Privacy Policy & Notice of Privacy Practices

Craft Peptides ("we," "us," or "our") is committed to protecting your personal and medical information. This Privacy Policy & Notice of Privacy Practices describes how we collect, use, and disclose your information when you:

• • Use our telemedicine platform and peptide therapy services as a patient;
• • Visit our website or patient portal; or
• • Communicate with us by phone, email, text, or other electronic means.

This policy is designed to comply with the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and applicable state laws.

We do not sell your personal or health information.

Protected Health Information (PHI)

This includes information that identifies you and relates to your past, present, or future physical or mental health:

• • Medical History: Current diagnoses, medication history, lab results, and contraindications relevant to peptide therapy.
• • Treatment Records: Prescriptions, consultation notes, and treatment plans developed by your provider.
• • Telehealth Data: Audio/video consultation records, chat logs, and identity verification documents.

Non-PHI and Technical Data

• • Account Information: Name, email, shipping address, and telephone number.
• • Financial Data: Credit card details and billing information processed via our secure payment gateway.
• • Device & Usage Data: IP addresses, browser type, and interaction logs.

We apply the minimum necessary standard to all uses and disclosures, meaning we limit PHI access to only what is needed to accomplish the intended purpose.

Treatment

We share your information with licensed healthcare providers, compounding pharmacies, and labs to conduct consultations and fulfill prescriptions.

Payment

We use your information to bill you for services, process credit card payments, and manage accounts.

Health Care Operations

We use data to conduct quality assessment and improvement activities, maintain regulatory compliance, and perform business management.

• • Right to Inspect and Copy: You may request access to your medical and billing records.
• • Right to Amend: You may request corrections to your PHI if you believe it is incorrect or incomplete.
• • Right to an Accounting of Disclosures: You may request a list of certain disclosures we have made.
• • Right to Request Restrictions: You may ask us to limit how we use or share your PHI.
• • Right to Confidential Communications: You may ask us to contact you via specific means or at alternative locations.

We utilize AES-256 bit encryption for all data at rest and in transit. Our video consultation platform is HIPAA-compliant, ensuring that your sessions are private and secure.

We retain medical records for a minimum of seven (7) years following the last date of service, or longer if required by law. After the retention period, data is securely destroyed using industry-standard digital shredding methods.

In the event of a breach affecting your protected health information, we will notify you within 60 days as required by HIPAA.

If you have questions about this policy, wish to exercise your privacy rights, or need to file a complaint, please contact our Privacy Officer:

You have the right to file a complaint if you believe your privacy rights have been violated. Contact our Privacy Officer or file with the U.S. Department of Health and Human Services Office for Civil Rights at www.hhs.gov/ocr/privacy.

We will not retaliate against you for filing a complaint.