GroupTestHub — Privacy Policy

1. Information We Collect

A. Information You Provide Directly

• Authentication data (Supabase Auth): Email address, hashed password, email verification status, authentication provider (email or Google OAuth if enabled), last sign-in timestamp and IP.
• Profile data: Alias (public display name), avatar/profile picture (stored in Supabase Storage “avatars” bucket).
• Role assignments: Data in user_roles table.
• Group participation: Memberships, roles within groups, contributions.
• Documents: Uploaded PDFs/images (third-party COAs, lab results) stored in Supabase Storage; external COA links.
• Shipping/tracking: Tracking numbers you voluntarily provide.
• Payment data: Status, amounts, Stripe reference IDs. We do not store credit card numbers — Stripe handles all payment details.

B. Automatically Collected Information

• IP address, browser type, operating system, device identifiers, usage analytics, cookies/session storage.

C. Information from Third Parties

• Payment metadata from Stripe.
• Authentication data from Google (if used).
• Limited shipping/compound information shared with partner laboratories (see Section 3).

D. Laboratory Intake and Shipping Information

When you, a Manager, or a Lab Shipper provide information in a laboratory’s intake forms, shipping documents, chain-of-custody paperwork, or similar forms, that information is transmitted or forwarded to the partner laboratory being used in the group. This may occur via encrypted email or by including the documents physically inside the package sent by the Lab Shipper.

Group Test Hub does not receive, collect, store, or process this information. We do not have access to the contents of laboratory intake or shipping forms.

2. How We Use Your Information

To create and manage accounts, facilitate group tests and payments (including late-join store credit allocation), send transactional emails, provide support, improve the Platform, detect fraud, and comply with legal obligations.

3. Third-Party Processors

• Lovable Cloud / Supabase — Hosting, database, auth, storage (data processed in US/Europe regions).
• Stripe, Inc. — Payment processing (see Stripe Privacy Policy).
• Google — Authentication (if you use Google OAuth).
• Cloudflare Workers — Edge runtime.
• Resend (or email provider) — Transactional emails via noreply@grouptesthub.com.
• Partner laboratories (Janoshik Analytical, Freedom Diagnostics, Peptide Test, Vanguard Laboratory, etc.) — Receive only the compound information, lab testing being requested, and any data you or the Lab Shipper directly provide to them in intake or shipping forms.

4. Email & Notifications

Transactional emails sent from noreply@grouptesthub.com for:

• Payment confirmations
• Payment notifications to Managers
• Late-join store credit grants
• Authentication emails (signup, magic link, recovery, email change, etc.)
• Group phase changes and important updates

Non-essential emails include unsubscribe options. Manage preferences in account settings.

5. Cookies & Tracking

• Supabase auth/session cookies (essential)
• Stripe checkout cookies (essential)
• Local/session storage for app state (essential)

Non-essential cookies are not collected. There are zero non-essential tracking, marketing, or analytical cookies being collected.

6. Your Privacy Rights

Access, Correction, Deletion: Available in account settings or by contacting support@grouptesthub.com.

Data Portability: Request a portable copy of your data.

GDPR (EU/EEA/UK): Additional rights to object/restrict processing and lodge complaints with your supervisory authority. Lawful bases: contract, legitimate interests, consent. Contact privacy@grouptesthub.com.

CCPA/CPRA (California): Right to know, delete, and opt-out of sale. We do not sell personal information.

COPPA: The Platform is not intended for individuals under 21 years of age. We do not knowingly collect personal information from anyone under 21.

7. Data Retention & Security

Retention

• Active accounts: While account is active.
• Financial records: Minimum 7 years (legal/tax requirement).
• Group history/results: Retained in anonymized form to support other participants.
• Deleted accounts: Personal identifiers removed or anonymized; transaction/group history retained in anonymized form.

Security

• Row-Level Security (RLS) on every table
• Encryption at rest and in transit
• Role-segregated access via security definer functions
• Regular audits and least-privilege access

Breach Notification

We will notify affected users and authorities as required by law (CCPA, GDPR, state laws) without undue delay.

8. Public Visibility — Be Explicit

• Public groups: Discoverable; alias + metadata visible to all registered users. Results can be made public (irreversible once made public).
• Aliases: Once used in a group or publicly visible context, your alias becomes a public identifier visible to other group members and (in Public mode) to all registered users.

9. International Data Transfers

Our infrastructure (Supabase/Lovable Cloud, Cloudflare) processes data primarily in the United States and Europe. If you are outside the US, your data will be transferred to these regions. For EU/EEA/UK users, we use Standard Contractual Clauses (SCCs) and other appropriate safeguards. Contact us for details.

10. Changes to This Privacy Policy

We may update this Policy at any time. Material changes will be notified via in-app banner or email. Continued use after changes constitutes acceptance.

11. Contact Us

privacy@grouptesthub.com
Create The World, LLC dba Group Test Hub
Illinois, USA

For GDPR matters, contact our Data Protection Officer at the same address.