Cookie and Tracking Technologies Notice

Cookie and Tracking Technologies Notice

Effective date: [EFFECTIVE DATE] | Version: [VERSION] | Last updated: [LAST UPDATED]

1. What this notice covers

This notice covers wellpeps.com, the WellPeps marketing website. It explains the cookies and similar technologies the site uses, who sets them and what choices you have. It does not cover the Practice or the pharmacies. Section 3.5 covers portal.wellpeps.com, which our technology platform provider runs for us.

Read it with the Privacy Policy, the Consumer Health Data Privacy Policy and Your Privacy Choices. The Practice’s Notice of Privacy Practices covers protected health information.

2. What these technologies are

A website can store small pieces of information on your device or load code from other companies. We call these “cookies and similar technologies.” They include:

• Cookies: small text files your browser stores for a website.
• Local storage and similar: other places a site can save data in your browser.
• Pixels, tags and SDKs: small pieces of code that send information about your visit to a company, often an analytics or advertising company.
• Session replay and heatmaps: tools that record or recreate what you do on a page, such as clicks, scrolling and typing.
• Fingerprinting: working out who you are from your device settings without a cookie.

We group them into three kinds. Strictly necessary tools make the site work or keep it secure, and do not need your consent. Analytics tools count and study visits. Advertising tools measure ads or show ads to people who visited a site. Analytics and advertising tools need your consent first.

3. What wellpeps.com uses today

3.1 Cookies

The wp_gate cookie holds a code that shows the preview password was entered. It holds no information about you [VERIFY: the value is a code derived from the preview password, the same for every visitor]. The wp_consent cookie holds your choices and a random ID, and nothing else about you. Because both are strictly necessary, we do not ask for consent to set them. If the preview password page is removed, wellpeps.com will set only wp_consent, and only if you make a choice [VERIFY: gate status at publication].

3.2 Requests to other companies

Our text fonts (Inter and Lora) are served from wellpeps.com itself, so loading them does not contact any other company.

3.3 Other technologies on wellpeps.com

• Web server logs. Like most websites, our web server records your IP address, browser, the page requested and the time. We use it for security and troubleshooting and keep it for [30 days] [VERIFY: log retention and where logs are stored].
• AI assistant. The assistant on wellpeps.com runs in your browser. It makes no network request and does not store what you type in your browser or send it to us or to an AI company [VERIFY: engineering to confirm]. It does not give medical advice (see the AI Use Disclosure).
• Forms. The sign-up forms send what you type only when you submit them, to the server in Section 3.2.

3.4 What we do not use today

• Analytics tools.
• Advertising, retargeting or conversion pixels.
• Social media plug-ins or share buttons that load code from another company.
• Session replay, screen recording, heatmaps or form-field capture.
• Device fingerprinting or cross-site tracking.
• Location tracking or location fences.
• Third-party chat widgets.

3.5 Health assessment, checkout and patient portal (portal.wellpeps.com)

The health assessment, intake forms, checkout and patient portal run on portal.wellpeps.com. Our technology platform provider operates that site for us. It uses cookies and similar tools to keep you signed in, protect your session and run its tools.

[VERIFY: complete inventory of every cookie, script and SDK on portal.wellpeps.com and its checkout and intake pages, listed here by name, who sets it, purpose and duration. Do not publish this section until the list exists and confirms that nothing on the portal is an analytics or advertising tool, or lists each one that is.]

4. Our consent-first rule

Today we set only essential cookies, so there is no cookie banner. A banner will appear when we add our first tool that needs your consent. This is how we will run wellpeps.com and how we will change it:

1. Nothing that is not essential loads before you say yes. That covers analytics, advertising, social media and measurement tools, and any data sent from our servers to such a company.
2. A fair choice. We show “Accept,” “Reject” and “Choose” with equal weight. Rejecting is as easy as accepting. No box is checked in advance. We do not nag.
3. We remember your choice for [12 months] so we do not keep asking. You can change it at any time in Your Privacy Choices.
4. Global Privacy Control. Before we turn on any tool that is not essential, we will build and test handling for Global Privacy Control, and treat the signal as a “no” to advertising, sale and sharing.
5. Listed first. A tool is added only after this notice lists it: its name, who provides it, what it does, what it collects, and how long it lasts.
6. Contracts. Where the tool allows it, we sign terms that stop the provider from using the data for its own purposes.
7. Review. We keep a list of every tool on our pages and review it at least every [3 months] [VERIFY: owner and schedule].

5. Pages that could reveal your health

Some pages could show that you have, or are looking into, a health condition or treatment. On these pages we will not use advertising tools. We will not use analytics tools either, unless you have also given the separate consent that the Consumer Health Data Privacy Policy describes. We will never use session replay on them. These pages are [DECISION: sell/share: counsel to confirm the list]:

• the Weight Loss, Hair Restoration, Sexual Wellness and Healthy Aging program pages and every treatment page or product card;
• Learning Center articles about conditions or treatments;
• free guide pages and their sign-up dialogs, and waitlist and program-notice forms;
• the AI assistant;
• the health assessment link, and everything on portal.wellpeps.com.

No session replay. We do not use session replay, screen recording, click or scroll heatmaps that capture text, or form-field capture, on any page of wellpeps.com or portal.wellpeps.com. These tools can record what you type or see, including health information. We would have to change this notice and ask for your consent before using one anywhere [DECISION: counsel to confirm the absolute rule].

6. Your choices

• Your Privacy Choices. Use the link in the footer of every page. Today there is no tool to switch off, so the page explains your other choices. When we add any non-essential tool, it will have a working control for each category.
• Browser settings. You can block or delete cookies in your browser. If you delete wp_gate, the site will ask for the preview password again. Blocking essential cookies may stop parts of a site from working.
• Global Privacy Control. You can turn on this setting in some browsers, or add it with a browser extension. See Your Privacy Choices for how we treat it.
• Do Not Track. There is no common standard for it. Because wellpeps.com does not track you across other sites, it does not change what the site does today.

7. Records of your choices

When the consent control is live, we will keep a record of each choice: the date and time, the version of this notice you saw, what you chose, and whether a Global Privacy Control signal was present. We keep it for [24 months] to show what you chose [DECISION: counsel: whether the record stores IP addresses]. See Section 7 of the Privacy Policy.

8. Changes and contact

We will post any change here and update the “Last updated” date. We will not add any tool that is not essential until this notice lists it and the consent control works.

Questions: email [PRIVACY EMAIL]. To use a privacy right, see Your Privacy Choices and the Privacy Policy.

9. Tools we use only if you opt in

The tools below load only after you choose “Accept” or switch on the matching category in Your Privacy Choices. They do not load on the pages in Section 5 unless that section says otherwise. You can switch them off at any time.

9.1 Analytics

9.2 Advertising and measurement

Advertising tools may involve a “sale” of personal information or “sharing” for cross-context behavioral advertising under some state laws. See Section 5.2 of the Privacy Policy. You can opt out at any time in Your Privacy Choices or with a Global Privacy Control signal. We do not send health information, order information or anything from portal.wellpeps.com to these companies, we do not upload our email lists to them, and we do not build lookalike audiences from sign-ups [DECISION: sell/share].

Technical and drafting notes

Held wording and when it takes effect