What we collect, and what we do with it

Nothing is collected. Reading this website sets no cookies and uses no browser storage. It runs no analytics, no advertising pixel — including no Meta Pixel — and no tracking scripts. Fonts and images are served from this site itself, so your browser makes no requests to any other company while you read. (Biolivon Care, the app, sets sign-in cookies once you use it; they are described below.)

The search boxes on the peptide library and trial explorer filter in your browser. What you type is not sent anywhere, not even as part of the page address.

Like any website, ours runs on a hosting provider whose servers receive the standard technical details of each request — your IP address, your browser type, the page requested and the time — in order to serve the page. How long the provider keeps those records: Not yet confirmed.

Biolivon Care, at biolivon.com/care, is where you, your coach and your practitioner work from one care plan. It is for adults, and by invitation only: nobody signs up to it. An account is created when Biolivon or a practitioner invites someone into a care team, entering that person’s name and email address. Nothing else is collected until you sign in, and the app cannot be used until you have given the consents it asks for, one purpose at a time.

Your practitioner is a doctor registered in India. Biolivon checks their registration before they can join a care team, and the app shows you their name, qualification, and the body that registered them with their registration number. Your coach supports your plan with training, habits and nutrition, and does not advise on medicines.

Biolivon Care is not a medical device. It does not diagnose, treat, cure or prevent any medical condition. For medical advice, diagnosis or treatment, ask your practitioner or another healthcare professional.

It is not for emergencies. Messages are not monitored around the clock. If you feel very unwell, call 112 or see a doctor straight away.

To provide your care: so you, your coach and your practitioner work from the same plan; so your practitioner can see when something crosses a threshold (for example, weight falling faster than your plan allows, or a side effect at or above a set severity), which is plain arithmetic against the thresholds in your plan, or the app’s defaults where your practitioner set none, and not a diagnosis; so that messages about medicines, symptoms or an emergency reach your practitioner rather than your coach; to look into a concern that someone on your care team reports; and to sign you in securely and keep a record of who did what. Not for marketing or advertising, never sold, and never shared with anyone outside your care team except the service providers listed under Who receives it, and Biolivon’s Grievance Officer and administrators when someone reports a concern (see Reporting a concern).

Routing is automatic. As you send a message, plain written rules check it for words about medicines, doses and injections, symptoms and how you feel, and for emergency wording such as chest pain or thoughts of self-harm. A message the rules recognise goes to your practitioner as a clinical question. Your coach cannot see it or your practitioner’s answer to it, and you are told it has gone to your practitioner.

The rules catch what they recognise, not every possible wording. If a question is for your practitioner, say so in your message. If a message sounds like an emergency, the app also tells you straight away to call 112 or see a doctor.

Messages from your care team are checked too: a message from your coach that reads as advice about medicines is held back rather than sent. A held message is not stored. Only the fact that it was held, and which rule held it, goes into the audit trail.

Anyone on a care team, whether client, coach or practitioner, can report a concern in the app, under Messages → Report a concern. It can be about a message, about a person on the team, or about your care. You can also use it to ask for a different coach or doctor. It is not for emergencies: if you feel very unwell, call 112.

A report goes to the Grievance Officer, and to Biolivon’s administrators, who handle accounts. They see who made it, who it is about, what you wrote, and the one message you chose to share, if any. They see nothing else from the care record. The person you report is not shown your report, and it never appears to your care team in the app, not even in a care record’s activity log.

The Grievance Officer looks into it and can change your coach or doctor. You read the answer in the app, under Account → Your reports, even if your care team has changed since. We also email you that an answer is ready; the email never contains the answer or what you reported.

If someone on your care team reports a concern about you, the Grievance Officer and the administrators see what they write, and the one message of yours they chose to share, if any. That is why your consent to your care team seeing your record mentions it.

A report is part of your care team’s record, and is deleted with it (see How long it is kept). The reports you make, with their answers, are in your download and under Account → Your reports. For a coach or practitioner, a report on a care team they can no longer see stays with that client’s record: they see only its reference, reason and dates.

Hostinger, which hosts this website, also holds the app’s database on the same server and sends the app’s emails from the biolivon.com mailbox. Emails never contain health information. Each one carries a sign-in code, an invitation, the answer to a request about your data, a notice that a concern you reported has an answer, or, only if you turn it on, a notice that you have a new message. A notice never includes the message, the report or the answer. When a concern is reported, the Grievance Officer and the administrators get an email that says only that there is one. Both are listed with your care team under Who receives it.

Free text is encrypted in the database with AES-256-GCM: check-in notes, messages, plan priorities, medicines, programme content, coach notes, escalations and how they were resolved, reviews, what a report of a concern says and its answer, and notes on requests about your data. The key is kept in the server’s configuration, outside the database, so a copy of the database on its own cannot be read.

The rest is not encrypted this way, so that the app can draw trends and check thresholds. It is protected by the database’s own access controls only: your name and email address; check-in numbers (weight, waist, energy, appetite, sleep, training and protein); the side effects you choose and how severe they are; biomarker names, values and units; the plan’s markers to watch, thresholds, protein target and review date; programme titles; whether a message went to your practitioner, and which rules sent it; how urgent an escalation is; what kind of concern a report raises, who it is about and whether it has been answered; your consent decisions; staff registration details; dates; and the audit trail.

There are no passwords. You sign in with a code we email you; codes and session tokens are stored only as hashes. A code stops working after five wrong tries, and no more than eight codes are sent to an address in an hour. While you ask for or enter a code, your IP address is used to slow down repeated attempts, in the server’s working memory only. Every connection uses HTTPS, and every action on a record goes into the audit trail.

Pages showing your information always come fresh from the server: the app does not store them on your device, and if you are offline it shows a plain “you’re offline” page instead of anything from an earlier visit.

Biolivon Care sets only the cookies that signing in needs. All of them are limited to biolivon.com/care, and none is used for tracking or advertising:

Consent is asked for one purpose at a time, never as a single accept-all. The exact wording and the version of this notice are recorded with every decision. These are the purposes, in the words you are asked to agree to:

We use a consultation enquiry to arrange your consultation: to confirm which verified practitioner can see you, to pass your enquiry to that practitioner so they can decide whether they can help, and to contact you about it by the means you chose. We use a callback request only to call you back, and message you on WhatsApp if you asked us to, to arrange a consultation. We use a practitioner application to verify the applicant and, if verification is completed, to publish their listing.

We do not use any of them for marketing or advertising, we do not sell them, and we do not build profiles from them. We do not pass them to 18pep.com or to any other store. Your consent covers arranging your consultation and nothing wider; using your information for any other purpose would need a new, separate consent from you. 18pep.com is owned by a separate business, though Biolivon’s operator hosts it on the same hosting account that runs this website. Enquiries are not stored on that account: they pass through it to the service that handles them, as described below. Biolivon Care, the app, and its database are hosted on that account too.

When you submit a form, the website also uses your IP address to stop the forms being submitted over and over. It is kept only in the server’s working memory — it is not added to your enquiry, and not written to disk or to logs — and it is discarded the first time anyone uses a form after ten minutes have passed, or when the server restarts, whichever is sooner.

Nothing is collected until you tick the consent box and submit the form. The exact wording you agreed to, and the version of this notice in force at the time, are recorded with your enquiry, so there is never any question about what you consented to. You are free not to give the information we ask for; the consequence is only that we cannot arrange a consultation without it.

WhatsApp is separate and optional. If you tick that box we may message you on WhatsApp about your enquiry and appointment only — never promotional messages. Reply STOP at any time to end them.

You can withdraw your consent at any time by writing to the Grievance Officer above. We then stop using your information and delete it, except anything the law requires us to keep. Withdrawing does not affect what was done lawfully before you withdrew.

In Biolivon Care, consent is asked for separately for each purpose, never as a single accept-all, and you can give or withdraw any of them yourself, at any time, under Account → Your consent in the app. Each purpose, in its exact wording, and what withdrawing it means, is under Your consent in the Biolivon Care part, above.

Every field is checked on the server before anything is accepted, including the fields your browser already checked, and each choice must match one the form actually offers. The website does not keep your enquiry and does not write its contents to its logs; it forwards it once, over an encrypted connection, to the service that receives our enquiries, and does not retry silently. Your enquiry is never re-sent to another address, so it cannot be diverted anywhere unencrypted. If we cannot confirm that it arrived, you are told so on screen rather than thanked for a message that may have gone nowhere.

The security practices of the service that receives your enquiry: Not yet confirmed.

How Biolivon Care protects your care record, including what is encrypted and what is not, is set out under Biolivon Care, above.

If a security breach affects your information, we will tell you and report it as the law requires.

Write to the Grievance Officer to:

This service is for adults. The consultation form accepts only age ranges of 18 and over, which relies on you telling us your age honestly. The callback request form does not ask your age. If we learn that someone under 18 has submitted an enquiry or a callback request, we delete it.

Biolivon Care is for adults only. Nobody can sign up to it: an account exists only when Biolivon or a practitioner invites someone into a care team, and we invite adults only. Before using the app, each client confirms that they are 18 or older, as the first part of their consent to keeping their care record. If we learn that an account belongs to someone under 18, we close it.

We link to research databases, journals and regulators. Following a link takes you to a website with its own privacy practices, which this notice does not cover. Our disclosures explain our commercial relationship with 18pep.com.

Each version is dated above, and the version in force is recorded with every consent. If we change how we use information you have already given us, we will ask you again rather than assume.