Consumer Health Data Privacy Policy

What we collect and why

When you use a sign-up form on Ellum, we collect:

• your email address;
• your US state;
• the peptides you choose to follow;
• the page you signed up on, and the date and time;
• which emails you agreed to receive, with the exact wording you saw.

We treat all of them as consumer health data.

We use them only for the purposes you agree to, each with its own checkbox:

• to email you when an Ellum Clinic doctor can see patients in your state;
• to email you updates on the peptide or topic you chose (regulatory status changes and major new research);
• to email you about research studies you might join, only if you tick that separate, optional box;
• to send your email, state and peptides to Ellum Clinic or a medical practice licensed in your state, so they can contact you about care, only if you tick that separate, optional box;
• to choose which paid offers from clinics and health companies we email you, using your peptides and state, only if you tick that separate, optional box. We send them ourselves;
• to email you a guide you asked for.

We also count sign-ups by state and peptide, without email addresses, to decide where Ellum Clinic opens first, which updates to write, and for reports that show only totals. The form tells you about this before you sign up.

When you read pages on Ellum, Google Analytics can collect for us: the address and title of each page you open (which can name a peptide), the page or site you came from, when you visited and for how long, browser and device details, your approximate location (country and region, estimated from your IP address) and the contents of two first-party cookies: one holds a random ID, the other the current visit. We use it only to count visits and see which pages are read. We treat it as consumer health data too.

Where we get it

From you, through the sign-up form, and from your browser when you read pages on Ellum, through Google Analytics.

What we share, and with whom

We don't sell consumer health data.

We share it only if you tick the box asking to be contacted about care:

• what we share: your email address, US state and the peptides you follow;
• with whom: medical practices licensed in your state that you agree to be contacted by, and Ellum Clinic once it exists.

Service providers that process it for us, only to run Ellum:

• website hosting: Vercel;
• database hosting: Supabase;
• email delivery: Resend;
• website analytics (page visits only, never sign-ups; no analytics on sign-up, confirmation or unsubscribe pages): Google, through Google Analytics.

Your rights and how to use them

You have the right to:

• confirm and access: find out whether we collect, share or sell your consumer health data, get a copy, and get a list of every third party and affiliate that has received it, with a way to contact each;
• withdraw consent: stop any or all of the uses above;
• delete: have your consumer health data deleted, including from backups; we also tell our service providers, and any practice we passed it to, to delete it. We keep only a record of which kinds of box were ticked or withdrawn and when, with no peptide named.

How. Email hello@ellumclinic.com from the address you signed up with and say what you want. You can also withdraw consent with the unsubscribe link in any email; we stop those emails within 10 business days. We confirm the request by replying to that address. We act without undue delay and within 45 days. If we need more time, we tell you within those 45 days, with the reason, and finish within 45 more. Deletion from backups is complete within six months.

Appeal. If we refuse a request, reply "appeal" to our answer. We'll tell you in writing within 45 days what we did and why. If we deny the appeal, you can complain to the Washington Attorney General at https://www.atg.wa.gov/file-complaint, or to your own state's attorney general.

Nevada residents

• How we process it: we store sign-ups in our database and use them only for the purposes you ticked, listed above, and to count sign-up totals. Google Analytics processes page visits for us only to count visits and show which pages are read. We make no automated decisions about you.
• Reviewing and changing it: email hello@ellumclinic.com to see or correct what we hold.
• Changes to this policy: we post the new version here with a new effective date. A change that affects data you've already given us applies to your data only if you agree to it.
• Other companies: Google Analytics records visits to Ellum for us only. Its cookies are set for ellumclinic.com alone, and its advertising and data-sharing features are off. No company collects information about your online activity across different websites when you use Ellum.