Privacy Policy & Data Protection

Categories of Data Processed

European Economic Area & UK (GDPR)

If you access Health Custodian from the European Union, European Economic Area, or the United Kingdom, our processing of your personal information is governed by Regulation (EU) 2016/679 (General Data Protection Regulation) and the UK Data Protection Act 2018.

1. Lawful Bases for Processing (Article 6 GDPR)

• Consent (Art. 6(1)(a)): For non-essential analytics cookies, activated only after your affirmative opt-in. You may revoke consent at any time via Cookie Settings.
• Legitimate Interests (Art. 6(1)(f)): For maintaining edge security, mitigating DDoS attacks, preventing abusive automated queries, and delivering responsive content delivery.
• Contractual / Direct Request (Art. 6(1)(b)): For processing your email and name when you directly message our editorial team requesting correspondence.

2. Your Data Subject Rights (Articles 15–22 GDPR)

Under European data protection law, you possess enforceable statutory rights:

• Right of Access (Art. 15): Obtain confirmation of whether your personal data is being processed and receive a readable copy.
• Right to Rectification (Art. 16): Require correction of inaccurate contact information.
• Right to Erasure ("Right to Be Forgotten", Art. 17): Request the permanent deletion of your inquiry messages and contact records.
• Right to Restriction of Processing (Art. 18): Restrict processing under contested accuracy conditions.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your national Data Protection Authority (such as the UK ICO or EU supervisory authorities).

We respond to verified requests within thirty (30) days without charge. Contact our privacy team via our Contact Channel.

United States State Privacy Laws

This section applies to residents of California (CCPA as amended by CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), and other states with comprehensive consumer data privacy statutes.

1. Notice at Collection & Data Handling

In the preceding 12 months, Health Custodian has collected the following categories of personal information: Identifiers (voluntarily submitted contact name and email address), and Internet/Network Activity (anonymized IP addresses, browser user-agents, and server response logs). We collect this information exclusively for direct user correspondence, cybersecurity safeguarding, and server load balancing.

2. "Do Not Sell or Share My Personal Information"

3. Global Privacy Control (GPC) Universal Opt-Out

In compliance with California CPRA, Colorado CPA, and emerging state regulations, Health Custodian automatically detects and respects the Global Privacy Control (GPC) browser signal (globalprivacycontrol.org). If your browser broadcasts the GPC signal, our platform instantly disables non-essential analytics and marks your profile as opted-out without requiring any manual submission.

4. State Privacy Rights & Appeals

• Right to Know / Access: Request the specific pieces and categories of personal information we maintain.
• Right to Delete: Request deletion of your personal information, subject to legal record retention exemptions.
• Right to Correct: Request correction of inaccurate personal data.
• Right to Non-Discrimination: You will never receive diminished service, slower load times, or denied content for exercising your privacy rights.
• Right of Appeal: If we decline to take action regarding your privacy request, you may appeal our decision by replying to our response. If your appeal is denied, residents of Colorado, Virginia, Connecticut, and Texas may contact their state Attorney General.

Consumer Health Data Protection (MHMDA & FTC)

Under Washington State's My Health My Data Act (MHMDA), Nevada SB 370, and Federal Trade Commission (FTC) health privacy enforcement policies, health-related browsing behavior warrants the highest tier of confidentiality.

• No Geofencing: We do not deploy geofencing or location tracking around medical facilities, clinics, hospitals, or pharmacies.
• No Medical Dossier Building: We do not track or correlate which medical articles, symptoms, medications, or surgical topics you read with advertising profiles.
• Zero Data Brokerage: We never sell, license, or share consumer health inquiries with insurance carriers, credit bureaus, employers, or commercial data aggregators.