This privacy notice (hereinafter referred to as the "Notice") explains how P PLUS FZ-LLC, a company incorporated in Ras Al Khaimah, United Arab Emirates, with registered number 0000004090065 ("we", "us", "our"), collects, uses, shares and protects Personal Data when you use the PepTrack mobile application (available on the Apple App Store and Google Play Store) (hereinafter referred to as the "App"), visit https://www.peptrack.com (hereinafter referred to as the "Website"), or otherwise interact with us.
We process your Personal Data in compliance with applicable data protection laws, including Regulation (EU) 2016/679 (hereinafter referred to as the "GDPR").
Please read this Notice together with our Terms of Service, which together explain our practices in full.
By using the App or the Website, you acknowledge that we will process your Personal Data in accordance with this Notice. You are not obliged to provide your Personal Data. If you do not wish to provide it on the basis set out in this Notice, you should not enter it in the App or on the Website or otherwise provide it to us. However, if you do not provide Personal Data, we may be unable to provide the App or Website's full functionality, including tracking and synchronisation features. We process your Health Data only where you have given explicit consent; using the App is not by itself consent to the processing of your Health Data.
The capitalised terms used in this Notice have the meanings set out hereunder:
Depending on how you interact with us, we collect the following categories of Personal Data:
| Category | What's included |
|---|---|
| Account data | Date of birth (provided directly), email address and display name, provided directly, via Google Sign-In (OAuth 2.0), or via Sign in with Apple. Where you use Apple's "Hide My Email" option, the address we hold is an Apple-generated relay address rather than your own. Login credentials and account preferences. |
| Health and tracking data | Peptide protocol details (compound, dose, route, frequency, schedule), dose logs (taken/skipped, timestamps, injection site, notes), body measurements (weight, body fat %, waist, chest, arm measurements), custom tracker ratings (1-5 scale and notes), and free-text notes. This data constitutes Health Data under Article 9 of the GDPR. |
| Profile data | Experience level and goals (optional). |
| Communications and support data | Messages, enquiries and other content you send us. |
| Technical data | IP address, device and browser information, and standard request metadata inherent to any app communicating with a server, used only for security and delivering the service. |
| Waitlist data | Email address, where you sign up to our waitlist via our Website. |
| Consent records | A record of each consent event, including timestamp, consent text version, source and IP address, retained to demonstrate consent. |
The App processes Health Data (special-category data under Article 9 of the GDPR). We process Health Data only on the basis of your explicit consent. We do not knowingly collect Personal Data from anyone under 18.
We collect Personal Data:
We use your Personal Data for the following purposes, relying on the following legal bases under the GDPR:
| Purpose | Legal basis |
|---|---|
| To operate the App and your account, synchronise your data across devices, and schedule dose reminders | Performance of a contract with you (Article 6(1)(b) of the GDPR) |
| To process your Health Data (peptide protocols, dose logs, body measurements, custom trackers and notes). Consent is captured in-app before any tracking feature is accessible. | Your explicit consent (Article 6(1)(a) and Article 9(2)(a) of the GDPR) |
| To authenticate you | Performance of a contract (Article 6(1)(b) of the GDPR) and our legitimate interests in keeping your account secure (Article 6(1)(f) of the GDPR) |
| To provide customer service and respond to your enquiries | Performance of a contract (Article 6(1)(b) of the GDPR) and our legitimate interests in supporting users (Article 6(1)(f) of the GDPR) |
| To send transactional emails (account verification, password reset) | Performance of a contract with you (Article 6(1)(b) of the GDPR) |
| To operate our Website waitlist and notify you when the App becomes available | Your consent (Article 6(1)(a)); you may unsubscribe at any time |
| To keep records and to establish, exercise or defend legal claims | Compliance with a legal obligation (Article 6(1)(c) of the GDPR) and our legitimate interests in protecting our rights (Article 6(1)(f) of the GDPR) |
| To maintain security and prevent abuse | Our legitimate interests in keeping the service secure (Article 6(1)(f) of the GDPR) |
Where we rely on your consent to process Health Data, you may withdraw that consent at any time via the App's privacy settings. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. If you withdraw consent for Health Data processing, the App's tracking features will become inaccessible, but your account will remain active under Article 6(1)(b).
The App does not use cookies. The Website (peptrack.com) may use strictly necessary cookies. We do not use analytics, advertising or tracking cookies in the App or on the Website.
Your account and tracking data are stored and processed within the EEA (Render, Frankfurt, Germany; AWS SES, Ireland; Microsoft, EU region). Limited authentication processing may involve Google and Apple in the United States, if you choose those sign-in options.
Where Personal Data is processed outside the EEA, we rely on appropriate safeguards, such as: (a) the EU–US Data Privacy Framework, where the recipient is certified; and (b) the European Commission's Standard Contractual Clauses. Google and Apple act as independent Data Controllers and apply their own transfer mechanisms.
We retain your account and tracking data for as long as your account remains active. You can manage your data directly from the App's Settings:
Deleted data is purged from backups within 90 days.
Furthermore, we may retain your Personal Data after the expiration of the relevant processing purposes in the following limited cases:
We implement technical and organisational measures designed to protect Personal Data, which include encryption at rest and in transit (HTTPS/TLS), encrypted local storage on your device, secure authentication token storage in the device operating system's keystore, access controls on a need-to-know basis, and EU data residency (Frankfurt, Germany). No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security; we respond to any personal-data breach as required by law.
PepTrack is a personal tracking tool. It does not provide medical advice, diagnosis or treatment. You are solely responsible for the lawfulness of the use of the App. Always consult a qualified healthcare professional before making any decision about a substance, dose or protocol.
Subject to the conditions and exemptions under applicable law, you have the right to:
Most of these rights you can exercise directly in the App from Settings. For any request that cannot be handled in-app, contact us at privacy@peptrack.com.
If you are unsure about your rights or are concerned about how your Personal Data may be processed, you may contact us at privacy@peptrack.com.
To exercise any right, contact us using the details in clause 12.2. Please note that whilst we will try to accommodate any request you make in respect of your rights, they are not absolute rights. This means that we may have to refuse your request or may only be able to comply with it in part.
Where you make a request in respect of your rights, we will require proof of identification. We may also ask that you clarify your request. We will aim to respond within one (1) month of receiving your request, which we may extend by up to two (2) further months where the request is complex or numerous (and we will tell you if so). If we receive repeated requests or have reason to believe requests are being made unreasonably, we reserve the right not to respond.
PepTrack does not use automated decision-making or profiling. All data displayed in the App is a simple presentation of the information you have entered (charts, streaks and trends computed from your own inputs).
The App and the Website are intended for persons aged 18 or over. We do not knowingly collect Personal Data from children. If you believe a child has provided us with Personal Data, please contact us and we will delete it.
We may update this Notice from time to time. The "Last updated" date shows when it was last revised, and material changes will be notified through the App or by other appropriate means. Please check it periodically.
If you have any question or concern about this Notice or how we handle your Personal Data, contact us at privacy@peptrack.com.