Privacy Policy

Who we are

ApexTruth Health is an independent health research publication and clean living marketplace. We follow the funding on every claim we publish. We name the funders. We show primary sources. Every product on the marketplace comes from an independent American business that meets our sourcing standards.

We exist because Americans are making health decisions based on research funded by the people who profit from the outcome. This site is our answer to that.

Contact: hello@apextruthhealth.com | 6701 Corporate Dr Ste N, Johnston, Iowa 50131

What we collect and why

1. Information you give us directly

When you create an account:

• Email address
• First and last name
• Password (stored as a bcrypt hash; we never see your actual password)

We use this to identify you across sessions, send you order and account emails, and let you save articles and health notes.

When you place an order:

• Shipping address
• Phone number (optional, used for delivery questions)
• Payment information

Your payment details are handled by Stripe. We do not store or see your card number, expiration date, or CVV. Stripe processes all payment data under their own PCI-DSS compliance. See stripe.com/privacy.

When you subscribe to the newsletter:

Email address only. We do not require a name. You can unsubscribe from any email with one click.

When you use ATH Coach:

• Intake profile data you choose to provide: age, biological sex, height, weight, training experience, goals, injuries, sport, season phase
• Messages sent to the coaching interface
• Training plans generated during your sessions
• Subscription status and billing information (handled by Stripe)

Coaching sessions use the Anthropic API to generate responses. Messages are sent to Anthropic for processing and are subject to their data handling practices. We do not store your coaching messages beyond the current session context window. Your intake profile and generated training plans are stored in your account and visible only to you. We do not use coaching conversation data to train models or for any purpose other than generating your response.

When you use ATH Labs:

• Biomarker values you enter manually
• Lab result PDFs you upload for extraction (see note below)
• Test dates and lab names you provide
• Biomarker history across multiple sessions

Lab result data is stored in your account and is only accessible to you. We do not share your biomarker data with third parties, insurers, employers, or advertisers. Your lab data is permanently deleted when you delete your account.

PDF uploads: if you upload a lab result PDF, the file is sent to the Anthropic API for data extraction and is immediately discarded. We do not store the PDF itself at any point. Only the extracted biomarker values are saved to your account, and only after you review and confirm them.

ATH Labs provides research context and educational information. It is not a medical service and does not constitute a clinical relationship. Lab result data handled within ATH Labs under the current model (manual entry and PDF upload by the user) is not subject to HIPAA because no covered entity transmits data to ATH. If a lab partner API integration is activated in a future phase, this policy will be updated to reflect the applicable HIPAA framework before that integration goes live.

When you apply to sell on ATH or register on Farm Direct:

Business name, contact information, address, and product details. Farm contact information (email, phone, USDA farm number, Stripe account details) is never shown in public pages. It is used only for platform operations and seller payouts.

2. Information collected automatically

Analytics

We use PostHog and Google Analytics 4. Both collect standard web analytics data: pages visited, time on site, browser type, approximate location (city/region level, not precise), and how you arrived. Neither collects your name or email unless you provided it separately. You can opt out of GA4 at tools.google.com/dlpage/gaoptout.

Error monitoring

We use Sentry to capture errors. Sentry logs include page URLs, browser information, and anonymized IP address fragments. Sentry does not log passwords, payment information, or email addresses.

Server logs

Our hosting infrastructure (Vercel, Railway) generates standard server logs including IP addresses, request timestamps, and status codes. Retained for 30 days, used for debugging and security only.

3. Bot prevention and security

Cloudflare

All traffic passes through Cloudflare. Cloudflare inspects traffic patterns to detect and block automated bot traffic before it reaches our servers. See cloudflare.com/privacypolicy.

Cloudflare Turnstile (invisible mode)

We use Cloudflare Turnstile on our account creation, sign-in, and password reset forms. Turnstile verifies you are human without showing a checkbox or image challenge. It analyzes behavioral signals (mouse movement, timing, browser characteristics) invisibly. Most users will never see any indication it is running.

As required by Cloudflare for invisible mode use: by using apextruthhealth.com, you acknowledge that Cloudflare Turnstile may process data about your browser and interaction patterns as described in the Cloudflare Turnstile Privacy Addendum. Turnstile does not use cookies, does not track you across sites, and does not build advertising profiles.

Cookies

We use a small number of cookies to make the site work:

We do not use advertising cookies. We do not use third-party tracking cookies. We do not sell data to advertisers or data brokers. If you block all cookies the site will still work for reading articles; you will not be able to stay signed in.

How we use your information

We use the information we collect to:

• Process orders and route them to the correct seller
• Maintain your account and its features (saved articles, health notes, order history)
• Send transactional emails (order confirmations, shipping, password resets)
• Send the newsletter if you subscribed
• Detect and prevent fraud, spam, and bot activity
• Debug errors and improve the site
• Understand aggregate usage patterns

We do not use your information to:

• Sell or rent it to third parties
• Build advertising profiles
• Train AI models on personal data
• Contact you with promotions from other companies

Who we share data with

We share data only with the services that make the site run. These are infrastructure providers, not advertising partners:

Sellers receive the shipping information needed to fulfill your order: your name, shipping address, and the items ordered. Sellers do not receive your email address, payment details, or account information.

We do not share data with data brokers, advertising networks, or anyone outside the list above.

Data storage and security

• Passwords are hashed using bcrypt (minimum 12 rounds). We cannot retrieve your password.
• Email verification tokens are stored as SHA-256 hashes and expire in 24 hours.
• All traffic is encrypted in transit via HTTPS/TLS.
• Backend database and CMS run on Railway's US infrastructure. Storefront runs on Vercel's edge network. All US-based.
• We do not store payment card data on our servers at any point.

Your rights

Children

This site is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, email hello@apextruthhealth.com and we will delete it.

Changes to this policy

When we make a material change we will update the version and date at the top of this page and notify newsletter subscribers if the change is significant. Continued use of the site after a change constitutes acceptance of the updated policy.

Material changes include: adding a new third-party data processor, changing how we use your data, or any change that meaningfully affects your rights. Minor wording clarifications and formatting updates do not require notice.

Contact

For privacy questions, data requests, or concerns:

hello@apextruthhealth.com
ApexTruth Health
6701 Corporate Dr Ste N, Johnston, Iowa 50131

We respond to all privacy requests within 30 days.