Creating an account does not connect a wearable, order a test or share information with a clinician. Each upload, connection and future transfer requires an affirmative action.
Categories and sources
Information may come directly from your onboarding answers and uploads or from a source you authorize. Apple Health, Strava, Oura and other available integrations retrieve only the permitted summaries shown in the product after authorization. Garmin and direct Eight Sleep access remain unavailable until partner access is approved; Eight Sleep data may appear through Apple Health when the source writes there.
- Goals, deadlines, habits, nutrition, sleep, activity and work context
- Authorized aggregate wearable, fitness and sleep summaries
- Laboratory and genetic files you upload
- Connection, consent, membership and deletion records
Uses
PEPRA uses these records to operate your account, display source status, validate compatibility and generate educational plans labeled by source and limits. Goals, questionnaire context and provider-permitted aggregate signals may be processed by an external AI service; Oura-origin and Oura-derived data is excluded from that processing. PEPRA does not use consumer health data for advertising, insurance, employment, credit or independent medical decisions.
Sharing and sale
PEPRA does not sell consumer health data. Infrastructure providers process it to host the service. A future laboratory, wearable, clinician or pharmacy transfer will require an identified route, appropriate terms and consent; pressing a current setup button does not make that transfer.
Your controls
You can delete individual uploaded files in the product and request access, correction, account deletion, consent withdrawal or an appeal by contacting james@getpepra.com. Withdrawal does not affect processing already required for security or legal compliance.
Security and incidents
PEPRA uses private storage, session protection and ownership checks. No system can guarantee absolute security. Applicable consumer-health-data and breach-notification obligations will be evaluated as the product and jurisdictions expand.