Privacy Policy

Last updated: October 25, 2026

1. Current Stage 1 operation: no participant health data collected

The Open Peptide Project is launching in two stages:

  • Stage 1 (Active now): Public access to our Evidence Library, Testing Standard, Batch Test Results, and published Study Protocol (v1.1). We do not currently operate any participant enrollment forms, account sign-ups, or health surveys on openpeptideproject.org, and we do not collect, store, or process any personal health or medical information.
  • Stage 2 (After independent legal & ethics review): Prospective observational registry enrollment will open only after our protocol and electronic informed consent complete legal and IRB review. Before any participant logs a single data point, our full study privacy notice and electronic informed consent will be presented prior to enrollment.

2. Website browsing & technical logs

You can browse the entire Evidence Library, Testing Standard, and Study Protocol without creating an account or submitting personal information. Our website is hosted on Cloudflare Pages. When you visit a page, Cloudflare processes standard, minimal technical request metadata (such as IP address, browser user-agent, and requested URL) transiently to deliver the page, prevent automated abuse, and maintain site security. We do not sell, rent, or trade visitor data, and we do not run third-party behavioral advertising pixels on our pages.

3. How participant data will be protected in Stage 2 (Protocol v1.1)

As detailed in Section 12 of Study Protocol v1.1, when prospective registry enrollment opens:

  • Pseudonymous study records: Each enrolled participant is assigned a random pseudonymous study ID (OPPR-XXXXXX). Contact details used for check-in reminders or safety follow-up are stored in an encrypted, access-controlled table isolated from survey and outcome logs.
  • Photo metadata stripping: When participants upload a vial label photo to verify a batch number, all EXIF and GPS location metadata are automatically stripped on intake before storage, and images demonstrating visible personal identifiers are rejected or cropped.
  • De-identification & cell suppression: Public datasets and analytical summaries are de-identified under the HIPAA Safe Harbor standard (18 identifiers removed; ages converted to 5-year bands; dates converted to relative study day Day 0, Day +1) and apply minimum cell-size suppression (k = 5) so rare combinations of compounds or demographics cannot identify an individual.
  • Right to withdraw: Participants may withdraw from prospective follow-up and request deletion of their contact record and unpublished individual study logs at any time.

4. Updates to this policy

Whenever we update this Privacy Policy—including when Stage 2 registry enrollment or supporter payment processing is activated—we will update this page and record the revision date at the top.