Notice of Privacy Practices
Effective: April 16, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Who We Are
pepti LLC, doing business as [pepti] (“we,” “us,” “our”), operates a telehealth platform connecting patients with independent licensed healthcare providers and FDA-registered compounding pharmacies. We are a HIPAA-covered entity and we are committed to protecting the privacy of your Protected Health Information (“PHI”).
Our Commitment
We are required by law to:
- Maintain the privacy and security of your PHI
- Provide you with this Notice describing our legal duties and privacy practices
- Notify you in the event of a breach of your unsecured PHI
- Follow the terms of this Notice currently in effect
How We Use and Disclose Your PHI
We may use and disclose your PHI for the following purposes without additional authorization:
Treatment
We share your PHI with the licensed healthcare provider you are matched with, the compounding pharmacy that fills your prescription, and clinical staff who help coordinate your care. For example, your intake answers, medical history, prescriptions, and uploaded documents are shared with your assigned physician so they can evaluate and treat you.
Payment
We use your information to process payments for the services you receive, including charging the payment method you authorize and producing receipts. We share limited PHI with our payment processor (Stripe) under a HIPAA-compliant Business Associate Agreement.
Healthcare Operations
We use your PHI for activities that support our operations, including quality improvement, audit, customer support, training, credentialing of our physicians, and improving our services. We never use your PHI for marketing without your prior written authorization.
Required by Law
We will disclose your PHI when required to do so by federal, state, or local law, including in response to court orders, subpoenas, public health reporting obligations, and law enforcement requests where legally required.
Other Disclosures
We may also disclose your PHI:
- To business associates who perform services on our behalf (each is bound by a HIPAA-compliant Business Associate Agreement)
- To public health authorities for disease prevention or to report adverse events to the FDA (e.g., MedWatch)
- To organ procurement organizations (in the rare event applicable)
- For research purposes only with your authorization or where authorized by law
- To avert a serious threat to health or safety
- For workers' compensation claims, where authorized by law
Uses That Require Your Authorization
The following uses and disclosures will be made only with your written authorization:
- Marketing communications (other than face-to-face or promotional gifts of nominal value)
- Sale of PHI (we never sell PHI)
- Most uses of psychotherapy notes
- Other uses not described in this Notice
You may revoke any authorization at any time, in writing, except to the extent we have already acted in reliance on it.
Your Rights
You have the following rights regarding your PHI. To exercise any of these rights, email privacy@hellopepti.com:
Right to Access
You may request to inspect and obtain a copy of your PHI. We will respond within 30 days. We may charge a reasonable fee for copies.
Right to Amend
You may request that we amend your PHI if you believe it is incorrect or incomplete. We may deny your request under certain circumstances, but we will respond in writing.
Right to Request Restrictions
You may request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree, except where you pay out of pocket in full for a service and request that we not disclose information about that service to your health insurer.
Right to Confidential Communications
You may request that we communicate with you in a specific way (e.g., by mail rather than email) or to a specific address. We will accommodate reasonable requests.
Right to an Accounting of Disclosures
You may request a list of certain disclosures we have made of your PHI in the past six years (excluding disclosures for treatment, payment, healthcare operations, and certain others permitted by law).
Right to a Paper Copy of This Notice
You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.
Right to File a Complaint
You may file a complaint with us by emailing privacy@hellopepti.com, or directly with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr. We will not retaliate against you for filing a complaint.
Breach Notification
In the event of a breach of your unsecured PHI, we will notify you within the timeframes required by the HIPAA Breach Notification Rule (no later than 60 days after discovery). We will also notify the Secretary of Health and Human Services and, where required, the media.
Security Safeguards
We maintain administrative, physical, and technical safeguards to protect your PHI, including:
- Encryption of PHI in transit (TLS 1.2+) and at rest
- Role-based access controls — only authorized personnel may access PHI
- An immutable audit log capturing every access, view, modification, or transmission of PHI
- Automatic session timeouts and authentication for provider/admin accounts
- Signed Business Associate Agreements with every third-party service that touches PHI
- Regular workforce training on HIPAA policies and security awareness
- Vulnerability scanning and incident response procedures
Changes to This Notice
We reserve the right to change this Notice at any time. Any changes will apply to all PHI we maintain. Updated notices will be posted on our website with an updated effective date.
Contact
For questions about this Notice or to exercise any of your rights:
Privacy Officer
pepti LLC
Email: privacy@hellopepti.com