Consumer Health Data Privacy Policy

This policy applies to you if you are:

• •WA A Washington state resident, or a person whose consumer health data is collected in Washington
• •NV A Nevada consumer whose consumer health data is collected, processed, or maintained by Craft Peptides
• •CT A Connecticut resident whose health-related personal data is processed by Craft Peptides

Craft Peptides provides telemedicine peptide therapy services to patients across the United States. If you are located in any of these states or your data is collected in these states, this policy applies to you.

We may collect the following categories of consumer health data:

We collect consumer health data through the following means:

• •Directly from you — when you complete your health assessment, intake forms, upload lab results, communicate with your clinician, or provide information during consultations
• •From your healthcare providers — when your Craft Peptides clinician documents your consultation, creates treatment plans, or writes prescriptions
• •From third-party services — from compounding pharmacies fulfilling your prescriptions, clinical laboratories and lab ordering platforms processing your bloodwork, and payment processors handling your transactions
• •From your device — technical data such as IP address and browser type collected when you interact with our platform (to the extent it relates to or can be used to infer health information)

We collect, use, and process consumer health data for the following purposes, which are necessary to provide the services you have requested:

• •Treatment — to facilitate your telemedicine consultations, develop personalized peptide therapy protocols, transmit prescriptions to compounding pharmacies, and provide follow-up care
• •Payment — to process payments for consultations, medications, and services
• •Healthcare operations — to conduct quality assurance, maintain regulatory compliance, and manage our clinical operations
• •Communication — to send appointment reminders, lab result notifications, medication calendar updates, and respond to your inquiries
• •Legal compliance — to comply with applicable federal, state, and local laws, regulations, and legal processes

We do not collect consumer health data beyond what is necessary to provide the services you have requested or for the purposes listed above.

We may share consumer health data with the following categories of third parties, only as necessary to provide the services you have requested:

• •Licensed healthcare providers — the physicians and physician assistants who provide your clinical care through the Craft Peptides platform
• •Compounding pharmacies — to fulfill your prescriptions (including Strive Pharmacy, Olympia Pharmacy, and other pharmacy partners)
• •Laboratories — to process bloodwork and lab orders you have requested
• •Technology service providers — our platform infrastructure providers (such as Amazon Web Services, Supabase, and Clerk) who process data on our behalf under contractual obligations to protect your information
• •Payment processors — to process your payments securely

We do not sell consumer health data. We do not share consumer health data for advertising or marketing purposes.

Depending on your state of residence, you may have the following rights regarding your consumer health data:

We will respond to verified requests within 30 days for Washington residents and 45 days for Connecticut and Nevada residents, as required by applicable law. We will not discriminate against you for exercising any of these rights.

To exercise any of the rights described above, contact us using one of the following methods:

• •Email: privacy@craftpeptides.com
• •Phone: (512) 807-7360
• •Mail: Craft Peptides, Attn: Privacy Officer, 1005 Congress Avenue, Suite 925-F35, Austin, TX 78701

We may need to verify your identity before processing your request. We will not require you to create a new account to exercise your rights, but may ask you to use your existing Craft Peptides account for verification purposes.

Where required by applicable law, we obtain your affirmative, opt-in consent before collecting or processing your consumer health data. Your consent is collected through clear checkboxes during your assessment intake and consultation booking processes. Consent obtained through broad terms of use, pre-checked boxes, or deceptive design is not valid under these laws.

You may withdraw your consent at any time by contacting us at privacy@craftpeptides.com. Withdrawal of consent does not affect the lawfulness of processing performed prior to withdrawal.

We retain consumer health data for a minimum of seven (7) years following the last date of service, or longer if required by applicable law, to comply with medical record retention requirements. When consumer health data is no longer necessary for the purposes for which it was collected or as required by law, we securely delete or de-identify the data.

If you request deletion of your consumer health data, we will delete the data from our active systems, archived systems, and backup systems, except to the extent retention is required by law.

We implement appropriate technical and organizational measures to protect consumer health data, including AES-256 bit encryption for data at rest and in transit, role-based access controls, and HIPAA-compliant platform infrastructure. For more details on our security practices, see our Privacy Policy & Notice of Privacy Practices.

WA In compliance with Washington law, Craft Peptides does not use geofencing technology to identify, track, collect data from, or send notifications to consumers who visit any healthcare facility, including hospitals, clinics, mental health facilities, reproductive health clinics, or substance use disorder treatment centers.

Craft Peptides does not sell consumer health data. We have never sold consumer health data. If this practice were ever to change, we would obtain valid, signed authorization from each affected consumer prior to any sale, as required by Washington, Nevada, and Connecticut law.

We may update this Consumer Health Data Privacy Policy from time to time. If we make material changes, we will update the “Last Updated” date at the top of this policy and may notify you by email or through our platform. Your continued use of our services after changes become effective constitutes your acknowledgment of the updated policy.

If you have questions about this policy, wish to exercise your consumer health data rights, or need to file a complaint, please contact:

WA Washington residents may also file a complaint with the Washington State Attorney General at atg.wa.gov.

CT Connecticut residents may file a complaint with the Connecticut Attorney General at dir.ct.gov/ag.