Privacy Policy.

Who we are

Peppies is deliberately built as a group of separate services under separate legal entities: the research-supply catalogue (research-use-only products), the blood-testing service (LabBridge), and the software (the app, including My Health Timeline) are run as distinct operations. Blood samples are analysed and reports are issued by independent partner laboratories — not by Peppies. Which entity is responsible for your data depends on which service you use: the entity named on your order confirmation is responsible for that order; the software entity is responsible for your account and timeline; the testing entity coordinates lab orders, while the issuing laboratory remains responsible for producing your report.

Registered controller details — legal entity names, registered addresses, and company numbers — are to be completed by the operator before publication: [controller entity, registered address, company/registration number]. Until then, all privacy questions and requests go to the single contact point in section 13, whichever part of Peppies your question concerns.

This policy covers the Peppies websites and apps, including peppies.eu, and our sister pet site puptides.eu where it links to this policy.

What we collect

Everything we hold falls into the categories below. Most of it exists only because you created it — an account, an order, a connection you switched on. The health-related categories (wearables, lab reports, provider sharing) are opt-in and run on your explicit consent.

How we use your data

• To fulfil your orders — take payment via Stripe, ship to your address, and send you order and dispatch emails.
• To run your account and timeline — sign you in, and show your lab reports, wearable metrics, and trends in My Health Timeline.
• To operate bookings, chat, and video sessions with the clinician or experience provider you chose — including sharing your health snapshot with your booked provider, but only while your sharing toggle is on.
• To measure and improve the site — first-party funnel analytics (pageviews, add-to-cart, checkout), aggregated by country.
• To send marketing email — only if you opted in. Every message includes an unsubscribe link, and withdrawing is one click.
• To keep the platform secure — detect abuse and fraud, and protect accounts.
• To meet legal obligations — tax, accounting, and records we are required to keep for completed orders.

We do not use your data for third-party advertising, and we do not sell personal data — to anyone, for anything.

Lawful bases (GDPR)

For visitors and customers in the EU/EEA, each use of your data rests on one of these bases:

• Contract — processing your orders and fulfilment: account, items, shipping address, payment confirmation, order emails.
• Consent — marketing email, connecting a wearable or sharing health data with a booked provider, and non-essential analytics including the local-storage identifiers. Because wearable metrics, lab reports, and health snapshots are health data (a special category under GDPR Article 9), these run on your explicit consent, and you can withdraw it at any time.
• Legitimate interest — first-party measurement of our own site and keeping the platform secure. You can object to this at any time (section 09).

Withdrawing consent never affects the service you already received, and it never affects the lawfulness of what happened while consent was in place.

Cookies & local-storage identifiers

We keep this minimal, and it is all first-party — nothing here belongs to an advertising network.

Sharing & processors

We share personal data only with the services below, only for the purpose stated, and never for their own advertising. We do not sell personal data.

Beyond this list, we disclose personal data only if the law genuinely requires it (for example, a valid order from an authority), and we keep such disclosures as narrow as legally possible.

International transfers

Some of the processors above (for example Stripe, Zoom, Google, WHOOP, Oura, Resend, and DigitalOcean) may process data outside the European Economic Area, including in the United States. Where that happens, we rely on the safeguards recognised by the GDPR — an adequacy decision (for example the EU–US Data Privacy Framework, where a provider is certified under it) or the European Commission's Standard Contractual Clauses in our agreements with the provider.

Operator note (remove before publication): confirm the applicable transfer mechanism for each provider — DPF certification status or SCCs in the signed data-processing agreement — before this section is relied on.

How long we keep things

• Account data — for as long as your account exists. Delete the account and it goes.
• Order records — for as long as tax and accounting law requires for completed orders; then they age out.
• Analytics — the session id lasts one visit; the device id stays in your browser until you clear it or withdraw consent; raw IP addresses are truncated to country and kept only for a short window.
• Wearable data & tokens — pulled while your connection is on; disconnecting stops the pull, and you can ask us to erase what was collected (section 09).
• Lab reports, bookings & chat — kept on your timeline while your account exists, and removed with it, subject only to records the law requires us to keep.

When you ask us to erase your data, we delete everything except the minimum the law requires us to retain (for example, invoices for completed orders) — and that remainder is deleted when its legal retention period ends.

Your rights & how to use them

Under the GDPR you can, at any time and free of charge:

• Access — ask what we hold about you and get a copy.
• Rectify — have anything inaccurate corrected.
• Erase — have your data deleted, subject only to legally required records.
• Portability — receive the data you gave us in a machine-readable format, or have it sent to another service.
• Restrict — pause processing while a dispute or check is resolved.
• Object — object to processing based on legitimate interest, including our first-party measurement.
• Withdraw consent — for marketing email, analytics identifiers, wearable connections, or provider sharing — as easily as you gave it.
• Complain — to your data protection supervisory authority, in the EU member state where you live, work, or where you believe an infringement happened. You can do this without asking us first.

How to exercise them

Some controls are directly in the product: disconnect a wearable, switch off provider sharing, or unsubscribe from any marketing email with the link in its footer. For everything else, email the privacy contact in section 13 from the address on your account, tell us which right you are using, and we will respond within one month as the GDPR requires. If a request is unusually complex we may extend by up to two further months — and we will tell you why within the first month. We may ask a follow-up question to confirm the request really comes from you before acting on health-related data.

Adults only

Peppies is for adults aged 18 and over. Our research-use-only products, accounts, tests, bookings, and community are not directed at children, and we do not knowingly collect data from anyone under 18. If we learn an account belongs to a minor, we close it and delete the data. If you believe a minor has created an account, contact us (section 13) and we will remove it.

Security

We protect your data with measures proportionate to its sensitivity: connections to our sites are encrypted in transit (TLS); passwords are stored hashed, never in plain text; wearable access tokens are held server-side rather than in your browser; community email addresses are hashed at capture; full card details never reach our systems (they go directly to Stripe); and access to personal data is limited to what operating the service requires. No system is perfectly secure — if a breach ever put your rights at risk, we would notify the supervisory authority and, where required, you, as the GDPR obliges us to.

Changes to this policy

When our data practices change — for example, when the first-party analytics described in sections 02 and 05 go fully live — we will update this page and change the effective date at the top. For material changes affecting how your data is used, we will tell you more directly (for example by email or an in-app notice) before they take effect, and where a change needs your consent, we will ask for it rather than assume it.