Privacy Policy

The Pep Report ("we," "our," or "us") is operated by DigitalTreehouse LLC. This Privacy Policy explains how we collect, use, store, and protect your personal and genetic information when you use our website, purchase The Pep Test™, or receive our personalized peptide and nutraceutical reports.

By using our services, you agree to the practices described in this policy. If you do not agree, please do not use our services.

Personal Information: When you create an account, order a test, or contact us, we collect information including your name, email address, phone number, shipping address, payment information, and account password.

Health and Demographic Information: When you complete our health assessment quiz, we collect information about your biological sex, age, height, weight, health goals, symptoms, and lifestyle.

Genetic Information: When you submit a DNA sample through The Pep Test™, our lab partner processes your sample and generates a genetic data file. This file is transmitted securely to our systems where it is analyzed against our knowledge base of peptide and nutraceutical interactions. Your raw genetic file is not retained after your report is generated.

If you are a resident of a state with a direct-to-consumer genetic testing privacy law (including but not limited to Alabama, Arizona, California, Florida, Kentucky, Maryland, Montana, Nebraska, Tennessee, Texas, Utah, Virginia, and Wyoming), you have the right to revoke your consent for the use, collection, storage, or disclosure of your genetic data. Upon revocation, we will direct destruction of your biological sample within 30 days, consistent with applicable state law. We obtain separate, specific consent before using your genetic data for any purpose beyond generating your report.

Telehealth and Clinical Information: If you use telehealth services through our platform, we and our Telehealth Partner collect information you provide during intake, including symptoms, medical history, medications, treatment goals, and any information shared during your visit. This is separate from your genetic data and is used to support your care.

Usage Information: We automatically collect information about how you interact with our website, including IP address, browser type, device type, pages visited, time spent on pages, and referring URLs.

Cookies and Similar Technologies: We use a small number of cookies and similar technologies that are needed for the site to work, to keep you signed in, and to measure how our own site is used. We do not place third-party advertising cookies or tags. See "Analytics and advertising" below.

We use your information to:

• Process and fulfill your Pep Test™ order
• Generate and deliver your personalized Pep Report
• Send you account updates, shipping notifications, and report alerts
• Provide customer support
• Improve our services and knowledge base
• Send marketing communications (you can opt out anytime)
• Measure how our own site is used so we can improve it
• Comply with legal obligations
• Prevent fraud and protect our services

We may share your information with:

Lab and Processing Partners: Our CLIA-certified lab partner processes your DNA sample. They handle your genetic data under strict confidentiality and security standards.

Service Providers: Companies that help us operate our business, including payment processors, shipping carriers, email service providers, hosting providers, and analytics services.

Advertising Platforms: None. We do not share your information with advertising platforms, ad networks, or data brokers. See "Analytics and advertising" below.

Telehealth and Pharmacy Partners: If you use telehealth services, we share relevant intake and clinical information with your treating provider and their affiliated pharmacy to facilitate evaluation, prescribing, and fulfillment. This is currently done through our partner FUSE Health Inc. We reserve the right to change telehealth or pharmacy partners at any time; in that event, your information will continue to be handled under this Privacy Policy and applicable law.

Licensed Providers: Your report is yours to share with a licensed healthcare provider of your choice. Through our telehealth services, you may also be connected with a licensed provider for evaluation and prescribing.

Legal Requirements: We may disclose information when required by law, court order, or government request.

We do NOT sell your personal or genetic information to third parties, and we never share your genetic, health-assessment, or report data with advertisers.

We use first-party analytics only. This means we measure how our own site is used with our own software, on our own servers, and the resulting data stays with us.

We do not run Google Analytics, Google Tag Manager, the Meta pixel, or any other third-party advertising or analytics tag on this site. No advertising platform receives information about your visit, your quiz answers, your order, or your report. We do not sell your information, and we do not share it with data brokers.

We record the pages you visit, the link or campaign that brought you here, and actions such as starting the quiz or completing an order. This information is tied to a random identifier, not to your name or email address, and we do not attempt to track you across other websites. We use your IP address to determine your general region and then discard it.

We honor the Global Privacy Control signal. If your browser sends it, we disable non-essential analytics for your visit.

If you arrived through a referral link from one of our affiliates or partners, we record that referral so the affiliate can be credited for the order. Affiliates see counts of visits and orders and the commission owed. They never see your name, email address, order contents, quiz answers, or report.

You may choose to share your Pep Report with a healthcare provider by entering their name and email address from your report page. Nothing is shared unless you take that action.

When you share, the provider receives an invitation to create an account and can then view the report you shared with them. Providers apply for access, are checked against the national NPPES provider registry, and are approved by us individually before any report opens to them.

A provider may keep private notes about you and may use a private chat with our assistant about your case. Those notes and that chat are the provider's working record. They are stored by us, they are not visible to you, and they are not part of your report.

You can revoke a provider's access at any time from your report page. Revoking access stops any further viewing. Your decision to share and your decision to revoke are both recorded in your account.

Providers who refer patients to us receive a referral link and promotional code so that their patients receive a discount. Providers are never paid a commission and never receive a payout from us.

Research use of your de-identified genetic and health information is optional and is separate from Pep Club membership. You are never required to agree to research in order to buy The Pep Test, to join The Pep Club, or to stay a member.

You may decline research and remain a Pep Club member with every membership benefit, and if you did agree you may withdraw at any time from your account settings. Withdrawing does not cancel your membership or change anything else about your account.

We use industry-standard security measures to protect your information, including encryption in transit and at rest, secure data centers, access controls, and regular security audits. Your raw DNA file is processed transiently to generate your report and is not stored after processing. The report results we retain are kept separately from your identifying information using industry-standard encryption and access controls.

Our CLIA-certified lab partner is subject to HIPAA. Where you use telehealth services, your treating provider and their pharmacy are independently responsible for HIPAA compliance for your clinical data. The Pep Report applies industry-standard safeguards to the data we hold directly, and is working to confirm the specific data-sharing and security terms with each telehealth partner.

No system is 100% secure, and we cannot guarantee absolute security.

If a breach involving your unsecured personal or health information occurs, we will notify affected individuals and, where required, the FTC and/or other regulators, in the manner and timeframe required by applicable law, including the FTC's Health Breach Notification Rule where applicable.

You have the right to:

• Access the personal information we hold about you
• Request corrections to inaccurate information
• Request deletion of your account and associated data
• Opt out of marketing communications
• Withdraw optional research consent at any time
• Request a copy of your genetic data
• Revoke consent for data processing (where applicable)

To exercise any of these rights, contact us at privacy@thepep.report or through our Contact page.

We do not retain your raw genetic data file; it is processed transiently to generate your report and is not stored afterward. We retain your personalized report results (the genetic variants relevant to your recommendations, shown by rsID and gene), your account information, and your health-assessment responses for as long as your account is active or as needed to provide services. If you delete your account, we delete your personal information within 90 days, except where retention is required by law. We retain de-identified genetic and health data for research only if you have given separate, optional consent, which you may withdraw at any time.

Clinical and telehealth intake information is retained by us and our Telehealth Partner as needed to provide care, support ongoing prescriptions, and comply with applicable medical recordkeeping laws, which may require longer retention than other account data.

Our services are not intended for anyone under 18. We do not knowingly collect information from minors. If you believe we have collected information from a minor, please contact us immediately.

Our services are operated from the United States. If you access our services from outside the U.S., your information will be transferred to, stored in, and processed in the United States.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on our website. Your continued use of our services after changes become effective constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, get in touch via our Contact page.