Privacy Policy

1. Who we are

Protocol Health Ltd. is a Wyoming, United States company. We are the controller responsible for the personal information described in this policy. The Service is intended for users located in the United States and for individuals who are 18 years of age or older.

2. Information we collect

We collect the following categories of personal information:

• Account and identity information: your name and email address, collected through our account authentication service when you create an account.
• Self-reported health information:the goals, conditions, lifestyle details, and current regimen you enter during intake about the “Research Subject.” This is sensitive personal informationand is also “consumer health data.”
• Builder and locked protocol content: educational suggestions, contextual explanations, stack selections, and the locked snapshot derived from your inputs and actions.
• Payment information: when paid builder access is offered and you purchase it, payment is processed by a dedicated payment processor. We receive transaction confirmation and limited billing details; we do not store full card numbers.
• Usage and device information: basic technical data such as IP address, browser type, and interaction logs collected to operate and secure the Service.

We collect this information directly from you, automatically through your use of the Service, and from service providers that support account, payment, and Service operations.

3. How we use your information

We use personal information to:

• prepare educational suggestions and context for the protocol builder;
• create and manage your account and authenticate you;
• process your one-time payment;
• send you transactional email (such as builder status and receipts);
• operate, maintain, secure, and improve the Service; and
• comply with legal obligations and enforce our terms.

We do not use your sensitive health information for targeted advertising, and we do not sell it. We process sensitive personal information only with your consent and only for the purposes described here.

4. Service providers

We use service providers to perform limited functions needed to operate the Service. They may process personal information only as necessary to perform those functions on our behalf.

The categories of service providers we use are:

• Contextual processing providers: prepare bounded explanations for protocol-builder suggestions.
• Payment processors: process purchases and return payment status.
• Account and security providers: authenticate users and protect account access.
• Communications providers: deliver transactional messages.
• Hosting and storage providers: host the Service and store account, intake, builder, and protocol data.

We require our service providers to protect personal information and to use it only to provide services to us. We may update these categories as our providers change; material changes will be reflected in this policy.

5. How we disclose information

We disclose personal information to the service-provider categories described above to provide the Service, to professional advisors and authorities where required by law, and in connection with a business transaction such as a merger or acquisition. We do not sell your personal information and we do not share it for cross-context behavioral advertising.

6. Your privacy rights

Depending on where you live, you may have some or all of the following rights under California (CCPA/CPRA), Virginia, Colorado, Texas, and other U.S. state privacy laws:

• Right to know / access the personal information we hold about you and how we use and disclose it.
• Right to delete the personal information we have collected from you.
• Right to correct inaccurate personal information.
• Right to data portability: to obtain a copy of your information in a usable format.
• Right to opt out of the sale or sharing of personal information and of targeted advertising. We do not sell or share personal information or use it for targeted advertising, so there is nothing to opt out of; we honor recognized opt-out preference signals where applicable.
• Right to limit the use of sensitive personal information to what is necessary to provide the Service.
• Right to non-discrimination for exercising your rights.
• Right to appeala decision on your request, where applicable under your state’s law.

Because health information is sensitive, we collect and process it only with your opt-in consent, which you provide during intake. You may withdraw your consent at any time.

How to exercise your rights

To exercise any of these rights, contact us at support@myprotocol.health. We will verify your request using the information associated with your account and respond within the timeframe required by applicable law (generally 45 days, which may be extended where permitted). You may use an authorized agent to submit a request on your behalf where the law allows. If we decline your request, you may appeal by replying to our decision; we will inform you of the outcome of any appeal.

7. Breach notification

Protocol Health is subject to the U.S. Federal Trade Commission’s Health Breach Notification Rule. In the event of a breach of unsecured identifiable health information, we are committed to notifying affected individuals, the Federal Trade Commission, and, where required, the media, in accordance with that Rule.

8. Cookies and tracking

We use cookies and similar technologies that are necessary to operate the Service, keep you signed in, and maintain security. We do not use third-party advertising cookies or sell information collected through cookies. You can control cookies through your browser settings, though disabling necessary cookies may affect how the Service works.

9. Data retention

We retain personal information only for as long as needed to provide the Service, deliver and make available your protocol, comply with our legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or de-identify it. Specific retention periods are being finalized as part of our records and data-minimization program.

10. How we protect your information

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, and destruction, and we limit access to those who need it to perform the purposes described in this policy. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Children’s privacy

The Service is intended solely for adults 18 and older. We do not knowingly collect personal information from anyone under 18, and the Service is not directed to children under 13. See our Age Policy for details.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised policy.

13. Contact us

If you have questions about this Privacy Policy or our handling of your information, contact us at support@myprotocol.health or by mail at the address in the footer below.