in Section 8, we disclose personal data only in these narrow situations: when you direct us to; to comply with a subpoena, court order, or other legal obligation, after reviewing whether the request is valid and, where we are permitted to, notifying you first; to protect the rights, safety, or property of you, PepSense, or the public where there is a genuine and imminent risk; and to a successor entity in a merger, acquisition, or sale of assets.

In a corporate transaction, health data would continue to be handled under this policy and under the standalone Consumer Health Data Privacy Policy. We would notify you before any material change in how it is handled, and we would obtain fresh consent where the law requires it.

6. What we do not do with your data

These are commitments, and they are also statements about how the product is built today.

• We do not sell personal information. We have never received money or other valuable consideration in exchange for your personal information, and we do not intend to. Maryland law prohibits the sale of sensitive data even with consent, and we apply that standard to every user everywhere
• We do not sell, share for advertising, or use to train AI models anything connected to the reconstitution calculator. The values you type are computed on your device and are not transmitted to us, so there is nothing there for us to sell, share, or train on. The two calculated values you can choose to save onto a compound are stored in your private account and are subject to every commitment in this list: never sold, never shared for advertising, never used to train, fine-tune, or evaluate models, and never sent to an AI provider
• We do not share personal information for cross-context behavioral advertising, and we do not engage in targeted advertising. Because we do not sell or share, there is no "Do Not Sell or Share My Personal Information" mechanism for us to offer, and none is required
• We do not use health data for advertising, marketing, audience building, or use-based data mining, by us or by anyone else. Combining health data with advertising is a line we will not cross
• We do not track you across other companies' apps or websites. There is no advertising identifier collection and no App Tracking Transparency prompt, because there is nothing to track
• We do not disclose your data to data brokers, advertising networks, or social media platforms
• We do not run advertising SDKs, analytics SDKs, marketing pixels, tag managers, or session replay in the app, on the web app, or on pepsense.ai
• We do not profile you in a way that produces legal or similarly significant effects, and we make no automated decisions about you of that kind
• We do not sync your protocol data or progress photos to iCloud or CloudKit. There is no iCloud integration in the app. Data the app stores on your own device may be included in a device backup you control, as explained in Section 3
• We do not use your data to train, fine-tune, or evaluate AI models, and our agreements with our AI providers do not permit them to train on our API inputs and outputs
• We do not enrich your profile from outside sources or compile information about you from public databases
• We do not require a phone number, and we do not send marketing text messages to anyone who has not given separate express written consent to receive them

7. How the AI works, and exactly what leaves PepSense when you ask a question

Before we send any question text to an AI provider, we ask for your permission on a separate screen that explains what is sent and to whom. That permission is distinct from your health data consent and distinct from the Terms of Use, and you can change it in Settings.

When you ask a question, three things happen. First, the text of your question is sent to Voyage AI, which converts it into a numeric representation so that we can search our research library, and then ranks candidate passages against it. Second, your question, the earlier messages in that same conversation, and the research excerpts we retrieved are sent to Anthropic's Claude API, which drafts the answer and its citations. Third, the question and the answer are saved to your account so that your history is there when you come back.

What is not sent matters as much. Your name, email address, account ID, and authentication tokens are not sent to Anthropic or to Voyage AI. Nothing from your protocol log is sent either: not your compounds, not your doses, not your weight, not your side effects, not your goal metrics, not your photos. The request carries the question text, the earlier messages in that conversation, and the retrieved research excerpts, and that is all.

The reconstitution calculator involves no AI at all. It is fixed arithmetic performed on your device on the numbers you enter. Nothing from the calculator is sent to Anthropic or to Voyage AI, and no AI model sees its inputs, produces its result, or reviews its result. The values you type are not transmitted to us either. If you choose to save a result onto one of your compounds, the two calculated values that get written to your account, the concentration in mg per mL and the vial total in mg, are stored for you in your protocol and are still never sent to any AI provider.

Because the question text is what leaves, what you type is what matters. If you would not want a sentence to leave PepSense, do not type it into the question box.

Answers are AI-generated summaries of published research. They can be incomplete, out of date, or wrong. Much of the peptide literature is preclinical or conducted in animals, and a finding in a mouse is not a finding in a person. No clinician reviews the output before you see it. Answers are labeled in the product as AI-generated summaries of published research that are not medical advice, and none of it is medical advice.

The internal query log, stated accurately

Separately from your account history, our servers keep an internal log of question and answer text so that we can review answer quality and catch failures in retrieval. We want to describe this accurately rather than flatteringly.

These rows are stored without your user ID, email address, or account link attached. We do not call them de-identified, because we do not think that word would be honest here: the same question text also exists in your account history with a timestamp, so we are not going to claim the two could never be correlated. Treat these rows as pseudonymous internal records, not as anonymous ones.

This log covers research questions and answers only. Nothing from the calculator is written to it. The values you type are not sent to our servers at all, and the two calculated values you may choose to save go to your own compound record in your account, not to this log.

We limit the exposure with time. Rows in this log are retained for no more than 30 days from creation and are then purged. We do not use them for advertising, profiling, personalization, or model training, and they are never disclosed outside the processors named in Section 8.

If you delete your account, your account-linked question history is deleted along with everything else. Because log rows carry no account link, they are not located by the deletion routine; they age out under the 30-day limit above. If you would like us to make a reasonable effort to locate and remove log rows associated with a specific conversation, write to support@pepsense.ai with the detail needed to find it and we will try, and we will tell you plainly if we cannot.

8. Who receives your data: processors, and independent third parties

Two very different kinds of company can touch your data, and lumping them together would be misleading, so we separate them. A processor handles your data only on our instructions, under a written data processing agreement, and may not use it for its own purposes; an independent third party decides for itself how it uses the data it receives, under its own privacy policy, and we do not control that use.

The first group below is our processors. Each acts on our instructions under a written agreement that limits them to processing for us, prohibits use for their own purposes, requires appropriate security, requires them to bind their own subprocessors to equivalent terms, and requires deletion or return of data when the relationship ends.

The second group is independent third parties. We are careful not to describe them as our processors, because they are not.

No company in either group receives the values you type into the reconstitution calculator, because those values are computed on your device and are not transmitted anywhere. If you use the optional save action, the two calculated values it writes, the concentration in mg per mL and the vial total in mg, are stored by Supabase as part of your account, on our instructions and under our data processing agreement, and by no other company. No AI provider receives them.

We keep both lists short on purpose, and we name every company that receives your data. We will update this section before adding any provider that would receive health data.

Independent third parties that act as their own controllers

These companies are not processing on our instructions. When you interact with them, they receive data under their own privacy policies and decide for themselves how to use it. We list what they receive so that you know, but we cannot make commitments on their behalf, and we do not pretend to.

• Apple, for App Store and StoreKit transactions. If you subscribe on iOS, Apple is the merchant of record. Apple processes the payment and holds the transaction record under its own terms; we never receive your card details. We cannot delete Apple's transaction records and we cannot cancel your subscription for you
• Apple, for Sign in with Apple. If you choose Sign in with Apple, Apple authenticates you and decides what to share with us. On a first sign-in it may share your name and an email address, which can be a private relay address. The authentication event is Apple's, under Apple's privacy policy
• Google, for Sign in with Google. If you choose Sign in with Google, Google authenticates you and decides what to share with us. The authentication event is Google's, under Google's privacy policy
• Google, for Google Fonts on the web. When your browser loads pepsense.ai or the web application, it requests our typefaces from Google's font service, and that request carries your IP address, user agent, and the referring page directly to Google. This is a browser-to-Google request that we do not intermediate and for which we hold no data processing agreement. We are working to self-host our fonts and will remove this entry when we do. The mobile app does not make this request, because its fonts are bundled inside the app

What we check before adding a provider

Before a new company can receive personal data from PepSense, we confirm what it would receive, whether it would be a processor or an independent controller, and whether the arrangement is necessary rather than merely convenient. For processors, we execute a written data processing agreement before any data flows, and we confirm the agreement obliges them to protect the data at least as strictly as this policy and Apple's App Store Review Guidelines require.

We do not claim to audit our providers' internal operations, and we will not tell you that we do. What we can tell you is what each one receives, which is set out above, and that we keep the list this short deliberately.

9. How long we keep data

We keep personal data only as long as we need it for the purpose we collected it, or as long as the law requires. Here is the schedule by category.

Two general points apply to everything in the table. First, when we say data is deleted, we mean it is removed from our live production systems at that time. Second, encrypted backups of our database are taken on a rolling schedule and are retained for up to 30 days before they rotate out and are destroyed, so a copy of deleted data can persist inside a backup for up to 30 days after live deletion. We do not surgically edit historical backups, and we would rather tell you that than imply an instantaneous erasure everywhere that no operator of a backed-up database can honestly promise. Backups are used only for disaster recovery, are not queried in the ordinary course, and if a backup were ever restored we would re-apply pending deletions to the restored data.

10. Deleting your account and your data

You can delete your PepSense account and everything in it yourself, from inside the app, at any time, wherever you live. You do not need to email us, open a support ticket, or explain why.

In the app: open Settings, scroll to Delete Account, and confirm. Deletion of your live data runs immediately, usually within a few seconds, and the app shows you a confirmation when it has succeeded. Backup copies cycle out within 30 days, as described in Section 9. Deletion is not reversible.

By email: write to support@pepsense.ai from the email address on your account with the subject "Delete my account." We will verify that the request comes from you, complete the deletion within 30 days, and email you a confirmation when it is done. Most email requests complete within a few business days.

There is no deactivation-only option. A temporary disable is not deletion, and we do not offer it as a substitute for one.

Deleting your account removes the following from our live systems:

• Your authentication record, email address, and user ID
• Every compound in your protocol, including any concentration in mg per mL and vial total in mg you saved onto it from the reconstitution calculator, and every dose event, including routes and injection sites
• Every weight entry, side effect entry, and goal metric entry
• Every progress photo, including the underlying image files in storage
• Your conversations and every message in them, both your questions and the AI answers
• Your daily usage counters
• Your consent records, except the minimal record of the deletion request itself
• Scheduled dose reminders on your device, which are cancelled
• If you signed in with Apple, we also send a token revocation request to Apple as part of deletion, so that PepSense's access to your Sign in with Apple identity is withdrawn

What is not removed by account deletion, and why

We would rather tell you than let you assume. These are the things account deletion does not reach. We have tried to make this list complete rather than short.

• Encrypted backups, for up to 30 days. Deletion applies to live systems immediately and works through our backup rotation, which completes within 30 days
• The internal query log described in Section 7. Those rows carry question and answer text with no account link, so the deletion routine cannot find yours. They are purged on their own 30-day schedule
• Records held by Apple as merchant of record for any purchase you made. We do not control them and cannot delete them
• Records held by RevenueCat. We request deletion of your subscriber record as part of account deletion; any portion retained for financial or audit purposes persists under that provider's terms
• A waitlist entry, if you signed up on the website. Waitlist rows live in a separate list and are not matched to accounts. To remove yours, email support@pepsense.ai and ask us to delete your waitlist entry as well, and we will
• Support emails you sent us, which are retained on the schedule in Section 9 so that we have a record of what was asked and answered
• Records we are legally required to keep, such as billing and tax records, and a minimal record of the deletion request itself so that we can show it was honored. This carve-out is narrow and limited to what law actually requires
• The values you type into the calculator are not on this list, and not because we kept them. They are computed on your device and discarded when you leave the calculator screen, so account deletion has nothing to reach. Anything you did save from the calculator onto a compound is not on this list either, because it is deleted with your account like the rest of your protocol data

Other ways to remove data without deleting your account

You do not have to delete everything to remove something. Inside the app you can delete individual dose events, weight entries, side effects, goal metrics, and progress photos, one at a time.

You can withdraw health data consent under Settings, which stops all future collection, as described in Section 4.

The values you type into the reconstitution calculator need no removal step. They are not uploaded to us and are discarded from device memory when you leave the calculator screen or close the app, so there is nothing stored for you to delete. If you used the optional save action, the calculated concentration in mg per mL and vial total in mg live on that compound record, and you remove them by editing or deleting that compound in the app, like any other protocol entry.

Onboarding answers stored only on your device (age, gender, height, journey stage, goals), buffered entries waiting to upload, and any cached email address held for the onboarding flow remain on the device until you use Reset onboarding in Settings or delete the app. They were never uploaded to us in the first place.

If you signed in with Apple or Google, you can also revoke PepSense's access from your Apple ID or Google account settings. For Sign in with Apple this is in addition to the revocation request we send during account deletion, not a substitute for it.

11. How we protect your data

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of what we hold. No system is perfectly secure, and we will not tell you otherwise.

We also want to be clear about what we are not claiming. PepSense does not hold a SOC 2 report, an ISO 27001 certification, a HITRUST certification, or any equivalent third-party security certification, and we will not describe ourselves as certified, audited, or compliant with a standard we have not been assessed against. If that changes, we will say so here and name the standard and the assessor.

Below is what we commit to. These are obligations we hold ourselves to, and under Section 5 of the FTC Act they are enforceable promises, which is why the list is shorter than it could be.

• Data is encrypted in transit using current TLS, and our database and object storage providers encrypt data at rest using their platform encryption
• Database access controls are configured so that a user's protocol and health records are readable only by that user's own authenticated session, and we test that isolation before shipping changes to those tables
• Progress photos are stored in a private storage bucket that is not publicly addressable and are served to you through short-lived signed links
• Access to production systems is limited to the small number of people who need it to operate the Service, and access to consumer health data is limited to those who need it for the purposes described in this policy
• Accounts with administrative access to our production systems are required to use multi-factor authentication
• Secrets and service keys are held server-side and are not shipped in the app bundle
• Every processor listed in the first table of Section 8 is covered by a written data processing agreement before any data flows to it
• We maintain a written incident response plan that maps to the notification deadlines in Section 12, and we review it at least annually
• We design for data minimization: we collect what a feature needs, we do not collect location or advertising identifiers at all, we run the reconstitution calculator on your device and leave the values you type there rather than sending them to a server, we store only the two calculated values you deliberately choose to save onto a compound, and we do not send identifiers or protocol data to our AI providers

12. If there is a data breach

If personal data we hold is compromised, we will notify you in accordance with applicable law, and we will do it without unreasonable delay.

We treat ourselves as covered by the FTC Health Breach Notification Rule. Under that rule, an unauthorized disclosure of identifiable health information counts as a breach even when no attacker is involved and no system is compromised, which is one of several reasons we run no advertising, analytics, or attribution technology anywhere near health data.

Our notice to you will say what happened, when it happened and when we discovered it, what categories of information were involved, the name of any third party that acquired the data if we know it, what we have done in response, what you can do to protect yourself, and how to reach us with questions.

• Individuals: notice without unreasonable delay and no later than 60 calendar days after discovery, by email to the address on your account, or by mail where email is not available
• Federal Trade Commission: notice as soon as possible and no later than 10 business days after discovery if 500 or more individuals are affected
• Prominent media in an affected area: notice within 60 calendar days if 500 or more residents of a single state or jurisdiction are affected
• State attorneys general and other regulators: as required by the breach notification law of your state, which in some states is as short as 30 days

13. Your privacy rights in the United States

These rights come from California, Washington, Nevada, Colorado, Connecticut, Texas, Virginia, Oregon, Montana, Maryland, Minnesota, and other state privacy laws. Rather than sorting you by residence and offering different rights to different users, we extend all of them to every PepSense user in the United States.

Under the California Consumer Privacy Act, all of the health data described in Section 4, plus your account credentials, are "sensitive personal information." We use sensitive personal information only to provide the Service you asked for and for the permitted business purposes described in Section 5. We do not use or disclose it to infer characteristics about you. Because we do not use it beyond those permitted purposes, the right to limit the use and disclosure of sensitive personal information does not apply, and there is nothing for you to limit. If that ever changes, we will publish a way to exercise the right before the change takes effect.

We honor Global Privacy Control and other universal opt-out signals. Because we do not sell or share personal information and do not run targeted advertising, there is nothing for the signal to switch off, but we treat it as a valid opt-out request and would not process one differently.

• Know and access: confirm whether we process your personal data and get a copy of it, including the categories collected, the sources, the purposes, and the categories of third parties that received it
• Correct: fix inaccurate personal data. Most protocol data you can edit directly in the app at any time
• Delete: remove your personal data, including your entire account. See Section 10, which also states honestly what deletion does not reach
• Portability: obtain a copy of the data you provided in a portable, machine-readable format
• Opt out of sale, sharing, targeted advertising, and profiling: we do none of these, so there is nothing to opt out of. We state it here so that the answer is on the record
• Limit the use of sensitive personal information: not applicable, as explained above
• Obtain a list of the third parties that received your data. Section 8 is that list, split between processors and independent third parties, and we will confirm it for your account on request
• Withdraw consent to health data collection at any time, as described in Section 4
• Non-discrimination and no retaliation: we will never deny you the Service, charge you a different price, give you a lower quality of service, or penalize you in any way for exercising a privacy right

14. How to submit a privacy request, and how to appeal

Email support@pepsense.ai with the subject "Privacy Request" and tell us what you want. You can also handle most requests yourself inside the app: access and correct your data on the relevant screens, withdraw health data consent under Settings, and delete your account under Settings.

We will ask you to verify your identity, usually by confirming that you control the email address on the account. We ask for the minimum needed to be reasonably confident you are who you say you are, we do not use verification information for any other purpose, and we delete it when the request is closed. If we cannot verify you, we will tell you why.

Authorized agents may submit requests on your behalf with written permission from you, and we may contact you to confirm that permission.

Requests are free. If a request is manifestly unfounded or excessive, or is repeated more than twice in a 12-month period, we may charge a reasonable fee or decline, and we will explain why in writing.

• We respond within 45 days. If we need more time, we will tell you within that first 45 days and take up to 45 more
• For consumer health data requests, the same 45-day timeline applies, with one 45-day extension on notice to you
• We will tell you what we did, and if we declined any part of the request, why

Appeals

If we deny your request, our response will explain why and how to appeal. To appeal, reply to our decision or email support@pepsense.ai with the subject "Privacy Appeal." A person who was not involved in the original decision will review it, and we will respond in writing within 45 days with our decision and the reasons for it.

If we deny your appeal, you may complain to your state attorney general. Washington residents may file with the Washington State Attorney General using the complaint form at www.atg.wa.gov/file-complaint. Nevada residents may contact the Nevada Attorney General. We will include a link to the appropriate complaint form in any appeal denial we send.

Nothing in this section affects the dispute resolution provisions described in Section 20.

15. Where we offer the Service, and where data is processed

PepSense is currently offered to users in the United States only. The iOS app is distributed on the United States App Store storefront, our sign-up flow is built for United States users, and our documents, disclosures, and rights framework are written to United States federal and state law.

We do not target, market to, or offer the Service to individuals in the European Economic Area, the United Kingdom, or Switzerland. We do not monitor the behavior of individuals located there. If you are located outside the United States, the Service is not offered to you, and you should not create an account.

Because we do not offer the Service in the EEA or the UK, we have not appointed a representative under Article 27 of the EU GDPR or the UK GDPR, and we do not claim to have one. We would rather state that plainly than leave a placeholder in a published policy.

PepSense is operated from the United States, and our providers process data in the United States. United States law may permit government authorities to access data in ways that differ from the law where you live.

We choose our database region deliberately and will disclose it here if we ever operate in more than one.

If we expand to the EEA or the UK

If we decide to offer the Service in the EEA or the UK, we will do the work before opening sign-ups there rather than after. That means, at a minimum: appointing and naming an Article 27 representative for the EU and one for the UK, and publishing their contact details here; documenting our legal basis for each processing activity, relying on explicit consent under Article 9(2)(a) for health data, collected separately from our Terms of Use and withdrawable at any time; completing a data protection impact assessment for the health data processing and a transfer impact assessment for each provider that receives personal data; putting Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum in place with each provider; assessing whether a data protection officer is required and appointing one if so; and updating this policy to describe EEA and UK data subject rights, including the right to lodge a complaint with a supervisory authority.

Until all of that is complete and published, we will not accept sign-ups from those regions. We would rather be honest about being United States only than serve users under a compliance posture we have not actually built.

16. PepSense is for adults only

The Service is offered only to individuals who are 18 years of age or older. Our onboarding asks your age and blocks account creation if you are under 18, and creating an account is a representation that you are 18 or older.

PepSense is not directed to children, is not designed to appeal to children, and is rated accordingly on the App Store. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete the account and its data promptly.

If you believe a person under 18 has created an account, write to support@pepsense.ai and we will act on it.

17. Cookies, local storage, and tracking technologies

The pepsense.ai marketing website sets no cookies, uses no browser local storage or session storage, and loads no analytics scripts, tag managers, advertising pixels, social embeds, or third-party trackers. There is nothing to consent to, which is why you do not see a cookie banner.

The one third-party request the website currently makes is to Google Fonts, which delivers our typefaces. Your browser's request goes directly to Google and carries your IP address, user agent, and the referring page. We do not control that request and we hold no data processing agreement covering it. We are working to self-host our fonts so that the request stops being made, and we will update this section when that ships. The mobile app does not make this request, because its fonts ship inside the app.

The PepSense web application sets a strictly necessary authentication cookie so that you stay signed in. It is required for the Service to function and is not used for analytics or advertising. The mobile app stores your session tokens in the device's app storage for the same reason.

We do not use cookies or any other technology to build advertising profiles, to retarget you, or to follow you to other websites.

18. The website waitlist, your phone number, and text messages

The waitlist form on pepsense.ai collects your name and email address, and offers an optional phone number field. The form also carries a hidden field used only to catch automated spam submissions; it collects nothing about you.

The phone number field is optional and labeled as optional. You can join the waitlist without giving one, and we will not treat a blank phone field differently in any way. We collect it only so that we have a second way to reach you about access if email fails or bounces.

We use waitlist information only to contact you about access to PepSense. We do not sell it, we do not share it for advertising, we do not add it to a marketing list, and we do not use it to build a profile about you.

Text messages require their own consent. We do not send marketing or promotional text messages to any number unless you have given prior express written consent to receive them, through a separate, unchecked consent checkbox presented at the point of collection that names PepSense, Inc. as the sender, states that messages may be sent using automated technology, states that consent is not a condition of joining the waitlist or of any purchase, states that message frequency varies and that message and data rates may apply, and links to our SMS Terms and to this policy. Giving us a phone number, by itself, is not consent to be texted, and we do not treat it as consent.

If you do consent to texts, you can stop them at any time by replying STOP to any message, and you can reply HELP for assistance. You can also email support@pepsense.ai and ask us to stop, and we will.

We keep a record of any texting consent you give, including the time, the page it was given on, and the exact disclosure text you were shown, so that we can prove the consent and honor a revocation.

To have your waitlist entry removed entirely, email support@pepsense.ai and ask. Waitlist entries are stored separately from PepSense accounts, so deleting a PepSense account does not remove a waitlist entry, and asking us to remove a waitlist entry does not affect your account.

Waitlist entries are kept until you ask us to remove you, or for 24 months from signup, whichever comes first.

19. HIPAA, and what actually protects your data

PepSense is not a health care provider, a health plan, or a health care clearinghouse, and we do not act on behalf of one. We conduct no HIPAA standard transactions and we have no business associate relationship with a covered entity. That means the federal Health Insurance Portability and Accountability Act does not apply to the information you enter here, and we will never claim to be HIPAA compliant, HIPAA protected, or HIPAA secure. Any product that tells you a consumer tracking app is HIPAA compliant is telling you something that does not mean what it sounds like.

That does not mean your information is unregulated. State consumer health data laws, including the Washington My Health My Data Act and Nevada's consumer health data law, apply to us directly and carry real consequences, including a private right of action in Washington. California's Confidentiality of Medical Information Act reaches applications like ours that are designed to let you manage your own health information. Every state comprehensive privacy law that recognizes a sensitive data category treats what you log here as sensitive, and we treat it that way for every user regardless of where they live. The FTC Health Breach Notification Rule applies to us. And Section 5 of the FTC Act makes every statement in this policy an enforceable promise, which is exactly why we have written it the way we have, including the description of what the reconstitution calculator does and does not do, and the description of exactly which two values it can write to your account when you ask it to.

If we ever add a feature where a clinician or a telehealth partner uses PepSense on behalf of patients, or where we ingest records from a provider, this analysis changes, and we will update this policy before that feature ships.

20. Disputes about privacy

This policy describes what we do with your data. It does not set the rules for resolving a legal dispute with us.

Dispute resolution for all users, including iOS users, is governed by the dispute resolution section of the PepSense Terms of Use at pepsense.ai/terms. That document is the single authoritative source for governing law, venue, informal resolution, arbitration, and any class action waiver, and it controls over anything in this policy or in the End User License Agreement that could be read to say otherwise.

Nothing in this section limits your ability to raise a privacy concern with us informally at support@pepsense.ai, to appeal a denied privacy request under Section 14, or to file a complaint with your state attorney general or another regulator. We would always rather hear from you first, but you are never required to come to us before going to a regulator.

21. Changes to this policy

We update this policy when our practices change. The effective date at the top always reflects the current version, and we keep prior versions available on request.

For minor edits, such as clarifying language or correcting a typo, we update the page and the effective date. For material changes, meaning any change to what we collect, how we use it, who receives it, how long we keep it, or what rights you have, we will notify you by email at the address on your account and inside the app before the change takes effect.

We will not apply a material change to data we already collected, and we will not broaden how we use it, without asking for your consent first. If a change affects health data, we will ask for fresh, separate, unbundled consent, as Washington and Nevada law require, and we will update the standalone Consumer Health Data Privacy Policy at pepsense.ai/consumer-health-data-privacy at the same time.