Who we are

LegitPep operates this website. Patient-facing care is delivered by independent US-licensed providers, and medications are dispensed by an independent US-licensed compounding pharmacy. For privacy questions, contact privacy@legitpep.com.

Provider information & licensure

Telehealth medical oversight and the provider network for LegitPep are coordinated through LocumTele (locumtele.org). Care is delivered by independent providers who are licensed in the US state where the patient is located. Before your consultation is completed, the name, professional credentials, and license information of your treating provider are made available to you, and these details remain accessible through your patient portal. You may verify any provider’s license, or file a complaint, with the medical board in your state.

State-specific provider disclosures. In accordance with applicable telemedicine requirements, the following public provider information is made available to patients in these states:

• Massachusetts: Patients may obtain the treating provider’s name, license type, and license number, and may verify licensure or file a complaint with the Massachusetts Board of Registration in Medicine, consistent with the Massachusetts Board of Registration in Medicine Policy 15-05 (2015), p. 7.
• Rhode Island: The treating provider identifies themselves and discloses their licensure and credentials at the outset of the telemedicine encounter, consistent with the Rhode Island Board of Medical Licensure and Discipline Telemedicine Guidelines; patients may verify licensure or file a complaint with that Board.
• Vermont: The treating provider’s identity and Vermont licensure are disclosed to the patient, consistent with the Vermont Board of Medical Practice Policy on Telemedicine; patients may verify licensure or file a complaint with the Vermont Board of Medical Practice.

What we collect

• Account info: name, email, phone, date of birth, billing & shipping address, password (hashed).
• Health information (PHI): the medical history, current medications, allergies, height, weight, and treatment goals you share during your consultation; provider notes; prescription records; dispensing records.
• Order info: medications purchased, dosages, refill schedule, payment method (full card numbers are tokenized by the payment processor and not stored on our servers).
• Site usage: standard server logs (IP, user-agent, page-views, timestamps) and cookies described below.
• Communications: messages you send via email, the contact form, or the patient portal.

HIPAA & protected health information

Your protected health information (PHI) is handled under the federal Health Insurance Portability and Accountability Act (HIPAA) where applicable. PHI includes any information that identifies you and relates to your health, treatment, or payment for treatment. PHI is shared only with the people and entities required to deliver your care: your prescribing provider, the dispensing pharmacy, and any subcontractor bound by a Business Associate Agreement (such as a hosting provider, secure-messaging vendor, or shipping carrier acting under our instruction).

You have the right under HIPAA to: receive a copy of our Notice of Privacy Practices; access and obtain a copy of your PHI; request a correction; request restrictions on certain uses; and request an accounting of disclosures. To exercise these rights, email privacy@legitpep.com.

How we use your information

To process your consultation and provide treatment, fulfill prescriptions, ship medications, send treatment reminders and order updates, provide customer support, prevent fraud, and improve the platform. We do not sell your personal or health information to third parties.

Cookies

• Functional cookies: session, cart contents, and the gate cookie (“lp_gate”) which prevents the entry confirmation modal from re-appearing for 90 days.
• Analytics cookies: aggregate, anonymized traffic data. PHI is excluded from analytics tracking.

Sharing

We share data with: your prescribing provider (to evaluate and treat you), the dispensing pharmacy (to compound and ship your medication), our payment processor (to charge cards), our shipping carrier (to deliver orders), our email service provider (for transactional emails), and law enforcement when legally required. All vendors are bound by confidentiality and data-processing agreements; vendors handling PHI are bound by Business Associate Agreements.

Retention

Pharmacy and provider records are retained for the period required by state pharmacy and medical-board law (typically 5–10 years, varying by state). Account records are retained while your account is active and for a reasonable period after closure, subject to legal retention obligations.

Your rights

You may request access to, correction of, restriction on, or deletion of your personal information (subject to legal retention requirements). You may also unsubscribe from marketing emails (transactional and treatment-related emails will continue while you have an active prescription). Email privacy@legitpep.com.

Security

We use TLS for all transmissions, encryption at rest for PHI, hashed password storage, role-based access internally, regular security audits, and breach-notification procedures consistent with HIPAA. No system is perfectly secure; we encourage strong unique passwords and two-factor authentication on your account.

Children

LegitPep is not directed at children. You must be at least 18 years old to use the site. We do not knowingly collect data from anyone under 18.

Changes

This policy may be updated periodically. The current version is always posted at this URL with the effective date above. Material changes affecting how PHI is handled will be communicated to active patients by email.