Privacy Policy | Supplepedia

Introduction

Supplepedia is operated by Supplepedia LLC, a Texas limited liability company ("Supplepedia," "we," "our," or "us"). We take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and mobile application (collectively, the "Service").

Information We Collect

Account Information

When you create an account, we collect:

Name and email address
Authentication credentials (managed securely by our authentication provider)
Profile preferences and display name
Whether your reminders use detailed or generic wording

Supplement and Health Goal Data

Supplements you track in your stack
Medications and hormones your practice adds to your plan, and medications you tell your practice you already take, including the dose and how often you typed
Labs, procedures and visits your practice schedules for you, with their due dates, the place and preparation details your practice adds for you, whether you or your practice marked them done and when, any note you or your practice add when marking one done, and the lab details and notes your practice records
Health goals and progress tracking data
Questionnaire responses for personalized recommendations
Community posts, ratings, and reviews you submit
Reports you submit about content, including any details you add, and legal notices you send us (your name, contact details, and the notice). Legal notices and the copies we preserve are kept for 3 years after the matter is closed, or longer where the law requires, even if you delete your account (see Data Retention).

Usage Information

Device type, operating system, and app version
Pages visited and interaction patterns
App performance and crash data

Subscription Information

If you subscribed to Supplepedia Premium through our mobile app before October 14, 2026, your subscription status, plan type, and expiration date are stored to manage your access to premium features. We do not collect or store your payment card details, billing address, or other financial information. All mobile in-app payments are handled directly by Apple (App Store) or Google (Google Play Store).

If you subscribe to a practitioner plan on the web, payments are processed by Stripe. We store your Stripe customer ID, subscription ID, plan tier, status, and renewal dates. We do not store your full payment card number. Stripe holds card details directly. See the "Practitioner Accounts" section below for additional details.

Practitioner Profile Data

If you create a practitioner account, we additionally collect:

Practice name, practice type, professional title, and (optionally) bio, website, city, and state
Contact email used for patient-facing communications
NPI (National Provider Identifier), stored encrypted at rest and never written to application logs
Notification preferences for protocol imports and adherence reports
Whether your patients' reminders use detailed or generic wording

Practitioner-Shared Data

A practice gives you protocols to follow once you are its patient on Supplepedia, which starts when you accept its invitation.

In a protocol-sharing-only relationship, accepting the practice's invitation shares your progress with that practice and its staff, for every protocol it gives you. Your written notes are shared only if you also turn that on in Settings. The two categories are:

Your progress: your name and email address, which of their protocols you imported and when, whether you logged each dose and on which days, the numbers you record for that protocol's goals, and whether you marked a dose skipped along with the reason category you picked.
Your written notes: your check-in notes and journal entries, anything you type to explain a skipped dose, and notes you attach to a goal measurement.

Two things are never shared under this arrangement, whatever you choose: your assessment scores, and records from any other practitioner you see. Our servers remove them before the data leaves.

Your practice and its staff can look at your current progress whenever they choose. They are not asked again each time, and we do not notify you of each view. You can stop sharing a protocol's progress at any time in Settings and keep the protocol. When you do, your practice and its staff stop seeing that progress on their next request.

A practice can also end its relationship with you. When it does, your plan from that practice stops, and we tell you in the app and by email where available. For 30 days you keep read-only access: you can open the app, read your history and export a summary. After that, your access through that practice ends. The practice keeps the records it holds about you under its agreement with Supplepedia.

Your practice and its staff do not see your payment information or your postal address. In a protocol-sharing-only relationship, they also see nothing outside the protocols you have imported and agreed to share. A clinical engagement gives them more, as described below. Adherence summaries are generated from your logs each time someone at your practice views them, rather than stored as separate reports, so stopping the sharing stops those summaries immediately. Your underlying logs are retained as described in Data Retention below.

What your practice and its staff do with what they see is up to them. If they export, print, or copy your information into their own records, that copy is theirs, is governed by their own professional obligations, and is outside our control.

How HIPAA applies depends on how you use Supplepedia. If you use it on your own to track supplements and goals, that is consumer wellness information you created for yourself, and HIPAA does not generally apply to it.

If you work with a practitioner through Supplepedia, that changes. In a clinical engagement, your practice and its staff may record clinical notes about you, exchange messages with you, discuss your care with each other, add medications and hormones to your plan and see the medications you tell them you already take, schedule labs, procedures and visits for you, request validated health assessments and see your scores, send you questionnaires of their own, including ones due before a visit, and read your answers, and review your logs, your written notes and the readings you record, such as blood pressure, as part of your care. You can also message your practice in the app: everyone at the practice who can see your record can read your messages and reply, and the messages stay with the practice as part of its record. That information can be Protected Health Information under HIPAA, and your practitioner is the covered entity for it. When a practice invites you, it may give us your name, email address, phone number and date of birth, and notes for its own records, before you create an account, so that your profile is ready for you to confirm.

Practitioner relationships run at one of two levels. In a clinical engagement, which is the default when a practitioner invites you, Supplepedia acts as your practitioner's business associate and handles that information on their behalf, under an agreement their practice must have in place before the invite can be sent or accepted. A practice can instead be on a protocol-sharing-only plan, where the clinical features are switched off and what is shared is your name, email address, when you joined, your protocols and your progress on them, and your written notes only if you choose to share them. We do not act as a business associate for that lighter arrangement, and practitioners whose use involves Protected Health Information are required to use the clinical engagement instead. Clinical fields are encrypted at rest under a key held separately from the database, and access to them is recorded in an audit log that cannot be altered afterward.

Third-Party Services

We use the following third-party services to operate the Service:

Amazon Web Services: AWS Cognito is the sign-in system for the Service. It holds your email address, name, verification status, any Apple or Google sign-in identifiers you use, multi-factor authentication settings, and sign-in timestamps. It holds no clinical or care-relationship data. We have also built support for storing encrypted backups with AWS, but it is not switched on today; backups currently stay on the application host. See AWS Privacy Notice.
Clerk: our previous sign-in system. Clerk is no longer the active provider. It is kept configured as a documented fallback and still holds the email and login records of accounts created before the change. See Clerk's Privacy Policy.
Apple App Store / Google Play Store: in-app purchase and subscription payment processing. We do not receive or store your payment details. See Apple's Privacy Policy and Google's Privacy Policy.
Stripe: payment processing for web-based practitioner subscriptions. Stripe receives your card details and billing information directly; we receive only a customer ID, subscription metadata, and payment status. See Stripe's Privacy Policy.
AWS SES (Amazon Web Services): delivery of invitation emails, which we are phasing in. When a practice invites you, we send AWS your email address, the name of the practice and practitioner inviting you, and a single-use invitation link. When a practitioner is invited to join an existing practice, we send their email address, the practice name, and the link. An invitation to set up a new practice does not include a practice name. If a practice ends its relationship with you, the notice we email you goes the same way: we send AWS your email address, the name of the practice, and the date your access ends. Until this is switched on, these emails are sent through Loops. An invitation to a patient is sent without the practice or practitioner name, and an invitation to a practitioner includes the practice name only when joining an existing practice. If an invitation sent through AWS cannot be delivered, or is reported as spam, AWS tells us, and we keep a one-way coded record of that email address, not the address itself, so that we do not email it again. See the AWS Privacy Notice.
Loops: marketing, subscription, and inquiry email delivery. We send Loops your email address, name, and (for practitioners) practice metadata in order to deliver product updates you opted into, subscription emails, and practitioner inquiry notifications. Until invitation emails move to AWS SES, Loops also delivers them: an invitation to a patient is sent without the practice or practitioner name, and an invitation to a practitioner includes the practice name only when joining an existing practice. The notice that a practice has ended its relationship with you may also be sent through Loops until then, with your email address and the date your access ends, and without the practice name. See Loops's Privacy Policy.
Flex (withflex.com): third-party telehealth provider that issues Letters of Medical Necessity (LMNs) for HSA/FSA-eligible purchases. If you click through to Flex from our site, you are interacting with Flex directly under their terms; we do not transmit your account or health data to Flex. See Flex's Privacy Policy.
Sentry: error and crash reporting to improve app stability. Sending data to Sentry is gated on a signed Business Associate Agreement. That agreement is not in place today, so our servers and our website refuse to start Sentry at all and send it nothing. The mobile app still reports crashes and errors to Sentry; those reports are stripped of email addresses and clinical fields before they leave your device, and they do not include IP addresses. See Sentry's Privacy Policy.
Neon: cloud database hosting for storing your account and supplement data. See Neon's Privacy Policy.
Fly.io: application hosting and compute. Every request you make is processed on Fly infrastructure, so your data passes through it in the course of using the Service. See Fly.io's Privacy Policy.
Cloudflare: DNS for our domain, content delivery for the www and payment subdomains, and object storage for practitioner clinic branding images such as logos and app icons. As of August 17, 2026 the main site and API no longer pass through Cloudflare, so it does not see the content of your requests or responses to the app. If you reach the site by typing www, Cloudflare handles the redirect and sees the web address you asked for, though not the page content. The branding images it stores are practice materials, not patient data. See Cloudflare's Privacy Policy.
Expo: delivers push notifications to your device. Push notification titles and bodies use generic wording by default so health details do not appear on your lock screen or pass through the notification relay. Reminders your device schedules for itself never pass through Expo. See Expo's Privacy Policy.
Fullscript: dispensary integration that lets a practitioner send you a supplement plan through their Fullscript account. It is built but not switched on today, so nothing is sent to Fullscript. When a practice enables it, Fullscript would receive the patient name or email used to look you up in their dispensary, and the plan itself. Enabling it requires a Business Associate Agreement on file for the practice. See Fullscript's Privacy Policy.
Meta (Facebook): website advertising measurement only. The Meta Pixel is gated on a signed Business Associate Agreement, which is not in place today, so the pixel is not loaded on our website and no events reach Meta, whatever you choose in the cookie banner. The iOS app does not include the Meta SDK and does not send device identifiers or app events to Meta. See Meta's Privacy Policy.
Google Analytics: website analytics to understand traffic sources, page views, and user engagement on our website. See Google's Privacy Policy.
HEY: hosts our email, including legal notices, privacy requests, and other messages you send to an @thesupplepedia.com address. HEY is not covered by a Business Associate Agreement, so please do not send health information by email. If a message contains it, we do not forward or copy it, and we handle it under our security incident procedures.

Advertising and Tracking

We use advertising tools to measure the effectiveness of our marketing campaigns and to deliver relevant ads to users who may be interested in our Service.

Mobile App (iOS)

The iOS app does not track your activity across other companies' apps and websites. It does not include the Meta advertising SDK, does not access the Identifier for Advertisers (IDFA), and does not present Apple's App Tracking Transparency prompt.

Crash and performance reports are sent to Sentry so we can keep the app stable. That data is used for diagnostics, not for advertising, and is not linked with third-party data for tracking. It is stripped of email addresses and clinical fields before it leaves your device.

Android

The Android app does not currently send advertising identifiers or app events to Meta. If we enable advertising measurement in a future release, you can opt out of personalized advertising in your device settings under Google > Ads.

Website

Our website uses Google Analytics for website analytics. It uses cookies and similar technologies, and is only activated after you provide consent via our cookie consent banner. You can withdraw consent at any time by clearing your cookies or using your browser's privacy controls.

The Meta Pixel is integrated for advertising measurement but is switched off. It is gated on a signed Business Associate Agreement with Meta, which we do not have, so the pixel script is never loaded and no events are sent, even if you accept the cookie banner. If that changes we will update this policy before turning it on.

How We Use Your Information

To provide and maintain the Service, including your supplement stack and progress tracking
To provide personalized supplement recommendations
To manage your subscription and premium feature access
To enable community features (posts, ratings, discussions)
To improve our services, fix bugs, and enhance the user experience
To communicate with you about your inquiries or account

Data Sharing

We do not sell your personal information to third parties. We share data with the third-party service providers listed above for the purpose of operating the Service and improving user experience. No data is shared with Meta today, on the website or in the apps, as described in the "Advertising and Tracking" section. Nothing about you reaches a practice unless you are its patient on Supplepedia: after you accept its invitation, or if you added one of its protocols before invitations were introduced. A practice can move that earlier kind of link to a clinical engagement by confirming to us that it has a clinical relationship with you and your consent. What the practice and its staff can then see is described in "Practitioner-Shared Data" above. In a clinical engagement, it does not depend on a separate choice to share. If you send us a copyright notice, we may share a copy of it with the person who posted the content so they can respond. That copy is redacted: we remove any health information and include only the contact details they need to respond. We may also disclose information if required by law or to protect our rights.

Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it by law. While your account is active, your supplement and progress logs are retained indefinitely so your history and trends stay available to you. Deleting your account removes them, with one exception. If a practice manages your care through Supplepedia, the records that practice holds about you stay with the practice under its agreement with Supplepedia: your plan, your dose and check-in history and the readings you recorded, your assessment results and questionnaire answers, the medications you told the practice you take, the labs, procedures and visits it scheduled for you, the details it entered when it invited you, the alerts it received about you, and the practice's own notes and messages. We also keep the record of each time you accepted our terms and privacy policy, with your confirmation that you are 18 or older, as evidence of your consent. Your personal app data is still deleted, including your sign-in, the name and email on your profile, your device and notification settings, and your community activity. Subscription billing records may be retained longer where required for tax or accounting compliance. Legal notices you send us, and the copies we preserve for them, are kept for 3 years after the matter is closed, or longer where the law requires, even if you delete your account sooner. Reports you submit are deleted 3 years after they are resolved, or when you delete your account; if we must keep a report for a legal claim, we keep it with your account details removed. If an email we send cannot be delivered to an address, or is reported as spam, we keep a one-way coded record of that address, not the address itself, so that we do not email it again. That record is not tied to an account and is kept even if you delete yours.

Data Protection Rights (GDPR)

Under GDPR, users in the European Union have the following rights:

Right to access your personal data
Right to rectification of inaccurate data
Right to erasure ("right to be forgotten")
Right to restrict processing
Right to data portability
Right to object to processing

To exercise any of these rights, including requesting an export of your personal data, please contact us at kacey@thesupplepedia.com. We will respond to your request within 30 days.

California Privacy Rights (CCPA)

California residents have the right to:

Know what personal information is collected
Know whether personal information is sold or disclosed
Say no to the sale of personal information
Access their personal information
Request deletion of their personal information
Equal service and price, even if they exercise their privacy rights

Data Storage and Security

We implement appropriate technical and organizational measures to maintain the security of your personal information, including encryption in transit and at rest. Measures currently in place include:

Encryption in transit (HTTPS with HSTS) and AES-256-GCM encryption at rest for sensitive health fields, under a key separate from the database.
Database backups are encrypted with a distinct key, and encryption cannot be disabled in production.
Practitioner and administrator sessions time out automatically after a period of inactivity, and the session cannot be resumed afterward without signing in again. Background activity such as a page refreshing on its own does not count as activity.
Sensitive account changes, such as turning off multi-factor authentication or changing your email address, require you to have signed in recently. Changing your password signs out your other devices.
An audit log records access to health records and cannot be edited or deleted after the fact.
Push notifications we send use generic wording by default, so health details do not appear on a locked screen.
Reminders your device schedules for itself use the wording your practice sets. Detailed reminders can show the items due, your streak, and your provider's name, and anyone who can see your lock screen can read them; generic reminders show none of these. Your reminders are detailed unless a practice you are a patient of uses generic reminders, and you cannot change this setting yourself. If you chose generic reminders in an earlier version of the app, your reminders stay generic.

However, no Internet-based service can be 100% secure, and we cannot guarantee the absolute security of your data.

Children's Privacy

The Service is for adults. You must be 18 or older to use it, and patients confirm that they are when they accept a practice's invitation. We do not knowingly collect personal information from anyone under 18. If you believe we have collected information from someone under 18, please contact us so we can delete it promptly.

Third-Party Links

Our website and mobile application contain links to third-party websites, including Amazon affiliate links. We are not responsible for the privacy practices or content of these third-party sites.

Changes to Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

Contact Us

For any questions about this Privacy Policy, to exercise your data rights, or to request deletion of your account data, please contact us at: kacey@thesupplepedia.com