Your data, handled with care.

Information We Collect

Account info

Email, name (optional), password hash, subscription status.

Health & research data

Compounds logged, doses, timing, cycle info, symptoms, mood/energy/sleep ratings, bloodwork uploads, attached photos, and free-text notes.

Device data

Device model, OS version, app version, crash logs, and diagnostic signals needed to keep the app working.

Usage data

Which features you use and when, so we know what to improve. We use privacy-preserving analytics and do not use third-party advertising SDKs.

Apple Health / HealthKit

Only the categories you explicitly authorize (e.g., weight, steps, sleep, heart rate).

How We Use It

• To operate, maintain, and improve the Service.
• To generate your personal insights, reports, and trends.
• To provide customer support.
• To send transactional and important service emails. We do not send marketing without opt-in.
• To detect, prevent, and address fraud, abuse, or security incidents.
• To comply with legal obligations.

How We Share Information

• Service providers — cloud hosting, email, crash analytics, payment processing, and customer support tools, each under a written Data Processing Agreement.
• Legal — if required by law, subpoena, or to protect rights, safety, or property.
• Business transfers — in connection with a merger, acquisition, or asset sale, with notice to you.
• With your consent — e.g., exporting a PDF to share with your clinician.

We do not sell personal information as defined by the CCPA or share it for cross-context behavioral advertising.

AI Processing

Some AI-generated insights are produced with third-party large-language-model providers under a Data Processing Agreement that prohibits use of your data to train their public models. Where possible, we process insights on-device or with de-identified inputs. You can turn off AI insights at any time in Settings.

Data Retention & Deletion

We keep your data while your account is active. You can delete your account and all associated data from Settings → Account → Delete Account. We will complete deletion within 30 days, except where retention is required by law (e.g., tax or billing records).

Security

We use TLS 1.2+ in transit, AES-256 at rest, access controls, audit logging, and periodic security review. No system is perfectly secure; if we detect a breach affecting your data, we will notify you as required by applicable law.

Your Rights CCPA · GDPR · state laws

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate data.
• Delete your data.
• Export your data in a portable format.
• Object to or restrict certain processing.
• Opt out of sale or sharing (we don't do either, but you can confirm).
• Lodge a complaint with your local data protection authority.

Contact privacy@peplab.ai to exercise any of these rights. We verify requests and respond within 30–45 days.

Children's Privacy

The Service is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe we have, contact privacy@peplab.ai and we will delete it.

International Users

Peplab is operated from the United States. If you use the Service from outside the U.S., your information will be transferred to, stored, and processed in the U.S. under standard contractual clauses where applicable.

Changes to This Policy

We may update this Privacy Policy. Material changes will be announced in-app and by email. The "Last updated" date at the top of this page always reflects the current version.

Contact