Privacy

We do not sell your data. We do not share it with advertisers. We do not use cookies to track you across other websites. If you never give us your email address, we never know who you are.

• Nothing that identifies you, until you choose to give it. Reading this site, searching the study library and using the free tools do not require an account.
• Your email address, if you join the newsletter, request a free download, book a call, or create a member account. You are giving it to us for that purpose.
• Member account data, only when you choose an account. This can include your display name, saved tools, tool results, journaling and practice entries, preferences, legal-version acknowledgements, and explicit sharing grants. It belongs to your Auth account.
• What you tell us, if you fill in a form or write to us. That includes anything you volunteer about your health, which we treat as sensitive.
• Privacy-bounded usage. Which public pages are opened, active reading time, approximate scroll depth, route sequences during one browser tab, and broad referral categories. We do not store a cross-site identifier, raw query strings, form values, or health content in these events.

• Lab results, test results, medical records, or uploaded scan files. Nothing in member sync uploads them, and we do not want them stored here. If you bring labs to a call, they stay with you.
• Payment card details. Purchases happen on the retailer's own checkout, under their privacy policy, never on this site.
• Anything from children. This site is not directed at anyone under 16.

We use privacy-bounded, cookieless analytics for public pages when your browser has not enabled Do Not Track or Global Privacy Control. Those browser signals turn collection off. Creating an account or accepting the Terms does not turn identity tracking on. In Preferences, you can separately allow us to attach your Auth account ID to future analytics events; without that choice, events remain anonymous. Even with that choice, events never include saved tools, journaling, health entries, lab results, uploads, email contents, or free-text page content.

We use a small number of service providers to actually run the site. They process data on our behalf and are not permitted to use it for their own purposes:

• Supabase -- authentication and the database behind member data, the study library and stored form submissions.
• Configured email provider -- sends a one-time sign-in link and optional updates after the required manual setup.

Links out to product retailers and partner sites are governed by those companies' own privacy policies once you leave here. See our affiliate disclosure.

• Unsubscribe from any email using the link at the bottom of it. It works immediately, and we do not ask why.
• Change updates, educational email, analytics, and data-sharing choices independently in your member Preferences. These choices do not change your legal acknowledgements.
• Review and revoke individual data-sharing grants in your member account. Revocations are one-way and audited.
• Ask us what we hold about you, ask for a copy, or ask us to delete it, by writing to ryan@theholistichub.org. We will act on it, and we will not make it difficult.
• Depending on where you live, you may have additional rights under laws such as GDPR or the CCPA. We apply the choices above to everyone regardless of location, because it is simpler and fairer than sorting people by postcode.

Member data stays while your account is active or until you ask us to delete it. Revoked grants stop permitting access, while immutable audit records may be retained for security. Optional update consent is recorded with its source and consent or revocation time. Anonymous, aggregate usage statistics are kept only as long as they remain useful and cannot identify you.

We use reputable providers, we limit who can reach the data, and we keep the amount we hold small on purpose, because the safest data is the data you never collected. No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach ever affects your information, we will tell you plainly and quickly.

Nothing here is a diagnosis, a treatment, or a doctor-patient relationship, so this site is not a medical record and is not covered by HIPAA. If you share health details with us, we treat them as private and sensitive, but please do not send anything you would not want in an ordinary email.

If this policy changes in a way that matters, we will change the date at the top and say so to the newsletter rather than quietly editing the page. Questions go to ryan@theholistichub.org or through contact.