Privacy Policy

Exec Groupware (“Exec Groupware,” “we,” “us,” or “our”) owns and operates the PeptideCloud platform (peptidecloud.ai and related applications). This Privacy Policy explains how we collect, use, disclose, and protect information when you use our website, platform, and services.

PeptideCloud is a practice-management and clinical operations platform designed for clinicians and health professionals who offer peptide therapy and related services. We act as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA) when we process Protected Health Information (PHI) on behalf of our clinic customers. We make a Business Associate Agreement (BAA) available as a standard part of our service.

We collect information in the following categories:

We use the information we collect to:

• Provide, maintain, and improve the PeptideCloud platform
• Authenticate users and manage accounts and subscriptions
• Enable clinics to manage clients, protocols, orders, renewals, labs, billing, and related workflows
• Send transactional and service-related communications
• Provide customer support
• Maintain security, audit logs, and prevent fraud or abuse
• Comply with legal obligations
• Enforce our terms and agreements

We do not sell personal information or PHI. We do not use PHI for marketing or advertising.

We share information only in these limited circumstances:

• With the following subprocessors:
  • Stripe — payment processing
• With the clinic that owns the data — staff users of a clinic can access the data belonging to that clinic according to the permissions set by the clinic.
• When required by law or to respond to valid legal process.
• In connection with a business transfer (merger, acquisition, or sale of assets), subject to appropriate protections.
• With your direction or consent.

When we act as a Business Associate, our use and disclosure of PHI is further limited by the BAA we sign with the clinic.

When a clinic customer uses PeptideCloud to create, receive, maintain, or transmit PHI, we act as a Business Associate of that clinic. We will:

• Use and disclose PHI only as permitted by the BAA and applicable law
• Implement administrative, technical, and physical safeguards
• Report breaches as required
• Make PHI available for access, amendment, and accounting of disclosures as required under the BAA

Clinics remain responsible for their own HIPAA compliance as Covered Entities (or as Business Associates of other Covered Entities).

We retain clinic and patient data according to the instructions of the clinic under the applicable Business Associate Agreement. When a clinic cancels its subscription or requests deletion, we will follow the retention and return/destruction terms of the BAA.

We implement safeguards designed to protect information, including:

• Encryption in transit and at rest
• Role-based access controls
• Multi-factor authentication options
• Audit logging
• Idle session timeouts
• Regular access reviews

No method of transmission or storage is 100% secure. We work to maintain appropriate protections consistent with the sensitivity of the data we handle.

Clinic customers and staff users may access, update, or delete account information through the platform or by contacting us.

Individuals whose information is held by a clinic (patients/clients) should generally contact the clinic that holds their records. As a Business Associate, we will assist clinics in responding to individual rights requests as required under the BAA and HIPAA.

You may also contact us at compliance@peptidecloud.ai with privacy questions or requests.

If you are a resident of California or certain other U.S. states with comprehensive privacy laws, you may have additional rights regarding your personal information, including the right to:

• Know what personal information we collect, use, and disclose
• Request access to or deletion of your personal information
• Correct inaccurate personal information
• Opt out of the “sale” or “sharing” of personal information (we do not sell personal information)
• Limit the use of sensitive personal information, where applicable
• Not be discriminated against for exercising your privacy rights

To exercise these rights, contact us at compliance@peptidecloud.ai. We will verify your request and respond as required by applicable law. If you are a patient/client of a clinic that uses PeptideCloud, please contact that clinic first, as they control your records.

Our marketing website (peptidecloud.ai) may use cookies or similar technologies for basic functionality, security, and (if enabled) analytics. You can control cookies through your browser settings.

PeptideCloud is not directed to children under 18. We do not knowingly collect personal information from children.

PeptideCloud is operated from the United States. If you access the service from outside the United States, you understand that information may be processed in the United States.

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the effective date. Material changes will be communicated to account holders as appropriate.

For privacy-related questions or requests: