Privacy Notice

1. Scope

This notice explains how Origin Peptides ("OriginHeals", "we", "us") collects, uses, shares and retains personal information when you use originheals.com, buy products, use the research assistant, join the community or participate in the partner program.

2. What we collect

• Account and order data: name, e-mail, shipping address, phone (optional), order history, the versions of terms you accepted and the network address at acceptance.
• Payment data: handled by our payment processor. We receive only a token, the card brand, last four digits and authorization results — never the full card number.
• Verification signals: hashed device, network and address indicators used to prevent fraud and self-referral in the partner program.
• Research assistant: your questions, the assistant's answers and the policy decision applied to each message (retained 180 days by default).
• Community: posts, comments, reviews, reports and appeals you submit, plus moderation decisions about them.
• Technical data: server logs (request id, path, status, latency) and privacy-respecting analytics events. We do not use third-party advertising trackers.

3. How we use it

• To fulfil orders, allocate inventory from released lots, ship and provide support.
• To meet legal and compliance obligations, including research-use attestations, age verification, tax and lot traceability (which orders received which lot).
• To detect fraud, abuse and self-referral, and to enforce our terms.
• To operate the partner program: attribution, commission ledger, payouts and tax reporting where required.
• To operate and improve the research assistant and moderation systems — retrieved literature, not your personal data, is used to answer questions.
• To send transactional messages (order, shipping, lot-status and safety notices). Marketing e-mail is sent only with your consent and always includes unsubscribe.

4. Who we share it with

Service providers acting on our instructions: payment processor, shipping carriers and label provider, e-mail/SMS delivery, cloud hosting and object storage, malware scanning, and AI model providers for the research assistant and moderation classifier (they receive the message text needed to respond and are contractually barred from training on it where such terms are available).

Authorities, carriers or processors where required by law, subpoena or to protect safety. We do not sell personal information.

5. Retention

Order, attestation and lot-traceability records: 7 years (regulatory and tax). Assistant conversations: 180 days unless you delete them sooner. Community content: while published, then archived per moderation rules. Server logs: 30 days. Fraud signals: 24 months.

Deletion requests remove or anonymise personal data except where retention is legally required; order and attestation records are pseudonymised rather than deleted.

6. Your rights

Depending on your state you may have rights to access, correct, delete or export your data and to opt out of certain processing. Submit requests to privacy@originheals.com or from your account page; we verify identity before acting and respond within 45 days. We do not discriminate for exercising rights. [Counsel to map state-specific rights — D5.]

7. Security

Data is encrypted in transit and at rest. Access by staff is role-based, requires multi-factor authentication and is logged in an append-only audit trail. Lab reports are stored in private object storage and served through short-lived signed links.

8. Children

Our services are for adults 21 and over. We do not knowingly collect information from anyone under 21.

9. Changes and contact

We will post changes here with a new version number. Questions: privacy@originheals.com · Origin Peptides ("OriginHeals", "we", "us").