Privacy Policy

1. Overview

Blackwell Biosciences LLC ("Company," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, store, share, and protect information we receive from users of blackwellbiolabs.com and the Blackwell BioLabs mobile application (collectively, the "Services").

By accessing or using the Services, you agree to this Privacy Policy. If you do not agree, please discontinue use of the Services.

2. Information We Collect

2.1 Information You Provide

• Account information: Email address, password (hashed), display name, authentication provider (Apple Sign In, Google, email)
• Demographic data (optional): Date of birth, biological sex, gender identity, height, weight, race/ethnicity, collected during onboarding to personalize benchmark comparisons. All fields are optional.
• Protocol configuration: Compound names, dosage amounts, dosage units, scheduling preferences, administration time anchors
• Dose logs: Date and time of each logged administration, optional notes
• Weekly health check-ins: Self-reported scores for pain levels, energy, mood, sleep quality, weight, and compound-specific symptom metrics
• Injury & body map data: Body region coordinates (normalized X/Y position on a body silhouette) and pain/mobility severity scores, used for tracking recovery
• Progress photographs: Photos you voluntarily upload for progress tracking purposes. Photos are stored in access-controlled private storage and are not used for marketing, advertising, or any external purpose
• Onboarding responses: Research goals, personal intent statement, and health objectives you enter during setup
• Communications: Emails or messages you send us

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, time spent, tap/interaction patterns (for product improvement only)
• Device information: Device type, operating system version, app version, timezone, locale
• Log data: IP addresses, error logs, crash reports, retained for up to 90 days
• Purchase data: Order history, payment method type (not full card numbers), transaction amounts, order status, collected on the website only
• Website analytics and advertising data: On the website only, we use Google Tag Manager and the Meta Pixel to measure site performance and advertising results. These tools collect page views, site interactions, and standard device and browser information. When you place an order, the conversion event shared with our advertising partners includes the order value and hashed contact identifiers used for ad measurement matching. See Section 3 for details and your choices.

2.3 Information We Do NOT Collect in the Mobile App

The following applies to the Blackwell BioLabs mobile application:

• The app does not collect precise GPS location data
• The app does not access your contacts, microphone (beyond what required SDKs include), or calendar
• The app does not include third-party advertising or behavioral tracking SDKs (no Amplitude, Firebase Analytics, Facebook SDK, AppsFlyer, etc.)
• The app does not collect biometric data or integrate with Apple HealthKit or Google Health Connect
• Your dose logs, health check-ins, body map data, and progress photographs are never shared with advertising platforms

3. Cookies & Tracking Technologies

The website uses essential cookies to operate, plus analytics and advertising tags described below. The mobile app uses no advertising or third-party analytics tools.

3.1 Essential Cookies

• Session and authentication cookies: Set by our authentication provider (NextAuth.js) to keep you logged in. Essential for the Services to function; expire when you sign out or close your browser.
• CSRF security tokens: Short-lived tokens that protect form submissions from cross-site request forgery attacks. Deleted at session end.
• Referral attribution cookie (bbl_ref): Set when you arrive via a referral or affiliate link. Stores only a referral code, no personal data. It is deleted as soon as the referral is recorded, when you create an account or place an order, and otherwise expires on its own after 30 days.

3.2 Analytics & Advertising Tags (Website Only)

• Google Tag Manager: Loads and manages the measurement tags on the website, including tags served through a first-party subdomain for reliability.
• Meta Pixel and Conversions API: Measure the performance of our advertising on Meta platforms. Purchase events include order value and hashed contact identifiers used for match quality. We do not share your browsing history beyond our own site, and the mobile app data listed in Section 2.1 is never sent to Meta or any advertising platform.
• First-party analytics: Our own page view and event logging, used to understand how the site is used and to improve it.

We do not sell your personal information, and we do not use cross-site device fingerprinting.

3.3 Managing Cookies & Opting Out

You may disable or delete cookies through your browser settings at any time, and browser tracking protections or blocking extensions will prevent the analytics and advertising tags from loading without affecting your ability to shop. Disabling essential session cookies will prevent you from logging in and using authenticated features. You can also manage how Meta uses data about you through your Meta ad preferences, and opt out of interest-based advertising generally at aboutads.info/choices. To exercise privacy rights over data we hold, contact us at [email protected].

4. How We Use Your Information

• Provide, operate, and maintain the Services
• Generate your personalized progress reports, trend charts, and insights
• Compute anonymized community benchmarks (aggregated, non-identifying comparisons)
• Send protocol reminders and milestone notifications you have authorized
• Process purchases, fulfill orders, and handle refunds (website only)
• Communicate with you about your account, orders, or the Services
• Improve, develop, and personalize the Services using usage data and, where you have not opted out, User Content under the license in our Terms of Service
• Detect, investigate, and prevent fraud, abuse, and violations of our Terms
• Comply with legal obligations

5. How We Share Your Information

We do not sell your personal information to third parties. We may share your information only in the following circumstances:

5.1 Service Providers

We share data with trusted service providers who help us operate the Services, subject to confidentiality obligations. These include:

• Hosting & infrastructure: Our Services are hosted on VPS infrastructure. Data is stored in the United States.
• Payment processing: our card payment processors handle card transaction data and billing information as required to complete your purchase; BTCPay Server (self-hosted, no data shared with third parties) is retained solely to service orders placed before card-only checkout took effect
• Email delivery: Resend (transactional email only, no marketing profiling)
• App distribution: Apple App Store and Google Play (standard distribution metadata only)
• Advertising measurement (website only): Meta receives website events described in Section 3.2, including purchase value and hashed contact identifiers, to measure and improve our advertising. Mobile app data is never included. You can opt out as described in Section 3.3.

5.2 Anonymized Aggregate Data

We may publish, share, or use de-identified aggregate data (for example, aggregated, de-identified usage trends across the app) for research, marketing, or product development. This data cannot identify you individually.

5.3 Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect our rights, your safety, or the safety of others.

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of the transaction. We will notify you via email and/or a prominent notice on the Services prior to such transfer.

6. Data Retention

• Account & profile data: Retained while your account is active and for 90 days following deletion
• Progress photographs: Deleted within 90 days of account deletion, unless retention is required by law
• Dose logs & health metrics: Retained for the life of your account; deleted within 90 days of account closure
• Anonymized aggregate data: Retained indefinitely; this data does not identify you
• Purchase records: Retained for 7 years for tax and legal compliance purposes
• Log data & crash reports: Retained for up to 90 days

7. Your Rights & Choices

• Access & correction: You may view and update your account information at any time through account settings.
• Data portability: You may request a copy of your data by emailing [email protected]. We will respond within 30 days.
• Account deletion: You may delete your account from account settings or by emailing [email protected]. We will delete your personal data within 90 days, subject to legal retention requirements.
• Opt out of data sharing: Where sharing controls are available in account settings, you may opt out of contributing your User Content to anonymized benchmarks and product improvement on a prospective basis. Note: opting out does not apply to fully anonymized aggregate data that cannot identify you.
• Push notifications: You may disable push notifications at any time via your device settings or within the app.
• Photo deletion: You may delete individual progress photos from within the app at any time.

California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information we collect, the right to delete, and the right to opt out of the sale or sharing of personal information. We do not sell personal information for money. Our use of website advertising tags (Section 3.2) may qualify as "sharing" for cross-context behavioral advertising under the CCPA; you can opt out of it at any time using the methods in Section 3.3 or by contacting [email protected].

Delaware Residents (DPDPA)

Delaware residents have rights under the Delaware Personal Data Privacy Act (Del. Code Ann. tit. 6, ch. 12A), including the right to access, correct, and delete your personal data, the right to obtain a portable copy of your data, and the right to opt out of the sale of personal data and targeted advertising. We do not sell personal data. Our website advertising tags (Section 3.2) may qualify as targeted advertising; you can opt out using the methods in Section 3.3 or by contacting [email protected].

8. Security

We implement commercially reasonable technical and organizational security measures to protect your information, including:

• TLS/HTTPS encryption for all data in transit
• Access-controlled private storage for progress photographs and sensitive health data
• Auth-gated API access: progress photos are never publicly accessible
• Passwords are hashed using industry-standard algorithms (bcrypt/Argon2)
• Regular automated database backups with 14-day retention

No method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, and your use of the Services is at your own risk.

9. Children's Privacy

The Services are not directed to individuals under the age of 21. We do not knowingly collect personal information from anyone under 21. If we become aware that we have inadvertently collected such information, we will delete it immediately. If you believe we have collected information from a minor, please contact us at [email protected].

10. Mobile App: Data Practices Summary

The following summarizes data collected by the Blackwell BioLabs mobile app:

11. Third-Party Links

The Services may contain links to third-party websites, including laboratory services and research references. We are not responsible for the privacy practices of third-party sites. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice within the Services at least 14 days before taking effect. Your continued use of the Services after the effective date constitutes acceptance.

13. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or your personal data, contact us at: