Effective: April 27, 2026 · Version 5.0
This policy explains what personal data PeptideMonitor collects, how it is used, who it is shared with, and what rights you have over it. We try to write clearly and keep collection to the minimum needed to run the Service.
PeptideMonitor is operated by Tomas Sniukas, an individual sole proprietor based in the Republic of Lithuania. In this policy we refer to ourselves as "PeptideMonitor," "we," "us," or "our."
The data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR), the UK GDPR, and equivalent laws is Tomas Sniukas, contactable at the details in section 20 below.
This Privacy Policy applies to your use of the PeptideMonitor mobile application, the website at peptidemonitor.app, and any related services (together, the "Service"). By using the Service you acknowledge the practices described here.
This policy does not apply to third-party services you separately connect to PeptideMonitor. Those services (such as WHOOP, Oura, Apple Health, and your Apple ID) are governed by their own privacy policies.
If you choose to connect a wearable or third-party service, we receive data from that service based on the permissions you grant. See sections 7 and 8 for specifics on WHOOP, Oura, and Apple HealthKit.
We use personal data to:
We do not sell your personal data. We do not rent it. We do not operate as a data broker.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases under the GDPR and equivalent laws:
You may withdraw consent for consent-based processing at any time without affecting the lawfulness of processing carried out before withdrawal.
PeptideMonitor processes information that may be classified as "special category data" under Article 9 GDPR, including health data, biometric measurements, and information about supplements or substances you track. We treat this data with elevated care.
The legal basis for processing special category data is your explicit consent, given when you create an account and when you connect wearables or upload lab and DEXA results. You may withdraw this consent at any time by disconnecting integrations, deleting specific records, or deleting your account.
Health data is stored in encrypted form and is accessible only through your authenticated account.
PeptideMonitor currently supports three wearable integrations: Apple HealthKit, WHOOP, and Oura. No other wearable integrations are supported, and we do not have plans to add others.
If you connect your WHOOP account, the Service requests data from WHOOP via the WHOOP Developer API based on the permissions you grant during authorisation. Scopes that may be requested include:
To maintain the connection we store your WHOOP OAuth access token and refresh token in encrypted form on our backend. These tokens are used only to sync your WHOOP data into PeptideMonitor and are never shared with third parties.
You can disconnect WHOOP at any time from the Wearables screen in the app. Disconnecting revokes the token and stops further syncing. You can also revoke access directly from your WHOOP account settings. See whoop.com/privacy for how WHOOP itself handles your data.
If you connect your Oura account, the Service requests data from Oura via the Oura Cloud API v2 based on the permissions you grant during authorisation. Scopes that may be requested include:
To maintain the connection we store your Oura OAuth access token and refresh token in encrypted form on our backend. These tokens are used only to sync your Oura data and are never shared with third parties.
You can disconnect Oura at any time from the Wearables screen in the app. Disconnecting revokes the token and stops further syncing. You can also revoke access directly from your Oura account settings. See ouraring.com/privacy-policy for how Oura itself handles your data.
You can disconnect any wearable integration at any time from the Wearables screen in the app. Disconnecting revokes stored tokens for that service and stops further data collection. Biometric data previously imported remains in your account unless you delete it separately.
If you enable the Apple HealthKit integration, we access only the health data categories you explicitly authorise on your device. In line with Apple's HealthKit requirements:
When Apple HealthKit integration is enabled, data collected by Apple Watch that you have authorised for sharing with the Health app will flow into PeptideMonitor through HealthKit. This may include heart rate, HRV, activity, workouts, sleep, body weight, and other metrics your Apple Watch tracks. The same HealthKit privacy rules in 8.1 apply to Apple Watch data.
If you choose to sign in using Sign in with Apple, Apple may share your name and a relay email address with us. You can choose to share or hide your real email address; if you hide it, Apple provides a private relay email that forwards to your real address. We use this information solely to create and maintain your account.
PeptideMonitor uses two AI service providers to deliver specific features. Each is used only for the purposes described below.
We use Mistral AI's OCR API to convert uploaded laboratory PDFs and DEXA scan PDFs into machine-readable text. When you upload a lab or DEXA document:
Mistral AI is based in France (European Union). Per Mistral's published terms, customer data submitted to its API is not used to train Mistral's models.
We use Google Gemini to:
When Gemini is used:
Per Google's published terms for the Gemini API, prompt and response data submitted via the paid API tier are not used to train Google's models.
If we change AI service providers in the future (for example, replacing Gemini with Anthropic's Claude or another model), we will update this policy and, where consent is required under applicable law, request your consent in-app before activating the new provider.
We will not transmit personal data to any AI provider beyond what is described in 9.1 and 9.2 without first updating this policy.
We rely on a small number of service providers to operate the Service. Each has been selected for its security posture and legal compliance. Current service providers include:
We share only the minimum data necessary for each provider to perform its function, under contractual obligations requiring appropriate confidentiality and security measures.
Your primary account data is stored in Supabase's US East region (Northern Virginia, United States). Some of our other service providers are also based in the United States or may process data there.
When personal data of users located in the European Economic Area, the United Kingdom, or Switzerland is transferred outside those regions, we rely on appropriate legal safeguards, which may include:
Mistral AI processing occurs in the European Union; no transfer outside the EU is involved for OCR processing.
By using the Service, you acknowledge that your data may be processed in the United States and other countries that may have different data-protection standards than your home jurisdiction.
We share personal data only in the following limited situations:
We do not sell, rent, or license your personal data to third parties.
We retain your personal data for as long as your account is active and for the following periods:
You can request account deletion at any time from within the app or by contacting info@peptidemonitor.app. Valid deletion requests are processed within 30 days, subject to any legal obligation to retain specific records.
The website peptidemonitor.app uses minimal cookies or local storage only where necessary for the site to function (for example, to remember your theme preference). We do not use cross-site tracking, advertising cookies, or third-party advertising trackers.
The mobile application may collect limited analytics and crash data to understand how the app is used and to improve performance. These analytics do not identify you personally.
If we introduce additional analytics or advertising tools in the future, we will disclose them in an updated version of this policy and, where required, request your consent.
We use reasonable technical and organisational safeguards to protect your personal data, including:
No system is completely secure. If we become aware of a data breach affecting your personal data, we will notify you and relevant supervisory authorities as required by applicable law.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:
California residents have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information as defined by the CCPA.
Residents of other U.S. states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Utah, Texas, and Oregon) have similar rights to access, correct, and delete personal data.
To exercise any of these rights, contact us at info@peptidemonitor.app. We may ask you to verify your identity before acting on a request. We will respond within the timeframes required by applicable law (typically 30 days under the GDPR; 45 days under the CCPA).
PeptideMonitor is intended for adults only. The Service is not directed to children under 18. We do not knowingly collect personal data from children. If we become aware that a child has provided personal data, we will delete it as soon as possible. If you believe a child has provided us with personal data, please contact us at info@peptidemonitor.app.
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective" date at the top of this page and, where appropriate, notify you in-app or by email. Your continued use of the Service after an update constitutes acceptance of the revised policy.
This Privacy Policy is governed by the laws of the Republic of Lithuania and applicable EU privacy regulations. Nothing in this policy limits rights that cannot be waived under applicable mandatory law, including rights under the GDPR, the CCPA, or other consumer-protection statutes.
For questions, requests, or complaints about this Privacy Policy, or to exercise your data rights, contact us at:
For App Store purchase and subscription support, including refund requests, please contact Apple directly at reportaproblem.apple.com.
PeptideMonitor is operated by Tomas Sniukas, a sole proprietor based in Vilnius, Lithuania. This Privacy Policy should be read alongside our Terms of Service.
© 2026 PeptideMonitor