Consumer Health Data Privacy Policy

Consumer Health Data Privacy Policy

Effective date: October 6, 2026 | Version: 1.0 | Last updated: October 6, 2026

1. About this policy

1.1 Who we are

WellPeps, a Wyoming corporation (“WellPeps,” “we,” “us”), runs wellpeps.com. We are a brand and service company. We are not a medical practice or a pharmacy, and we do not prescribe, compound or dispense medication. Independent licensed clinicians of OSI Medical Services, P.A. (the “Practice”) decide whether to prescribe. A prescription is not guaranteed. State-licensed pharmacies prepare and ship medication. Our contact details are in Section 11.

1.2 What consumer health data is

Consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health. It includes information about health conditions, treatments, diagnoses, medications and symptoms; tests, vital signs and body measurements; reproductive or sexual health; gender-affirming care; biometric and genetic data; precise location that could show you are seeking health care; and any information that shows you are seeking health care. It also includes health facts we work out from other information.

For example, your email address together with the health topic of a free guide you asked for can show that you are interested in a health condition or treatment. We treat that as consumer health data.

1.3 Laws this policy is written to meet

We wrote this policy to meet the Washington My Health My Data Act, Nevada SB 370 and the consumer health data provisions of the Connecticut Data Privacy Act. We also considered other state privacy laws that cover health data. These laws are not identical. We give everyone in the United States the protections in this policy, whatever state you live in. That is a choice, and it does not admit that any law applies to us.

1.4 Where to find this policy

A link to this policy is in the footer of every page of wellpeps.com, including the homepage. We also link it at every form that collects your information and in the patient intake.

2. How this policy fits with HIPAA and our other policies

2.1 PHI is covered by the Notice of Privacy Practices

HIPAA protects protected health information (PHI) that the Practice, a pharmacy or another covered entity creates or receives in connection with your care, and that their service providers handle for them. The consumer health data laws generally do not apply to PHI. The Notice of Privacy Practices covers PHI and explains your HIPAA rights, such as access to your medical record.

2.2 The Practice and WellPeps

The Practice is a HIPAA covered entity. Where we handle protected health information for the Practice, we do so as the law requires of a service provider that HIPAA calls a “business associate.”

2.3 What this policy covers

This policy covers consumer health data that is not PHI. Today that means:

• the health topic tied to your email address when you sign up on wellpeps.com for a free guide, a program notice or a waitlist;
• records that show you are seeking or receiving health care and that WellPeps keeps for its own business, such as your order and plan history, support requests and marketing preferences;
• health details you send to WellPeps outside the patient portal, for example in a support email;
• pages-visited records in our web server logs that show you looked at a health-related page; and
• any other information that the law treats as consumer health data and not as PHI.

2.4 Our other documents

This policy works with the Privacy Policy, the Notice of Privacy Practices, the Cookie and Tracking Technologies Notice, Your Privacy Choices and the Informed Consent to Telehealth Services and Treatment. If two of them differ on consumer health data, the one that protects you more applies.

3. What we collect, why and where it comes from

3.1 What we collect

3.2 Where it comes from

It comes from you (when you fill in a form, use the platform or write to us); from your browser, automatically; and from the Practice, pharmacies, laboratories and our payment processor about your order, for example whether an order shipped.

3.3 Why we collect it

• To give you the product or service you asked for, such as a guide, a waitlist spot, an order or support.
• To run and secure wellpeps.com and our systems, prevent fraud and fix errors.
• To meet legal duties and defend legal claims.
• With your consent only: to send emails about the topic you chose.

We do not use consumer health data for advertising. We collect only what we need. We will not collect more kinds of consumer health data, or use it for a new reason, until we update this policy and, where the law requires, get your consent.

4. Your consent

4.1 When we ask

The laws let us collect and share consumer health data without your consent when it is necessary to give you a product or service you asked for. For anything else, we ask first. We ask separately for collecting and for sharing.

4.2 How we ask

• A separate box that is not part of any terms, any policy or any other agreement.
• Not checked in advance. You must make a clear choice.
• Plain words that say what we collect or share, why, with which kinds of recipients, and how to withdraw.
• No tricks. Saying no is as easy as saying yes, and we will not refuse you a service because you said no, unless we truly need the information to provide it.

4.3 What we ask for today

• On wellpeps.com sign-ups (guides, waitlists and program notices): your consent to collect your email address and the health topic you chose so we can send what you asked for, and a separate, optional consent for follow-up emails about that topic (Appendix A.1).
• In the patient intake: an optional consent to use your email and the program you chose to send you program emails (Appendix A.2). Declining does not affect your care or your order.
• Sharing: today we share consumer health data only as needed to provide the service you asked for (see Section 5). If we ever want to share it for another reason, such as advertising, we will ask first with a separate consent. We do not do this today.

4.4 Withdrawing consent

You can withdraw any consent at any time on the Your Privacy Choices page or by emailing [email protected]. We will stop the collection or sharing the consent covered within 15 business days. Withdrawing does not undo what happened before. If we need the information to provide a service you asked for, withdrawing may mean we can no longer provide it, and we will tell you. To take back permission you gave the Practice for PHI, follow the Notice of Privacy Practices and the HIPAA Authorization Forms.

5. Who we share consumer health data with

5.1 Who receives it

“Sharing” here means giving consumer health data to another company. Companies that process it for us under contract (called processors) are not “sharing” under these laws, but we list them so you can see the whole picture.

Affiliates. WellPeps is owned in part by a principal of our management-services partner. That partner receives consumer health data only as described in the table above.

Lists on request. You can ask for a list of every third party and affiliate that received your consumer health data, with an email address or online way to contact each. See Section 7.

5.2 Processor contracts

We give consumer health data to processors only under a written contract that limits what they may do with it.

5.3 Legal requests

We give consumer health data to a court or agency only when the law requires it. We review each request, and where the law allows we tell you first so you can object. We review any request about reproductive health care or gender-affirming care with counsel before we respond.

5.4 Other companies tracking you online

Other companies do not collect consumer health data about your online activities over time and across different websites when you use wellpeps.com. Our text fonts are served from wellpeps.com itself, so loading them does not contact any other company. If this changes, we will update this policy first.

6. No sale without your signed authorization

We do not sell consumer health data. We will not sell it unless you first sign a separate written authorization that is valid under the law. A consent to collect or share is not an authorization to sell.

A valid authorization is separate from any other document and says, in plain words:

• which consumer health data would be sold;
• who is selling it and who is buying it, with contact details for both;
• why it is being sold and how the buyer will use it;
• that you do not have to sign it to get any product or service;
• that you can revoke it at any time, and how;
• that the buyer may pass the data on and it may no longer be protected by these laws;
• that it expires one year after you sign it; and
• your signature and the date.

We will give you a copy and keep a record for six years. Some states ban the sale of sensitive data altogether, and we follow those laws.

7. Your rights and how to use them

7.1 Your rights

• Confirm. Ask whether we are collecting, sharing or selling consumer health data about you.
• Access. Get a copy of the consumer health data we hold about you, in a portable format where feasible, and a list of all third parties and affiliates that received it, with an email address or online way to contact each.
• Withdraw consent. Take back a consent, as described in Section 4.4.
• Delete. Ask us to delete consumer health data about you.
• Correct. Ask us to fix information that is wrong. This is a right we give you by policy.
• Appeal. Appeal if we say no to a request.

7.2 What happens when you ask us to delete

After we confirm your request, we delete the data from our active systems, tell our processors, affiliates and third parties that received it to delete it, and delete it from backups within 6 months of confirming your request. PHI held by the Practice and pharmacies is kept as medical record and pharmacy law requires. We may keep the minimum we need to follow the law, stop fraud or defend legal claims, and we will tell you what we kept and why. Deleting information we need to provide a service may end that service.

7.3 How to make a request or an appeal

• Use the Your Privacy Choices page on wellpeps.com.
• Email [email protected].
• Write to WellPeps, Attn: WellPeps Privacy Officer, 30 N Gould St., Suite R, Sheridan, WY 82801.
• By phone: (307) 881-8700, during normal business hours.

Say which right you want to use and the email address you used with us. Please do not put health details in a request. We check that the request is from you by matching what you tell us with what we hold and, where needed, by sending a link to your email address. You can use an authorized agent with your signed permission. We do not need an account to take your request.

7.4 When we respond

We respond within 45 days. If we need more time, we may extend once by up to 45 days and will tell you why. Requests are free. If a request is clearly unfounded or excessive, we may decline it or charge a reasonable fee as the law allows, and we will explain.

7.5 Appeals

If we deny your request in whole or in part, you can appeal within 60 days of our answer. Email [email protected] with “Appeal” in the subject line and say why you disagree. A person who did not decide the first request will review it, and we will answer in writing within 45 days and give our reasons.

7.6 Complaints to your state

If we deny your appeal, you can contact your state attorney general.

We will not treat you worse for using any of these rights.

8. No location fences

We do not use, and we do not allow anyone working for us to use, a location fence (a virtual boundary based on GPS, cell tower, Wi-Fi or similar data) around any place that provides in-person health care. We do not use one to identify or track people seeking care, to collect health data, or to send messages or ads about health care. State laws set a distance for these fences, and we do not use one at any distance. Our website does not read your device location today.

9. Keeping consumer health data safe

We limit access to consumer health data to the employees, contractors and processors who need it to give you the service you asked for, and each is bound to keep it confidential. We use administrative, technical and physical safeguards that fit the sensitivity of the data. We keep consumer health data only as long as we need it, on the schedule in Section 7 of the Privacy Policy, and then delete it or remove what identifies you. If a security breach affects consumer health data, we will tell you and the regulators as the law requires, including state breach laws and, where it applies, the FTC Health Breach Notification Rule.

10. Other promises, children and changes

• Children. Our services are for adults, 18 or older (19 in Alabama and Nebraska, 21 in Mississippi). We do not knowingly collect consumer health data from anyone under 18. If we learn we did, we will delete it.
• De-identified data. If we keep de-identified data, we keep it only in that form and do not try to re-identify it.
• Changes. We will post changes here and update the date. If a change adds a kind of data or a new use, we will ask for your consent first, and we will not apply a change to data we already collected without your consent.

11. Contact

Appendix A. Consent to collect (form wording)

A.1 wellpeps.com sign-up forms (guides, waitlists, program notices)

Two separate boxes, directly above the submit button, neither checked in advance. The form does not submit without the first box. The second box is optional. On a guide form, the boxes name the guide the person requested, as below. On a waitlist or program-notice form that is not for a guide, the words “the guide I requested” are replaced by “what I asked for”. On a form that has a first-name field (the waitlists) the first box reads “my email address, first name and my interest in”; on a form with an email field only it leaves out “first name”.

☐ I agree that WellPeps may save my email address and my interest in the topic of this form so WellPeps can send me the guide I requested.

☐ Optional: I also agree to receive emails from WellPeps about the topic of this form and related wellness tips. I understand that I do not need to select this option in order to receive the guide I requested.

Small print shown once, directly under both boxes (smaller type than the boxes): You can withdraw either consent at any time in Your Privacy Choices or by emailing [email protected]. Then the links: Consumer Health Data Privacy Policy, Privacy Policy, Your Privacy Choices.

A.2 Patient intake: optional program emails (GEN Health form)

Optional. The patient can continue without checking it. The signature block below applies here and to B.1.

☐ I agree that WellPeps may use my email address and the health program I chose to send me educational emails and updates about that program. This is optional. If I say no, my care and my order are not affected. I can withdraw this consent at any time through Your Privacy Choices or by emailing [email protected].

Electronic signature

By typing my name, I agree that my electronic signature is the legal equivalent of my handwritten signature, and that I have already agreed to receive and sign documents electronically under the Electronic Records, Signatures and Communications Consent.

Appendix B. Sharing (form wording)

B.1 Acknowledgment of necessary sharing

This is not a consent: sharing that is necessary to provide the service does not need one. It lets the patient see the sharing before intake. Do not call it a consent and do not let declining it look like a free choice.

☐ I understand that WellPeps will give the consumer health information I enter to the Practice, to the pharmacy that fills my prescription and, if I order labs, to the laboratory, only so they can provide the service I asked for. I have read the Consumer Health Data Privacy Policy.