Privacy notice

What we collect

• Clinic brief. Your answers about pressure, product interest, primary and additional operating states, clinic type, optional NPI, volume band, timeline, fulfillment preference and sourcing problem, then clinic name, contact name, role, work email, optional telephone and contact preference. The guided clinic brief asks for your goal and GLP-1 option, then clinic name, primary state, your name, work email and a U.S. phone number, and optionally timing, approximate monthly volume and other states. To suggest the primary state, the site reads the approximate U.S. state of your connection from our hosting provider’s network location data; we do not store that lookup, and you can change the state before you send.
• Extended qualification. Backup position, current supplier (if any), notes and any added states or NPI. Free-text fields ask you not to include patient or medical information, and we do not want it.
• Calculator. Only when you ask for the full calculation by email: the numbers you typed, with your clinic and contact details.
• Retatrutide status list. Clinic name, role, state, business email, optional NPI, your acknowledgement of the regulatory statement, its version and the time you gave it.
• Pharmacy applications. Pharmacy or facility name, contact name, business email, state, classification and your message.
• Consent records. The exact text of each consent you tick, its version, the time and the page, plus your IP address and browser user agent at the time of submission.
• NPI check. When you give an NPI we look it up in the public NPPES registry run by CMS and store the result and the public registry record. This does not confirm current professional or pharmacy licensure.
• Site events. Page views, calls to action, funnel steps, previews, submissions and result states, recorded on our own server with the page path, your experiment assignment (for example which headline you saw) and a random per-visit identifier your browser generates and discards when the tab closes. Events never contain names, emails, phone numbers, NPIs, notes or form contents; the server rejects anything that looks like them. The admin area records no analytics.
• Abuse protection. Short-lived counters keyed by a one-way hash of your network address, expiring within two days.

The consents you give, separately

Each consent is a separate, unticked checkbox. The text you see is the text we store, with version 2026-10-13.2:

Contact about this sourcing request (required)

I agree that GLP-1 Supply Desk may contact me about this sourcing request using the contact details I provided. Consent is not a condition of any purchase.

Ongoing professional updates (optional)

Send me occasional professional updates about sourcing pathways and regulatory changes by email. I can unsubscribe at any time.

Telephone or text contact (optional, required for a call or text)

I agree to be contacted by phone or text at the number I provide about this enquiry. Reply STOP to any text to opt out.

Introduction to a selected pharmacy (asked only at that step)

Introduce me: I agree that GLP-1 Supply Desk may share my clinic's name, my contact details and this sourcing request with the selected pharmacy so that it can contact me directly.

Follow-up messages

Saving a brief queues a short, intent-specific sequence about that brief: a confirmation, the due-diligence checklist, a reminder if the optional qualification is unfinished, a backup-sourcing worksheet when continuity was your concern, a product and state follow-up and one close-loop question about keeping the brief active. A saved guided clinic brief also queues one email about our current recommended supplier: an advertisement for a third-party supplier with which we have no commercial relationship. It names the supplier, links to the supplier’s own site and carries our postal address, and nothing about your clinic is shared with that supplier. Every message carries a one-click unsubscribe link. Messages are sent from our own outbox through Resend, our email-delivery provider, and replies reach our support mailbox.

When a pharmacy receives your information

Never automatically. Only after a reviewer confirms a fit and you tick “Introduce me” on the private introduction page for that specific pharmacy. That page shows you the pharmacy’s name and the terms it has on file before you decide; until you tick it, nothing about your clinic reaches the pharmacy and your details stay with us. Outside that page, pharmacy identities stay on our server.

Where it is stored and who processes it

• Our database, hosted by Neon (Postgres) in the United States (AWS us-east-1), is the system of record.
• The website runs on Vercel, which processes requests and keeps server logs. On the live site, Vercel Speed Insights also measures how fast public pages load (Core Web Vitals): it records the page path and timing figures only, sets no cookies and collects no personal data, and the admin area and private links are never measured.
• The NPPES registry (CMS) receives only the NPI you entered.
• Email is delivered through Resend (United States), and our support mailbox is hosted by Zoho Mail. No other third-party analytics, CRM or chat provider is connected at present. If one is enabled, this notice is updated first.

How long we keep it

Briefs, qualifications, applications and their consent records are kept while we have an open request or relationship with your organisation and for as long as we need to show consent afterwards. Site events are kept in aggregate for reporting. Ask us to delete your details at any time; we keep only what we must to honour an opt-out.

Your choices

Reply STOP to any text, use the unsubscribe link in any message, or use the resumable link in your brief confirmation to update or close your brief. You can also email support@glp1supplydesk.com to access, correct or delete your details or withdraw a consent. Consent is not a condition of any purchase.

Cookies

The public site sets one first-party cookie that records which page and funnel variants you were assigned, so a visitor sees the same version each time; it contains no personal data. The admin area, used only by the review team, sets one session cookie for sign-in. The per-visit identifier lives in your browser’s session storage, not in a cookie. If you start a clinic brief and leave before sending it, your browser keeps the unfinished, non-personal draft in its local storage for seven days after your last change so you can continue: your goal, GLP-1 option and primary state, the page where you started, any campaign tags of the link that brought you and a random draft identifier. It never stores your name, clinic name, email, phone, NPI, consents or anything you type, and the draft is deleted when you send the brief or choose Start over.

Who we are

GLP-1 Supply Desk is the publisher of this site. A legal operator name will be added here when it is configured; nothing else is implied. 300 Chadbourne St, San Angelo, TX 76903.