Privacy Policy

The Services are operated by HealthyMango™ LLC, a limited liability company. For the purposes of European, United Kingdom, and applicable U.S. state privacy laws, HealthyMango is the controller of the personal information collected through the Services and is the business responsible for the practices described in this Policy. Contact details for privacy questions and requests are provided at the end of this Policy.

This Policy applies to the healthymango.org website, its subdomains, and the Healthy Mango newsletter. It applies to visitors to the Services, to individuals who subscribe to a newsletter or educational update, and to individuals who otherwise interact with us through the contact channels published on the Services. It does not apply to any other product, service, or property operated by HealthyMango.

We collect personal information in the following categories. The specific pieces of information collected in any given interaction depend on what you choose to submit and on how you interact with the Services.

Information you provide directly

• Newsletter contact information: your email address and your preferred language (English or Spanish) when you subscribe to the Healthy Mango newsletter through a signup form on the Services.
• Communications you send us: the content of any email, correction, comment, or other communication you send to one of our published contact addresses (for example support@healthymango.org, privacy@healthymango.org, legal@healthymango.org, or marketing@healthymango.org), together with the sender address and any information you choose to include.
• Information submitted through future features: if we introduce accounts, surveys, sign-up forms for specific programmes, or other features that collect personal information, we will describe the categories collected either in an updated version of this Policy or in a supplemental notice presented at the point of collection.

Information collected automatically

• Infrastructure and access logs generated by our hosting provider: the Services are hosted on Vercel, and Vercel records infrastructure-level information about requests made to the Services. That information may include your IP address, the URL you requested (which on the Services identifies the compound, safety topic, or other educational page you viewed), your browser user-agent string, the HTTP method and status code, the referring URL, timestamps, and security or diagnostic signals such as request identifiers and rate-limit indicators. HealthyMango is the party responsible for personal information contained in those logs even though Vercel writes them, and HealthyMango uses the logs, in conjunction with Vercel, for security, abuse prevention, capacity planning, and diagnostic purposes. The specific retention period for these logs is governed by Vercel's platform configuration and may change; we do not represent a fixed retention period here.
• Language routing signals: the Services read a small number of request-level signals (for example the referring URL and a language header set by our own routing logic) to serve the correct language version of a page. These signals are used at page-render time and are not stored by us beyond the ordinary log activity described above.
• Locally stored preferences on your device: the Services store a small number of preference values in your browser's localStorage on your device. These currently include the list of compounds you have marked as favourites (which by their nature may reveal your interest in specific compounds) and your preferred library view (grid or list). These values are stored on your device and are not transmitted to HealthyMango by the Services; they can be cleared by you at any time through your browser's site-data controls.

Information we do NOT currently collect

As of the effective date of this Policy, the Services do not currently run any third-party web analytics service (for example Google Analytics, Plausible, Fathom, Vercel Analytics, or PostHog), do not set any advertising or marketing tracking pixels, do not run any error-tracking software development kit (for example Sentry), do not set any first-party or third-party cookies through the Services, do not present a cookie consent banner (because no cookies are currently set), and do not embed any third-party media, chat widget, or captcha service that would collect personal information about you. This inventory describes current practice; it is not a permanent commitment. If we introduce any such technology in the future, we will update this Policy and, where required by law, provide the corresponding notice, choices, or consent mechanism before that technology is active.

We use the personal information described above for the following purposes, and for other reasonably related and reasonably expected purposes that are compatible with them:

• Delivering and improving the Services, including serving the correct language version of a page, remembering your local preferences on your device, providing you with the content you requested, and maintaining the operation, security, and reliability of the Services.
• Sending the Healthy Mango newsletter, educational updates, notifications about new or updated articles, occasional readership surveys, promotions, sponsored educational content, partner communications, and other marketing communications, in each case to the email address you submitted through the newsletter form and until you unsubscribe.
• Responding to messages you send to us, resolving requests you make, and following up on editorial corrections, factual queries, or legal notices.
• Understanding how the Services are used at an aggregate level, informing editorial and product decisions, and (if and when analytics are introduced) measuring readership, engagement, and translation quality.
• Complying with applicable law, responding to lawful requests from public authorities, exercising or defending our legal rights, and protecting our rights, property, and safety and those of our users and the public.
• Preventing, detecting, and investigating fraud, abuse, spam, security incidents, and other conduct that is unlawful or that violates our Terms of Use.

HealthyMango reserves the right, subject to applicable law and the choices described in this Policy, to expand the ways in which we use, disclose, share, license, or sell eligible categories of personal information. Reserved future uses may include, without limitation, personalising the Services based on inferred interests, delivering advertising on or through the Services, participating in targeted advertising or cross-context behavioural advertising, sharing eligible personal information with advertising, analytics, marketing, commercial, or data partners where permitted by applicable law, building audience segments, measuring campaign performance, and integrating first-party or third-party analytics.

We may disclose, share, license, or sell eligible categories of personal information to advertising, analytics, marketing, commercial, or data partners where permitted by applicable law. Depending on your jurisdiction, some of these activities may legally constitute a "sale," a "sharing," or the processing of personal information for "targeted advertising" (or the analogous concept in your jurisdiction). Before we introduce any of these activities, and before any category of personal information is used, disclosed, shared, or sold for such a purpose, we will (a) update this Policy to describe the activity, (b) present any notice, choice, opt-out, or consent mechanism required by applicable law, and (c) honour any preference you have previously expressed to the extent required by law. Until an activity is disclosed here as active, it is not active.

We may disclose personal information in the categories and for the purposes described below.

• Service providers and processors: we may disclose personal information to third-party vendors that process personal information on our behalf and under our written instructions, such as our hosting provider (Vercel), our newsletter and email-service provider (Resend), any future transactional email provider, security and fraud-prevention provider, and any future analytics or infrastructure provider. Where required by applicable law we enter into data-processing terms with these vendors that restrict how they may use the information.
• Advertising, analytics, marketing, commercial, and data partners: we may disclose, share, license, or sell eligible categories of personal information to advertising, analytics, marketing, commercial, or data partners where permitted by applicable law and, where required, subject to your consent, opt-out, or other choice. Any such activity will be described in this Policy at the time it becomes active and will be accompanied by the state-law choices described below.
• Corporate transactions: if HealthyMango, the Healthy Mango brand, the Services, or a substantial portion of the assets that support them is involved in a merger, acquisition, financing, reorganisation, sale of assets, bankruptcy, or similar transaction or proceeding, personal information may be transferred to, or accessed by, the counterparty and its advisers as part of that transaction, subject to customary confidentiality obligations and to the terms of this Policy.
• Legal, safety, and rights: we may disclose personal information when we believe in good faith that disclosure is required or permitted by law, that it is necessary to comply with a subpoena, court order, regulatory demand, or other legal process, that it is necessary to enforce our Terms of Use or any other applicable agreement, that it is necessary to protect the rights, property, or safety of HealthyMango, our users, or the public, or that it is necessary to detect, prevent, or address fraud, security, or technical issues.
• Aggregated or de-identified information: we may create and disclose aggregated, anonymised, or de-identified information that cannot reasonably be used to identify you. We will not attempt to re-identify de-identified information except as permitted by law.

Certain U.S. state privacy laws define the terms "sale," "sharing," and "targeted advertising" (or use analogous terms such as "cross-context behavioural advertising") broadly enough to cover activities that a reader may not usually think of as commercial sales. Under those definitions, a website may be treated as "selling" or "sharing" personal information whenever it discloses personal information to a third party for valuable consideration or for the purpose of delivering advertising based on activity across different websites.

As of the effective date of this Policy, HealthyMango does not currently sell or share personal information for cross-context behavioural advertising, and does not currently process personal information for targeted advertising, in either the ordinary or the state-law sense of those terms. HealthyMango reserves the right to begin any such activity in the future subject to applicable law. HealthyMango will not begin any activity that would legally constitute a sale of personal information, a sharing of personal information for cross-context behavioural advertising, or the processing of personal information for targeted advertising until it has, at a minimum, (a) updated this Policy to describe the activity, (b) implemented and published a "Your Privacy Choices" or equivalent opt-out link accessible from the Services, (c) implemented server-side handling of the Global Privacy Control ("GPC") and other universal opt-out signals recognised by the applicable state law, (d) implemented the sensitive-personal-information and consumer-health-data limitations required by the applicable state law (including any separate consent or authorisation required), and (e) presented any notice or obtained any consent required by applicable law. The "Your Privacy Choices" opt-out link and the server-side GPC handling described above do not yet exist on the Services; they will be implemented before any activity requiring them is begun.

As of the effective date of this Policy, the Services do not set any cookies through your browser. No first-party or third-party cookies are set, no consent banner is presented, and no cookie preference centre is offered, because none is required for the current version of the Services.

The Services do store a small number of preference values in your browser's localStorage on your device. localStorage is a browser-provided storage area that persists across visits until you or your browser clears it. The values currently stored are (i) the list of compounds you have marked as favourites and (ii) your preferred library view (grid or list). These values are stored on your device, are not transmitted to us, are not associated with an identifier of you or your device, and can be cleared by you at any time through your browser's site-data controls (typically found under "Settings," "Privacy," or "Clear browsing data" in your browser).

If we introduce cookies, pixels, tags, software development kits, fingerprinting, or similar tracking technologies in the future, we will update this Policy to describe them, and where required by applicable law we will present a cookie notice, a preference centre, and any consent mechanism required by the law of your jurisdiction before those technologies become active. Any cookie preference centre, when introduced, will honour recognised browser-level and platform-level opt-out signals to the extent required by law.

If you subscribe to the Healthy Mango newsletter, you consent to receive email communications from us. Those communications may include: the periodic Healthy Mango newsletter; announcements of new or updated articles, compound pages, safety topics, or educational features; occasional readership surveys; promotions and offers; sponsored educational content; communications from or on behalf of our commercial or editorial partners; and other marketing communications reasonably related to the Services.

Every marketing email we send will include a functional unsubscribe link. You may unsubscribe from marketing communications at any time by clicking that link. You may also request to be removed from marketing communications by writing to privacy@healthymango.org. Unsubscribing from marketing communications will not affect our ability to send you transactional or administrative communications that are necessary for the operation of the Services (for example a reply to a message you sent us, or a notice of a material change to this Policy).

When you submit the newsletter form, the server-side action validates your email address and creates or updates a contact record in Resend (Resend.com), the email-service provider we use to store newsletter subscribers and, in the future, to send the newsletter. The contact record stored in Resend consists of the submitted email address, its subscription status, and its membership in exactly one of two language-specific mailing segments in Resend — an English segment or a Spanish segment — matching the language you selected on the form. The language you select therefore determines which segment your contact belongs to, so that any future Healthy Mango newsletter can be sent to you in the language you chose. If you submit the form again with the other language selected, we update your contact's segment accordingly: your contact is added to the newly selected language segment before being removed from the other, and after the update your contact belongs to exactly the language segment you last selected. Resend processes the submitted email address and this segment membership on our behalf as our service provider, under a data-processing arrangement offered by Resend. In addition to the record stored in Resend, the server writes a redacted subscription event to its standard-output log recording (i) the email-address domain, (ii) an outcome flag such as "created" or "already subscribed", (iii) an adapter identifier, and (iv) the language you selected; the local part of the address and the Resend segment identifiers are not logged. Because our hosting provider (Vercel) captures server standard output, those redacted event fields may appear in platform-level infrastructure logs subject to the retention and access practices of that provider. You may unsubscribe at any time as described above; unsubscribing sets your contact in Resend to unsubscribed status so that we do not send you further marketing communications, subject to the operational and legal retention considerations described elsewhere in this Policy.

The Contact page includes a form you may use to send us questions, editorial corrections, citation queries, technical reports, media inquiries, or general feedback. When you submit the form we collect the name you provide, the email address you provide, the inquiry topic you select from a predefined list, and the message you type. We use that information to review your inquiry and to reply to you.

Contact-form submissions are transmitted by email using Resend (Resend.com), the same email-service provider we use for the newsletter. For this workflow Resend acts as a service provider that carries the message on our behalf — no contact record is created in Resend's Contacts database, no membership in any Resend segment is added, and submitting the contact form does NOT subscribe you to the Healthy Mango newsletter or to any marketing communication. The message is delivered from a healthymango.org sender address to support@healthymango.org, with the email address you provided placed in the reply-to field so we can respond to you directly.

The delivered message is retained in the operator's support mailbox for as long as is reasonably necessary to review and respond to it and to keep an editorial record of any correction it flags, consistent with the retention practices for other communications you send to our published contact addresses. Server-side logs of the submission event contain only the email-address domain, the inquiry topic, an outcome flag, and an adapter identifier — the name, the local part of the email address, and the message body are not written to standard-output logs. If you prefer, you may bypass the form and email support@healthymango.org directly.

As of the effective date of this Policy, we do not use any third-party web-analytics or audience-measurement service on the Services. We reserve the right to introduce first-party or third-party analytics, audience-measurement, performance-monitoring, error-tracking, or A/B-testing tools in the future in order to understand how the Services are used, to inform editorial and product decisions, and to improve the reader experience. If we do so, we will update this Policy to identify the provider or providers, to describe the categories of information they process, and to describe the choices you have with respect to that processing.

Healthy Mango publishes educational information about peptides and research compounds. We are not a healthcare provider, we do not diagnose, and we are not a covered entity or business associate under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") for the general educational content on this site. Nevertheless, we recognise that certain laws in your jurisdiction (for example the Washington My Health My Data Act, the Nevada consumer health data law, and analogous state laws) define "consumer health data" broadly, and that some of the information described in "Personal information we collect" above may fall within those definitions when linked or reasonably linkable to an identified or identifiable consumer.

Consistent with that broader legal definition, we take the following position on consumer health data:

• The Services do not currently ask you to submit diagnoses, medical records, clinical laboratory results, treatment histories, insurance claims, or individualised health profiles, and we do not currently maintain any such records.
• Certain data generated by ordinary use of a health-focused website — for example the URLs of the compound or safety pages you view, search terms you type into our search feature, the referring URL that brought you here, your IP address and device signals, and interaction history over time — could be treated as consumer health data under some state laws if it is linked or reasonably linkable to you and identifies or supports an inference about your health status. Some of this data is stored only by our hosting provider (Vercel) as infrastructure logs, some is stored only on your device (localStorage favourites and view preference), the submitted email address is stored by our email-service provider (Resend) as a newsletter contact record when you submit the newsletter form, and a redacted subscription event (email-address domain, outcome flag, adapter identifier) is written to server standard output.
• HealthyMango does not currently use any of that data to construct individualised health profiles, to infer a specific reader's diagnosis or medical condition, to share consumer health data with a third party for advertising or data-broker purposes, or to sell consumer health data.
• Before HealthyMango introduces any feature or processing activity that requires consumer-health-data consent, authorisation, or a separate consumer-health-data notice under the applicable law (including the Washington My Health My Data Act), HealthyMango will implement the required notice, consent, and authorisation mechanisms and will update this Policy accordingly.

HealthyMango will not sell consumer health data of Washington residents, or of residents of any other state whose law prohibits or restricts such a sale, in violation of that law. Nothing in the "Reserved uses and future commercial flexibility" section of this Policy authorises the unrestricted sale of consumer health data.

We retain personal information for as long as reasonably necessary to fulfil the purposes for which it was collected and to comply with our legal obligations, resolve disputes, and enforce our agreements. Because the current implementation of the Services collects very little personal information, the retention picture today is straightforward: platform-level infrastructure and access logs are retained according to the retention schedule configured on our hosting provider (Vercel), which may change over time and for which we do not represent a fixed period here; newsletter contact records are retained in Resend for as long as the address remains subscribed, with retention subject to Resend's own retention and account-deletion practices, and unsubscribed addresses are marked accordingly rather than deleted so we do not accidentally re-add them from a future signup; the derived event fields written to server standard output (email-address domain, outcome flag, adapter identifier) are retained only within the platform infrastructure logs described above; communications you send to our published contact addresses are retained for as long as reasonably necessary to respond to and follow up on your communication and to keep an editorial record of any correction you have flagged.

When we introduce features that generate longer-lived personal information (for example a mailing list, an account system, or an integrated analytics platform), the retention schedules for those data sets will be described in an updated version of this Policy or in a supplemental notice.

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorised access, disclosure, alteration, and destruction. Those safeguards include serving the Services exclusively over HTTPS, restricting access to production systems on a need-to-know basis, hosting the Services on a reputable cloud platform, and maintaining a minimal collection surface (see the categories described above).

No method of transmission over the Internet or of electronic storage is completely secure, and we cannot guarantee the absolute security of personal information. You are responsible for taking reasonable steps to protect the personal information you share with us, including keeping your own email account and devices secure.

HealthyMango is based in the United States. Personal information collected through the Services is processed in the United States and may be processed in any other country in which HealthyMango or its service providers maintain infrastructure. Laws in the United States and in other countries where we process personal information may differ from the laws of your jurisdiction and may afford different or lesser protection than the laws of your jurisdiction.

If you access the Services from outside the United States, you understand and consent to your personal information being transferred to and processed in the United States and in other jurisdictions where we or our service providers operate. Where required by applicable law we implement appropriate transfer mechanisms (for example the European Commission's Standard Contractual Clauses or their United Kingdom equivalent) with respect to any personal information subject to the General Data Protection Regulation or an analogous framework.

The Services are intended for adults aged 18 or older and are not directed to children. We do not knowingly collect personal information from children under the age of 13, and we do not knowingly collect personal information from anyone under the age of 18 through features that would require age-gating under applicable law. If you believe that a child under 13 has submitted personal information to us, please contact privacy@healthymango.org and we will delete that information promptly.

Depending on your jurisdiction of residence, you may have the following rights with respect to personal information we hold about you. Some of these rights apply generally; others are conferred by specific U.S. state privacy laws or by non-U.S. privacy frameworks (for example the European Union General Data Protection Regulation). Where a right applies to you, you may exercise it as described in the "How to exercise your rights" section below.

• Right to know: request that we disclose the categories of personal information we have collected about you, the categories of sources from which the information was collected, the business or commercial purposes for which the information was collected, the categories of third parties with whom we have disclosed the information, and the specific pieces of personal information we hold about you.
• Right to access: request a copy of the personal information we hold about you.
• Right to correct: request that we correct inaccurate personal information we hold about you.
• Right to delete: request that we delete personal information we hold about you, subject to permitted legal exceptions.
• Right to portability: request that we provide the personal information you have provided to us in a structured, commonly used, machine-readable format, and (where technically feasible) that we transmit it to another controller of your choice.
• Right to opt out of sale, sharing, or targeted advertising: to the extent we sell personal information, share personal information for cross-context behavioural advertising, or process personal information for targeted advertising, request that we stop doing so with respect to your personal information. As explained above, we do not engage in these activities as of the effective date of this Policy.
• Right to limit use of sensitive personal information: to the extent applicable, request that we limit the use or disclosure of sensitive personal information (as that term is defined in the applicable law) to purposes that are necessary to provide the Services.
• Right to opt out of profiling that produces legal or similarly significant effects: to the extent we engage in such profiling, opt out of it.
• Right to withdraw consent: where we rely on your consent to process personal information, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
• Right to non-discrimination: exercise of any of these rights will not result in denial of the Services, differential pricing, or a reduction in the quality of the Services except as expressly permitted by law.
• Right to appeal: in certain U.S. states, if we deny your request in whole or in part, you have the right to appeal our decision by contacting privacy@healthymango.org. Our appeal response will explain the outcome and, where required, provide the contact information for the applicable state attorney general.

You may exercise the rights described above by sending a request to privacy@healthymango.org. Please include enough information for us to reasonably verify your identity (typically the email address you have submitted through the Services, together with a description of the request and any information required by the applicable law) and, if you are submitting the request through an authorised agent, sufficient information for us to verify the agent's authority to act on your behalf.

We will acknowledge receipt of a rights request within the time frame required by the applicable law and will respond substantively within the time frame required by the applicable law (typically 45 days from receipt of a verifiable request, extendable once by an additional 45 days where reasonably necessary). We do not charge a fee for responding to a verifiable rights request unless the request is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or decline to act as permitted by law.

This section supplements the disclosures above for residents of specific U.S. states. Except where a state law provides otherwise, the rights described in the "Your rights and choices" section apply.

California

This subsection is provided pursuant to the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively "CCPA"). In the preceding twelve months, we have collected the categories of personal information described in "Personal information we collect" above, from the sources described in that section, for the purposes described in "How we use personal information" and "How we disclose personal information." We have not sold personal information, we have not shared personal information for cross-context behavioural advertising, and we do not process sensitive personal information for purposes other than providing the Services. If any of these categories or activities change, we will update this Policy. California residents may exercise their CCPA rights (to know, to access, to correct, to delete, to opt out of sale or sharing, to limit sensitive personal information, to non-discrimination, and to appeal) as described in "How to exercise your rights." We will verify your identity in a manner reasonably designed to confirm that the request is being made by, or on behalf of, the individual to whom the information relates.

Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Jersey, Tennessee, and other comprehensive state laws

Residents of states with a comprehensive consumer privacy law have the rights described in the "Your rights and choices" section to the extent conferred by their state's law. This includes the right to opt out of targeted advertising and the sale of personal information to the extent we engage in those activities, the right to opt out of certain profiling, and (in several states) the right to appeal an adverse decision on a rights request. Where the applicable state law requires that we recognise a universal opt-out mechanism such as the Global Privacy Control, we will honour that mechanism to the extent required by law once we introduce any activity to which such a mechanism could apply.

Washington My Health My Data Act

This subsection is provided to Washington residents pursuant to the Washington My Health My Data Act ("MHMDA"). We do not collect, share, or sell consumer health data as defined by MHMDA in a manner that requires specific consumer health data consent or authorisation today. If we introduce features that would collect consumer health data (for example, features that infer or record a Washington resident's specific health interests), we will present the required MHMDA consent notice, obtain the required consent before collection, and will not sell such data without the separate authorisation required by MHMDA. Washington residents may contact privacy@healthymango.org with questions or requests concerning consumer health data.

Nevada

Nevada residents have a right to submit a verified request directing us not to make certain sales of covered personal information about them. As described elsewhere in this Policy, we do not sell personal information as of the effective date of this Policy. Nevada residents may nevertheless submit an opt-out request to privacy@healthymango.org, and we will honour it if we introduce any activity that would be within scope of the Nevada statute.

If you access the Services from the European Economic Area, the United Kingdom, or Switzerland, this section provides the additional notices required by the General Data Protection Regulation and the United Kingdom General Data Protection Regulation. HealthyMango is the controller of the personal information collected through the Services.

We process personal information on the following legal bases: with your consent (for example when you subscribe to the newsletter or, in the future, when you accept a cookie category that requires consent); in the performance of a contract with you or in order to take steps at your request prior to entering into a contract (for example when we respond to a request you have sent us); for our legitimate interests in operating, securing, and improving the Services (for example when our hosting provider records access logs), where those interests are not overridden by your rights and interests; and to comply with a legal obligation.

You have the rights of access, rectification, erasure, restriction of processing, objection to processing, portability, and, where processing is based on consent, withdrawal of consent (without affecting the lawfulness of processing prior to withdrawal). You have the right to lodge a complaint with your national data protection supervisory authority. Requests may be sent to privacy@healthymango.org.

We may update this Privacy Policy to reflect changes in the Services, in our data-collection practices, in applicable law, or in our operating context. The date at the top of the Policy shows when it was last updated. If we make a material change, we will provide additional notice in a manner reasonably designed to bring the change to your attention (for example a prominent notice on the Services, or an email to newsletter subscribers). Your continued use of the Services after the effective date of a change constitutes acknowledgement of the updated Policy to the extent permitted by applicable law.

For any question about this Privacy Policy, any request to exercise a right described in it, or any comment on our privacy practices, please contact us using the addresses provided at the end of this document. We aim to respond to privacy inquiries within the time frame required by the applicable law and, where no specific time frame applies, within a reasonable time.