Legal Changelog

Privacy Policy updated in two places that were published without a changelog entry until now. (1) 2026-08-20: account creation now collects your first and last name, and optionally a phone number. The policy states how those are held (one table readable only by you), that providing a name makes your health information identified rather than pseudonymous, and that phone numbers are not used to contact you — no SMS is sent today, and reminders by text will be opt-in if they are ever built. (2) 2026-10-05: the third-party AI processors are now described correctly. Anthropic performs inference for every optional AI feature (the protocol chat, vial-label scanning, lab and body-composition PDF reading, packing-slip import and the Pro evidence summary) and receives what you submit to the feature you used plus relevant context from your own records. OpenAI converts the text of a chat question into a numeric vector to find matching research and receives nothing else — no images, no documents. The earlier text had OpenAI performing vision inference on scanned labels, which it does not. Neither provider trains on data sent through its API.

In force.

RATIFIED after licensed-counsel review. The operator is now named in all three documents as Peplo Health LLC, a New Jersey limited liability company, replacing the [COMPANY_NAME] placeholder — no bracketed placeholders remain. All three documents are governed by New Jersey law. Terms Section 17 now requires BINDING INDIVIDUAL ARBITRATION before the American Arbitration Association under its Consumer Arbitration Rules, seated in New Jersey, with a jury-trial and class-action waiver, a severability rule for that waiver, carve-outs for small claims / injunctive IP relief / complaints to a government agency, a one-year limitations period, and exclusive New Jersey jurisdiction for every dispute not subject to arbitration. The liability cap in both the Terms and the Disclaimer rises from US$25.00 to the greater of US$100.00 or the amount paid in the trailing twelve months, per counsel's view that a $25 cap is unlikely to be enforced. Terms Section 8 names Peplo Health LLC as merchant of record and Stripe, Inc. as the payment processor, with card data never reaching our servers and chargebacks subject to Stripe's procedures. The Privacy Policy is rewritten to conform to the New Jersey Data Privacy Act (N.J.S.A. 56:8-166.4 et seq.): controller/processor roles, categories of personal data and of third-party recipients, sensitive-health-data consent and withdrawal, an express no-sale / no-targeted-advertising / no-significant-effect-profiling statement, 45-day response and 60-day appeal timelines with a route to the NJ Division of Consumer Affairs, and recognition of universal opt-out mechanisms (Global Privacy Control and Do Not Track) — enforced in code, which disables all optional analytics for a signaling browser. Security records that we are not a HIPAA covered entity while applying HIPAA-aligned safeguards anyway. The draft banner is removed; these documents are now binding.

Ratified — reviewed by licensed counsel and in force.