Peptivist
Consumer health data
A separate policy for consumer health data, as Washington, Nevada and Connecticut require. It says what health data we hold, where it comes from, who sees it, and how you get rid of it.
Effective 5 October 2026 · Sold by Opsgrip LLC
The short version
- All of it comes from you. We collect no health data from any other source — no data broker, no advertising network, no other app, no device we have not been explicitly connected to.
- We do not sell it. Not for money, and not in exchange for anything else.
- We never use it for advertising, and there is no advertising anywhere in Peptivist.
- There is no analytics, attribution or crash-reporting software in the app. None. So there is no path by which health data reaches one.
- The only sharing that happens is the sharing you set up yourself, area by area, and you can end it instantly.
What counts as consumer health data here
These laws define health data broadly — it includes anything that identifies your past, present or future physical or mental health status. In Peptivist that means effectively everything you record:
- What you take and when — compounds, supplements, medications, the schedule, and each dose ticked off, skipped or missed, with the date.
- Injection sites, where you record one.
- Body measurements — weight, waist, chest, hips, arms, thighs, neck.
- Sleep, food, water and training, with times of day.
- Lab results — bloodwork PDFs and photographs of panels.
- Photographs of your body, where you upload them.
- Prescription records — whatever you copy off the label, including the prescriber’s name, the prescription number and refills remaining.
- Your date of birth, held as an age attestation on your login.
- What you keep and buy — vials and orders, notes on vials that went bad, and your private order reviews. We treat these as health data too, because an inventory of compounds says what a person takes.
- The fact that you share an inventory with someone. An order alert (“An order has shipped”) names nothing, but it reveals that two people keep peptide stock together, so we treat the alert itself as health data and list the providers that carry it below.
Where it comes from
One source: you. Every item above is something you typed into the app or a file you chose to upload. We do not obtain health data from data brokers, advertising networks, other applications, public records, or any third party. We do not infer health data about you from anything else — the app derives no conclusions from your records, does not score them, and never runs recognition, measurement or machine learning on a photograph you upload.
Why we collect it
To provide the thing you signed up for and nothing else: to show you what is due, keep your history, count your inventory, and show your records to the specific people you have granted access to. We do not use consumer health data for advertising, for profiling, for training any model, for product analytics, or for any secondary purpose.
Who it is shared with
Other Peptivist users you choose. This is the product. When you grant somebody access to a profile you pick the areas separately — schedule, inventory, logs, lab results and photographs, and the change history. Somebody granted the schedule cannot see your bloodwork, and that is enforced in the database rather than by hiding a screen. You can revoke access at any time, immediately, without their approval and without notifying them.
Other Community members, if you post there. Community is optional. Anything you choose to write or upload in it — including anything about your own health — is shown to other members under your username, and, in a channel the owner shows on peptivist.com, to anyone reading the website. Nothing from your Peptivist records is ever posted for you; only what you type or attach yourself.
Service providers, under contract, processing only on our instructions. This is the complete list of third parties with any access to consumer health data:
Supabase Inc.
Database hosting and file storage. Holds all of it, as our processor. Region us-east-2 (United States).
Resend
Sends sign-in codes, invitation emails and order alerts. It sees an email address, the name of whoever invited you, and the one-line alert — which never names a vendor, product, quantity or price. Listed here because the alert reveals that you share an inventory with someone; it receives nothing else.
Expo (650 Industries, Inc.)
Relays push notifications to Apple and Google, who deliver them to your phone. It sees your push token and the same one-line alert, and nothing else. Only involved if you allow notifications.
Two other providers are involved in running Peptivist and receive no consumer health data: RevenueCat handles subscription and membership status and sees an account identifier and which plan or membership you have; GIPHY receives the words of a Community GIF search from our server, not who searched.
Nobody else. No affiliates. No advertisers, data brokers or analytics companies. We would disclose data if legally compelled, and if we receive a demand for your records and are permitted to tell you, we will.
How it is protected
- Files live in a private storage bucket and are never given a public URL. Opening one requests a signed link that expires in five minutes.
- Every image is re-encoded before upload, which strips the location metadata a photograph normally carries.
- Access is enforced by row-level security in the database, so a modified copy of the app cannot read what it is not entitled to.
- Everything travels over HTTPS.
Your rights
If you are in Washington, Nevada or Connecticut, you have the right to know what consumer health data we collect and who we share it with, the right to withdraw your consent to its collection and sharing, and the right to have it deleted, including by our processors. Washington residents may enforce these rights directly.
You do not have to ask us to exercise most of them, and you do not have to wait:
Know
This page is the disclosure. More → Settings → Export my records gives you the actual data, as spreadsheets and a PDF. Free on every plan.
Withdraw consent to sharing
More → People, then remove access. It takes effect immediately, needs nobody’s approval, and does not notify them.
Delete
More → Settings → Delete my account and data. Immediate, permanent, removes your uploaded files from storage rather than just the links, and cannot be undone by anybody including us. See the deletion page.
Correct
Everything is editable in the app.
If you would rather we did it, or you cannot reach the app, write to peptivistsupport@opsgrip.com from the address on your account. We respond to rights requests within the period the law requires. If we refuse a request we will tell you why, and you may appeal by replying to that answer; if we deny the appeal you may complain to your state Attorney General.
Deletion and backups
Deletion removes your records from the live database and from file storage immediately.
Database backups are taken daily and seven days are kept. A deleted account’s records age out of them within that week, and a backup is never used to restore a deleted account.
Your uploaded files are not in those backups at all. Database backups cover the database, which holds only a record that a file exists — not the file. When you delete, the bloodwork and the photographs are removed from storage there and then, and there is no backup copy of them to outlive it.
Changes, and how to reach us
If we change this policy we will update the date at the top, and we will not apply a material change to consumer health data already collected without telling you in the app first.
Opsgrip LLC — peptivistsupport@opsgrip.com
This page covers consumer health data specifically. The privacy policy covers everything else, and the terms cover the agreement itself.