Consumer Health Data Privacy Notice

Effective date: August 23, 2026
Last updated: August 23, 2026
Health-data notice version: [CHD-VERSION, e.g., 2026.1]

This Consumer Health Data Privacy Notice (“Health Data Notice”) supplements our Privacy Notice. It applies to “consumer health data” and similar information protected by the Washington My Health My Data Act, Nevada consumer-health-data law, and other applicable laws.

The Service is operated by QOLITY LLC, operating the Peptides & Nootropics and The Evidence-Based Encyclopedia of Peptides and Nootropics brands (“Operator,” “we,” “us,” or “our”).

We do not sell consumer health data. We do not use it for targeted advertising. We do not provide it to affiliates, creators, product vendors, employers, or insurers.

Do not submit patient records or identifiable patient information. The Service is not a medical-record, telehealth, prescribing, or patient-management system.

1. What “consumer health data” means here

Consumer health data generally means personal information that is linked or reasonably linkable to a person and identifies or reveals that person’s past, present, or future physical or mental health status.

Because the Service concerns peptides, medications, nootropics, herbs, supplements, mushrooms, and related topics, information such as a search, bookmark, support message, or inferred interest may qualify even when it is not a diagnosis and even when HIPAA does not apply.

This Notice uses “consumer health data” broadly to include information treated as such under applicable law.

2. Categories of consumer health data we may collect

Depending on the features you use, we may process:

1. Search data: a term temporarily processed to return search results. Under the privacy-preserving configuration, raw search terms are not intentionally persisted in application logs or analytics.
2. Viewed-content data: the page requested to deliver content. We do not maintain an account-level history of every entry viewed by default.
3. Saved-content data: compounds, articles, categories, or alerts you affirmatively bookmark or save.
4. Optional Recent Activity: a personalized list of viewed content only if you separately opt in. It is off by default.
5. Communications: health-related interests or questions included in support, correction, survey, or feedback messages.
6. Subscription context: information that a person subscribes to a health-related encyclopedia.
7. Professional information: a voluntarily provided credential, role, specialty, student status, or organization that may reveal a professional health-care connection.
8. Inferences: limited inferences necessary to provide a requested feature, such as associating a bookmark with a category. We do not create advertising profiles from health interests.
9. Security and request data: records reasonably necessary to authenticate, secure, investigate, or respond to a health-data request.

We do not intend to collect diagnoses, laboratory results, medication lists, genetic data, biometric data, patient records, or identifiable case information. Do not submit them.

3. Sources of consumer health data

We may receive consumer health data from:

• you, when you search, save, enable an optional feature, communicate, or submit a request;
• your browser or device as needed to deliver a page or maintain a secure session;
• an organization administrator, but only for account administration and not compound-level reading history;
• authentication, hosting, database, email, support, security, and payment processors acting on our behalf;
• a referral system, limited to attribution and not health-interest activity; and
• a person who reports a security, privacy, content, or account issue.

We do not purchase consumer health data from data brokers.

4. Why we collect and use consumer health data

We collect or use consumer health data only as reasonably necessary to provide a product or service you requested, with your consent where required, or as otherwise permitted by law.

Purposes may include:

• returning a search result during the active request;
• storing a bookmark or alert you asked us to save;
• providing optional Recent Activity after separate opt-in;
• authenticating and securing an account;
• processing a subscription;
• responding to support, correction, privacy, or security requests;
• preventing fraud, scraping, unauthorized access, or abuse;
• maintaining legal acceptance and transaction records;
• debugging and maintaining the Service without retaining raw health-interest activity;
• complying with law; and
• establishing, exercising, or defending legal claims.

We do not use consumer health data to:

• target advertisements;
• decide eligibility for employment, insurance, credit, housing, or health care;
• set individualized prices based on health interests;
• market a compound, clinic, pharmacy, supplement, or product;
• compensate an affiliate based on entries read;
• build a data-broker profile; or
• train a model to infer a person’s health condition for advertising or eligibility decisions.

5. Consent

5.1 Necessary processing

We may process consumer health data without separate consent when the processing is necessary to provide a product or service you requested or where law otherwise permits. For example, a search term must be transiently processed to return search results, and a bookmark must be stored to provide the bookmark feature.

5.2 Optional processing

We will request standalone affirmative consent before collecting or using consumer health data for an optional purpose that is not necessary to provide the requested core service.

The consent request will:

• be separate from general Terms acceptance;
• identify the categories of data;
• identify the specific purpose;
• not use a preselected checkbox;
• not use dark patterns;
• explain how to withdraw consent; and
• link to this Notice.

5.3 Optional Recent Activity

The following or substantially similar text should be used:

“I consent to Peptides & Nootropics storing the entries I view so it can show me a personalized Recent Activity list. This feature is optional and off by default. I can disable it and delete the history at any time in Privacy Settings.”

The feature must remain disabled unless a current consent record exists.

5.4 New categories or purposes

We will obtain any new consent required before collecting a new category of consumer health data or using existing consumer health data for a materially different purpose not disclosed when collected.

6. How we disclose consumer health data

We disclose consumer health data only:

1. to processors necessary to provide, secure, support, or maintain the Service;
2. at your direction;
3. as necessary to comply with law, respond to valid legal process, protect safety or security, investigate fraud or abuse, or establish and defend legal claims; or
4. in a business transaction subject to appropriate restrictions and applicable law.

Processors may include:

• Vercel — hosting, content delivery, limited network and security logs;
• Clerk — account authentication and identity;
• Neon — account preferences, bookmarks, consents, and application records;
• Stripe — subscription and payment information; it should not receive entry-level reading or search data;
• [EMAIL/SUPPORT PROVIDER] — messages you send and transactional communications;
• [SECURITY/ERROR PROVIDER] — minimized error and security information with raw search terms and compound-specific authenticated URLs removed; and
• Vercel Analytics — aggregate or coarse metrics only after applicable consent.

The current specific processor list, purpose, and data categories are maintained at /subprocessors.

We do not disclose identifiable consumer health data to affiliates, creators, sponsors, product vendors, employers, insurers, or data brokers.

7. Sale of consumer health data

We do not sell consumer health data.

If we ever proposed a transaction that qualifies as a sale under applicable consumer health law, we would not proceed without the separate, written, signed authorization required by law. That authorization would be distinct from Terms acceptance and would identify the data, purchaser, purpose, expiration, revocation method, and other legally required information.

A merger, acquisition, or sale of assets will be handled under applicable law and does not authorize the buyer to disregard this Notice.

8. No geofencing around health-care facilities

We do not use a geofence around an entity that provides in-person health-care services to identify, track, collect data from, or send health-related messages or advertisements to a person.

The Service does not request precise device location for this purpose.

9. Your consumer health data rights

Subject to verification, exceptions, and applicable law, you may request:

• confirmation of whether we collect, share, or sell your consumer health data;
• access to consumer health data we maintain;
• a list of affiliates, processors, or other third parties with whom it was shared, as required;
• correction of inaccurate information;
• withdrawal of consent;
• deletion, including directing processors to delete;
• portability in a usable format; and
• appeal of a denied request.

Because we do not sell consumer health data, there is no sale authorization to revoke.

10. How to exercise rights

Submit a request by emailing peptidesandnootropicsencyclopedia@proton.me with “Consumer Health Data Request” in the subject.

Identify:

• the right you are exercising;
• the email associated with your account;
• the relevant feature or time period, if known; and
• whether you are acting through an authorized agent.

We will not require you to create a new account to submit a request.

11. Verification and authorized agents

We will use reasonable methods to verify identity and authority while minimizing additional information.

We may:

• ask you to authenticate to the account;
• send a confirmation to the account email;
• request information that reasonably matches our records; or
• require an authorized agent to provide evidence of authorization and ask you to directly confirm the request.

We will not use verification information for an unrelated purpose.

12. Response timing

We aim to respond without undue delay and within forty-five days after receiving a verifiable request, unless applicable law allows an extension.

If reasonably necessary, we may extend the period once by up to forty-five additional days and will explain the reason within the initial period.

If we deny a request in whole or part, we will explain the basis and provide appeal instructions.

13. Deletion

When a verified deletion request applies, we will delete the consumer health data from active systems and notify processors as required, subject to lawful exceptions.

Routine backups and archives may not be immediately accessible. Applicable law may permit deletion from backups to be delayed until restoration or for a limited period. Our target is to remove deleted consumer health data through ordinary backup rotation within ninety days and no later than six months where that maximum is permitted.

We may retain a minimal record of the request and deletion, legal acceptance, transaction, security incident, fraud investigation, or litigation hold as permitted by law. Retained information will not be used for a new incompatible purpose.

Deleting bookmarks, Recent Activity, or an account does not automatically cancel a paid subscription. The account interface must present cancellation and deletion together so you can select both.

14. Withdrawal of consent

You may withdraw consent through Privacy Settings or a request to peptidesandnootropicsencyclopedia@proton.me.

Withdrawal is prospective. We will stop the optional processing and delete the related information on request, subject to permitted retention. Withdrawal may disable the optional feature but will not affect core access that does not require it.

15. Appeals

You may appeal a denial by emailing peptidesandnootropicsencyclopedia@proton.me with “Consumer Health Data Appeal” in the subject within [AT LEAST 30] days after the decision.

The appeal will be reviewed by a person who was not solely responsible for the initial denial where feasible. We will respond within the period required by applicable law and provide information about contacting the appropriate attorney general or regulator when required.

16. Security

We use safeguards designed to protect consumer health data, including data minimization, encryption where appropriate, least-privilege access, administrator multi-factor authentication, vendor restrictions, logging, and incident response.

No system is completely secure. Contact peptidesandnootropicsencyclopedia@proton.me immediately if you believe your account or consumer health data is at risk.

17. Retention

Our retention schedule is described in the Privacy Notice.

In particular:

• raw search terms are not intentionally persisted;
• account-level viewing history is not stored by default;
• bookmarks remain until deleted or the account is deleted;
• optional Recent Activity remains only until deleted, consent is withdrawn, or the configured short history period expires;
• raw security logs generally remain no longer than ninety days; and
• legal acceptance and transaction records may be kept longer for legal purposes.

18. Changes to this Health Data Notice

We will post updated versions and maintain a version history.

Before applying a materially new consumer health data category, purpose, disclosure, or sale, we will provide prominent notice and obtain any consent or authorization required by law. Passive continued use will not be treated as consent where affirmative consent is required.

19. Contact

Operator: QOLITY LLC
Consumer health data requests: peptidesandnootropicsencyclopedia@proton.me
Email: peptidesandnootropicsencyclopedia@proton.me
Appeals: peptidesandnootropicsencyclopedia@proton.me
Security: peptidesandnootropicsencyclopedia@proton.me