PRIVACY POLICY
EFFECTIVE DATE: 9 October 2026 DATA CONTROLLER: Optimizer Health Limited trading as Optimizer Peptides
1. INTRODUCTION AND DATA CONTROLLER
1.1 Optimizer Health Limited ("we", "us", "our", or the "Company") is committed to protecting and respecting your personal data in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 ("DPA 2018").
1.2 For the purpose of UK data protection law, Optimizer Health Limited is the Data Controller in respect of personal data collected via optimizerpeptides.com (the "Site"), our waitlist forms, customer account systems, and commercial communications.
1.3 Our Contact Details:
- Legal Entity:
Optimizer Health Limited - Registered Office:
6 Queens Road, Marlow, England, SL7 2PX - Data Protection Enquiries Email:
dpo@optimizerpeptides.comorcompliance@optimizerpeptides.com - ICO Registration number: 00015910504 (UK data protection fee registration completed; board-confirmed on OPTAAA-158, 2026-10-16 / 2026-10-20). You may contact the ICO at ico.org.uk or helpline 0303 123 1113.
2. PERSONAL DATA WE COLLECT
We collect and process the following categories of personal data:
2.1 Waitlist and Research Access Data:
- Contact details: Email address, full name, organization/institution name, job title, research interest area.
- Consent & attestation records: Timestamp, IP address, age-gate confirmation (18+), research-use-only attestation.
2.2 Order and Transaction Data (when commerce enabled):
- Commercial contact details: Billing name, delivery address, phone number, business email address.
- Order records: Product SKUs, quantity, transaction reference, tax/VAT identifier, delivery tracking numbers.
- Financial details: Masked payment tokens (payment card numbers and bank details are processed securely by PCI-DSS compliant third-party payment gateways; we do not store full payment card numbers).
2.3 Account and Communications Data:
- Login credentials (hashed passwords), user preferences, account communication logs, customer support queries, survey responses.
2.4 Technical and Usage Data:
- IP address, browser type and version, time zone setting, browser plug-in types, operating system, device identifiers, page access logs, clickstream data, and age-gate passage flags.
3. PURPOSES AND LAWFUL BASES FOR PROCESSING
Under UK GDPR Article 6, we process your personal data under the following lawful bases:
| Processing Activity | Categories of Personal Data | Lawful Basis (UK GDPR Art. 6) |
|---|---|---|
| Waitlist Registration & Research Access | Email, name, institution, attestation log | Consent (Art. 6(1)(a)) / Legitimate Interests (Art. 6(1)(f) - managing B2B research launch) |
| Order Processing & Contract Fulfillment | Billing/delivery name, address, payment details, order SKUs | Contract Performance (Art. 6(1)(b)) |
| Age Verification & Compliance Logging | IP address, timestamp, age attestation record | Legal Obligation (Art. 6(1)(c) - compliance with trade/age controls) / Legitimate Interests |
| Customer Service & Technical Support | Contact details, query text, transaction history | Contract Performance (Art. 6(1)(b)) / Legitimate Interests |
| Direct Electronic Marketing (Updates/Promotions) | Email address, research preferences | Consent (Art. 6(1)(a)) or PECR Soft Opt-In for existing B2B customers |
| Accounting, VAT & Statutory Recordkeeping | Invoices, transaction records, tax numbers | Legal Obligation (Art. 6(1)(c) - UK tax & company law) |
| Website Security, Fraud Prevention & Analytics | Technical data, IP logs, session data | Legitimate Interests (Art. 6(1)(f) - protecting IT systems & auditing Site traffic) |
4. ABSOLUTE PROHIBITION ON HEALTH / MEDICAL DATA
4.1 No Medical Data Processed. Optimizer Peptides supplies materials strictly for laboratory research. We do not provide clinical care, therapeutic advice, or consumer health services. We do not intentionally collect or process Special Category Personal Data (such as medical history, health conditions, or treatment plans under UK GDPR Article 9).
4.2 Unsolicited Health Enquiries. If a user submits personal health or medical information (e.g., asking for dosing or self-treatment advice), we will immediately delete the enquiry, refuse service, and advise the user that our materials are strictly non-medicinal.
5. SHARING AND THIRD-PARTY PROCESSORS
We do not sell, rent, or trade your personal data to third parties. We share personal data only with trusted third-party service providers acting as Data Processors under strict data processing agreements:
- Hosting & Infrastructure: Google Cloud Platform / Firebase (data hosting, database management, waitlist processing).
- Payment Gateways: PCI-DSS certified payment processors (e.g., Stripe, bank merchant providers).
- Shipping & Logistics: UK post and courier services (e.g., Royal Mail, DHL, DPD) for order dispatch.
- Email & CRM Services: Automated transactional and compliance email infrastructure (e.g., SendGrid, Mailchimp, or equivalent).
- Professional Advisers & Authorities: Legal counsel, accountants, auditors, or regulatory/law enforcement bodies (where legally required by court order or statute).
6. INTERNATIONAL DATA TRANSFERS
6.1 Where personal data is transferred outside the United Kingdom or European Economic Area (EEA) (e.g., to cloud hosting infrastructure located in the United States), we ensure appropriate safeguards are implemented in accordance with UK GDPR Chapter V, including:
(a) Standard Contractual Clauses (SCCs) combined with the UK International Data Transfer Addendum (UK Addendum); or
(b) Binding Corporate Rules or adequacy decisions recognized by the UK Secretary of State and ICO.
7. DATA RETENTION SCHEDULES
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:
| Category of Data | Retention Period | Rationale |
|---|---|---|
| Waitlist Data (No Purchase) | 24 months from registration or until consent withdrawn / unsubscribe | B2B launch notification cycle |
| Order & Financial Records | 6 years from the end of the relevant financial tax year | UK Companies Act & HMRC statutory requirement |
| Customer Account Data | Duration of active account + 2 years post-inactivity | Customer account maintenance & dispute defense |
| Technical & Age-Gate Logs | 12 months from log creation | Security audit & compliance evidence |
| Marketing Consent Logs | Duration of active marketing consent + 6 years | Evidencing PECR/GDPR compliance |
8. YOUR DATA PROTECTION RIGHTS
Under UK data protection law, you have the following rights in relation to your personal data:
- Right of Access (Article 15): The right to request a copy of the personal data we hold about you.
- Right to Rectification (Article 16): The right to request correction of inaccurate or incomplete data.
- Right to Erasure / "Right to be Forgotten" (Article 17): The right to request deletion of your data where no overriding legal basis exists.
- Right to Restrict Processing (Article 18): The right to restrict processing under certain conditions.
- Right to Data Portability (Article 20): The right to receive your data in a structured, machine-readable format.
- Right to Object (Article 21): The right to object to processing based on legitimate interests or direct marketing.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting prior lawful processing.
Exercising Your Rights: To exercise any right, please contact us at dpo@optimizerpeptides.com. We respond to all valid requests within one calendar month.
Right to Complain to the ICO: You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe your data has been handled unlawfully. Website: ico.org.uk | Helpline: 0303 123 1113.