Scope and responsibility
PEPMAX LLC (PepMax) provides this notice for personal information it handles through pepmax.com and its nonclinical account, purchase, and support services. Contact support@pepmax.com or PEPMAX LLC, 1925 Lovering Avenue, Wilmington, DE 19806, US.
Clinical intake is completed directly through MDI Medical Group PC's clinical platform. The Medical Group, Providers, and dispensing pharmacies maintain their own clinical or dispensing records and provide their own privacy notices. Information subject to the Health Insurance Portability and Accountability Act (HIPAA) is handled according to the applicable entity's obligations. This notice does not replace those notices or claim that every interaction with PepMax is protected by HIPAA.
PepMax may receive administrative, order, prescription-status, and fulfillment information needed to coordinate requested services. If you voluntarily provide health information in a support message, that information is also sensitive even though the message is outside clinical intake. Our separate Consumer Health Data Privacy Policy addresses health-related information within its scope.
Information and sources
Information you provide may include name, age or date of birth, email, telephone number, billing and delivery addresses, account credentials, treatment interests, purchases, communications, and communication choices. Avoid sending complete medical records through ordinary support email; use the clinical channel for clinical information.
Our third-party payment providers process card details, authorizations, charges, fraud checks, and refunds. PepMax may receive transaction identifiers, payment status, billing and verification details, card brand, and limited card information such as the last four digits. Where you separately authorize a saved payment method, a payment provider may retain it or a secure token for future purchases. Saving a payment method does not authorize automatic renewal. Do not send a full card number or card security code to support by email, text, or chat.
The Medical Group and pharmacies may provide information necessary for coordination, such as intake or consultation status, prescription/order identifiers, authorized treatment details where needed, pharmacy routing, fulfillment, shipment, and delivery information. Carriers and service providers may supply delivery, verification, security, and transaction information.
When you visit the site, it may generate IP addresses, browser and device details, timestamps, referring pages, pages requested, approximate location, and security logs. Cookies or similar storage may support login, shopping, preferences, and fraud prevention. Any optional analytics or advertising collection must be described in an updated notice and consent controls where required before being activated.
Purposes
We use information to operate accounts, verify identity and location, process requested purchases and refunds, coordinate appointments and authorized fulfillment, respond to support requests, send operational messages, protect the site, prevent fraud, maintain records, and comply with law. We may use information for service improvement and for communications you request, subject to applicable health-data restrictions and consent requirements.
We do not make medical decisions from your information. We do not use sensitive health information for targeted advertising. We do not sell personal information or disclose it for cross-context behavioral advertising under this policy. Any future change to those practices requires updated disclosures and legally required choices or consent before the change takes effect.
Recipients and limits
We disclose information as needed to the Medical Group, Providers, and licensed pharmacies, to arrange requested services; to payment, hosting, communications, security, verification, support, and delivery vendors performing authorized functions; and to authorities or other recipients where legally required or permitted. Payment providers may process transaction and device information under their own notices for payment security, fraud prevention, and legal obligations. Other vendors may process information only within their authorized roles and applicable contractual and legal restrictions.
We may disclose limited information to professional advisers or in a proposed or completed business transaction, subject to confidentiality and applicable restrictions on health data. We may also disclose information at your direction or with valid consent. We do not authorize a business successor to disregard existing privacy obligations.
Choices and requests
You may ask to access, correct, or delete information, obtain a portable copy, withdraw consent where processing depends on consent, and exercise applicable opt-out or appeal rights. Rights depend on applicable law and the information involved. Email support@pepmax.com with "Privacy Request" and describe your request. Authorized agents may submit requests subject to reasonable verification of their authority.
We verify identity proportionately and respond within applicable statutory periods. We will explain a permitted refusal and how to appeal where required. To appeal, use "Privacy Appeal" in the subject line. We will not unlawfully discriminate against you for exercising rights. You may also complain to your state attorney general or other relevant regulator. Washington health-data rights are addressed separately.
You can stop marketing email through its unsubscribe mechanism and withdraw optional messaging permission using the available instructions. Necessary security, order and legally required messages may continue where permitted. Browser controls can restrict cookies; some essential functions may be affected. We honor legally required browser-based opt-out signals, including Global Privacy Control where applicable. Standard Do Not Track signals do not themselves change essential processing.
Residents of states with applicable comprehensive privacy laws may also have rights to opt out of sale, targeted advertising, or qualifying profiling and to limit certain sensitive-data processing. We do not engage in sale or cross-context behavioral advertising under this notice or use automated profiling to make decisions producing legal or similarly significant effects. If the California Consumer Privacy Act applies, its access, deletion, correction, authorized-agent, and nondiscrimination protections apply as required. The categories and purposes above describe our collection practices.
Retention, security, and children
We retain information for the period reasonably needed for the stated purpose, accounting for ongoing service, tax and transaction records, disputes, security, and legal retention requirements. We delete or deidentify information when no longer needed, subject to lawful exceptions and required backup-deletion rules. Clinical records have separate retention obligations and should be requested from the responsible provider or pharmacy.
We use safeguards appropriate to the sensitivity and volume of information. No system can guarantee absolute security. Where a security incident triggers notification duties, we provide notices required by applicable law.
Payment details should be entered only in the secure checkout. Payment providers handle card data for processing; PepMax support does not request full card numbers or security codes. We limit payment-related information shared outside the payment flow to what is needed for billing, fraud prevention, refunds, disputes, and legal obligations. Avoid including medical history or clinical documents in payment messages; use the Medical Group's clinical channel.
The services are intended for adults 18 and older. We do not knowingly solicit children's information for enrollment. Contact support if you believe a child has provided information; we will evaluate and address it as required.
Updates
We will identify revisions by updating the effective date and provide additional notice or obtain consent where legally required. A posted revision alone does not authorize a materially different use of previously collected sensitive information when consent is required.