PepBear Privacy Policy

Updated October 9, 2026. Prepared launch policy; publication pending. PepStar LLC operates PepBear. Contact [email protected] for privacy questions.

Information you provide

PepBear processes account email and authentication information, your profile, manually entered existing plans, scheduled and recorded activity, optional injection-site records, inventory, check-ins, symptoms, measurements, and messages or review replies you submit. Do not put information about another person in your records without permission.

Health connections

If you explicitly grant access, PepBear imports supported health measurements to display dated observations and coverage. Apple Health access follows your device permissions. Connected vendor access depends on availability and authorization; you may disconnect it. Server-side connection credentials are restricted to the service, not exposed to coaches or public client queries. We do not claim these credentials are encrypted with a separate application encryption key.

Coaching and private records

Coach access requires your explicit accepted relationship and consent to the described weekly categories. A bounded weekly summary can include scheduled and recorded activity, skipped or uncertain records, check-in coverage, weight, symptom records and measurement coverage. Your coach can send a reviewed action; you can reply. Generic access to your full health profile, old chats, photos and private journal is not granted by accepting an invitation. Coach private notes are for that coach; client-facing reviewed actions and your replies are shared within the accepted relationship. Revoking sharing prevents future relationship access, subject to records already seen or legitimately retained by your coach.

Assistant and service providers

The launch Assistant uses curated educational records and deterministic responses. It does not send your message or health records to an inference provider to generate these responses. Older versions used different processing; existing historical records may remain until deleted. Authentication, database, storage and server functions use Supabase infrastructure. Apple and any vendor you connect process information under their own terms. We do not make unsupported guarantees about a provider's training, retention or security practices.

Commerce and advertising

PepBear health records are not sold or used to target affiliate offers or advertising. The website may contain clearly disclosed sponsored merchant links. Following a link takes you to that merchant, whose privacy policy applies. Native education has no purchase links. Affiliate commissions do not imply clinical endorsement.

Retention and deletion

We retain account records while needed to provide the service, unless you delete them or request deletion. In-app account deletion starts a scoped, resumable deletion of PepBear records and supported connected resources. A failed step may require retry; the interface must not describe an incomplete deletion as complete. Shared PepStar authentication may remain if used by another PepStar application. Provider-side data, backups, legal retention and records independently retained by your coach may not disappear immediately. Contact [email protected] if a deletion cannot finish.

Your choices and security

You may decline health permissions, disconnect sources, revoke coach sharing, correct records and request deletion. PepBear applies authentication, ownership restrictions and bounded sharing controls; no system can promise absolute security. Authentication passwords, if used, are processed by the authentication provider rather than stored as plaintext in the application database. Public educational browsing requires no PepBear account.

Children and changes

PepBear is not directed to children. A store age rating is not a medical-use approval. We will update this policy when processing changes and show the revision date. This policy does not replace a clinician's advice or a connected provider's terms.