Legal

Consumer Health Data Privacy Policy

Last updated October 3, 2026. Pepmaxing exists to record health-related information, so this is the heart of our privacy commitments. It supplements the Privacy Policy and provides the disclosures required by consumer health privacy laws — Washington’s My Health My Data Act, Nevada SB 370 and Connecticut’s consumer health data provisions among them — where those laws apply.

Scope

This policy explains how LastGenApps LLC, a Wyoming limited liability company and the company behind Pepmaxing (“we”, “us”, “our”), collects, uses and discloses consumer health data through the Pepmaxing iOS application and the pepmaxing.health website. “Consumer health data” means personal information that identifies your past, present or future physical or mental health status, including information derived or inferred from other data. Pepmaxing is a tracking, reference and educational product. It is not a healthcare provider, does not diagnose or treat, and is not covered by HIPAA; this policy is what protects your health data instead.

Consumer health data we collect

Depending on the features you use, we collect or process:

Profile and goals: biological sex, age, height, weight, goals, experience level, motivation, obstacles, the compounds you use or are interested in, and check-in and weigh-in preferences.
Protocol and dosing information: compound identity, dose amount and unit, administration route, frequency, schedule, cycle, blend composition, vial size and reconstitution volume, start date, notes, every dose logged or skipped with its time and any override, streaks, and injection-site history.
Health observations: weight, body-fat percentage, lean mass, waist and other circumferences, mood, energy, sleep and similar measurements you enter, with dates and notes.
Body-scan results: circumferences, estimated weight and body fat, posture angles, a quality score and the body-shape parameters the App uses to draw your body. (The scan’s video and frames are processed on your device and never collected — see Storage.)
Progress photos: photos you choose to capture or import to track change over time.
Nutrition information: meals, water, nutrition targets, foods you search or scan, and portion corrections you make to estimates.
Assistant conversations: the questions you ask and the answers you receive, insofar as they concern your health.
Derived information: estimates and projections the App computes from the above — estimated compound levels, body-mass index, body fat, lean and fat mass, and Ahead projections from published trial averages.
Feedback and support messages when they mention your health.

We do not collect precise location, biometric identifiers, genetic data, reproductive or sexual health data, or data from other apps or from healthcare providers. We do not use geofences around healthcare facilities, or anywhere else, to identify or collect consumer health data.

Sources of consumer health data

We collect consumer health data directly from you, as you enter it; from your use of the App’s protocol, tracking, nutrition, photo, body-scan and assistant features; and from information the App derives from those sources, such as estimates, projections and body-scan measurements computed from a video on your device. When Apple Health integration becomes available it will be an additional source, only for the data types you authorise, and this policy will be updated before it ships. We do not obtain consumer health data from data brokers, advertisers, employers, insurers or clinicians.

Why we collect and use it

We collect consumer health data only with your consent, given as you enter it, and only to provide the features you ask for: personalising the App; scheduling, logging and reminding you about doses; rotating injection sites; tracking vials; estimating compound levels from published half-lives; recording and charting health observations; scanning and measuring your body; logging nutrition against your targets and estimating meals from photos; answering your questions from our research library and your own data; projecting published trial averages onto your data; synchronising everything across your devices; and providing support and account deletion.

We also use it, to the minimum extent necessary, to enforce fair-use limits on AI analysis, to secure the service and prevent abuse, and to comply with the law. We do not use consumer health data for advertising, marketing or profiling, do not derive characteristics about you for any purpose other than the features you use, and do not use it to train artificial-intelligence models.

How data is stored and transmitted

Synchronised to your account. Your protocols, dose logs, health observations, body-scan results, meals, assistant conversations, saved and custom compounds and preferences are stored locally on your device and mirrored to your account on our servers, encrypted in transit, so that a new device or a reinstall restores them. Unlike some trackers, Pepmaxing is not “on-device only”; we say so because you should know where your data is.

Never transmitted. The body-scan video, its frames and the fitted 3D mesh are processed by Apple’s Vision framework and our model on your iPhone and remain in the App’s private storage on that device. Only the resulting numbers and shape parameters synchronise. The assistant runs on your device; your messages are not sent to any AI provider.

Transmitted once, not stored. A meal or Nutrition Facts label photo is sent through our server to OpenAI for a single analysis, without your identity, and is not stored by us. Food searches and barcodes that our own database cannot answer are sent to Open Food Facts without any account identifier.

Progress photos are uploaded to private, account-scoped storage that only your authenticated session can open.

Access. Every table and storage bucket is protected by row-level security so that only your account can read your rows and files. Our staff do not browse user data; access to production is limited to the people who operate it and is used only to keep the service running. We do not run analytics, advertising or attribution software in the App, so no consumer health data — not even the fact that you use a health app — flows to such providers.

Disclosures and recipients

Infrastructure processor: Supabase, Inc. hosts authentication, the database, private file storage and the server functions that call OpenAI and Open Food Facts, processing consumer health data only on our instructions under a data-processing agreement.
AI provider: OpenAI processes meal and Nutrition Facts label photos to produce food and portion estimates. It receives the photo and our instructions, never your identity; it does not use API content to train its models and deletes it within 30 days, subject to legal exceptions.
Food database: Open Food Facts, a non-profit, receives barcodes and search terms our database cannot answer, without any identifier. The USDA FoodData Central dataset is hosted by us; nothing is sent to the USDA.
Subscriptions, analytics and crash reporting: RevenueCat verifies App Store purchases and keeps your subscription status in sync; Superwall presents and tests subscription offers; PostHog receives product-usage events (which screens and features were used) and session replays in which every text field and image is masked on the device before upload; Sentry receives crash reports. Each receives an opaque account identifier and purchase, paywall, usage or crash information respectively — never consumer health data. Analytics and replay can be switched off in Settings → Your data.
Platforms: Apple and Google receive sign-in and, where applicable, purchase information under their own terms. They receive no consumer health data from us. Apple’s on-device frameworks (Vision) process the body scan locally and send nothing to Apple.
Legal and safety recipients: we may disclose information when required by a valid legal demand or reasonably necessary to protect users, the service or the public, and we will notify you where the law permits.
Successors: in a merger, acquisition or asset transfer, consumer health data may transfer to the successor, who will be bound by this policy unless you consent otherwise.

We do not sell consumer health data — selling would require your separate, signed authorisation, which we do not seek — and we do not share it with advertisers, data brokers, employers, insurers or other users. There are no “other members” at Pepmaxing: the App has no community or social feature.

Retention and deletion

Consumer health data in your account is kept while the account exists and is deleted when you delete it, or sooner when you delete an individual entry, photo or scan.
Deleted data leaves our live systems immediately and our provider’s backups within 30 days; backups are never restored into the live service.
Body-scan videos and frames live only on your device and are removed when you delete the scan or the App.
Meal and label photos are not stored by us; OpenAI deletes them within 30 days.
Portion corrections and AI-usage counts are linked to your account and deleted with it.
Support correspondence, and records we must keep for legal or accounting reasons, may be retained for as long as those purposes require.

Because we hold no device-hashed reports, analytics events or attribution records, account deletion reaches all of your consumer health data; the subscription, paywall, usage and crash records held by RevenueCat, Superwall, PostHog and Sentry contain no health data and are keyed to an opaque identifier that deletion severs. See the Data deletion page for the steps and the complete list of what may remain.

Your consumer health data rights

Subject to applicable law, you have the right to: confirm whether we are collecting, sharing or selling your consumer health data and access it; receive a list of the third parties with whom we have shared it (the recipients above) with their contact details on request; withdraw consent to future collection or sharing; delete your consumer health data; and not be discriminated against for exercising any right.

How. Most rights are self-service in the App: every entry, photo and scan can be edited or deleted, and Settings → Delete account removes everything — that is also how you withdraw consent entirely. For access, a copy of your data, or any other request, email contact@pepmaxing.health from the address on your account and describe the request; we may ask for information reasonably necessary to verify that the account is yours. We respond within 45 days and may extend once by a further 45 days where the law allows, telling you why. An authorised agent may act for you with your written permission.

Appeal. If we decline a request, you may appeal by replying to our decision or emailing us with the subject “Appeal consumer health data decision”. We answer appeals in writing with our reasons within the time the law requires. If we deny your appeal, you may contact the attorney general of your state; Washington residents may do so through the Washington State Office of the Attorney General.

Changes to this policy

We may update this policy when our practices or legal obligations change. We will post the revised policy here with a new date and, before collecting new categories of consumer health data, sharing it with new categories of recipients or using it for a materially new purpose, will obtain any consent the law requires and tell you in the App.

Review our Privacy Policy, Terms of Use, Refund policy and Data deletion page. Contact LastGenApps LLC about consumer health data at contact@pepmaxing.health.