Privacy policy
You can read every article on this site without an account, without logging in, and without telling us anything.
Short version: you can read every article on this site without an account, without logging in, and without telling us anything. We collect the minimum that keeps the site running, nothing more.
This document is a working draft written to match how the site actually behaves. Have a lawyer in your operating jurisdiction review it, and fill in the controller entity name, registered address, and supervisory authority before going live.
1. Who we are
HealthJournalHub publishes independent health journalism at healthjournalhub.com. For data protection purposes the controller is the publishing entity named at the end of this page. Privacy questions go to privacy@healthjournalhub.com and are answered by a person, not a ticket bot.
2. What we collect
Three buckets, no hidden fourth one.
| Data | Why we have it | Legal basis | Kept for |
|---|---|---|---|
| Aggregate analytics: pages viewed, referrer, country, device class | Understanding which coverage is useful | Consent, where required | 14 months |
| Server logs: IP address, user agent, timestamp | Security, abuse prevention, debugging | Legitimate interest | 30 days |
What we deliberately do not collect
- Health data about you. We publish health information, we don’t gather yours.
- Reading histories tied to an identity. There are no reader accounts to tie them to.
- Payment details. Nothing is sold on this site.
- Data from anyone we know to be under 16.
3. Cookies and similar technology
Strictly necessary cookies (your theme choice, your cookie decision) are set without asking, because the site cannot honour your preferences without remembering them. Analytics and advertising cookies only run if you allow them, and you can change that decision at any time.
Every cookie is listed individually, with duration and purpose, in the cookie policy, where you can also switch the optional categories off.
4. Advertising
Display advertising is served through Google AdSense. With advertising consent on, Google may set cookies and use identifiers to personalise ads and measure performance. With consent off, ad slots either stay empty or serve non-personalised ads. Ads never appear inside article text, and advertisers receive no personal data from us.
5. Who else sees your data
Only the processors that make the site work, each under a data processing agreement, each with a defined slice:
- Cloudflare hosts and serves the site, and sees request metadata including IP addresses.
- Google Analytics 4 processes aggregate usage data, only with your consent.
- Google AdSense serves display advertising, only with your consent.
- GitHub holds the article repository and the editorial workflow. No reader data lives there.
We do not sell personal data, rent mailing lists, or hand anything to data brokers. If a lawful authority compels disclosure, we comply with the narrowest possible reading of the request and tell you unless we are legally barred from doing so.
6. International transfers
Some processors operate outside the UK and EEA, including in the United States. Those transfers rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, plus the provider’s own supplementary safeguards.
7. Your rights
Depending on where you live, you can ask us to show you the data we hold, correct it, delete it, export it, restrict how we use it, or object to processing based on legitimate interest. Where processing rests on consent, you can withdraw consent at any time without giving a reason.
Email privacy@healthjournalhub.com. We respond within 30 days, free of charge, and we don’t require you to prove your identity beyond what is needed to be sure we aren’t handing your data to someone else. If you think we’ve handled a request badly, you can complain to your national supervisory authority.
8. Security
The public site has no login, no database, and no user-generated content, which removes most of the attack surface that leaks reader data in the first place. Articles are static files served from Cloudflare’s edge. Admin access uses GitHub authentication with two-factor authentication required. Secrets live in environment variables, never in the repository.
9. Children
This site is written for adults and is not directed at children. We don’t knowingly collect data from anyone under 16. If you believe a child has sent us personal data, email us and we’ll delete it.
10. Changes to this policy
Material changes are dated at the top of this page, with the previous version available on request. We don’t backdate revisions or quietly widen what we collect.
11. Contact and controller details
Privacy requests: privacy@healthjournalhub.com. Everything else: the contact page.
Controller entity, registered address, company number, and supervisory authority to be inserted before launch.