Privacy Policy

The information we collect depends on how you interact with Drop Protocol and which services you use.

Some of the information you choose to share with us, including laboratory results you upload and the health-related context you provide during intake and weekly check-ins, is health-related in nature. Drop Protocol & Vitality LLC is a coaching and educational service and is not a medical practice or healthcare provider; we provide coaching and education rather than medical care. We may nonetheless receive health-adjacent information and laboratory reports from clients. We handle that information as confidential client information under this Privacy Policy and the application's privacy and security practices, use it only to deliver your coaching and Personalized Protocol, and do not use it to diagnose, treat, or manage any medical condition.

The health-adjacent information we may receive from clients includes laboratory reports you upload, body metrics, exercise information, nutrition information, supplement information, sleep, recovery and stress information, physical limitations you choose to share, and limited coaching-scope acknowledgments. We collect this information only to deliver the coaching and educational services you purchase, and we handle it as confidential client information under this Privacy Policy and the safeguards described below.

Account and Contact Information

We may collect information such as:

• Name
• Email address
• Phone number
• Preferred contact method
• Account identifiers
• Authentication and account-status information
• Communications with Drop Protocol

Enrollment and Coaching Information

When you enroll in an assessment or coaching service, we may collect information reasonably necessary to provide the service, including:

• Age
• Sex used for assessment and laboratory-pathway purposes
• Height
• Current body weight
• Optional goal weight
• Goals and priorities
• Lifestyle and schedule information
• Sleep and recovery information
• Nutrition habits and dietary preferences or restrictions
• Training experience and current training practices
• Training schedule and available equipment
• Physical limitations or movement restrictions relevant to exercise programming
• Current supplement information
• Information about prior approaches or strategies you have tried
• Other information you voluntarily provide that is relevant to your coaching goals

We intentionally limit the information requested through our standard intake and do not use the portal as a medical-record system.

Weekly Coaching Information

Clients participating in ongoing coaching may submit periodic check-ins containing information such as:

• Self-reported energy rating (1 to 10)
• Self-reported sleep quality rating (1 to 10)
• Self-reported recovery rating (1 to 10)
• Self-reported stress resilience rating (1 to 10)
• Self-reported overall well-being rating (1 to 10)
• Optional self-reported joint comfort rating (1 to 10)
• Optional self-reported digestive comfort rating (1 to 10)
• Training and nutrition ratings
• The reporting week the check-in covers
• Optional body weight
• Planned and completed training sessions
• Progress, challenges, questions, and other coaching-related information

These ratings are self-reported wellness inputs used for coaching context only. They are not diagnostic measurements and are not used to diagnose, treat, or monitor any medical condition. Submitted check-ins are retained as a historical record and are not edited after submission. Coaching staff may add private internal notes to a check-in for coaching purposes; those notes are not shown in the client portal.

Body Composition Information

For clients enrolled in an assessment, reassessment, or coaching service, we may record body composition measurements in the client portal, including:

• Body weight in pounds
• Body fat percentage
• Lean mass in pounds
• Fat mass in pounds
• Waist circumference in inches
• The date of the measurement
• How the measurement was taken (for example DEXA, InBody, a body-composition scale, calipers, tape measure, or scale only)
• Where the information came from (reported by you, entered by coaching staff, or taken from a report)
• A body composition report or document associated with the measurement, when one exists
• Private internal notes added by coaching staff, which are not shown in the client portal

Body composition measurements are recorded by coaching staff; clients do not enter or edit them in the portal. Values are stored as measured. The application does not calculate body mass index and does not derive one measurement from another. If a recorded measurement is corrected, the earlier record is kept as part of your measurement history rather than being overwritten, so that measurements referenced in an earlier completed progress review remain accurate to what was on file at that time. Body composition measurements may be included in progress reviews and used for coaching discussion only; they are not diagnostic measurements and are not used to diagnose, treat, or monitor any medical condition.

Progress Reviews and Coaching Focus Information

Information maintained in connection with coaching may also include periodic progress reviews. A progress review organizes information already collected for your coaching service, such as selected laboratory results, goals, reported check-in scores, and nutrition or training records, for a defined period of time. A review may include:

• The period reviewed and the date of the review
• A written summary from your coach that is shown to you in the portal
• Optional written comments from your coach about a specific area, shown to you in the portal
• A coaching focus label your coach selects for each area included in the review
• A record of the values and information that were on file at the time the review was completed
• Private internal notes added by coaching staff to support the coaching relationship, which are not shown in the client portal

Coaching focus labels describe where your coach chooses to place emphasis for a period. They are not diagnoses, clinical classifications, or medical interpretations, and no focus label is assigned automatically by the application. Completed reviews are retained as a historical record so that earlier periods remain viewable. Private internal notes are accessible to authorized Drop Protocol administrators.

Laboratory and Biomarker Information

When laboratory information is used as part of an assessment or reassessment, we may collect or maintain:

• Laboratory provider
• Collection date
• Laboratory pathway or panel information
• Review status
• Laboratory reports uploaded by you
• Individual biomarker values and the units in which they were reported
• Laboratory reference information provided with your results
• Dates and other laboratory or panel details associated with a set of results
• Historical biomarker information from earlier results, so results can be viewed over time
• Records of corrections or clarifications made to a recorded result
• Limited client-visible review notes concerning whether baseline laboratory requirements have been met or whether additional testing is needed

Laboratory results you provide may be recorded in the client portal in an organized, itemized form so individual values can be displayed back to you, kept alongside the laboratory reference information reported with them, and shown over time as a longitudinal view. This is used to organize your information and support coaching discussions. Drop Protocol does not perform laboratory testing, does not diagnose or treat any condition based on laboratory values, does not independently verify every laboratory result, and does not replace your healthcare provider. Trends shown in the portal are informational only; they do not establish cause and effect, do not constitute medical interpretation, and no treatment decision is made automatically by the application.

Coaching tools within the portal may also display your information alongside coaching targets or reference information used in our coaching method. Those coaching targets are established by Drop Protocol for coaching purposes and are not laboratory reference ranges.

Training, Workout, and Supplement Coaching Information

If your service includes exercise programming or supplement-strategy coaching, we may maintain:

• Exercise programming prepared for you as part of your coaching service
• Supplement-strategy information maintained as part of providing the service, in addition to the supplement information you report
• Workout activity you record in the portal, such as completed workouts and exercises
• Sets, repetitions, load, duration, distance, and effort information you enter
• Completion status and related timestamps

Client-Reported Compound Information

Drop Protocol expects to make available a feature that allows a client to report peptides or other compounds the client is using, so the coach has relevant context when providing coaching services. If you choose to use that feature, we may collect the information you provide, which may include:

• The name of the compound you report
• The amount you report
• The unit associated with that amount
• The frequency you report
• A start date
• A stop date
• Whether you report that the use is directed or managed by an outside healthcare provider
• Timestamps and related record-history information showing when the entry was reported or updated

This information is client-reported. It reflects what you tell us, and it is stored so that it forms part of your coaching record, can be displayed back to you, and can be reviewed by your coach. Recording it in the portal does not mean Drop Protocol recommended, prescribed, directed, or verified the compound, its amount, its frequency, its source, its quality, or its use, and it does not mean Drop Protocol has confirmed any outside healthcare provider or prescription. Where we ask whether use is directed or managed by an outside healthcare provider, your answer is recorded as reported; we do not verify that statement, do not verify prescriptions, and do not coordinate your care with any provider.

We use this information to maintain your coaching record, display your own reported information back to you, allow your coach to review it, support coaching conversations, and keep a record of what was previously reported. We do not use it to prescribe, diagnose, treat, titrate, recommend compounds or medication, or determine administration instructions, and it does not automatically change any protocol or interpret any laboratory result.

This feature is limited to the specific information listed above. It is not a prescription-medication record, and we do not ask for prescription details, pharmacy or manufacturer information, product identifiers, provider names, or diagnoses through it. Compound information you report is maintained within our own application infrastructure and is not included in payment processing, laboratory-ordering, email notification, or analytics data flows.

Documents

The client portal may contain documents associated with your services, including:

• Personalized protocols
• Calorie and macronutrient targets
• Exercise programming
• Coaching documents
• Laboratory reports uploaded by you
• Other documents associated with your assessment or coaching services

Payment and Transaction Information

We maintain information necessary to administer payments and services, which may include:

• Payment status
• Transaction amount
• Transaction date
• Service purchased
• Payment-provider identifiers
• Subscription or coaching-cycle status
• Limited payment references submitted for manually verified payment methods

Payment-card information is processed by Stripe. Drop Protocol does not store full payment-card numbers or card security codes in its application.

Technical and Security Information

Our technology providers may process information associated with operation and security of the service, including:

• IP address
• Browser and device information
• Login and authentication events
• Timestamps
• Application activity
• Security events
• Document-access events
• Error and diagnostic information

Drop Protocol follows a data-minimization approach and seeks to collect information reasonably necessary to provide its services.

Our standard client intake does not request detailed:

• Medical diagnoses
• Medication lists
• Surgical history
• Family medical history

We may ask whether you are currently receiving medical care or taking prescription medication where that context is relevant to determining whether you should consult your licensed healthcare professional before making changes to wellness practices.

Clients should not use general coaching fields to submit unnecessary detailed medical records.

Where a purpose-built feature exists for a specific kind of information, such as the client-reported compound feature described above, that feature collects only the specific items identified in this Privacy Policy. The availability of such a feature does not change the limits on general-purpose intake and coaching fields, and clients still should not submit diagnoses, detailed medical records, prescription documents, provider records, or unnecessary medical narratives through unrelated general fields.

We may use information collected through Drop Protocol to:

• Create and maintain your account
• Process enrollment
• Provide purchased services
• Conduct biomarker-informed assessments
• Develop personalized coaching strategies
• Establish calorie and macronutrient targets
• Develop exercise programming
• Review and discuss supplement strategy
• Organize laboratory results and display them over time within the portal
• Maintain workout records you enter in the portal
• Maintain and review information you choose to report about compounds you are using
• Provide lifestyle and recovery coaching
• Review laboratory documentation within the scope of our services
• Deliver protocol and coaching documents
• Conduct weekly coaching check-ins
• Track progress through coaching cycles
• Administer billing and payments
• Determine service eligibility and access
• Communicate with you
• Respond to support requests
• Maintain application security
• Detect or prevent fraud or misuse
• Maintain business, accounting, and transaction records
• Comply with applicable legal obligations
• Establish, exercise, or defend legal claims

We do not use laboratory information to provide medical diagnoses or prescribe medical treatment.

• Drop Protocol may recommend Goodlabs as a convenient independent laboratory-testing pathway.
• Goodlabs is an independent third-party service.
• Laboratory testing is ordered and purchased separately from Drop Protocol services.
• When you follow a link from Drop Protocol to Goodlabs, your interaction with Goodlabs, including laboratory ordering, payment, specimen collection, testing, results delivery, and information submitted directly to Goodlabs, is governed by Goodlabs' own terms and privacy practices.
• Drop Protocol does not currently maintain an automated API integration with Goodlabs and does not automatically retrieve your Goodlabs laboratory results.
• If you choose to provide laboratory results to Drop Protocol, you do so by securely uploading or otherwise submitting those results through the available Drop Protocol workflow.
• You may also submit qualifying laboratory results obtained through another legitimate laboratory provider.

Credit and debit card payments are processed through Stripe.

Stripe may collect and process information necessary to:

• Process transactions
• Authenticate payments
• Prevent fraud
• Manage recurring billing
• Maintain payment methods
• Provide billing services

Drop Protocol receives transaction and payment-status information necessary to administer your services but does not store your complete payment-card credentials.

Your use of Stripe payment services may also be subject to Stripe's applicable privacy terms.

We use third-party service providers to operate portions of our website, client portal, authentication, database, file storage, payment processing, and related infrastructure.

These providers may process information on our behalf as necessary to provide their services.

Current material technology/service providers include infrastructure associated with:

• Lovable. Used in connection with development, hosting, deployment, and operation of the Drop Protocol application.
• Supabase. Used within the application's backend infrastructure for functions that may include database services, authentication, and private file storage.
• Stripe. Used for payment processing, billing, subscriptions, and payment-method management.
• Goodlabs. An independent third-party laboratory-testing platform that clients may choose to use. Goodlabs is not integrated with the Drop Protocol database for automatic transfer of laboratory results.

We may also use other vendors reasonably necessary to operate, secure, maintain, communicate about, or support our services.

We do not authorize service providers to use client information for purposes unrelated to providing their applicable services except as permitted by their agreements with us or required by law.

We do not sell client laboratory reports or coaching information.

We may disclose information:

• To service providers that support our operations
• To payment processors for transactions and fraud prevention
• At your direction or with your authorization
• When reasonably necessary to protect the security or integrity of our services
• To investigate fraud, abuse, or unlawful activity
• To comply with applicable law, regulation, subpoena, court order, or other lawful process
• To establish, exercise, or defend legal claims
• In connection with a merger, acquisition, financing, sale, reorganization, or transfer of all or part of the business, subject to applicable law

We use administrative and technical safeguards designed to protect information within our control.

The client portal uses authenticated access controls, and client documents and laboratory reports are maintained using private storage rather than intentionally public file locations.

Access controls are designed so clients can access their own information while authorized administrative users can access information necessary to provide and administer services.

Document-access activity may be logged for security and accountability purposes.

No electronic system can be guaranteed to be completely secure. Accordingly, we cannot guarantee absolute security of information.

You are responsible for maintaining the confidentiality of your account credentials and should notify us if you believe your account has been compromised.

We retain information for as long as reasonably necessary for providing our services, maintaining client records, legitimate business purposes, accounting and financial-record requirements, dispute resolution, security, enforcing our agreements, and complying with applicable legal obligations.

Retention is currently managed operationally rather than through an automated deletion schedule. We do not currently operate an automated process that deletes records after a fixed period, and we do not claim one.

In practice, different categories of information are treated differently:

• Records that may be eligible for deletion on request, such as certain intake, check-in, and uploaded document content no longer needed to deliver services
• Records reasonably retained for service and business purposes, such as client account, service-history, and coaching records
• Financial and payment records, retained as reasonably necessary for accounting, tax, and financial-recordkeeping purposes
• Agreement and consent records, retained as evidence of the agreements and acknowledgments a client accepted, and of the version accepted
• Security and access records, retained as reasonably necessary for security, accountability, and abuse prevention
• Records required or reasonably necessary for legal, compliance, or dispute-resolution purposes

For certain coaching records, updating information does not necessarily erase what was recorded before. Where a record is meaningful as a history, including client-reported compound information and recorded laboratory results, a copy of what was previously reported may be kept alongside the current version. This allows us to maintain continuity of your coaching record, understand what information was reported at a particular time, and preserve the integrity of coaching records. Editing an entry should therefore not be assumed to delete the previously reported information.

Certain records may need to be retained even after a deletion request, where reasonably necessary or legally required.

When information is deleted from active systems, residual copies may remain temporarily in backups or other systems until overwritten or deleted through ordinary retention processes.

You may contact Drop Protocol to request:

• Access to certain personal information associated with your account
• Correction of inaccurate information
• A copy of applicable information associated with your account
• Deletion of eligible information

Drop Protocol does not currently provide self-service deletion of an entire client account through the portal.

Requests are handled manually.

We may need to verify your identity before completing a request.

Certain information may need to be retained despite a deletion request where reasonably necessary or permitted by law, including information associated with:

• Completed transactions
• Accounting or tax records
• Fraud prevention
• Security
• Contractual obligations
• Disputes
• Legal claims
• Legal or regulatory requirements

We may also deny or limit requests where permitted by applicable law.

Clients may be able to download certain documents made available through the client portal, including personalized protocol documents and other coaching materials.

The availability of individual document downloads does not constitute a complete export of all information associated with an account.

Clients may contact Drop Protocol to request a broader copy of applicable account information.

The website and underlying technology providers may use cookies, local storage, or similar technologies necessary for:

• Authentication
• Session management
• Security
• Application functionality
• User preferences
• Performance and diagnostics

If optional analytics, advertising, or other non-essential tracking technologies are introduced in the future, this Privacy Policy and any required consent mechanisms should be updated before those technologies are activated.

Drop Protocol services are not intended to be knowingly provided to children through the standard client enrollment process.

If we learn that information has been collected from a person who is not legally eligible to use the service, we may take appropriate steps to delete or restrict that information.

The website and client portal may contain links to third-party services.

Drop Protocol is not responsible for the privacy practices, security, content, or policies of independent third parties.

You should review the applicable policies of a third-party service before providing information directly to that service.

We may update this Privacy Policy from time to time to reflect changes to our services, technology, business practices, or legal requirements.

When we make changes, we will update the "Last Updated" date.

Where required by applicable law, we may provide additional notice regarding material changes.

For privacy-related questions or requests, contact:

Drop Protocol & Vitality LLC

Email: contact@dropvitality.com