Privacy Policy

Privacy Policy

Effective date: October 6, 2026 | Version: 1.0 | Last updated: October 6, 2026

1. Who we are and what this policy covers

1.1 Who we are

WellPeps, a Wyoming corporation (“WellPeps,” “we,” “us”), runs wellpeps.com and the WellPeps patient experience. Our contact address is 30 N Gould St., Suite R, Sheridan, WY 82801. For privacy questions, email [email protected].

1.2 What WellPeps does and does not do

WellPeps is a brand and service company. We handle marketing, patient support, intake, education and other non-clinical services. We are not a medical practice or a pharmacy. We do not practice medicine, prescribe, compound or dispense medication.

Independent licensed clinicians who belong to OSI Medical Services, P.A. (the “Practice”) review your health information and decide whether to prescribe. A prescription is not guaranteed. Independent state-licensed pharmacies prepare and ship medication.

1.3 Our technology platform

The health assessment, intake forms, checkout, messaging with your clinician and your patient portal run in a technology platform at portal.wellpeps.com. An independent software company provides the platform. We set it up and decide what it asks you. That company, the Practice and the pharmacy also receive and use your information, as described in this policy.

1.4 Which notice applies

2. What we collect, where it comes from and why

We collect what we need to run our services. In this table, “platform” means portal.wellpeps.com.

Location. We do not collect precise location from your device through wellpeps.com. In the platform we ask which state you are in, because a clinician must be licensed there to treat you.

Profiles and inferences. We do not build advertising profiles about you, and we do not guess your health conditions from what you browse. The topic of the guide or waitlist you choose is the only health signal wellpeps.com records.

3. Health information: how the rules differ

Health information is handled under different rules depending on where it sits.

• Protected health information (PHI). Information you give for your care through the platform, and the records the Practice makes, are generally PHI. HIPAA and the Notice of Privacy Practices govern PHI. The Practice is the HIPAA “covered entity.” When we handle health information for the Practice, we do so as a service provider that HIPAA calls a “business associate.” HIPAA limits how PHI can be used for marketing, and some marketing uses need your written permission.
• Other health information. Some health-related information is not PHI. Examples are the topic of a free guide you request on wellpeps.com, and order and support records we keep for our own business. The Consumer Health Data Privacy Policy covers it. Some states give it extra protection, such as separate consent and no sale without your signed authorization.
• Pharmacies and labs. Each is a separate health care business with its own privacy notice.

To use a HIPAA right, such as getting a copy of your medical record, follow the Notice of Privacy Practices. For everything else, use this policy. We describe how we protect your information instead of using labels such as “HIPAA compliant.”

4. How we use information

We use personal information to:

• run wellpeps.com and answer questions about our programs;
• send you what you ask for: a free guide, our newsletter, or a notice that a program has opened;
• connect you with the Practice, so a licensed clinician can review your information and decide whether treatment is appropriate;
• support your care: take payment, issue refunds, arrange shipping with the pharmacy and answer questions about your order;
• contact you about your account, orders, safety notices and changes to our policies;
• keep our services safe: prevent fraud, abuse and security incidents, and enforce our terms;
• meet legal duties and respond to valid legal requests; and
• improve wellpeps.com and our services, using information that does not identify you.

We do not use your health information to send you advertising. We do not use it to make decisions about you by automated means that have legal or similarly significant effects.

5. Who we share information with

5.1 Who receives it

5.2 Sale and sharing

We do not sell your personal information. We do not share it for cross-context behavioral advertising.

Some state laws use “sell” to include giving personal information to another company for something of value, even if no money is paid. California uses “share” to mean giving personal information to a third party for cross-context behavioral advertising, which means ads based on your activity across different websites. We do neither. Companies that work for us under contract and may not use your information for their own purposes are not a sale or sharing.

We do not knowingly sell or share the personal information of anyone under 16.

Before we turn on any advertising technology that sends personal information to another company, we will update this policy and Your Privacy Choices, build the opt-out control, and ask for your consent first.

6. Cookies, tracking technologies and Global Privacy Control

6.1 Cookies and similar tools today

wellpeps.com sets only essential cookies. wp_consent is a first-party cookie, set only if you make a choice in Your Privacy Choices, that remembers that choice, with a random ID (not your name or email), for 12 months. It is strictly necessary for its purpose.

Our text fonts are served from wellpeps.com itself, so loading them does not contact another company. We do not use analytics, advertising or social media tags, or session recording, today. The Cookie and Tracking Technologies Notice lists everything. portal.wellpeps.com is run for us by our technology platform provider and has its own cookies.

6.2 Global Privacy Control and Your Privacy Choices

Global Privacy Control (GPC) is a browser setting that tells websites you want to opt out of the sale or sharing of your personal information. Today, wellpeps.com does not sell or share personal information and does not use advertising or analytics tags, so a GPC signal does not change what the site does. Your Privacy Choices explains what you can do now.

6.3 Do Not Track

Some browsers send a “Do Not Track” signal. There is no common standard for it. Because wellpeps.com does not track you across other websites, a Do Not Track signal does not change what the site does today.

7. How long we keep information

We keep personal information only as long as we need it for the reasons in this policy, or as the law requires. The periods below are our standard periods. Longer periods apply if the law requires them or if we need the information for a legal claim.

When we no longer need information, we delete it or remove what identifies you. Backups are overwritten on their normal schedule.

8. How we protect information

We use administrative, technical and physical safeguards that fit the sensitivity of the information. wellpeps.com uses an encrypted (HTTPS) connection. We limit who can see your information to the people and vendors who need it to do their jobs. No system is perfectly secure. If a breach affects your personal information, we will tell you and the regulators as the law requires.

9. Children

Our services are for adults. You must be at least 18 to use them (19 in Alabama and Nebraska, 21 in Mississippi). Do not sign up for our email if you are under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child gave us information, email [email protected] and we will delete it.

10. Your privacy rights and choices

10.1 Your rights

We offer these rights to all US residents, whatever state you live in. Some may be limited by law or by the exceptions in Section 10.8.

• Access (know). Ask what personal information we have about you, where it came from, why we use it and who receives it, and get a copy in a portable format where feasible.
• Correct. Ask us to fix information that is wrong.
• Delete. Ask us to delete personal information we collected from you.
• Opt out. Opt out of the sale of your information, sharing for cross-context behavioral advertising and targeted advertising. We do none of these today.
• Limit sensitive information. Ask us to use your sensitive information (including health information) only to provide the services you asked for.
• Withdraw consent. Take back a consent you gave us. This does not undo what we did before you withdrew.
• Appeal. Appeal if we say no to a request (Section 10.6).
• No unfair treatment. We will not treat you worse for using these rights (Section 10.7).
• Decisions by automated means. We do not make decisions about you by automated means that have legal or similarly significant effects. If that changes, we will tell you and give you the rights the law requires.

10.2 How to make a request

Use any of these:

• Use the Your Privacy Choices page on wellpeps.com.
• Email us at [email protected].
• Write to WellPeps, Attn: WellPeps Privacy Officer, 30 N Gould St., Suite R, Sheridan, WY 82801.

Tell us what you want, the email address you used with us, and your state. Please do not put health details in a request. Health records are requested through the Practice (see Section 10.8).

10.3 How we check it is you

We compare what you tell us with what we hold. We may send a link to the email address you used with us. For information in the platform, we may ask you to sign in. We will not ask for your Social Security number, and we ask for a government ID only if we cannot confirm who you are any other way. Opt-outs, unsubscribes and withdrawing consent need less checking. If we cannot confirm who you are, we will tell you why.

10.4 Authorized agents

You can ask another person to make a request for you. We will ask for your signed permission, or a power of attorney, and may confirm with you directly. A parent, guardian or conservator may act for the person they represent.

10.5 When we respond

• We confirm we received your request within 10 business days.
• We respond within 45 days. If we need more time, we may extend once by up to 45 days and will tell you why.
• We act on opt-outs and limit requests within 15 business days, and on marketing unsubscribes within 10 business days.
• There is no charge. If requests are clearly unfounded or excessive, we may charge a reasonable fee or decline, as the law allows, and we will explain.

10.6 Appeals

If we deny your request in whole or in part, you can appeal within 60 days of our answer. Email [email protected] with “Appeal” in the subject line and say why you disagree. A person who did not decide the first request will review it, and we will answer in writing within 45 days and explain our reasons. If we deny your appeal, you can contact your state attorney general.

10.7 No unfair treatment

We will not deny you service, charge you a different price or give you a different level of quality because you used a privacy right. If you ask us to delete information we need to provide a service you asked for, we may not be able to provide that service, and we will tell you.

10.8 Limits

PHI held by the Practice, a pharmacy or a lab is handled under the Notice of Privacy Practices or that entity’s notice, and medical records must be kept for the periods the law sets. We may also keep information we need to follow the law, stop fraud, resolve disputes or defend legal claims. If we keep something you asked us to delete, we will tell you what and why.

11. Marketing email and text messages

Email. We send marketing email only to people who signed up for it (the newsletter, a free guide or a program notice). Each email has an unsubscribe link and our postal address, 30 N Gould St., Suite R, Sheridan, WY 82801. We stop marketing email within 10 business days of your request. We may still send messages about your account, orders, safety and care.

Text messages. We do not send marketing text messages. If we text you about your account, orders or care, we do so only with your consent and under the Text Messaging Terms.

We do not use your health information in marketing without your consent. Some uses of PHI for marketing also require your written authorization under HIPAA (see the HIPAA Authorization Forms).

12. State-specific information

12.1 State laws and what they add

Many states have privacy laws. We give every right in Section 10 to every US resident, whatever state you live in. Some states have additional rules, such as consent before sensitive data is processed, a right to appeal a denial, and extra protection for consumer health data, and we follow the law that applies to you. The Consumer Health Data Privacy Policy covers consumer health data. Section 12.2 is our notice for California residents.

12.2 California notice at collection

This is our notice at collection for California residents. In the last 12 months we have collected the categories below. We use them for the reasons in Section 4 and keep them for the periods in Section 7. We have not sold or shared any category for cross-context behavioral advertising.

Sensitive personal information. We use it only to provide the services you ask for, keep our systems secure, prevent fraud and meet legal duties. We do not use it to infer other facts about you or for advertising. Because of this, the CCPA does not require a “Limit the Use of My Sensitive Personal Information” link, but you may still ask us to restrict our use, and we will honor it through Your Privacy Choices.

12.3 More for California residents

• Shine the Light. California residents may ask once a year about personal information we disclosed to other companies for their own direct marketing. We do not disclose personal information for that purpose. Email [email protected].
• Financial incentives. We do not offer you money or other value in exchange for your personal information.
• Medical information. Medical information held by providers is also protected by California’s Confidentiality of Medical Information Act.

13. International visitors and links to other sites

Our services are for people in the United States. If you use wellpeps.com from outside the United States, your information may be sent to and handled in the United States, where privacy laws differ from yours.

wellpeps.com links to other sites, such as government health pages, pharmacy sites and the patient portal at portal.wellpeps.com. We do not control other sites, and each has its own policy.

14. Changes to this policy

We will post any change on this page and update the “Last updated” date. For a material change, we will email people who gave us an email address and post a notice on wellpeps.com. If we want to use health information we already collected in a materially different way, we will ask for your consent first. You can ask us for earlier versions of this policy.

15. Contact us

Acknowledgment of receipt (optional form in the GEN Health intake)

☐ I have read the Privacy Policy (version 1.0, effective October 6, 2026) and I know where to find it again. I understand it explains how WellPeps handles my information, and that the Practice’s Notice of Privacy Practices explains how my health information is handled for my care.

Electronic signature

By typing my name, I agree that my electronic signature is the legal equivalent of my handwritten signature, and that I have already agreed to receive and sign documents electronically under the Electronic Records, Signatures and Communications Consent.