Skip to content

Privacy & Data Use

Privacy & Data Use

How this site handles claims, Evidence Watch emails and a separate research submission pilot, written plainly. This is an explanation of current practice, not legal advice or a legal guarantee.

What this site is

The Peptide Evidence Registry is an educational evidence registry. It explains what the published evidence does and does not show about peptides and GLP-1 medicines. It is not a shop, a clinic, a forum or a health service, and it does not provide medical advice or personalised recommendations.

What the claim submission form collects

The Submit a Claim form sends claims to an editorial review queue. It may collect personal information, as does Evidence Watch when you join with an email address. A claim submission may include:

  • The claim text you write (required).
  • An optional compound or topic label.
  • An optional link to where you saw the claim.
  • An optional contact email address.
  • Optional context or notes you choose to add.
  • A timestamp and an editorial status (for example 'pending'), which the site needs to run its review workflow.

Please do not submit personal health information

Do not include medical records, bloodwork or test results, symptoms, dosing histories, or anything about your own or anyone else’s health. This site cannot give individual advice and will not respond to medical questions. If you are unwell or concerned about a product you have taken, please speak to a doctor or pharmacist. Submissions containing personal health information may be deleted without review.

Evidence Watch email alerts

If you join Evidence Watch, we store your email address and the date you subscribed. Nothing else is asked for and nothing else is required — no name, no account, no health information.

That email address is used for one purpose only: sending you the Evidence Watch updates you asked for — important new human trial results, regulatory or licensing changes, and material changes to Registry evidence ratings. It is not used for supplier marketing or promotional content, and subscriber data is never sold or shared for marketing.

You can unsubscribe at any time using the unsubscribe link included in Evidence Watch emails. Subscriber records are kept while you are subscribed and for as long as is operationally necessary afterwards to honour an unsubscribe request, then removed.

Research submissions through Jotform (pilot)

Launch review — not open for external research submissions

The Research Submission Portal has been tested on Jotform, a separate platform. We are not yet inviting real external research submissions. There is no live submission link on this site while the privacy notice and operating arrangements are being verified.

The pilot portal asks for researcher name, email address, organisation and ORCID identifier, alongside compound information, source links and any documents uploaded by the researcher. Jotform currently handles this separately from the Registry website; the portal is not yet connected to the Registry’s database. Do not assume information submitted there appears in the Registry or in Evidence Watch.

Submissions undergo initial Jotform AI-assisted triage, followed by manual review and an approval or rejection decision. Outcome emails may be sent to the address supplied. Approval of a submission for review is not scientific endorsement, and neither approval nor rejection automatically publishes the submission, documents or researcher details on this site. Rejection and approval records, and copies of submissions and uploads, are retained only under the retention schedule set out below.

Jotform’s standard accounts may store form submissions and uploaded files in data centres located in the United States and/or the European Union, and Jotform offers a GDPR Datacenter option that migrates an account’s data to EU storage (How to Store Your Data on EU Servers). For the account used by this pilot that transfer is complete: Jotform’s EU Safe Forms wizard confirmed on 26 September 2026 that all of the account’s data had been transferred to its EU datacenter, and the account’s GDPR Data Center setting — store my data only in Europe (Germany) is switched on. That is about where Jotform stores this account’s form submissions and uploaded files. It does not establish that AI-assisted processing, email sending, other sub-processors, or every residual backup copy are also confined to the EU.

Jotform publishes the terms it offers as a data processor in its Data Processing Agreement (Jotform GDPR DPA) and information about international transfers on its transfer impact assessment pages (Jotform transfer information). These are Jotform’s own documents about Jotform’s arrangements; they are not our statements and they do not confirm anything about our particular account configuration.

Storing data in the EU is not, by itself, assurance that no processing happens elsewhere. Features involving AI or other third-party sub-processors can send data to providers in other jurisdictions even where the stored submission itself sits in an EU data centre.

Jotform’s publicly available Artificial Intelligence Policy (Jotform AI Policy) contains nuanced and, in places, inconsistent statements about whether form-submission content is used to train AI models. It says personal data is not used to train Jotform’s underlying AI systems, while also stating that data entered into form fields may be used to train its AI and that some AI providers use data to train their own models. For that reason we do not claim that anything submitted through the pilot is never used to train AI. The exact processing and sub-processor terms applying to the Workflows AI Review configuration used for this pilot remain unresolved and are being checked separately.

Please do not submit identifiable patient information or personal health data, third-party confidential documents, or anything you do not have permission to share. Acknowledging that you have read a privacy notice is separate from consenting to a particular use of your data; an acknowledgement is not consent to publication, marketing or any other unrelated purpose.

Details to confirm before real intake

EU storage of this account’s submissions and uploads is confirmed (see above), and a retention schedule has now been adopted (see “How long data is kept”; its manual implementation is still pending). Before real external submissions are invited we must still confirm and document the exact terms and recipients of AI-assisted processing, including the Workflows AI Review configuration, its sub-processors and whether any form-field content is used to train AI; and the lawful basis for each processing purpose. We are also asking Jotform support to clarify an unrelated Enterprise Data Centers control in the account interface that still displayed a United States location, so nothing about residual storage is assumed. External research intake remains on hold until these are settled; this notice makes no promises about arrangements that are not yet verified.

How claim submission data is used

Submissions are used only for editorial evidence review — deciding whether a claim should be checked and published with a verdict. Not every submission is reviewed, published or individually answered.

If you choose to include a contact email, it is used only for editorial follow-up relating to that submission — for example, to ask where a claim appeared. It is not sold, not shared with marketers, and not used for newsletters or marketing of any kind.

Technical and hosting data

Like almost every website, this one is served through hosting and platform providers (including the Lovable platform and its underlying infrastructure). Those providers may process technical request data — such as IP addresses, browser and device information, and pages requested — and aggregate usage information needed to operate, secure and understand the site. The exact handling of that data is governed by the platform providers’ own privacy documentation, which this page does not replace.

This project has not intentionally installed any advertising trackers, affiliate tracking pixels or Google Analytics. There is no ad targeting and no cross-site marketing tracking built into this site by its editor.

How long data is kept

UK GDPR’s storage limitation principle requires personal data to be kept no longer than necessary, but it does not set a universal period (ICO guidance on storage limitation). The periods below are maximum retention periods we have chosen; data may be deleted sooner when it is no longer needed, and the schedule is reviewed and may be shortened.

DataMaximum retention
Test (fictional) research portal submissions and filesDeleted within 30 days of the test ending.
Incomplete or withdrawn research submissionsDeleted within 90 days of last contact or decision.
Rejected research submissionsAttachments and substantive content deleted within 90 days unless a documented reason applies; minimal audit details (submission ID, date, status, reason and contact where necessary) kept for 12 months after rejection.
Accepted research submissionsNecessary evidence files and editorial history kept during active review and up to 3 years after the latest substantive editorial decision, reviewed annually. Personal contact details deleted 12 months after the last relevant correspondence unless an active collaboration needs them. Public, non-personal literature references and educational entries may remain while editorially useful.
Submit a Claim — rejected or not selectedDeleted within 12 months of the decision.
Submit a Claim — publishedNon-personal claim, source and editorial record kept while publicly relevant, reviewed annually. Any optional contact email deleted within 6 months of the last necessary follow-up.
Evidence Watch subscribersEmail kept while subscribed and removed from the active list promptly on unsubscribe. Only a minimal suppression or audit record is kept where strictly necessary, under a limited documented schedule.
Security and operational logs under our controlUp to 90 days unless preservation is needed for a security incident.
Correspondence linked to research submissions12 months after the case closes unless an active project or complaint needs it longer.

Longer retention applies only where a specific record is needed for an active complaint, legal claim or hold, or a relevant regulatory obligation; the reason is documented and reviewed every 90 days. We do not assume that any UK GDPR research exemption automatically applies to this editorial registry.

Deleted items may remain for a limited time in provider trash folders or backups under those providers’ own schedules, so we do not promise immediate, irreversible deletion; provider timings are being verified rather than assumed. Records due for deletion are checked monthly, the retention policy is reviewed quarterly, and deletions are logged without keeping the deleted personal content.

Retention schedule adopted — implementation pending

This schedule was adopted on 26 September 2026. Monthly manual deletion checks and quarterly policy reviews are planned; the manual process is still being put in place. Automatic deletion has not been configured, and a single global auto-delete setting will not be used because different records follow different retention clocks.

Access, correction or deletion

If you have submitted information through this site or the research portal pilot, or joined Evidence Watch, you may ask about your personal data, request access or correction, or request erasure where applicable. You may also have rights to restrict or object to processing and to data portability, depending on the circumstances. To make a request, email the site’s owner and editor, Colin Jackson-White, at the dedicated Peptide Evidence Registry privacy contact peptide.registry@gmail.com. This address handles all relevant data requests, including those about claim submissions, Evidence Watch emails and the Jotform research submission pilot. Please include enough detail to identify the relevant record (such as the approximate date and the contact email used, if any); do not send health information. You can also complain to the Information Commissioner’s Office (ICO). We will handle requests in accordance with applicable data-protection law, including its statutory requirements and response deadlines.

External links

This site links to external references — regulator pages, trial registries, journals and other sources. Those sites have their own privacy practices, which this notice does not cover. Check the privacy information on any external site you visit.

Changes and scope of this notice

This notice may be updated as the site evolves; the date below shows the current version. It describes current practice in good faith and is not legal advice. It does not limit your statutory rights or our legal obligations; if you need advice about your specific situation, speak to a qualified professional.

Last updated: 27 September 2026