Consumer Health Data Privacy Policy
Peptide Dose Tracker (peptidedosetracker.com)
Effective date: October 12, 2026
Last updated: October 12, 2026
This policy is published under the Washington My Health My Data Act (chapter 19.373 RCW). We apply it to everyone who uses Peptide Dose Tracker in the United States, wherever you live, and we use the same request process for residents of Nevada, Connecticut and other states with consumer health data laws. It supplements our Privacy Policy. If the two conflict about consumer health data, this policy controls, except that nothing here limits the rights and information in section 12 of the Privacy Policy. That section applies because we are established in the European Union and the EU GDPR treats health-related data as a special category.
1. Who we are
Peptide Dose Tracker is operated by Uladzislau Yasinski, a sole proprietor (NIP 5273049048), ul. Michała Kleofasa Ogińskiego 11 lok. 9, 03-318 Warsaw, Poland ("we", "us"). Privacy requests: [email protected].
We are not a health care provider, a health plan or a HIPAA covered entity. Information in the service is not protected health information under HIPAA.
2. Short version
- By default your tracker data stays in your browser on your device. We do not receive it.
- We collect tracker data only if you turn on cloud sync (a Pro feature) after you read and accept a separate consent screen. You can turn sync off at any time.
- We do not sell consumer health data. We do not share it with anyone other than the service providers ("processors") listed below, who act only on our instructions.
- You can ask us to confirm, give you a copy of, or delete your consumer health data, and you can withdraw consent at any time.
3. Consumer health data we collect, and why
| Category | What it includes | Why we collect it and how we use it | When |
|---|---|---|---|
| Tracker entries | Names of substances or medications you type; vial details (amount, liquid added, dates, expiry date you enter); schedules; logged injections (date, time, amount you enter, injection site); notes you write | To show you your log, schedule and vial stock on your devices, to produce exports and reports you request, and to send the reminders you set up | Only if you turn on cloud sync. Content is encrypted on your device before upload (see section 7) |
| Reminder settings | Days and times of reminders; your email address or browser push address | To deliver the reminders you turn on. Reminders use fixed generic wording and never include substance names, amounts or notes | Only if you turn on email or push reminders and give consent on a separate screen |
| Calculator inputs and results | Strengths, volumes, syringe type, results | Calculators run in your browser. Inputs and results are not sent to us | Never collected |
| Account and billing data tied to a health tool | Email address, sign-in method, plan and subscription status, Stripe customer ID, IP address, browser and device type, security logs | To sign you in, bill you, secure the service and answer support requests. We treat this data as consumer health data because it shows that a person uses a health-related tool | When you create an account, subscribe or use the service. We ask for your explicit consent when you create the account |
| Usage events (optional) | Names of actions such as "vial saved", a random anonymous ID, approximate browser details. Never values, names, notes or amounts | To understand which features are used and fix problems | Only if you turn on "Help improve the tracker" in Settings and give your explicit consent. Off by default |
| Support messages | What you write to us and any files you attach | To answer you. Please do not include health details you do not want us to hold | When you contact us |
We do not collect precise location, biometric data, genetic data, or data about reproductive or sexual health services. We do not use geofences.
If we want to collect another category of consumer health data, or use the data for another purpose, we will first update this policy and ask for your consent.
4. How we use consumer health data
We use it only for the purposes in section 3: to provide the features you request, send reminders you set up, process your subscription, secure the service, respond to you, and comply with law. We do not use it for advertising or marketing, to build profiles about you, to train AI models, or to make decisions about you. We do not give it to employers, insurers or data brokers.
5. Where it comes from
We collect consumer health data from you (what you enter) and from your browser or device (technical data sent when you connect). Stripe tells us whether a payment succeeded and the status of your plan. We do not buy data from data brokers and we do not combine your data with data from other sources.
6. Who we share it with
Sales and sharing. We do not sell consumer health data. We do not share it with third parties or affiliates. We have no affiliates that receive it. If this ever changes, we will update this policy and ask for your separate consent before any sharing, and we will not sell consumer health data without a signed authorization that meets RCW 19.373.070.
Processors. We disclose consumer health data only to processors that handle it for us under written contracts that limit them to our instructions:
| Processor | Category | What it receives |
|---|---|---|
| Cloud infrastructure and database provider used for sync | Hosting and storage | Encrypted tracker data and reminder schedules, only if you turn sync on |
| Resend (Plus Five Five, Inc.) | Email delivery | Your email address and the generic text of sign-in links, receipts and reminders |
| Vercel Inc. | Website hosting | Request data such as IP address and browser details |
| PostHog Inc. (EU cloud, Frankfurt) | Product analytics | Page views on public pages with no persistent ID; usage event names only if you opt in |
| Stripe Payments Europe, Limited and Stripe, LLC | Payments | Email, billing details and plan. Never tracker entries, substance names, amounts or notes |
| Google LLC | Optional sign-in and support email | Your Google account email if you use Google sign-in; support messages |
If we use a new processor, we will add it here.
Other disclosures. We may disclose data if required by valid legal process, in the way EU and Polish law allow (for a request from a court or authority in the United States, usually through a mutual legal assistance treaty), to prevent or investigate security incidents, fraud or illegal activity, or in a merger, acquisition or sale of the business where the buyer takes over this policy and its obligations. Because tracker content is encrypted with a key we do not hold, we cannot read it and could provide only encrypted data. We will tell you before data is transferred to a successor, unless the law forbids it.
7. Local storage, cloud sync and encryption
Without sync, tracker data is stored in your browser (IndexedDB and local storage) on your device. It is not on our servers. We cannot recover it if you clear site data or lose the device, so use the export and backup file features.
Cloud sync is not available in the current version. The rest of this section describes how it will work when we release it, and we will not collect tracker data for sync before you accept the consent screen.
With sync on, your tracker data is encrypted on your device with a key that stays with you before it is uploaded. We store the encrypted data, cannot read its contents, and cannot restore it if you lose your key. We still hold that data, so we treat it as consumer health data and honor all rights in this policy. Reminder times are not encrypted, because we need them to send reminders. If you turn sync off, we stop collecting. The copy on our servers is deleted 60 days later, or immediately if you use Delete cloud copy. If your Pro plan ends, sync stops and the copy is deleted after 60 days unless you resubscribe.
8. Consent
We ask for consent before collecting tracker data for sync, on a screen that lists the categories of data, the purposes, who receives the data, and how to withdraw. Accepting our Terms is not consent. Consent is a clear action you take on that screen, and declining does not stop you from using the free tracker. We also ask for your explicit consent, on separate screens, when you create an account, when you turn on reminders and when you turn on analytics in the tracker. If we ever ask to share consumer health data, we will ask separately from the consent to collect it.
To withdraw consent, open Settings, Sync, and turn sync off, or email [email protected]. Withdrawing stops future collection. You can also delete the cloud copy (section 10).
9. Your rights
You have the right to:
- confirm whether we are collecting, sharing or selling your consumer health data, and access it, including a list of all third parties and affiliates we have shared or sold it to, with contact details for them (at this time there are none);
- withdraw consent to our collection and sharing of your consumer health data;
- have your consumer health data deleted;
- correct inaccurate data (you can edit your entries in the tracker, and you can ask us if you cannot) and get a copy in a portable, readily usable format;
- appeal if we refuse to act on a request;
- not be discriminated against for using these rights.
10. How to use your rights
- In the app: Settings, Privacy. You can turn off sync, export your data, delete your cloud copy, or delete your account.
- By email: [email protected]. You do not need to create an account to send a request. If you have an account, we may ask you to confirm the request from the email address on file. If we cannot authenticate you with commercially reasonable efforts, we may ask for additional information, and we will tell you that we could not authenticate the request. If we decline a request, we tell you within the same period why and how to appeal.
Timing. We respond without undue delay and within one month of receiving your request. We may extend this once by up to 45 days when reasonably necessary, and we will tell you the reason within the first month. We reply to requests free of charge. If requests are manifestly unfounded or excessive, in particular because they repeat earlier requests, we may charge a reasonable fee or decline, and we will explain why.
Deletion. When we verify a deletion request we delete your consumer health data from our systems, including archived and backup systems, and we tell our processors to delete it too. Live data is deleted within one month of the request and usually within minutes when you use the in-app delete button. Backups are overwritten on a 35-day cycle, so deleted data leaves backups within 35 days of deletion, and in all cases within six months of verifying your request. Data stored only on your device is under your control: use Settings, Erase this device, or clear site data in your browser. We keep billing records that contain no tracker data as long as tax and accounting rules require.
Appeal. If we refuse or do not act on a request, reply to our message or email [email protected] with "Appeal" in the subject. We will tell you in writing within 45 days of receiving the appeal what we did or did not do and why. If we deny the appeal, you may contact your state attorney general: Washington, https://www.atg.wa.gov/file-complaint ; Connecticut, https://portal.ct.gov/ag/consumer-issues/file-a-complaint ; Nevada, https://ag.nv.gov .
11. Security and breach notice
We limit access to consumer health data to the people and processors who need it to provide the service you requested, and we maintain administrative, technical and physical practices that meet a reasonable standard of care for the type and amount of data we hold. No system is completely secure, and we cannot guarantee that unauthorized access will never occur.
If we discover an unauthorized acquisition or disclosure of unsecured health information in your account, we will notify you without unreasonable delay and no later than 60 calendar days after discovery, as the FTC Health Breach Notification Rule (16 CFR Part 318) requires, and we will notify the FTC and other authorities where required. Because the EU GDPR applies to our processing, we also notify the Polish supervisory authority (UODO) within 72 hours where feasible if a breach is likely to result in a risk to you, and we tell you without undue delay if it is likely to result in a high risk to you, without waiting for the 60-day limit. The notice will describe what happened, the types of information involved, steps you can take, what we are doing, and how to contact us.
12. Minors
The service is for adults 18 and older. We do not knowingly collect consumer health data from anyone under 18. If you believe a minor has used the service, email [email protected] and we will delete the data.
13. Changes
We will post changes on this page with a new "Last updated" date. If a change adds a category of consumer health data, a purpose, or a recipient, we will tell you and ask for your consent before it takes effect for you.
14. Contact
Uladzislau Yasinski, Peptide Dose Tracker, ul. Michała Kleofasa Ogińskiego 11 lok. 9, 03-318 Warsaw, Poland. Email: [email protected]