Privacy Policy.

Who we are

Peppies operates as a single company, Peppies Research Supply, which runs its services as distinct operations: the research-supply catalogue (research-use-only products), the blood-testing service (LabBridge), and the software (the app, including My Health Timeline). Blood samples are analysed and reports are issued by independent partner laboratories — not by Peppies. Whichever service you use, Peppies is responsible for your orders, your account and your timeline, and for coordinating lab orders; the issuing laboratory remains responsible for producing your report.

The controller for personal data collected across these services is Peppies. All privacy questions and requests go to the single contact point in section 13, whichever part of Peppies your question concerns.

This policy covers the Peppies websites and apps, including peppies.eu, and our sister pet site puptides.eu where it links to this policy.

What we collect

Everything we hold falls into the categories below. Most of it exists only because you created it — an account, an order, a connection you switched on. The health-related categories (wearables, lab reports, provider sharing) are opt-in and run on your explicit consent.

How we use your data

• To fulfil your orders — take Peppies payments via Tagada, ship to your address, send order and dispatch emails, or share the delivery details you approved with the independent seller you selected.
• To run your account and timeline — sign you in, and show your lab reports, wearable metrics, and trends in My Health Timeline.
• To operate bookings, chat, and video sessions with the clinician or experience provider you chose — including sharing your health snapshot with your booked provider, but only while your sharing toggle is on.
• To measure and improve the site — first-party funnel analytics (pageviews, add-to-cart, checkout), aggregated by country.
• To send marketing email — only if you opted in. Every message includes an unsubscribe link, and withdrawing is one click.
• To send the stock alert you requested — one email for that item when it becomes available; the alert then closes unless you add it again.
• To keep the platform secure — detect abuse and fraud, and protect accounts.
• To meet legal obligations — tax, accounting, and records we are required to keep for completed orders.

We do not use your data for third-party advertising, and we do not sell personal data — to anyone, for anything.

Lawful bases (GDPR)

For visitors and customers in the EU/EEA, each use of your data rests on one of these bases:

• Contract — processing your orders and fulfilment: account, items, shipping address, payment confirmation, order emails.
• Consent — marketing email, connecting a wearable or sharing health data with a booked provider, and non-essential analytics including the local-storage identifiers. Because wearable metrics, lab reports, and health snapshots are health data (a special category under GDPR Article 9), these run on your explicit consent, and you can withdraw it at any time.
• Legitimate interest — first-party measurement of our own site and keeping the platform secure. You can object to this at any time (section 09).

Withdrawing consent never affects the service you already received, and it never affects the lawfulness of what happened while consent was in place.

Cookies & local-storage identifiers

We keep this minimal, and it is all first-party — nothing here belongs to an advertising network.

Sharing & processors

We share personal data only with the services below, only for the purpose stated, and never for their own advertising. We do not sell personal data.

Beyond this list, we disclose personal data only if the law genuinely requires it (for example, a valid order from an authority), and we keep such disclosures as narrow as legally possible.

International transfers

Some of the processors above (for example Tagada, Google, WHOOP, Oura, Resend, DigitalOcean, or a session provider shown for a booking) may process data outside the European Economic Area. Where that happens, we rely on safeguards recognised by the GDPR, such as an adequacy decision or the European Commission's Standard Contractual Clauses.

How long we keep things

• Account data — for as long as your account exists. Delete the account and it goes.
• Order records — for as long as tax and accounting law requires for completed orders; then they age out.
• Analytics — the session id lasts one visit; the device id stays in your browser until you clear it or withdraw consent; raw IP addresses are truncated to country and kept only for a short window.
• Wearable data & tokens — pulled while your connection is on; disconnecting stops the pull, and you can ask us to erase what was collected (section 09).
• Lab reports, bookings & chat — kept on your timeline while your account exists, and removed with it, subject only to records the law requires us to keep.
• Wishlist alerts — until the item becomes available, you unsubscribe, or you delete the owning account. After a successful alert we remove the readable email address and retain only aggregate demand counts.

When you ask us to erase your data, we delete everything except the minimum the law requires us to retain (for example, invoices for completed orders) — and that remainder is deleted when its legal retention period ends.

Your rights & how to use them

Under the GDPR you can, at any time and free of charge:

• Access — ask what we hold about you and get a copy.
• Rectify — have anything inaccurate corrected.
• Erase — have your data deleted, subject only to legally required records.
• Portability — receive the data you gave us in a machine-readable format, or have it sent to another service.
• Restrict — pause processing while a dispute or check is resolved.
• Object — object to processing based on legitimate interest, including our first-party measurement.
• Withdraw consent — for marketing email, analytics identifiers, wearable connections, or provider sharing — as easily as you gave it.
• Complain — to your data protection supervisory authority, in the EU member state where you live, work, or where you believe an infringement happened. You can do this without asking us first.

How to exercise them

Some controls are directly in the product: disconnect a wearable, switch off provider sharing, or unsubscribe from any marketing email with the link in its footer. For everything else, email the privacy contact in section 13 from the address on your account, tell us which right you are using, and we will respond within one month as the GDPR requires. If a request is unusually complex we may extend by up to two further months — and we will tell you why within the first month. We may ask a follow-up question to confirm the request really comes from you before acting on health-related data.

Adults only

Peppies is for adults aged 18 and over. Our research-use-only products, accounts, tests, bookings, and community are not directed at children, and we do not knowingly collect data from anyone under 18. If we learn an account belongs to a minor, we close it and delete the data. If you believe a minor has created an account, contact us (section 13) and we will remove it.

Security

We protect your data with measures proportionate to its sensitivity: connections to our sites are encrypted in transit (TLS); passwords are stored hashed, never in plain text; wearable access tokens are held server-side rather than in your browser; community email addresses are hashed at capture; full card details never reach our systems (they go directly to the payment processor); and access to personal data is limited to what operating the service requires. No system is perfectly secure — if a breach ever put your rights at risk, we would notify the supervisory authority and, where required, you, as the GDPR obliges us to.

Changes to this policy

When our data practices change — for example, when the first-party analytics described in sections 02 and 05 go fully live — we will update this page and change the effective date at the top. For material changes affecting how your data is used, we will tell you more directly (for example by email or an in-app notice) before they take effect, and where a change needs your consent, we will ask for it rather than assume it.