Consumer Health Data Privacy Policy

This policy exists because several US states — Washington's My Health My Data Act, Nevada's SB 370, and others — give specific protections to consumer health data, and treat it more strictly than other personal information. It applies to everyone who reads this site, not only residents of those states.

We publish reviews of telehealth providers. Which page you read could, in principle, suggest something about your health — someone reading about GLP-1 providers may be considering a GLP-1. That inference is what these laws are about, and it is the reason this site is designed the way it is.

None that is linked to you.

Two things record that a page was read, and they are different. Our own counter adds a row containing the route pattern — such as /review/[brand] — a timestamp, and a coarse automated-or-not classification. It holds no identifier and not the resolved URL, so nothing in it associates a health interest with a person, including by us.

We also run Vercel Web Analytics, and it records more than our counter does. Per Vercel's published documentation it stores, for each page view: the resolved URL — so the specific review, not just the pattern — the dynamic path, the referring site, a timestamp, your approximate location to city level, your device type, and your operating system and browser with their versions. It also derives a visitor identifier from your request, which Vercel discards after 24 hours. It sets no cookies and Vercel states it does not store the data point against an IP address.

What that means for a health interest, stated plainly rather than reassuringly: for up to 24 hours, the specific review pages read from one request source can be connected to each other. We do not receive that identifier, we cannot query it, and Vercel discards it — but a connection that exists is a connection.

If you write to us through the feedback control and choose to describe your own situation, that message is stored as you sent it and emailed to us through Resend, our email provider, which processes and stores it in order to deliver it. So a message describing your own health now exists in two places rather than one, and one of them is a company that is not us. We ask you not to send us health information you would not want stored, because we cannot un-know it, and now cannot un-send it either.

We do not sell consumer health data. We have never sold it, and we will not. Under these laws a sale requires your written authorisation; we do not seek one because we do not do it.

We do not sell or trade it. No advertising network and no data broker receives anything from this site. Two companies do receive something. One is an analytics provider: Vercel Web Analytics, our hosting provider's own first-party product, which receives the page views described above — it is not an advertising network, it sets no cookies, and it builds no cross-site profile, but it is an analytics provider. The other is Resend, our email provider, which receives a feedback message ONLY if you choose to send one. Neither receives anything in exchange for payment to us, and neither may use it for its own purposes.

We do not geofence. We do not use location around healthcare facilities, pharmacies, clinics or family planning centres for any purpose, and we never will. That has not changed and is the commitment that matters under these laws.

Vercel Web Analytics records approximate location to city level — country, region and city, such as "US, California, San Francisco" — derived from the network your request arrives on. That is not precise location, it is not linked to anything you send us, and it is never used to draw a boundary around a place.

We do not infer conditions about anyone, and we hold no data that would let us.

Our hosting provider, Vercel, receives your IP address in order to serve you a page, and keeps operational logs we do not control or analyse. We do not currently know their retention period, and we are not going to state one we have not verified. Resend (resend.com) receives a feedback submission in order to email it to us, which means your message and, if you gave them, your email address and name. It receives nothing at all if you never write to us. No processor other than those two receives anything.

We use no advertising partners and no data enrichment of any kind. We do use one analytics partner, and it is the same company: Vercel Web Analytics is our host's own first-party product. It receives the page views described above. We also use one email partner, Resend, named in the paragraph above.

Where these laws apply to you, you have the right to confirm whether we collect, share or sell your consumer health data; to access it, including a list of anyone it was shared with; to withdraw consent to its collection and sharing; and to have it deleted, including from our backups.

In practice, for a reader who only reads, the answer to all of these is that we hold nothing linked to you. If you have written to us, you can ask us to delete that and we will — and because the right above extends to backups, here is the limit on it stated plainly: your message exists both in our database and in the email it was delivered in, so a deletion has to cover our mailbox and Resend's logs as well as the row. We will do all three and tell you when each is done, rather than deleting the row and calling it deleted.

To exercise any of this, use the feedback control on any page. We will not require an account and will not ask for more than we need. If we decline a request we will say why, and you may appeal by replying — we will respond to an appeal in writing.

Washington's Act lets residents bring a claim directly under the state's Consumer Protection Act. We would rather you told us first and gave us the chance to fix it — but that right is yours and this policy does not ask you to waive it. Nothing in our terms of use limits it either.

This site is built so that the honest version of this page is a short one. If that ever stops being true — if we add analytics, advertising, any collection that could be linked to a person, or any new company that receives what you send us — this page will change first.