Consumer health data privacy policy

Last updated: 1 August 2026

Washington’s My Health My Data Act, Nevada’s SB 370 and the health-data provisions of Connecticut’s privacy law require a policy about consumer health data — information that could say something about a person’s physical or mental health — kept separate from a general privacy policy. This is ours.

The short version

We do not ask for, collect, or store health information about you. Our self-tests run entirely inside your browser: your answers and your score never leave your device, are never sent to us, and are never sent to anyone else.

What could count as health data here

One thing, and only with your permission: the fact that a browser opened a page on a health topic. That would be recorded by Google Analytics, the only measurement tool on this site. On our self-test pages analytics does not run at all unless you have said yes, wherever in the world you are — and a yes given anywhere else on the site does not carry over, because consent to health-related measurement has to be asked for separately. We ask again on those pages, once.

None of it is linked to a name, an email address, or an account, because we do not hold one for you.

Where it comes from

Only from you, through your own browser, as you read. We do not buy data, we do not receive it from other companies, and we do not combine it with anything from elsewhere.

Who we share it with

Nobody. We do not sell consumer health data, so there is no authorisation for you to sign. The only company that receives analytics data is Google, acting as our analytics provider. We have no affiliates. We do not pass anything to advertisers, data brokers or partners, and we do not use any of it for targeted advertising.

How long it is kept

Analytics records are held by Google for the retention period set on our property and deleted after that. The cookies in your browser expire on the schedule set out in our cookie policy, and are removed straight away if you withdraw consent.

Geofencing

We do not use geofencing anywhere, and specifically not around health facilities of any kind.

Your rights

  • Withdraw consent — use "Your privacy choices" at the bottom of any page. It takes effect immediately and deletes the analytics cookies in your browser.
  • Ask what we hold about you — write to [email protected]. Because we keep no account for you, the honest answer is usually that we hold nothing we could connect to you, and we will say so plainly rather than pretend otherwise.
  • Ask us to delete it — same address.
  • We will never refuse you service, hide content, or treat you differently because you used any of these rights.

We reply within 45 days, and tell you why if we need longer. If you believe we have handled your health data wrongly, you can complain to the Attorney General of your state — in Washington, Nevada and Connecticut those offices enforce the laws above.

Contact

Write to [email protected].