What we collect, why we collect it, who else sees it and how long we keep it. Effective 18 September 2026.
This site is operated by NOVAPEP LTD, a company registered in England and Wales under number 17330194, registered office 463 Northolt Road, Harrow, England, HA2 8JN. For anything in this policy, including a request about your own data, write to support@novapep.co.
NOVAPEP LTD is the data controller for the personal data described below.
We collect three separate things: what an order needs in order to reach you, what you choose to tell us if you ask for a protocol, and ordinary technical data about your visit. The protocol questionnaire is the sensitive one — it asks about your health, and it is entirely optional. Blood-test files you upload are deleted automatically after ten days. We do not sell your data to anyone.
Your name, email address, phone number, and either a delivery address or the easybox you chose. We also keep what you ordered, what it cost, the discount code if you used one, and the courier's tracking number. We need this to pack the parcel, hand it to the courier, email you about it and issue an invoice. Payment is collected on delivery, so we never see or store card details.
The questionnaire records your name, email, age, sex, weight, height, your goals, what you told us about your health and any medication you are taking, whether you have recent bloodwork, your exercise, sleep and stress answers, anything you listed as a complaint, and any compound you asked about. You may also upload blood-test results as PDFs or images. All of it is optional — nothing on this site requires you to complete the questionnaire.
Your IP address, browser and device type, the pages you look at, and the language you chose. Your IP is also sent to a lookup service to work out which country you are in, so prices display in a sensible currency.
Most of the questionnaire is health data, which data-protection law treats as a special category needing stronger protection. We process it on the basis of your explicit consent, given when you submit the questionnaire, and for one purpose only: producing the protocol you asked for and answering your questions about it.
To generate the protocol, your answers are sent to Anthropic, the provider of the AI model that writes it. Your name and email are not needed for that step and are not part of what is sent. Anthropic does not use this content to train its models.
You can withdraw this consent at any time by emailing us, and we will delete your questionnaire, your uploads and your protocol.
We do not sell personal data and we do not share it for anyone else's marketing. We use these service providers, each only for what is listed:
We will also disclose data where the law requires it.
Strictly necessary storage keeps your cart, your language and your delivery choice working, and cannot be switched off. Analytics and advertising cookies are off until you turn them on — Google's tags start in a denied state and are only released if you accept. You can change your mind at any time from the cookie banner, which you can reopen from any page.
Anthropic and Google are based in the United States and Ahrefs in Singapore. Where data reaches them, the transfer relies on the European Commission's Standard Contractual Clauses and the UK addendum, together with the safeguards in each provider's own data-processing terms.
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to what we do with it, or send it to you in a portable form. Where we rely on consent, you can withdraw it at any time — that does not affect anything done before you withdrew it. Write to support@novapep.co and we will answer within one month.
If you think we have handled your data badly, you can complain to a supervisory authority: in the UK the Information Commissioner's Office (ico.org.uk), in Romania the ANSPDCP (dataprotection.ro), or the authority where you live.
This site is for adults. We do not knowingly collect data from anyone under 18, and the protocol generator refuses to produce anything for someone who tells us they are under 18.
The site is served over HTTPS. Questionnaires, uploads, orders and protocols are stored outside the public web root, and each protocol is reachable only through a long unguessable link that is emailed to you. No system is perfect, and we will tell you and the relevant authority if a breach ever puts you at risk.
If we change how we handle your data we will update this page and the date at the top. Material changes affecting data we already hold will be emailed to you where we have your address.