Pepjoy Privacy Policy

Separate consumer health data policy: Pepjoy maintains a standalone Washington Consumer Health Data Privacy Policy for consumer health data governed by the Washington My Health My Data Act (MHMDA). It is published with its own separate link wherever this Privacy Policy is published. See Section 10.

1. Introduction

This Privacy Policy describes how Kythe LLC, a Georgia limited liability company ("Kythe," "we," "us," or "our"), collects, uses, stores, and discloses information when you use the Pepjoy mobile application (the "App") and the related website at pepjoy.app (the "Site," and together with the App, the "Services"). Pepjoy is an iOS application designed to help users record and reflect on information related to their use of GLP-1 medications.

This Privacy Policy is a notice about our privacy practices. Please review it before using the Services.

2. What Pepjoy Is (and Isn't)

Pepjoy is a journaling and tracking tool for individuals taking GLP-1 medications. The Services help you record information you already know, such as what you took, when you took it, your weight, your nutrition, and how you felt, and visualize that information over time.

Pepjoy does not provide medical advice, diagnosis, dosing recommendations, treatment plans, or interpretations of your medical condition. Pepjoy does not calculate doses, model how medications behave in your body, recommend medication schedules, or interpret your symptoms. The Services are intended for general wellness and personal record-keeping purposes only.

Always consult a qualified healthcare provider for medical advice, diagnosis, and treatment decisions. Information you record in Pepjoy is your record, not a clinical recommendation.

3. Information We Collect

We collect only the information necessary to provide the Services. We do not sell your information, and we do not use your health information for advertising.

3.1 Information You Provide Directly

Pepjoy does not have user accounts. You do not create an account, sign in, or provide any login credentials to use the Services. The information you provide is the information you choose to enter, during onboarding or later in the App, including:

• Onboarding details you enter when you first set up the App: first name, current weight, goal weight, target date, and your goal selections.
• Profile details you optionally add in the Profile tab: sex, height, and an optional profile photo, which is stored on your device.
• Medication information you enter: medication name, prescribed dose, dose schedule, and (for compounded medications) vial concentration as stated by your pharmacy, plus the pharmacy name and lot number you optionally record for a vial.
• Logged data: shots or doses, weight measurements, water intake, protein intake, fiber intake, feeling entries, and optional photos.
• Optional photographs you choose to capture or attach to log entries (e.g., progress photos, photos of vials or pens).
• Free-text content in notes fields on entries you log.

3.2 Information from Apple HealthKit

If you grant permission, Pepjoy writes weight entries that you log in the App to Apple Health on your device. The current version does not request or read data from Apple Health.

The App writes the following Apple Health data type:

• Body Mass (the weight entries you log in Pepjoy)

Pepjoy does not read or write medication or dose information through Apple Health. We do not transmit Apple Health data to Kythe servers, use Apple Health data for advertising, or sell Apple Health data.

You can revoke Pepjoy's permission to write weight to Apple Health at any time in iOS Settings under Privacy & Security > Health > pepjoy.

3.3 Technical Information

A minimal set of technical information is involved in operating the App and diagnosing problems. Pepjoy does not operate a custom backend for user health data, and the App does not transmit the information described below to systems controlled by Kythe except as expressly described:

• Device information: device model, iOS version, App version, and language/region settings. This information is used on your device so the App runs correctly. It is not sent to us.
• Crash and performance data: if you have opted in to sharing diagnostics with app developers in iOS Settings, Apple provides us aggregated, non-identifying crash and performance reports. The App itself does not send crash reports to us.
• Subscription receipts from Apple's StoreKit are validated on your device to confirm your subscription status. Your receipts are not sent to us.

3.4 Website Information

When you visit pepjoy.app, the Site is hosted and delivered through Cloudflare Pages and Cloudflare's network. Cloudflare processes technical request information as necessary to deliver and secure the Site. We use Cloudflare Web Analytics to understand aggregate Site traffic and performance. Cloudflare states that Web Analytics does not use cookies or localStorage for analytics and does not fingerprint individual visitors for analytics purposes.

The analytics information available to us may include page views, referring sites, browser, device type, operating system, and country-level information. We do not use Google Analytics, advertising pixels, or cross-site behavioral advertising trackers on the Site. Under our current configuration, Kythe does not receive exported raw HTTP request logs. The Site does not contain a contact form; if you email a pepjoy.app address, your message is handled as described in Section 3.5.

3.5 Support Communications

If you contact us by email or another support channel, we receive the email address or other contact information you use, the contents of your message, any attachments, and any other information you choose to provide. Please avoid including health information unless it is necessary for us to respond to your request. If you include health information, we treat it as sensitive and use it only to provide support, protect the Services, or comply with applicable law.

3.6 Information We Do Not Collect

For clarity, we do not collect:

• Government-issued identifiers (Social Security numbers, driver's license numbers, passport numbers).
• Payment card information. All payments are processed by Apple via the App Store; we never see your payment details.
• Precise geolocation.
• Contacts, calendar, microphone audio, or camera data outside of optional photos you explicitly capture and save.
• Cross-app or cross-website tracking data. Pepjoy does not include any third-party advertising SDKs.

We do not use the Services to track you across third-party websites or apps for targeted advertising, and we do not sell or share personal information for cross-context behavioral advertising. Accordingly, there is no sale or sharing for targeted advertising to opt out of under our current practices. If our practices change, we will update this Privacy Policy and honor legally required opt-out preference signals, including Global Privacy Control where applicable.

4. How Your Information Is Stored and Synced

4.1 On-Device Storage

The primary copy of your Pepjoy data lives on your device, in Apple's SwiftData framework. This includes all logged metrics, photos, and your settings.

4.2 iCloud Sync via CloudKit

Your Pepjoy data syncs to your iCloud private database via Apple's CloudKit service. The records that sync include medication records, dose schedules, injection and dose records, vial records (including concentration, pharmacy name, and lot number where entered), weight entries, water, protein, and fiber entries, feeling entries, progress photos, and related Pepjoy settings. Pepjoy does not import data from Apple Health into the CloudKit-synced store.

CloudKit data is encrypted in transit and at rest by Apple and is stored in your private iCloud container. Kythe does not have application-level access to your private CloudKit database. We do not retrieve, mirror, analyze, or use the contents of that private database for our own purposes.

Photos in particular: Pepjoy stores progress photos in your private iCloud container alongside your other entries. Pepjoy does not analyze, read, or process the contents of your photos for its own purposes. We do not extract information from photos, run computer vision on them, or transmit their contents to an advertising or analytics service.

4.3 No Custom Backend

Pepjoy does not operate a custom backend that stores a server-side copy of your in-App health data. App health data is stored on your device and, under the current architecture, in your private iCloud container. Subscription receipts are validated on your device through Apple's StoreKit, and crash and performance reports reach us only through Apple's opt-in diagnostics sharing, as described in Section 3.3.

5. How We Use Your Information

We use the information described above to:

• Provide and operate the Services.
• Sync your data across your devices (via your iCloud account).
• Validate your subscription status and process renewals (via Apple's App Store).
• Diagnose crashes and improve App stability (via Apple's opt-in diagnostics sharing, described in Section 3.3).
• Communicate with you and respond to support requests you choose to send us.
• Comply with legal obligations and protect the security and integrity of the Services.

We do not use your information to:

• Serve advertising to you, in Pepjoy or anywhere else.
• Train artificial intelligence or machine learning models.
• Build a profile of you for sale or transfer.
• Make automated medical decisions about your treatment.

6. How We Share Information

We do not sell your information. We do not share your information with advertisers, data brokers, or marketing partners.

We disclose information only in the following limited circumstances:

• With Apple, which provides the App Store, iCloud, CloudKit, HealthKit, and StoreKit infrastructure used by the App. Apple's handling of information through those services is governed by Apple's applicable terms and privacy policies.
• With Cloudflare, which hosts and delivers the Site and provides Cloudflare Web Analytics as described in Section 3.4. Cloudflare's handling of information through those services is governed by its applicable terms and privacy practices.
• With our email provider and any customer-support provider we use, but only as needed to receive and respond to communications you send us. We require service providers that process information for us to protect it and use it only for the services they provide to Kythe.
• When disclosure is required or expressly permitted by applicable law, including in response to valid legal process. We may challenge requests that we reasonably believe are overbroad, unlawful, or inconsistent with applicable health-privacy protections.
• In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business or assets, subject to applicable law and any notice, consent, confidentiality, or use restrictions that apply to the information involved.

7. Your Choices and Rights

7.1 Access, Export, Correction, and Deletion

You can access your data at any time within the App. You can export your data as a PDF report (a summary of your doses, weight and nutrition trends, and how you have been feeling) from Settings > Export data. The PDF report is available to all users at no additional cost.

You can correct most logged data by editing the entry within the App. Feeling and photo entries are corrected by deleting the entry and logging it again. You can delete individual entries within the App. To delete your Pepjoy data in bulk, see Section 8 (Data Deletion and Right to Erasure). Additional privacy rights may apply depending on where you live; see Sections 9 through 11.

7.2 Notifications

You can enable or disable Pepjoy notifications at any time in iOS Settings > Notifications > pepjoy, or within the App at Settings tab > Notifications.

7.3 HealthKit Permissions

You can revoke Pepjoy's permission to write weight to Apple Health at any time in iOS Settings under Privacy & Security > Health > pepjoy.

8. Data Deletion and Right to Erasure

You can delete your Pepjoy data directly within the App. This section explains what the in-App deletion control removes and how to request deletion of information that Kythe may separately receive, such as support communications.

8.1 How to Delete Your Data

Open the Profile tab, scroll to the bottom, and tap the red "Delete all my data" row. Confirm by tapping "Delete everything" in the dialog that appears. This deletes the Pepjoy data described below from the App and your synced store; it does not delete information that Pepjoy previously wrote to Apple Health.

Because Pepjoy has no account and no server-side copy of your in-App health data, the in-App control is the operative deletion mechanism for data stored on your device and in your private iCloud. If you want to request deletion of information Kythe separately maintains, such as a support email you sent us, contact [email protected].

You do not need to give a reason. We will not ask why.

8.2 What We Delete

When you delete your data, the in-App control removes the following from your device and, via CloudKit, from your iCloud private container (those removals propagate to your other devices shortly after, not instantly):

• Logged injections and dose records
• Weight entries
• Injection-site selections from the body map
• Daily metrics (water, protein, and fiber entries)
• Reported feelings, including positive and negative entries
• Photos you captured or attached in the app
• Notes and free-text content
• Your onboarding and profile settings, including HealthKit sync state

Pepjoy does not delete data that it previously wrote to Apple Health. Weight entries Pepjoy wrote to Apple Health remain part of your Apple Health record and can be managed separately in the Health app.

We do not hold a separate server-side copy of your in-App health data to delete.

8.3 What We May Retain

We may retain a limited amount of information that Kythe actually receives outside the App's private storage, but only where reasonably necessary for support, security, legal compliance, fraud prevention, or dispute resolution:

• Support correspondence, Apple-provided diagnostic reports, and other limited operational records that Kythe actually receives.

Kythe does not retain a separate server-side copy of health information you enter in the App. Information retained by Apple in connection with Apple services, subscriptions, or Apple Health is governed by Apple's own retention practices and your Apple account settings.

8.4 Timeline

In-App deletions generally begin immediately and may take a short time to propagate through iCloud to your other devices. For privacy requests concerning information that Kythe actually maintains, we will respond and complete the request within the time required by applicable law, subject to any permitted extension or exception.

8.5 Confirmation

For an in-App deletion, the App returns to its fresh-start state when the local deletion completes. If you submit a privacy request by email concerning information Kythe maintains, we will respond to the address you used and provide any confirmation required by applicable law.

8.6 Applicable Privacy Rights

Deletion and related privacy rights may apply under California, Washington, Nevada, Connecticut, and other applicable laws:

• California privacy rights. See Section 9.
• Washington MHMDA rights. See Section 10.

Nevada and Connecticut privacy rights are described in Section 11.

9. California Privacy Rights

California law provides additional protections for certain medical and personal information. The rights that apply depend on the type of information and whether a particular statute applies to Kythe.

9.1 California Confidentiality of Medical Information Act

Pepjoy is software designed to help you maintain and manage information about medications, doses, weight, and related health information. To the extent the California Confidentiality of Medical Information Act ("CMIA") applies to Kythe or information maintained through Pepjoy, we treat covered medical information as confidential and disclose it only as authorized or permitted by applicable law.

Nothing in this Privacy Policy is intended to reduce any rights you may have under the CMIA.

9.2 California Consumer Privacy Act / California Privacy Rights Act

If and to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), applies to Kythe, California residents may have the following rights, subject to applicable exceptions:

• The right to know and access the categories and specific pieces of personal information we collect, use, and disclose.
• The right to delete personal information we have collected from you, subject to applicable exceptions. See Section 8 for deletion mechanisms.
• The right to correct inaccurate personal information.
• The right to opt out of the sale or sharing of personal information for cross-context behavioral advertising. We do not sell personal information or share it for cross-context behavioral advertising.
• The right to limit certain uses or disclosures of sensitive personal information where that right applies. Under our current practices, we use health-related information only for purposes reasonably necessary to provide the Services and do not use it for advertising or unrelated secondary purposes.
• The right not to receive discriminatory treatment for exercising applicable privacy rights.

Retention. In-App health data remains on your device and, under the current architecture, in your private iCloud until you delete it. Information Kythe separately receives, such as support correspondence, is retained only as described in Section 8.3.

To exercise any CCPA/CPRA right that applies to information Kythe maintains, contact us at [email protected]. For data held only on your device or in your private iCloud, use the App's access, correction, export, and deletion controls. We will respond within the time required by applicable law.

10. Washington My Health My Data Act

If you are a Washington consumer, the Washington My Health My Data Act ("MHMDA") provides specific protections for consumer health data processed in connection with Pepjoy.

Pepjoy maintains a standalone Washington Consumer Health Data Privacy Policy, published with its own separate link wherever this Privacy Policy is published. That standalone policy controls with respect to consumer health data governed by the MHMDA.

The standalone policy describes the categories of consumer health data processed, sources and purposes, categories of data shared, recipients, and how to exercise MHMDA rights.

• Where the MHMDA requires consent for collection or sharing, we will obtain the required consent before the applicable processing occurs. Any consent required for sharing will be separate and distinct from collection consent.
• We do not sell consumer health data.
• We do not share consumer health data with advertisers or data brokers.
• You may exercise applicable rights to access, withdraw consent from future collection or sharing, and delete consumer health data as described in the standalone policy and Section 8.

To exercise a MHMDA right that cannot be completed directly in the App, email [email protected]. If we deny a request, you may appeal as described in the standalone Washington Consumer Health Data Privacy Policy.

11. Other State Consumer Health and Sensitive Data Rights

11.1 Nevada

Nevada law provides rights regarding consumer health data, including rights to confirm whether consumer health data is collected, shared, or sold; obtain information about recipients; request that collection or sharing cease; and request deletion. The categories of health data Pepjoy processes, the sources, purposes, methods of processing, and categories of recipients are described in Sections 3 through 6.

Pepjoy does not sell consumer health data, does not allow third parties to collect consumer health data over time across different websites or online services for targeted advertising, and does not use geofencing to identify or track visits to health care facilities or to send health-related advertising.

To exercise an applicable Nevada consumer health data right, contact [email protected]. We may take reasonable steps to verify the request and will respond within the time required by Nevada law.

11.2 Connecticut

Connecticut law may provide rights regarding personal and sensitive data, including rights to access, correct, delete, obtain a copy of personal data, withdraw consent to sensitive-data processing, and appeal certain denials. Pepjoy does not sell personal data, use it for targeted advertising, or use it for profiling in furtherance of decisions that produce legal or similarly significant effects.

Where Connecticut law requires consent to process sensitive data, we will obtain that consent before the processing occurs and provide a mechanism to withdraw it.

To exercise an applicable Connecticut privacy right, contact [email protected]. If we deny a request, you may appeal by replying to our decision with the word "Appeal."

12. Users Outside the United States

The Services are offered in the United States. The Services are not available in, and are not directed to individuals in, the European Union, the European Economic Area, the United Kingdom, or Switzerland. Availability in those regions may be added in a later version of the Services, and this Privacy Policy will be updated before any such expansion.

13. Children's Privacy

The Services are intended only for individuals who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided information to us, contact [email protected] and we will take appropriate steps to address it.

14. Data Security

We use safeguards designed to protect the limited information we handle and rely on security protections provided by iOS and Apple services for data stored on your device and in Apple infrastructure. These measures include:

• Security protections built into iOS for data stored by the App on your device.
• Encryption protections provided by Apple for iCloud and CloudKit data in transit and at rest.
• Encrypted network transport for communications between the App and Apple services.
• Least-privilege practices for any Kythe personnel access to operational systems that contain information we actually receive.

If we discover a breach of unsecured identifiable health information, we will provide notices to affected individuals, the Federal Trade Commission, and, where applicable, the media as required by the FTC Health Breach Notification Rule and other applicable law.

No system is perfectly secure. If you believe your information has been compromised, contact us immediately at [email protected].

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last Updated" date and provide notice in the App or through another appropriate method. If applicable law requires consent before we collect, use, or disclose information in a new way, we will obtain that consent before the new processing begins.

16. Contact Us

If you have questions about this Privacy Policy, our privacy practices, or an applicable privacy right, contact us:

Kythe LLC, 210 Lakeside Dr, Newnan, GA 30263 USA. Email: [email protected]