Privacy Policy & Health Data Notice

Last updated: 2026-07-21

This Privacy Policy & Health Data Notice explains how TrackPep ("TrackPep", "we", "us") collects, uses, stores, discloses, and protects your information when you use the TrackPep website and mobile app (together, the "Service"). By using the Service you agree to this Policy.

1. What TrackPep is — and is not

TrackPep is a personal record-keeping and journaling tool for people who want to keep their own log of medications, peptides, doses, injection sites, side effects, weight, hydration, nutrition, sleep, bloodwork, and related notes, and to see their own history and simple trends.

TrackPep is not a medical service and does not provide medical, pharmaceutical, or health advice. Specifically, TrackPep does not provide medical advice, diagnosis, treatment, or dosing instructions; does not recommend, prescribe, sell, or endorse any medication, peptide, or dosage; is not a healthcare provider, pharmacy, telehealth service, or medical device; and does not verify anything you choose to record. See our Medical Disclaimer for more. You are solely responsible for your own health decisions — always consult a qualified healthcare professional.

2. Information we collect

• Account data — email address, optional display name, your authentication provider (Google, Apple, or email), and your language and unit preferences.
• Onboarding data — goals, experience level, and preferences you provide to personalize the app.
• Health journal data (sensitive) — anything you choose to log: compounds, inventory, doses, injection sites, side effects, weight, hydration, nutrition, sleep, bloodwork, daily check-ins, progress photos, and notes. We treat this as sensitive personal data and consumer health data.
• AI assistant messages — if you use Pep Bot, your message text and limited context are sent to our AI provider (DeepSeek) to generate a response. Pep Bot is educational only and does not give medical advice.
• Device & technical data — operating system, app version, language, crash reports, and basic diagnostics.
• Product analytics — de-identified usage analytics (PostHog) and crash reports (Sentry). We do not send your health journal entries to analytics or crash tools.
• Subscription data — processed by Apple, Google, RevenueCat (mobile), and Polar (web). We receive only your entitlement status (Free/Pro) and purchase metadata; we never receive or store your full card details.

3. Health Data Privacy Notice

This section describes how we handle health data and "consumer health data" as defined under laws such as the Washington My Health My Data Act, Nevada's consumer health data law, and similar state laws.

We collect health data only that you choose to enter, and we use it to provide the Service's core tracking, history, reminder, and personalization features, to sync your data across your devices, to provide AI features you request, to maintain security, and to respond to support requests.

• We do not sell consumer health data.
• We do not share consumer health data for targeted advertising.
• We do not use your personal health data to train TrackPep-owned AI models.
• We do not use geofencing to identify or track you near healthcare facilities.

If we ever intend to materially change how we use, disclose, or process consumer health data, we will update this Policy and obtain any consent or written authorization required by applicable law before those practices begin.

4. How we use your data — and what we never do

We use your data only to provide the Service to you: showing your own timeline and trends, syncing your devices, sending reminders you set, generating exports and reports you request, and providing AI features you ask for. We do not profile or process your health data for our own commercial purposes.

We never sell your data. We never share your health or medical data with any third party for advertising or their own use, and we never share it with data brokers. Your medical data is for you, and you alone.

5. Service providers (subprocessors)

To run the Service we rely on a small number of providers that process data strictly on our behalf, bound by data-protection terms, and only to operate the feature involved:

We may also disclose data where required by law, subpoena, or legal process, or to protect the rights, safety, and security of our users and the Service. If TrackPep is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this Policy and applicable law.

6. Storage & retention

Your data is stored only so the Service can show it back to you and keep your devices in sync. It is encrypted in transit and at rest and protected with row-level security, so only your account can read it.

When you delete your account, your records are removed promptly (generally within 30 days) and roll off backups shortly after. Some records may be retained where required for legal, tax, or fraud-prevention purposes.

7. Your privacy rights

Depending on where you live (e.g. under the GDPR, UK GDPR, CCPA/CPRA, or other US state laws), you have rights to access, correct, delete, export, and restrict the processing of your data, to withdraw consent, and to opt out of sale, sharing, or targeted advertising (which we do not do). In the app you can:

• Access & export your data (Settings → Export);
• Correct any entry (every record is editable);
• Delete your account and all data (Settings → Delete account);
• Withdraw consent to optional analytics (Settings → Privacy).

US state residents. If you live in California, Colorado, Connecticut, Virginia, Oregon, Washington, Nevada, or another state with a privacy law, you may have additional rights, including the right to confirm, access, delete, and appeal, and rights regarding consumer health data. We do not sell personal information or consumer health data. To exercise any right, or to appeal a decision, email support@trackpep.com.

8. Security

We use encryption in transit (TLS) and at rest, row-level security, and provider-managed authentication. The mobile app supports an optional biometric / passcode lock. No system is perfectly secure, but we work to protect your data and to notify you of material incidents as required by law.

9. International users

TrackPep is operated from the United States. If you use the Service from outside the US, your information may be transferred to and processed in the US and other locations where our providers operate. Where required, we use appropriate safeguards for international transfers.

10. Children

TrackPep is intended only for adults aged 18 and over. It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact support@trackpep.com and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here with a new "Last updated" date and, for material changes, take additional steps such as notifying account holders.

12. Contact

Questions about this Policy or your data: support@trackpep.com.