Privacy Policy

Introduction

Vael is a brand operated by Wellness MD Group PC DBA PeRx ("Vael," "we," "us," or "our"), which operates the website located at vaelrx.com and related services (collectively, the "Platform"). We provide provider-supervised peptide therapy services through licensed telehealth providers.

This Privacy Policy describes how we collect, use, disclose, and protect your personal information, including health information, when you use our Platform. By using Vael, you agree to the collection and use of information in accordance with this policy.

Information We Collect

Personal Information

When you create an account or use our services, we may collect:

• Full name
• Email address
• Date of birth
• Biological sex
• Phone number
• Shipping address
• Payment information (processed securely by our payment provider)

Health Information

To provide personalized peptide therapy recommendations, we collect health-related information including:

• Health assessment responses (medical history, current conditions, symptoms, lifestyle factors)
• Health domain scores and Vael wellness scores
• Injection logs and treatment tracking data
• Monthly check-in responses and progress notes

Usage Information

We automatically collect certain information when you use our Platform, including:

• IP address and approximate location
• Browser type and operating system
• Pages viewed and features used
• Device information

How We Use Your Information

We use your information to:

• Facilitate telehealth consultations with licensed providers
• Process prescriptions and deliver peptide therapy products
• Generate personalized health assessments and wellness scores
• Provide monthly check-ins to track your progress
• Process payments and fulfill orders
• Communicate with you about your treatment, orders, and account
• Improve our Platform, services, and user experience
• Comply with legal and regulatory requirements

Affiliated Brands & Shared Platform

Vael and PeRx are brands operated by the same company, Wellness MD Group PC, on a shared technology platform. Information you provide to Vael is processed in the same systems and by the same service providers that support our other brands. We may use it to provide, support, and improve services across the brands we operate. Because these brands share a single operator and platform, this does not constitute a sale or transfer of your information to an unrelated third party.

How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

Telehealth Provider

Your health information is shared with Decoda Health, our telehealth provider partner, to facilitate medical consultations, provider evaluations, and prescription services. Decoda Health operates under its own privacy policy and is responsible for maintaining the confidentiality of your medical records in accordance with applicable law.

Service Providers

We work with trusted third-party service providers who assist us in operating our Platform:

• Supabase— Database hosting and user authentication
• Vercel— Website hosting and delivery
• Rainforest— Payment processing
• Sentry— Error monitoring and application stability (personal identifiers such as email and IP address are scrubbed before transmission)
• Omnisend— Email marketing and transactional communications (email address and name are shared to deliver order updates and, with your consent, promotional content; you may unsubscribe from marketing emails at any time)
• PostHog— Product analytics and session replay (anonymous page-view, navigation, and session replay data are collected to understand user behavior and improve the experience; no personal health information is transmitted and form inputs are masked in recordings)
• Vercel Analytics— Anonymous web performance analytics (page load times, visitor counts; no personal identifiers transmitted)

These providers are contractually obligated to protect your information and may only use it to perform services on our behalf.

Legal Requirements

We may disclose your information if required by law, subpoena, court order, or government request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your personal information. These include encrypted data transmission (TLS/SSL), secure database storage with row-level security policies, authenticated API access, and rate limiting to prevent abuse.

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Cookies & Tracking Technologies

We use cookies, local storage, and similar technologies to operate our Platform and improve your experience. These include:

• Essential cookies— Required for authentication, session management, and security. These cannot be disabled without breaking core Platform functionality (e.g., Supabase authentication tokens).
• Analytics cookies— We use PostHog to collect anonymous page-view, navigation, and session replay data to understand how users interact with our Platform and improve the experience. Session recordings capture page interactions (clicks, scrolls, page content) but mask form inputs. No personal health information is transmitted to PostHog. You may opt out of analytics collection at any time on our Do Not Sell or Share page (see the section below).
• Marketing cookies— With your consent, Omnisend may place cookies and tracking pixels to measure email campaign performance and deliver relevant content. You can opt out of marketing communications at any time through your Profile settings or by clicking the unsubscribe link in any marketing email.

Most web browsers allow you to control cookies through their settings. Disabling certain cookies may limit your ability to use some features of the Platform.

Data Retention

We retain your personal and health information for as long as your account is active or as needed to provide you with our services. We may also retain certain information as required by law or for legitimate business purposes, such as resolving disputes or enforcing our agreements.

If you wish to delete your account and associated data, please contact us at the address below. Certain information may be retained as required by applicable healthcare record retention laws.

Your Rights

Depending on your state of residence, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Opt out of certain data processing activities
• Receive a copy of your data in a portable format

To exercise any of these rights, please contact us using the information provided below. We will respond to your request within the timeframe required by applicable law.

California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we collect, the right to delete your information, and the right to opt out of the sale or sharing of personal information.

We do not sell your personal information for monetary consideration, and we do not share it with third parties for cross-context behavioral advertising. We use first-party product analytics (PostHog) to understand how the Platform is used and to improve it. You may opt out of analytics and session-replay collection at any time on our Do Not Sell or Share page (see the section below).

Children's Privacy

Our Platform is not intended for individuals under the age of 21. We do not knowingly collect personal information from anyone under 21 years of age. If we learn that we have collected information from a minor, we will take steps to delete that information promptly.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting the updated policy on our Platform with a revised "Last updated" date. Your continued use of the Platform after any changes constitutes acceptance of the updated policy.

Do Not Sell or Share My Personal Information

To opt out of analytics tracking and the sharing of your personal information, visit our Do Not Sell or Share page.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: