PeptoRat Track logo PeptoRat Track

PeptoRat Privacy Policy

Black Rat Holdings LLC

Effective / Last Updated: September 6, 2026

1. Overview

This Privacy Policy explains how Black Rat Holdings LLC (“Black Rat Holdings,” “PeptoRat,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information when you use PeptoRat. Because PeptoRat may process health-related information, we treat privacy and security as important design requirements.

PeptoRat is not intended for persons under 18.

2. Information We May Collect

2.1 Account and Contact Information

2.2 User-Entered Research and Health-Related Information

2.3 Device, Technical, and Usage Information

2.4 Subscription and Transaction Information

We may receive purchase status, product, subscription, renewal, and transaction identifiers from an app store or payment provider. We generally do not receive full payment-card numbers when payment is processed by a platform or payment processor.

2.5 Information From Apple Health and Google Health Connect

With your permission, PeptoRat may read the following from Apple Health (iOS) or Google Health Connect (Android) to fill in fields on your profile so you do not have to type them by hand: height, weight, body fat percentage, and — on Apple Health only, because Google Health Connect does not provide these — biological sex and date of birth.

This access is read-only. PeptoRat never writes information back to Apple Health or Google Health Connect. Once a value is read, it is stored and used the same way as if you had typed it yourself, and is covered by the rest of this Policy — it is not kept separate or treated differently because of where it came from.

You control this access through your device's own settings (iOS: Settings > Privacy & Security > Health > PeptoRat Track; Android: the Health Connect app's app permissions) and may revoke it at any time. Revoking access does not delete information already stored in your PeptoRat account; use the deletion options described in Section 12 for that.

If PeptoRat later allows you to connect any other health platform, device, cloud service, laboratory, or third party, we will describe the categories of information requested and obtain authorization where required before accessing that information.

2.6 The Ask the Rat AI Assistant

When you use the Ask the Rat chat feature, what you type is sent to a third-party AI service provider to generate a response. PeptoRat requires any AI provider it uses to process that content only to answer your question, not to use it to train their own models, and to handle it under a contractual confidentiality obligation. The specific provider may change as PeptoRat's infrastructure changes; this commitment applies regardless of which one is in use at a given time.

Conversation content may be briefly logged to maintain your chat history within the app, prevent abuse, and troubleshoot problems, subject to the retention described in Section 10.

3. How We Use Information

4. Consumer Health Data

Depending on what you enter or connect, PeptoRat may process information that is considered consumer health data under certain U.S. state laws. This may include information concerning medications, treatments, bodily functions, symptoms, laboratory values, health measurements, or other information linked or reasonably linkable to a person’s health status.

We will collect, use, or share consumer health data only for purposes disclosed to you, to provide a product or service you request, with consent where required, or as otherwise permitted by applicable law.

Where a jurisdiction requires a separate Consumer Health Data Privacy Policy or notice, we will provide that notice separately and prominently.

PeptoRat is not a HIPAA-covered entity. We are not a healthcare provider, health plan, or healthcare clearinghouse, so the Health Insurance Portability and Accountability Act (HIPAA) does not apply to the information you enter or import. Nothing you record in PeptoRat becomes part of a medical record, and if you need your official medical records you should contact your healthcare provider directly.

5. Our Core Health-Data Commitments

6. Optional Research Participation and De-Identified Data

6.1 Separate Choice

PeptoRat may invite you to participate in research, statistical analysis, safety analysis, product-development research, or aggregated scientific insights. Research participation is optional and is not established solely by accepting the Terms of Service or this Privacy Policy.

Where consent is required, PeptoRat will present a separate consent request before using or sharing consumer health data for the stated research purpose. The request will describe the relevant categories of data, purposes, categories of recipients if any, and how to withdraw consent from future collection or sharing.

6.2 Free and Paid Plans

Both free and paid users will receive legally required privacy choices. A paid subscription does not purchase privacy rights, and a free account does not by itself constitute consent to research use. PeptoRat may offer plan-specific features or benefits related to voluntary research participation only where permitted by applicable law and with any required notices.

6.3 De-Identification

When eligible information is used to create a de-identified research dataset, we take measures designed to remove direct identifiers and reduce the risk that information can reasonably be linked back to an individual. Depending on the dataset, measures may include removing account identifiers, names, email addresses, precise addresses, device identifiers, and direct identifiers in uploaded records; generalizing dates, age, or geography; limiting rare combinations; and applying access and contractual controls.

6.4 No Re-Identification

We will not attempt to re-identify information that we maintain as de-identified except where permitted by law for purposes such as evaluating the effectiveness of our de-identification methods. When appropriate, contracts with research or analytics recipients will prohibit re-identification and unauthorized onward disclosure.

6.5 Withdrawal

You may withdraw research consent for future collection, use, or sharing through the method provided in the research consent interface or by contacting [email protected]. Withdrawal does not necessarily allow us to retrieve information that was previously transformed into a dataset that is no longer reasonably linkable to you. We will honor any broader deletion or withdrawal rights required by applicable law.

6.6 Publication

Research findings may be published or presented only in a form intended not to identify individual users, unless you have separately provided legally valid authorization for an identified use.

7. How We May Disclose Information

We may disclose information in the following circumstances:

8. We Do Not Sell Identifiable Health Data

PeptoRat does not sell identifiable consumer health data for money. If a future activity would constitute a “sale” or “sharing” under an applicable privacy law, we will provide the notices, choices, consent, or authorization required before engaging in that activity.

9. Advertising and Analytics

We will not use identifiable health records for targeted advertising. If PeptoRat uses analytics technologies, we will configure and govern them with attention to health-data sensitivity and applicable consent requirements. We will not knowingly transmit sensitive health-record contents to advertising platforms for behavioral advertising.

10. Data Retention

We retain personal information for as long as reasonably necessary to provide the Services, maintain security, comply with legal obligations, resolve disputes, enforce agreements, and fulfill disclosed purposes. Retention periods may vary by data type.

When you delete your account, we remove your personal information from our active systems immediately. A copy may remain in encrypted backups for up to 30 days, after which it is purged as part of our normal backup rotation; we do not restore a deleted account from backup.

When information is no longer needed for another reason, we may delete, aggregate, or de-identify it, subject to legal, backup, fraud-prevention, and security requirements.

11. Security

We use reasonable safeguards designed to protect personal information, which may include encryption in transit, access controls, authentication safeguards, logging, least-privilege access, secure development practices, and vendor controls. No system can guarantee absolute security.

If an incident triggers a legal breach-notification obligation, we will provide notifications as required by applicable law.

12. Your Privacy Choices and Rights

Depending on where you live, you may have rights to request access, correction, deletion, portability, confirmation of processing, a list of certain recipients, withdrawal of consent, or an appeal of a denied privacy request. Some laws also provide rights concerning sale, sharing, targeted advertising, profiling, or sensitive data.

You may submit a privacy request to [email protected]. We may need to verify your identity before completing a request. We will not unlawfully discriminate against you for exercising applicable privacy rights.

12.1 EU/EEA Users — Legal Basis for Processing (GDPR)

If you are located in the European Economic Area, we process your personal information under one or more of the following legal bases:

In addition to the rights described above, EU/EEA users have the right to lodge a complaint with their local data protection supervisory authority.

13. Washington Consumer Health Data

For consumers covered by the Washington My Health My Data Act, PeptoRat will provide the disclosures and controls required by that law, including applicable information about categories of consumer health data collected, purposes, sources, sharing, recipients, withdrawal, deletion, and other consumer rights. Where required, consent to share consumer health data will be separate and distinct from consent to collect it.

If PeptoRat is subject to the Act, a separate Consumer Health Data Privacy Policy should be made available through a prominent, distinct link on the PeptoRat website or applicable homepage.

14. California and Other U.S. State Privacy Rights (CCPA and Similar State Laws)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to:

Residents of other states may have additional, similar privacy rights under applicable state law. Where legally required, PeptoRat will provide supplemental state notices and mechanisms concerning access, correction, deletion, portability, sensitive personal information, targeted advertising, sale or sharing, profiling, appeals, and recognized universal opt-out signals.

If we offer a financial incentive or a material difference in price or service related to personal-information practices, we will provide any notice and choice required by applicable law.

15. Minors

PeptoRat is not intended for individuals under 18, and we do not knowingly collect personal information from individuals under 18. If we learn that an individual under 18 has created an account or provided personal information, we may terminate the account and delete associated personal information as required or permitted by law.

16. International Users

PeptoRat is operated by a U.S. company. If you access the Services from outside the United States, information may be processed in the United States or other countries where our service providers operate. Additional notices, transfer mechanisms, or rights may apply depending on your jurisdiction.

17. Third-Party Links and Integrations

Third-party services have their own privacy practices. This Policy does not govern a third party’s independent collection or use of information. Review the privacy terms of any third-party service before connecting or sharing information with it.

18. Changes to This Privacy Policy

We may update this Privacy Policy as our Services, practices, or legal obligations change. We will post the revised Policy and update the Last Updated date. If a change materially affects how we use sensitive or consumer health data, we will provide additional notice or obtain consent where required.

19. Contact Us

Privacy questions, research-consent withdrawals, and privacy-rights requests may be sent to:

PeptoRat Privacy Team
Black Rat Holdings LLC
30 N Gould St Ste N
Sheridan, Sheridan County, WY 82801
United States
Email: [email protected]

20. Recommended In-App Research Consent Screen

This sample is included as implementation guidance and should be shown separately from the Terms and Privacy Policy when research participation is offered:

Help Improve Research

PeptoRat would like your permission to use eligible information from your PeptoRat records to create de-identified data for research, statistical analysis, safety and trend analysis, and improvement of PeptoRat.

Before eligible data enters the research dataset, PeptoRat uses measures designed to remove direct identifiers and reduce the likelihood that the information can reasonably be linked back to you. We do not provide researchers direct access to your identifiable PeptoRat health records through this program.

Participation is optional. You can decline and continue using the features available under your plan. You may withdraw consent for future research use from Privacy / Research Settings.

[ ] I agree to contribute eligible de-identified data for the research purposes described above.

[Not Now] [Agree]

21. Implementation Notes Before Launch