# DoseTempo — Privacy Policy & Notice of Privacy Practices
> **IMPORTANT:** This is a comprehensive draft prepared to support HIPAA
> compliance. It must be reviewed and finalized by a qualified healthcare
> attorney licensed in your jurisdiction before publication. Privacy laws
> vary by state; some states (e.g., California under CCPA/CPRA) impose
> additional obligations not fully addressed here.
>
> **Effective date:** October 23, 2026
> **Last updated:** October 24, 2026
> **Owner:** Privacy Officer — Aerron Retikis (aerron@domi-nation.online)
---
## Table of Contents
1. [About This Notice](#1-about-this-notice)
2. [Who We Are](#2-who-we-are)
3. [Protected Health Information We Receive](#3-protected-health-information-we-receive)
4. [How We Use and Disclose Your Health Information](#4-how-we-use-and-disclose-your-health-information)
5. [When We Share Information](#5-when-we-share-information)
6. [Your Rights Regarding Your Health Information](#6-your-rights-regarding-your-health-information)
7. [Our Responsibilities](#7-our-responsibilities)
8. [Security Safeguards](#8-security-safeguards)
9. [Data Retention](#9-data-retention)
10. [Breach Notification](#10-breach-notification)
11. [Changes to This Notice](#11-changes-to-this-notice)
12. [Complaints](#12-complaints)
13. [Contact Information](#13-contact-information)
---
## 1. About This Notice
This notice describes how DoseTempo ("we," "us," or "our") handles protected
health information (PHI) and describes the rights you have regarding your
health information and how you can exercise those rights.
### 1.1 Covered entity vs. business associate — who's who
Under HIPAA (§160.103), the roles in your care are distinct:
| Role | Who | What it means for you |
|---|---|---|
| **Covered entity** | Your prescribing practice | Owns your medical record. Responsible for your care, your treatment decisions, and most of your HIPAA rights (access, amendment, accounting of disclosures, breach notification to you). |
| **Business associate** | DoseTempo | A tool your practice uses to manage your peptide protocol. We create, receive, maintain, and transmit your PHI **on your practice's behalf** under a Business Associate Agreement (BAA). We do not provide medical advice, diagnosis, or treatment. |
| **Subcontractor** | Cloud (our managed backend) | Hosts the database, authentication, and storage on DoseTempo's behalf, bound by its own BAA with us. |
> **Your practice owns your medical record.** DoseTempo is a tool your
> practice uses to manage your peptide protocol. The practice — not
> DoseTempo — is the covered entity responsible for your care. We act on
> their behalf under a Business Associate Agreement (BAA). Most of your
> HIPAA rights are exercised **through your practice**, and we support
> them in fulfilling those obligations.
### 1.2 What DoseTempo does
DoseTempo is a software platform that helps practices that prescribe and
dispense peptides track patient-reported dose adherence and anticipate
replenishment needs. We do not provide medical advice, diagnosis, or
treatment. Your treatment relationship is with your prescribing practice —
not with DoseTempo.
---
## 2. Who We Are
| | |
|---|---|
| **Service** | DoseTempo — peptide adherence and replenishment management platform |
| **Role** | Business associate to prescribing practices (covered entities) |
| **What we do** | Provide software for dose tracking, adherence reporting, and replenishment alerts |
| **What we do not do** | Provide medical advice, diagnosis, treatment, or independent verification of dose administration |
---
## 3. Protected Health Information We Receive
When your practice enrolls you in DoseTempo, we receive the following
information about you:
### 3.1 Identifying information
- Your full name
- Date of birth
- Email address
- Phone number
### 3.2 Treatment information
- The peptide(s) you are prescribed
- Your prescribed dosing schedule (frequency, dose count, supply)
- Dose confirmation logs (when you report taking a dose)
- Injection site selections (where you report administering each dose)
- Refill status and replenishment alerts
### 3.3 Patient diary entries
- **Mood and symptom entries** — how you're feeling, any symptoms or
changes you've noticed, and responses to your injections (redness,
swelling, energy changes, etc.) that you choose to log in the in-app
diary.
- **"Flag for doctor" entries** — if you check the box to flag a diary
entry for your doctor, the entry (and any note about what you'd like to
discuss) is visible to your prescribing practice's care team, and a
**"wants to discuss" message is posted to your clinic's inbox** so your
care team is notified and can acknowledge it. The clinic can acknowledge
the message to mark it handled.
- Diary entries are **voluntary** — you choose what to write. They are
visible to you and to the clinicians at your assigned location (and, if
your practice has a business admin, to that business admin). They are
not shared with anyone else.
- Diary entries are **protected health information** and are stored
encrypted at rest, protected by Row-Level Security, and audit-logged
when created.
### 3.4 Communication
- Messages between you and your practice's staff sent through the platform
- **Announcements** from your practice's staff (general notices posted by
your location to all its patients)
- Support requests you submit to DoseTempo
- **Web push dose reminders** — a de-identified push notification (no name,
no peptide, no PHI in the body) sent to your device reminding you to
log your dose (see §3.6)
### 3.5 What we do NOT collect
- We do not collect your Social Security number.
- We do not collect financial or insurance information.
- We do not collect your home address (unless your practice enters it).
- We do not independently verify whether you actually administered a dose —
we record what you report.
### 3.6 Web push dose reminders & consent
- If you enable push notifications, DoseTempo sends up to three de-identified
notifications per scheduled dose to remind you to log it:
1. **Pre-dose reminder** — 1 hour before your scheduled dose time
2. **Due reminder** — at your scheduled dose time
3. **Post-dose reminder** — 1 hour after, only if you haven't logged your
dose yet (also sent via email as a fallback)
- **The notification body contains no protected health information** —
no patient name, no peptide name, no dose details. It is intentionally
de-identified so that if the notification is seen on your lock screen,
it reveals nothing about your treatment.
- **Push notifications are delivered over TLS** via your browser's push
service (Firebase Cloud Messaging for Chrome/Android, Apple Push
Notification service for Safari). The push service receives only the
anonymous notification body — no PHI is transmitted to the push provider.
- **Your push subscription is managed by your browser.** When you enable
notifications, your browser generates a subscription endpoint that
DoseTempo uses to send reminders. This endpoint is stored encrypted at
rest and is managed by your browser's own push infrastructure.
- **You can turn off notifications at any time** from the app or from your
device's notification settings. When you turn them off, DoseTempo asks
you to confirm, and **notifies your clinic that you've turned off
reminders** so your care team is aware. Turning them off does not affect
your ability to use the app — you'll still see your schedule when you log
in. Your clinic can filter their patient list by who has reminders on or
off.
- **On iPhone, push notifications require adding DoseTempo to your home
screen.** This is a Safari limitation. The app will guide you through
this if needed.
---
## 4. How We Use and Disclose Your Health Information
We use and disclose your PHI only as permitted by HIPAA and our Business
Associate Agreement with your practice.
### 4.1 For treatment
- To display your prescribed schedule and dose history to you.
- To report your dose confirmations and adherence to your prescribing
practice so they can manage your care.
- To share your patient diary entries (mood, symptoms, injection
responses, and items you've flagged for discussion) with your
prescribing practice's care team so they can address your concerns at
your next visit.
### 4.2 For healthcare operations
- To alert your practice when you may be approaching a peptide replenishment.
- To alert your practice when a dose may have been missed.
- To help your practice coordinate follow-up and refill management.
### 4.3 As required by your practice
- We process your practice's instructions regarding your schedule, supply,
and protocol. We act only as directed by the practice under our BAA.
### 4.4 For platform operations
- To provide, maintain, and improve the service.
- To secure the platform and detect or investigate security incidents.
- To maintain audit logs required by HIPAA and our security program.
### 4.5 As required by law
- We may disclose PHI when required by law, court order, or legal process.
- We may disclose to public health authorities as required.
- We may disclose to law enforcement as permitted by law.
### 4.6 What we do NOT do
- We do **not** sell your health information.
- We do **not** use your health information for marketing.
- We do **not** share your health information with third parties for their
own commercial purposes.
- We do **not** use your data to train artificial intelligence models or
sell derived analytics to third parties.
---
## 5. When We Share Information
### 5.1 Your prescribing practice
Your practice is the covered entity that directs how your PHI is used within
DoseTempo. They have access to your dose history, adherence, schedule, and
messages. Only staff at the location where you receive care can see your
information — staff at other locations (even within the same business)
cannot.
### 5.2 Our service providers (subcontractors)
We use a managed backend provider (Cloud) to host the database, handle
authentication, and store data. This provider is our subcontractor and is
bound by a Business Associate Agreement that requires it to safeguard PHI
under HIPAA. We do not share PHI with any other third party for processing.
### 5.3 Legal compliance
We may disclose information as required by law, regulation, or legal
process, or to investigate or respond to a security incident.
### 5.4 We do NOT share with
- Advertising networks
- Data brokers
- Social media platforms
- Analytics providers that use data for their own purposes
- Any party not bound by HIPAA or an equivalent obligation
---
## 6. Your Rights Regarding Your Health Information
Under HIPAA, you have the following rights regarding your PHI. Because
your practice is the covered entity that owns your record, most of these
rights are exercised **through your practice** — but we support your
practice in fulfilling them.
### 6.1 Right to access
You have the right to see the health information we maintain about you.
Request access through your practice. We will provide your practice with a
complete copy of your DoseTempo records (dose history, schedule, diary
entries, messages) so they can fulfill your request.
### 6.2 Right to amend
If you believe information in your DoseTempo record is incorrect, you may
request an amendment. Because your practice controls your record, submit
amendment requests to your practice. Note: you cannot edit your own
contact information (name, date of birth, email, phone) directly in the
app — if it needs to change, message your practice through the platform
and they will update it. **Your practice's staff can edit your contact
information**, and every change is tracked in a **change history** that
records what changed, who changed it, and when.
### 6.3 Right to an accounting of disclosures
You have the right to know who we have shared your PHI with (other than for
treatment, payment, or healthcare operations). Request this through your
practice. We maintain audit logs that document disclosures and will provide
an accounting covering the prior six years.
### 6.4 Right to request restrictions
You may ask your practice to restrict how your PHI is used or disclosed.
We will honor restrictions that your practice agrees to and communicates
to us in writing.
### 6.5 Right to confidential communications
You may request that we communicate with you by alternative means or at
alternative locations. For example, you may request that dose reminders be
sent to a specific email. Submit this request through your practice.
### 6.6 Right to a paper copy of this notice
You may request a paper copy of this notice at any time, at no charge.
### 6.7 Right to be informed of breaches
You have the right to be notified if your unsecured PHI is breached. Under
the HIPAA Breach Notification Rule, your practice (the covered entity) is
responsible for notifying you. DoseTempo (the business associate) notifies
your practice within **3 business days** of discovering a specified
incident and provides a complete breach report within **30 calendar days**
of discovery for confirmed reportable breaches (see §10). Your practice
then fulfills its own notification obligations to you.
---
## 7. Our Responsibilities
As the **business associate**, we are required to:
- Use and disclose PHI only as permitted by our BAA with your practice (the
covered entity) or as required by law.
- Safeguard PHI using appropriate administrative, physical, and technical
safeguards.
- **Notify your practice (the covered entity) of specified incidents within
3 business days** of discovery, and provide a complete breach report for
confirmed reportable breaches within **30 calendar days** of discovery
(see §10). Your practice — not DoseTempo — is then responsible for
notifying you if required.
- Make our records available to your practice so they can respond to your
rights requests (access, amendment, accounting of disclosures).
- Return or destroy PHI at the termination of our agreement with your
practice, if feasible, or extend the same protections if retention is
required by law.
- Maintain audit logs of access and disclosures for at least six years.
- Ensure our subcontractors (e.g., Cloud) are bound by equivalent
obligations under their own BAAs.
---
## 8. Security Safeguards
We protect your PHI with the following safeguards:
### 8.1 Access control
- No anonymous access. Every account is provisioned by an authorized
administrator.
- Each user has a unique login. Login sharing is prohibited and may result
in suspension.
- Only one active session per user at a time.
- Automatic logout after 15 minutes of inactivity.
### 8.2 Authentication
- Email and password authentication (no social login).
- **Multi-factor authentication (MFA)** required on every sign-in — a
6-digit verification code is emailed to your account and must be entered
before access is granted.
- Brute-force protection: after 3 failed login attempts, the IP address is
blocked for 24 hours.
### 8.3 Data isolation
- Your information is isolated by practice and location. A clinician at
one location cannot see patients at another location.
- Row-Level Security enforces tenant separation at the database level.
### 8.4 Encryption
- All data is encrypted **in transit** (TLS) and **at rest** (platform-
managed disk encryption).
- Secrets and credentials are stored in a secure secret manager and are
never logged, shared, or written to code.
### 8.5 Audit logging
- Every access to and action on PHI is logged with the actor, action,
timestamp, and IP address.
- Audit logs are retained for at least six years.
### 8.6 Breach detection
- Automated detection flags repeated failed authentications, IP blocks,
and unusual access patterns for review.
- Security alerts are reviewed by an administrator using a HIPAA 4-factor
risk assessment workflow.
### 8.7 Your account & security responsibilities
As a patient with a DoseTempo account, you are responsible for:
- **Keeping your password and verification code private.** Never share
them with anyone — including family members, caregivers, or anyone
claiming to be from DoseTempo or your practice. DoseTempo staff will
never ask for your password or verification code.
- **Logging in only on your own device.** Do not use a shared or public
computer to access your account. If you must, sign out completely
when finished.
- **Reporting anything unusual immediately.** If you see information
that does not belong to you, if you receive a verification code you
did not request, or if you suspect someone else has accessed your
account, contact your practice or file a support ticket marked
"URGENT — SECURITY" right away.
- **Keeping your contact information current.** If your email or phone
number changes, message your practice through the platform so they
can update your record. You cannot edit your own contact information
directly — this is by design, so your practice maintains an accurate
medical record.
### 8.8 If your account is compromised
If you suspect your account has been accessed without your authorization:
1. **Contact your practice immediately** — they can suspend your
account access to stop further unauthorized use.
2. **File a support ticket** marked "URGENT — SECURITY" through the
platform (if you can still access it) or have your practice file
one on your behalf.
3. **Change your password** as soon as you regain access, using the
"Change password" option in your "My info" settings.
4. DoseTempo will investigate the incident using audit logs and
complete a HIPAA 4-factor risk assessment to determine whether
your PHI was accessed and whether breach notification is required.
### 8.9 Account deactivation & archiving
- Your practice controls your account. If your practice **archives** you
or removes you from DoseTempo, your access to the platform ends.
- **Archived patients cannot be reactivated.** If you are archived and
later need to resume tracking, your practice must create a new patient
record for you (your email is freed for reuse when you're archived).
- Your **messages move to an archived messages inbox** in your clinic's
messages tab when you're archived — your care team can still review
them, but they're kept separate from active patient messages.
- All your records (prescriptions, dose history, diary entries, messages)
are **retained for audit and HIPAA compliance** — they are not deleted,
only hidden from the active patient list.
- You **cannot** delete your own account or your own data — only your
practice can direct changes to your record, because they are the
covered entity responsible for your medical record.
- If your practice terminates its relationship with DoseTempo, your
data is returned to the practice or destroyed at their direction
(see §9.2).
### 8.10 Web push dose reminders
- Push reminders are sent as **de-identified notifications** — the body
contains no PHI. This is a deliberate safeguard: even though a
notification can be seen on a lock screen, it reveals nothing about
your treatment.
- Push notifications are delivered over **TLS** via your browser's push
service. No PHI is transmitted to the push provider — only the
anonymous notification body.
- You can enable or disable push notifications at any time from the app
or your device settings.
- On iPhone, push notifications require adding DoseTempo to your home
screen (a Safari limitation). The app will guide you through this.
---
## 9. Data Retention
### 9.1 While your practice uses DoseTempo
We retain your PHI for as long as your practice maintains your account and
you are an active patient. Your practice determines when you are no longer
active.
### 9.2 On termination
When your practice terminates its relationship with DoseTempo:
- We will export your data and return it to your practice, or destroy it
at your practice's direction, as required by our BAA.
- If law requires us to retain certain records (e.g., audit logs), we will
extend the same protections for the retention period and destroy the data
when no longer required.
### 9.3 Audit logs
Audit logs are retained for a minimum of **six years** from the date of the
entry or the date the data is no longer needed, whichever is later.
---
## 10. Breach Notification
If we discover that unsecured PHI has been acquired, accessed, used, or
disclosed without authorization, we follow a two-tier notification timeline
when notifying the covered entities (the practices) we serve:
1. **Specified incidents — within 3 business days of discovery.** For
incidents involving a known or suspected acquisition, access, use, or
disclosure of unsecured PHI, we notify the affected practice(s) within
**3 business days** of discovery so they can begin their own
assessment and notification preparations without delay.
2. **Reportable breaches — within 30 calendar days of discovery.** For
incidents confirmed as reportable breaches under the HIPAA 4-factor
risk assessment, we provide the affected practice(s) with a complete
breach report within **30 calendar days** of discovery, including the
information they need to fulfill their own breach notification
obligations to affected individuals and, where applicable, to HHS and
the media.
3. We conduct a **HIPAA 4-factor risk assessment** for every incident to
determine whether it constitutes a reportable breach and document the
basis for that determination.
4. We document the incident, the assessment, the determination, and the
corrective actions taken, and retain those records for at least six
years.
> **Covered entity vs. business associate.** DoseTempo is the **business
> associate**; the practice is the **covered entity**. Under the HIPAA
> Breach Notification Rule (§164.410), the business associate notifies the
> covered entity; the covered entity is responsible for notifying affected
> individuals, HHS, and (for breaches affecting 500+ individuals in a
> jurisdiction) the media. The 3-business-day and 30-calendar-day timelines
> above are DoseTempo's commitments to the covered entity — they are
> shorter than HIPAA's outer regulatory limits (§164.410(b): without
> unreasonable delay and no later than 60 calendar days) so the covered
> entity has time to meet its own, shorter statutory deadlines.
Your practice — as the covered entity — is responsible for notifying
affected individuals. We support them with the information needed to do so.
---
## 11. Changes to This Notice
We reserve the right to update this notice to reflect changes in our
practices, legal requirements, or the services we provide. We will post
the current notice with its effective date. Material changes will be
communicated to your practice, who is responsible for informing you.
---
## 12. Complaints
If you believe your privacy rights have been violated, you may:
- File a complaint with your prescribing practice.
- File a complaint with the U.S. Department of Health and Human Services,
Office for Civil Rights (OCR).
**We will not retaliate against you for filing a complaint.**
---
## 13. Contact Information
For privacy questions, requests, or complaints:
- **Contact your prescribing practice first** — they are the covered
entity responsible for your care and your record.
- For platform-level privacy concerns, contact the DoseTempo Privacy
Officer — Aerron Retikis — at aerron@domi-nation.online or through the
support ticket feature in the platform.
> **OCR complaint portal:** https://ocrportal.hhs.gov/ocr/portal/landing.jsf
> **Toll-free:** 1-877-696-6775
---
## Acknowledgment
This notice is provided in accordance with the HIPAA Privacy Rule
(45 CFR Part 164, Subpart E) and the HIPAA Security Rule (45 CFR Part 164,
Subpart C). It is the official Privacy Policy and Notice of Privacy
Practices of DoseTempo, effective as of the last-updated date above.