Notice of Privacy Practices

Our Commitment to Your Privacy

PeptologyRx is required by law to maintain the privacy of your Protected Health Information (“PHI”), to provide you with this Notice of Privacy Practices describing our legal duties and privacy practices with respect to PHI, and to abide by the terms of this Notice while it is in effect. This Notice applies to all PHI created or received by PeptologyRx in its capacity as a HIPAA covered entity or business associate, to the extent applicable, in connection with the Health Insurance Portability and Accountability Act of 1996, as amended by the HITECH Act, and their implementing regulations at 45 C.F.R. Parts 160 and 164 (“HIPAA”).

In addition, because PeptologyRx sells products and services through PeptologyRx.com, this Notice also explains our privacy practices with respect to personal information we collect from customers, purchasers, and website visitors that does not constitute PHI, such as order, account, payment, and website usage information (“Purchaser Information”). The HIPAA provisions of this Notice govern PHI; the Website and Purchaser Information provisions below govern Purchaser Information. Where information relates to both your health and your purchase (for example, an order for a clinical product), we treat it as PHI and apply the HIPAA provisions of this Notice.

How We May Use and Disclose Your Health Information

Treatment, Payment, and Healthcare Operations

PeptologyRx may use and disclose your PHI, without your written authorization, to facilitate treatment, payment, and healthcare operations. For example, we may share your PHI with other healthcare providers involved in your care, with a health plan to obtain payment for services, or internally for quality assessment, training, and business planning purposes.

Other Permitted or Required Disclosures

Without your authorization, we may also use or disclose your PHI:

• as required by federal, state, or local law;
• for public health activities, such as reporting disease outbreaks or adverse events;
• to health oversight agencies for audits, investigations, or inspections;
• in response to a valid court order, subpoena, or other lawful legal process;
• to law enforcement officials as required or permitted by law;
• to avert a serious and imminent threat to your health or safety or that of another person; and
• to our business associates who perform functions on our behalf, provided they agree in writing to protect your PHI.

Business Associates

PeptologyRx may engage third-party vendors or service providers that create, receive, maintain, or transmit PHI on our behalf. In each such case, PeptologyRx enters into a Business Associate Agreement meeting the requirements of 45 C.F.R. § 164.504(e), obligating the vendor to safeguard your PHI and to use or disclose it only as permitted by the agreement and by law.

Uses and Disclosures Requiring Your Written Authorization

Uses and disclosures of your PHI not described above will be made only with your written authorization. This includes, for example, most uses and disclosures of medical notes, uses and disclosures of PHI for marketing purposes, and disclosures that constitute a sale of PHI. You may revoke a written authorization at any time by notifying us in writing, except to the extent we have already taken action in reliance on it.

Your Rights Regarding Your Health Information

Subject to certain conditions and limitations set forth in HIPAA, you have the right to:

• Access and Copy. Request access to, and obtain a copy of, PHI we maintain about you, in the form and format you request if readily producible.
• Amend. Request that we amend PHI you believe is incorrect or incomplete. We may deny your request under certain circumstances permitted by law.
• Accounting of Disclosures. Request a list of certain disclosures of your PHI made in the six years prior to your request, other than disclosures for treatment, payment, healthcare operations, and certain other excluded categories.
• Request Restrictions. Request that we restrict certain uses or disclosures of your PHI. We are not required to agree to all requested restrictions, except where you have paid out of pocket in full for a service and request that we not disclose PHI about that service to a health plan.
• Confidential Communications. Request that we communicate with you about your PHI by alternative means or at alternative locations.
• Paper Copy. Obtain a paper copy of this Notice at any time upon request, even if you previously agreed to receive it electronically.
• Notice of Breach. Receive notification if your unsecured PHI is breached, as described below.

To exercise any of these rights, please submit a written request to the Privacy Officer using the contact information at the end of this Notice.

Breach Notification

In the event of a breach of unsecured PHI, PeptologyRx will notify affected individuals, the U.S. Department of Health and Human Services, and, where required, the media, in the manner and within the timeframes required by the HITECH Breach Notification Rule (45 C.F.R. §§ 164.400–414).

Our Responsibilities

PeptologyRx is required to:

• maintain the privacy and security of your PHI as required by law;
• provide you with this Notice describing our legal duties and privacy practices regarding your PHI;
• abide by the terms of this Notice currently in effect; and
• notify you if we are unable to agree to a requested restriction or amendment, and of any breach of your unsecured PHI.

Website and Purchaser Information (Non-PHI)

This section applies to personal information PeptologyRx collects through Peptology-Rx.com and in connection with purchases, whether or not that information is PHI. It supplements, and does not limit, your rights under the HIPAA sections above.

Information We Collect

When you visit our website, create an account, place an order, or otherwise interact with us, we may collect:

• Contact and account information, such as your name, email address, mailing address, and phone number;
• Order and transaction information, such as products purchased, order history, and, where applicable, shipping and billing details;
• Payment information, such as the credit card information, billing address, and transaction confirmation (full payment card numbers are processed by our third-party payment processor);
• Device and usage information, such as IP address, browser type, pages viewed, referring URLs, and approximate location, collected automatically or through cookies and similar technologies; and
• Communications you send us, such as customer service inquiries, product questions, or marketing preferences.

How We Use Purchaser Information

We use Purchaser Information to:

• process, fulfill, and ship orders, and communicate with you about them;
• create and maintain your account and provide customer support;
• process payments and prevent fraud;
• send you marketing or promotional communications, where permitted, and where you may opt out at any time using the unsubscribe link in any email or by contacting us;
• operate, maintain, and improve our website, products, and services, including through analytics; and
• comply with tax, accounting, consumer protection, and other legal obligations.

Cookies and Similar Technologies

Our website uses cookies and similar technologies to operate the site, remember your preferences, and understand how visitors use our website. You can control cookies through your browser settings; disabling cookies may affect site functionality.

How We Share Purchaser Information

We do not sell Purchaser Information to third parties for their own marketing purposes. We may share Purchaser Information with:

• service providers who perform functions on our behalf, such as payment processing, shipping and fulfillment, website hosting, email delivery, and analytics, under contractual obligations to protect your information and use it only to provide services to us;
• professional advisors, such as accountants and lawyers, as needed;
• a successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections; and
• regulators, law enforcement, or other parties where required by law or to protect our rights, property, or safety, or that of others.

Retention

We retain Purchaser Information for as long as reasonably necessary to fulfill the purposes described above, including to complete transactions, provide customer support, maintain business records, and comply with our legal, tax, accounting, and recordkeeping obligations. Retention periods vary by category of information; for example, order and payment records are generally retained for the period required by applicable tax and consumer protection laws, while marketing preference and account information are generally retained until you close your account or opt out, plus a reasonable period thereafter for recordkeeping. When Purchaser Information is no longer needed for these purposes, we will delete, de-identify, or securely archive it in accordance with our internal data retention practices.

Security

We maintain administrative, technical, and physical safeguards designed to protect Purchaser Information against unauthorized access, use, alteration, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your Choices

You may update or correct your account information by contacting us, opt out of marketing communications at any time, and, depending on your state of residence, may have additional rights to access, delete, or correct personal information, or to opt out of certain sharing, under applicable state privacy laws. To exercise any of these choices, contact us using the information below.

Children

Our website and products are not directed to children, and we do not knowingly collect personal information from children under the age of 18.

Changes to This Notice

PeptologyRx reserves the right to change the terms of this Notice, including the Site and Terms of Service section, and to make the revised Notice effective for information we already maintain, as well as information we receive in the future. The current version of this Notice will be available at Peptology-rx.com/privacypolicy and, upon request, in paper form at our place of business.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with PeptologyRx using the contact form on our website, or, for PHI-related complaints, with the U.S. Department of Health and Human Services, Office for Civil Rights. PeptologyRx will not retaliate against you for filing a complaint.

Effective Date and Contact Information

This Notice is effective as of the user’s first access to the domain peptology-rx.com.