Consumer Health Data Privacy Policy

Effective date: April 15, 2026 — Version 1.0
Applies to: Residents of Washington State (RCW 19.373 — "My Health My Data Act")

1. Who we are

PeptideWise (this website, at getpeptidewise.com) and PeptideTracker (our mobile app, available on iOS and Android) are operated by Jonathan Amparo ("we," "us," "our"). Contact: contact@getpeptidewise.com.

2. What we mean by "consumer health data"

Under Washington's My Health My Data Act ("MHMDA"), consumer health datais any personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. For PeptideTracker, this includes:

• Injection logs (compound, dose, time, injection site, reaction notes)
• Vial inventory (compound, concentration, reconstitution date, storage)
• Protocol and titration schedules you configure
• Side-effect logs linked to specific doses
• Bloodwork and lab panel entries you enter manually
• Progress photos you save inside the app
• Body composition entries (weight, body fat percent)

The PeptideWise website does not collect consumer health data. It serves educational content only.

3. Categories of consumer health data and their sources

• Injection logs, vial inventory, protocols, titration schedules, side-effect logs — collected directly from you inside the PeptideTracker app.
• Bloodwork and lab panel entries — collected directly from you inside the app.
• Progress photos, body composition entries — collected directly from you inside the app.

We do not derive consumer health data from third-party sources, ad-platform SDKs, data brokers, or location tracking.

4. How we use consumer health data

We process consumer health data for a single purpose: to let you track your own protocol on your own device. Specifically:

• To display your dose history, vial inventory, and schedule back to you.
• To show trends and correlations between your logs (for example, linking a side-effect entry to the dose that preceded it).
• To schedule local reminders on your device for upcoming doses or vial expiry.

We do not use consumer health data for advertising, targeted marketing, analytics, model training, or any secondary purpose.

5. Where consumer health data is stored

All consumer health data stays on your device, inside an encrypted SQLite database (SQLCipher with AES-256). The encryption key is stored in your device's secure enclave (iOS Keychain or Android Keystore). We do not operate a server that receives, stores, or has access to your consumer health data. If you uninstall the app, the data and the key are deleted with it.

6. With whom we share consumer health data

We do not share, sell, rent, or lease your consumer health data with anyone.

Because consumer health data never leaves your device, we have no subprocessors, advertising partners, data brokers, or affiliates that receive it.

7. Sale of consumer health data

We do not sell consumer health data. Sale is prohibited under RCW 19.373.040 without a separate, valid authorization; we do not solicit such authorizations and do not intend to.

8. Retention

We retain consumer health data only for as long as you keep it on your device. You can delete individual entries at any time from within the app, or wipe everything via Settings → Account → Delete Account, which:

1. Empties every Drift table that stores consumer health data.
2. Clears all preferences and legal-acceptance timestamps.
3. Signs you out of your Sign in with Apple session and RevenueCat.
4. Returns you to onboarding.

Uninstalling the app also deletes all on-device consumer health data.

9. Your rights (Washington residents)

Under RCW 19.373.030, Washington residents have the right to:

1. Confirm whether we are collecting, sharing, or selling your consumer health data.
2. Access a list of all third parties with which we have shared or sold your consumer health data. (For us: none.)
3. Delete your consumer health data.
4. Withdraw consent from our collection and sharing of consumer health data at any time.
5. Appeal our response to any of the above requests.

Because consumer health data is stored on your device, you can exercise rights (1)–(4) yourself without contacting us: open the app, review the data, and delete individual entries or the entire dataset via Settings → Account → Delete Account or Settings → Privacy → Withdraw Consent.

If you would prefer that we process a formal request instead, email contact@getpeptidewise.com with the subject line [CHD Request] and describe which right you are exercising. We will respond within 45 days (with one extension of up to 45 additional days if reasonably necessary, per RCW 19.373.030(3)).

10. How to appeal

If we decline a request under Section 9, you may appeal by replying to our response email or sending a new message to contact@getpeptidewise.com with subject line [CHD Appeal]. We will respond within 45 days. If the appeal is denied, you may file a complaint with the Washington Attorney General at atg.wa.gov/file-complaint.

11. Consent

Before we collect or process consumer health data inside PeptideTracker, we ask for your consent during onboarding via a dedicated checkbox:

"I understand PeptideTracker collects consumer health data (injections, doses, bloodwork) on my device and I consent to it being processed solely for my own tracking and protocol management."

You can withdraw consent at any time via Settings → Privacy → Withdraw Consent. Withdrawing consent deletes all consumer health data on your device, because we have no basis to retain it without your consent.

12. Changes to this policy

If we materially change how we handle consumer health data, we will update this page and notify you in-app before the change takes effect. The current version is shown at the top of this page.

13. Contact

Questions, rights requests, or appeals: contact@getpeptidewise.com.