Privacy Policy

Introduction

At Supplepedia, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and mobile application (collectively, the "Service").

Information We Collect

Account Information

When you create an account, we collect:

• Name and email address
• Authentication credentials (managed securely by our authentication provider)
• Profile preferences and display name

Supplement and Health Goal Data

• Supplements you track in your stack
• Health goals and progress tracking data
• Questionnaire responses for personalized recommendations
• Community posts, ratings, and reviews you submit

Usage Information

• Device type, operating system, and app version
• Pages visited and interaction patterns
• App performance and crash data

Subscription Information

If you subscribe to Supplepedia Premium through our mobile app, your subscription status, plan type, and expiration date are stored to manage your access to premium features. We do not collect or store your payment card details, billing address, or other financial information. All mobile in-app payments are handled directly by Apple (App Store) or Google (Google Play Store).

If you subscribe to a practitioner plan on the web, payments are processed by Stripe. We store your Stripe customer ID, subscription ID, plan tier, status, and renewal dates. We do not store your full payment card number. Stripe holds card details directly.

Practitioner Profile Data

If you create a practitioner account, we additionally collect:

• Practice name, practice type, professional title, and (optionally) bio, website, city, and state
• Contact email used for patient-facing communications
• NPI (National Provider Identifier), stored encrypted at rest and never written to application logs
• Notification preferences for protocol imports and adherence reports

Practitioner-Shared Data

When you (a patient/user) import a practitioner's protocol, the practitioner who created that protocol can see your display name and that you imported the protocol, along with the import timestamp, and adherence reports you choose to send to the practitioner. You control whether to send a report.

Practitioners do not see your account email, address, payment information, or any data outside the protocols you have imported. You can revoke a practitioner's access to a protocol at any time from the app. Adherence reports sent to practitioners are retained for 90 days and then automatically deleted.

Supplepedia is a wellness platform and is not intended to collect or store Protected Health Information (PHI) as defined under HIPAA.

Third-Party Services

We use the following third-party services to operate the Service:

• Clerk: authentication and account management. Clerk processes your email and login credentials securely.
• Apple App Store / Google Play Store: in-app purchase and subscription payment processing. We do not receive or store your payment details.
• Stripe: payment processing for web-based practitioner subscriptions. Stripe receives your card details and billing information directly; we receive only a customer ID, subscription metadata, and payment status.
• Loops: transactional and inquiry email delivery. We send Loops your email address, name, and (for practitioners) practice metadata in order to deliver account, subscription, and adherence-summary emails.
• Flex (withflex.com): third-party telehealth provider that issues Letters of Medical Necessity (LMNs) for HSA/FSA-eligible purchases. If you click through to Flex from our site, you are interacting with Flex directly under their terms; we do not transmit your account or health data to Flex.
• Sentry: error and crash reporting to improve app stability. Error reports are anonymized and do not contain personally identifiable information such as IP addresses by default.
• Neon: cloud database hosting for storing your account and supplement data.
• Meta (Facebook) SDK: advertising measurement and optimization. When you install or use our mobile app, the Meta SDK collects device identifiers, app events (such as app opens and feature usage), and advertising-related data to measure the effectiveness of our advertising campaigns and deliver more relevant ads. This data is shared with Meta Platforms, Inc.
• Google Analytics: website analytics to understand traffic sources, page views, and user engagement on our website.

Advertising and Tracking

We use advertising tools to measure the effectiveness of our marketing campaigns and to deliver relevant ads to users who may be interested in our Service.

Mobile App (iOS)

Our iOS app uses the Meta (Facebook) SDK for advertising measurement. On iOS 14 and later, you will be asked via Apple's App Tracking Transparency (ATT) prompt whether you allow Supplepedia to track your activity across other companies' apps and websites. You can change this choice at any time in your device's Settings under Privacy & Security > Tracking.

• If you allow tracking: The Meta SDK may collect your device's Identifier for Advertisers (IDFA) along with app usage events to improve ad targeting and measure campaign performance.
• If you deny tracking: We will not access your IDFA. The Meta SDK may still collect limited, non-identifying data for aggregated ad measurement using Apple's SKAdNetwork framework.

Regardless of your ATT choice, the Meta SDK collects app events (such as app installs and opens) for basic analytics and ad attribution. No health-related or supplement-specific data is shared with Meta.

Android

Our Android app uses the Meta (Facebook) SDK for advertising measurement. The Meta SDK collects device identifiers, app events (such as app opens and feature usage), and advertising-related data to measure the effectiveness of our advertising campaigns. You can opt out of personalized advertising in your device settings under Google > Ads.

Website

Our website uses the Meta Pixel and Google Analytics for advertising measurement and website analytics. These tools use cookies and similar technologies. On our website, these tracking tools are only activated after you provide consent via our cookie consent banner. You can withdraw consent at any time by clearing your cookies or using your browser's privacy controls.

How We Use Your Information

• To provide and maintain the Service, including your supplement stack and progress tracking
• To provide personalized supplement recommendations
• To manage your subscription and premium feature access
• To enable community features (posts, ratings, discussions)
• To improve our services, fix bugs, and enhance the user experience
• To communicate with you about your inquiries or account

Data Sharing

We do not sell your personal information to third parties. We share data with the third-party service providers listed above for the purpose of operating the Service, measuring advertising effectiveness, and improving user experience. Specifically, device identifiers and app usage events may be shared with Meta for advertising measurement as described in the "Advertising and Tracking" section above. We may also disclose information if required by law or to protect our rights.

Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it by law. Adherence reports shared with a practitioner are automatically deleted 90 days after they are sent. Subscription billing records may be retained longer where required for tax or accounting compliance.

Data Storage and Security

We implement appropriate technical and organizational measures to maintain the security of your personal information, including encryption in transit and at rest. However, no Internet-based service can be 100% secure, and we cannot guarantee the absolute security of your data.

Data Protection Rights (GDPR)

Under GDPR, users in the European Union have the following rights:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing

To exercise any of these rights, including requesting an export of your personal data, please contact us at [email protected]. We will respond to your request within 30 days.

California Privacy Rights (CCPA)

California residents have the right to:

• Know what personal information is collected
• Know whether personal information is sold or disclosed
• Say no to the sale of personal information
• Access their personal information
• Request deletion of their personal information
• Equal service and price, even if they exercise their privacy rights

Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us so we can delete it promptly.

Third-Party Links

Our website and mobile application contain links to third-party websites, including Amazon affiliate links. We are not responsible for the privacy practices or content of these third-party sites.

Changes to Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

Contact Us

For any questions about this Privacy Policy, to exercise your data rights, or to request deletion of your account data, please contact us at: [email protected]