What this sheet covers
This sheet covers information collected through gradebio.com and through correspondence with Grade Bio. It does not cover what a dispensing pharmacy collects from a patient; that is the pharmacy's relationship and the pharmacy's notice.
What is collected on the contact form
Name, email address, an optional organization and telephone number, and the message written. Nothing else. The contact form on sheet G‑09 never asks for a license, an NPI or any patient information, and a message containing patient information will be deleted rather than filed.
What is collected on the access request
The fields listed in section 3 of the access sheet: legal name, professional credential, license type, license number, issuing state, expiration date, a copy of the license document, NPI, practice legal name and entity type, practice website where given, practice street address, city, state and ZIP, practice telephone, work email, role at the practice, the six attestations and the typed signature. Every field is there to verify a person and a license, and none is used for anything else.
Why it is collected
To confirm that a person requesting access is a licensed practitioner in good standing, to meet the record keeping the pharmacy model requires, and to reach an account about the lots it holds. Verification data is not used for marketing and is not sold, rented or shared with a data broker under any circumstances.
Who it is shared with
Verification data is shared with the licensed pharmacy of record for an account, because the pharmacy is the dispensing party and has its own obligation to know who it dispenses for. License and NPI details are checked against the issuing state board and the national provider registry, both of which are public records. Beyond that it is shared only with a regulator making a lawful request, and only to the extent of the request.
How long it is held
Verification records are held for the life of the account and for six years after it closes, which is the period the record keeping expectation runs to. Contact correspondence is held for two years. An unsuccessful access request is held for one year, so that a person who reapplies is not asked to explain the first attempt.
How it is protected
Verification data is encrypted at rest and in transit, held in a system separate from general correspondence, and reachable by the small number of people who run verification. A license document, where one is attached, is stored with the record and is never emailed onward.
Cookies and measurement
This site sets no advertising cookie, runs no third party tracking pixel and builds no cross site profile. A form protection challenge is used on the two forms to stop automated submission; it sets what it needs to make that decision and nothing further.
Correcting or deleting a record
Write to jv@gradebio.com and ask. A correction is made on receipt. A deletion is made unless a record has to be kept to meet the retention in section 6, in which case the reply names the specific record and the date it can be deleted rather than refusing in general.
Changes to this sheet
This sheet is reissued as a numbered revision rather than edited in place. This is revision A, issued 31 August 2026. A material change will be notified to every account before it takes effect.
Grade Bio is a brand of Mountain Brands LLC. Entity formation is pending and no registration has been filed. Correspondence to jv@gradebio.com or sw@gradebio.com.
Pre‑launch document Entity pending