Privacy Policy & Notice of Privacy Practices

Craft Peptides (“we,” “us,” or “our”) is committed to protecting your personal and medical information. This Privacy Policy & Notice of Privacy Practices describes how we collect, use, and disclose your information when you:

• • Use our telemedicine platform and peptide therapy services as a patient;
• • Visit our website or patient portal; or
• • Communicate with us by phone, email, text, or other electronic means.

This policy is designed to comply with the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and applicable state laws.

We do not sell your personal or health information.

Protected Health Information (PHI)

This includes information that identifies you and relates to your past, present, or future physical or mental health:

• • Medical History: Current diagnoses, medication history, lab results, and contraindications relevant to peptide therapy.
• • Treatment Records: Prescriptions, consultation notes, and treatment plans developed by your provider.
• • Telehealth Data: Audio/video consultation records, chat logs, and identity verification documents.

Non-PHI and Technical Data

• • Account Information: Name, email, shipping address, and telephone number.
• • Financial Data: Credit card details and billing information processed via our secure payment gateway.
• • Device & Usage Data: IP addresses, browser type, and interaction logs.

We apply the minimum necessary standard to all uses and disclosures, meaning we limit PHI access to only what is needed to accomplish the intended purpose.

Treatment

We share your information with licensed healthcare providers, compounding pharmacies, and labs to conduct consultations and fulfill prescriptions.

Payment

We use your information to bill you for services, process credit card payments, and manage accounts.

Health Care Operations

We use data to conduct quality assessment and improvement activities, maintain regulatory compliance, and perform business management.

• • Right to Inspect and Copy: You may request access to your medical and billing records.
• • Right to Amend: You may request corrections to your PHI if you believe it is incorrect or incomplete.
• • Right to an Accounting of Disclosures: You may request a list of certain disclosures we have made.
• • Right to Request Restrictions: You may ask us to limit how we use or share your PHI.
• • Right to Confidential Communications: You may ask us to contact you via specific means or at alternative locations.

We utilize AES-256 bit encryption for all data at rest and in transit. Our video consultation platform is HIPAA-compliant, ensuring that your sessions are private and secure.

We retain medical records for a minimum of seven (7) years following the last date of service, or longer if required by law. After the retention period, data is securely destroyed using industry-standard digital shredding methods.

In the event of a breach affecting your protected health information, we will notify you within 60 days as required by HIPAA.

If you have questions about this policy, wish to exercise your privacy rights, or need to file a complaint, please contact our Privacy Officer:

In addition to your HIPAA rights described in Section 4, residents of certain states have additional rights regarding consumer health data under state law. These rights apply to health-related information that may fall outside the scope of HIPAA.

Washington (My Health My Data Act), Nevada (SB 370), and Connecticut (Data Privacy Act, as amended)

If you are a resident of Washington, Nevada, or Connecticut, or if your consumer health data is collected in one of these states, you have the following additional rights:

• • Right to confirm and access — You may confirm whether we are collecting, sharing, or selling your consumer health data, and access the data we have collected about you.
• • Right to delete — You may request deletion of your consumer health data from our active, archived, and backup systems, except where retention is required by law.
• • Right to withdraw consent — You may withdraw your consent to the collection or sharing of your consumer health data at any time.
• • Right to a list of third parties — Washington and Nevada residents may request a list of all third parties with whom we have shared their consumer health data.
• • Right to opt out of sale — We do not sell consumer health data. We have never sold consumer health data.

To exercise any of these rights, contact our Privacy Officer at privacy@craftpeptides.com or (512) 807-7360. We will respond within 30 days for Washington residents and 45 days for Connecticut and Nevada residents.

We will not discriminate against you for exercising any of these rights.

Separate Consumer Health Data Privacy Policy: In compliance with Washington law, we maintain a separate Consumer Health Data Privacy Policy that provides additional detail about how we collect, use, share, and protect consumer health data.

Geofencing: Craft Peptides does not use geofencing technology to identify, track, collect data from, or send notifications to consumers at or near any healthcare facility.

California (CCPA/CPRA): While Craft Peptides does not currently meet the processing thresholds that trigger compliance obligations under the California Consumer Privacy Act (as amended by the CPRA), we extend the following rights to California residents as a matter of good practice: the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information. To make a request, contact privacy@craftpeptides.com.

You have the right to file a complaint if you believe your privacy rights have been violated. Contact our Privacy Officer or file with the U.S. Department of Health and Human Services Office for Civil Rights at www.hhs.gov/ocr/privacy.

We will not retaliate against you for filing a complaint.