Privacy Policy

1. Introduction

RegenCore LLC ("we," "our," "us," or the "Company") is committed to protecting your privacy and safeguarding your personal and health information. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our Peptide Tracker application and related services (collectively, the "Services").

We understand that health information is among the most sensitive types of personal data, and we have implemented comprehensive safeguards to protect your privacy in accordance with applicable federal and state laws, including the Health Insurance Portability and Accountability Act of 1996 ("HIPAA").

2. Company Information

3. HIPAA Compliance and Protected Health Information (PHI)

3.1 Our Commitment to HIPAA

RegenCore LLC recognizes the importance of protecting your health information. While our Services may not qualify us as a "Covered Entity" under HIPAA in all circumstances, we voluntarily adopt HIPAA-compliant practices to ensure the highest level of protection for your health-related data.

3.2 What is Protected Health Information (PHI)?

Protected Health Information includes any individually identifiable health information that relates to:

• Your past, present, or future physical or mental health condition
• The provision of health care to you
• Past, present, or future payment for health care services

In the context of our Services, this may include information about your peptide protocols, dosages, injection sites, health metrics, and related notes.

3.3 HIPAA Safeguards We Implement

Administrative Safeguards

• Designated Privacy Officer responsible for developing and implementing privacy policies
• Workforce training on privacy and security policies
• Risk assessments and management procedures
• Incident response and breach notification procedures
• Business Associate Agreements with third-party service providers

Physical Safeguards

• Secure data center facilities with controlled access
• Workstation security policies
• Device and media controls

Technical Safeguards

• Access controls and unique user identification
• Automatic logoff mechanisms
• Encryption of data in transit and at rest (AES-256)
• Audit controls and activity logging
• Data integrity verification
• Secure transmission protocols (TLS 1.3)

3.4 Your HIPAA Rights

Under HIPAA, you have the following rights regarding your Protected Health Information:

4. Information We Collect

4.1 Information You Provide Directly

• Account Information: Name, email address, password (encrypted), and contact preferences
• Health Tracking Data: Peptide names, dosages, injection sites, schedules, and protocols
• Health Metrics: Weight, mood ratings, energy levels, and personal notes
• Communication Data: Information you provide when contacting us for support

4.2 Information Collected Automatically

• Device Information: Device type, operating system, unique device identifiers
• Usage Data: Features used, time spent in app, interaction patterns
• Log Data: IP address, browser type, access times, pages viewed
• Cookies and Similar Technologies: Session data, preferences, authentication tokens

4.3 Information from Third Parties

We may receive information from third-party services if you choose to link them to our Services, such as:

• Health and fitness tracking apps (with your explicit consent)
• Payment processors (for premium features)
• Analytics providers (anonymized data only)

5. How We Use Your Information

5.1 Primary Uses

• Providing and maintaining our Services
• Tracking and managing your peptide protocols
• Generating insights and reports about your health metrics
• Sending reminders and notifications you have requested
• Responding to your inquiries and support requests

5.2 Secondary Uses

• Improving and optimizing our Services
• Developing new features and functionality
• Conducting research and analysis (using de-identified data only)
• Ensuring security and preventing fraud
• Complying with legal obligations

5.3 Legal Bases for Processing (GDPR)

For users in the European Economic Area, we process your data based on:

• Consent: Where you have given explicit consent
• Contract: Where processing is necessary to provide our Services
• Legal Obligation: Where required by law
• Legitimate Interests: For improving our Services (with appropriate safeguards)

6. Data Storage and Security

6.1 Data Storage Location

Your data is stored using industry-leading cloud infrastructure with servers located in the United States. We use data centers that maintain SOC 2 Type II certification and comply with HIPAA requirements.

6.2 Security Measures

• Encryption: All data is encrypted at rest using AES-256 encryption and in transit using TLS 1.3
• Access Control: Role-based access control with multi-factor authentication for all staff
• Monitoring: 24/7 security monitoring and intrusion detection
• Backups: Regular encrypted backups with secure offsite storage
• Vulnerability Management: Regular security assessments and penetration testing
• Incident Response: Documented incident response procedures with breach notification protocols

6.3 Data Retention

We retain your personal data for as long as your account is active or as needed to provide you Services. You may request deletion of your data at any time. After account deletion:

• Active data is deleted within 30 days
• Backup data is deleted within 90 days
• We may retain anonymized, aggregated data for research purposes
• We retain certain data as required by law

7. Data Sharing and Disclosure

7.1 We Do NOT Sell Your Data

7.2 Limited Sharing Circumstances

We may share your information only in the following limited circumstances:

With Your Consent

We may share your information when you explicitly authorize us to do so, such as when you choose to export your data or share reports with healthcare providers.

Service Providers

We work with carefully selected third-party service providers who assist us in operating our Services. These providers:

• Are bound by Business Associate Agreements (BAAs) as required by HIPAA
• Are contractually obligated to protect your data
• May only use your data to provide services to us
• Are prohibited from using your data for their own purposes

Legal Requirements

We may disclose your information if required by law, such as:

• In response to valid legal processes (subpoena, court order)
• To comply with regulatory requirements
• To protect our rights, privacy, safety, or property
• In connection with an investigation of suspected illegal activity

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice and obtain your consent where required.

8. Your Privacy Rights

8.1 All Users

Regardless of your location, you have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data
• Export: Receive your data in a portable format
• Opt-Out: Opt out of non-essential communications

8.2 California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information held by businesses
• Right to opt-out of sale or sharing of personal information
• Right to non-discrimination for exercising your privacy rights
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information

To exercise these rights, contact us at info@RegenCoreAlliance.com.

8.3 European Users (GDPR)

If you are in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

• Right to be informed about data processing
• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making and profiling

8.4 Nevada Residents

Nevada residents may opt out of the sale of certain personal information. We do not currently sell personal information as defined under Nevada law.

9. Cookies and Tracking Technologies

9.1 Types of Cookies We Use

9.2 Managing Cookies

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our Services.

10. Children's Privacy

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at info@RegenCoreAlliance.com.

If we discover that we have collected personal information from a child under 18, we will delete that information promptly.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws.

When we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Ensuring recipients are certified under applicable frameworks
• Obtaining your explicit consent where required

12. Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Notify affected individuals within 72 hours of discovery (as required by GDPR)
• Notify the appropriate regulatory authorities as required by law
• Comply with HIPAA breach notification requirements (within 60 days)
• Provide information about the breach and steps you can take to protect yourself
• Take immediate steps to mitigate the breach and prevent future incidents

13. Third-Party Links

Our Services may contain links to third-party websites, applications, or services. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Updating the "Last Updated" date at the top of this policy
• Sending an email notification for material changes
• Providing in-app notification

Your continued use of our Services after changes are posted constitutes your acceptance of the updated Privacy Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

15.1 Response Time

We will respond to your inquiries within:

• General inquiries: 5 business days
• Data access requests: 30 days (as required by HIPAA/GDPR)
• Urgent privacy concerns: 48 hours

15.2 Complaints

If you believe your privacy rights have been violated, you have the right to lodge a complaint with:

• Our Privacy Officer (contact information above)
• The U.S. Department of Health and Human Services Office for Civil Rights (for HIPAA complaints)
• Your local data protection authority (for GDPR complaints)
• The California Attorney General (for CCPA complaints)