Privacy Policy

Information We Collect

• •Identifiers (CCPA Category A): Email address and first name, provided when you complete our dietary quiz or subscribe to our newsletter. We also collect a one-way SHA-256 hash of your IP address, and the raw IP address is never stored.
• •Internet or Network Activity (CCPA Category F): Referrer domain, device type (desktop, mobile, tablet), aggregated usage analytics collected through Vercel Analytics (a cookieless, first-party analytics service), and session interaction data collected through Microsoft Clarity (clicks, scrolls, mouse movements, and a visual replay of your visit, with all form inputs and personally identifiable text masked at capture).
• •Geolocation Data (CCPA Category G): Country and region, auto-detected from Vercel request headers. This is approximate location only. We do not collect precise geolocation.
• •Inferences (CCPA Category K): Quiz result assignment, confidence score, and raw dimensional scores generated by our quiz algorithm based on your answers.
• •Quiz Behavioral Responses: Answers to seven behavioral questions covering your dietary goals, current symptoms, diet baseline, readiness for dietary structure, food reactivity patterns, preferred plan style, and biggest practical obstacle (such as cooking time, sourcing, family buy-in, budget, or social situations).
• •Discovery and Preference Data: How you found Paul (e.g., podcast, YouTube, friend referral), who the quiz is for (self, partner, family, or practitioner), and your preferred content format (podcasts, videos, articles, or quick tips).
• •We do NOT collect any medical or health data such as height, weight, age, BMI, diagnoses, or treatment history.

How We Use Your Information

• •To deliver your personalized quiz result and recommended dietary path based on your answers.
• •To send you the free dietary guide associated with your quiz result, if you opted in via the email gate.
• •To send our newsletter and related educational content about ancestral health, nutrition, and dietary optimization.
• •To segment email communications so you receive content relevant to your goals, dietary baseline, and preferred format, powered by quiz profile properties stored in Klaviyo.
• •To analyze aggregated, anonymous site traffic and quiz completion patterns to improve our content and user experience.
• •To detect and prevent abuse, spam, and fraudulent submissions.
• •To comply with legal obligations, including maintaining consent records and responding to data subject access requests.

Legal Basis for Processing (GDPR)

• •Consent (Article 6(1)(a)): We rely on your freely given, specific, informed consent, collected via an explicit opt-in checkbox, for all email marketing communications, including our newsletter and guide delivery. You may withdraw consent at any time by clicking the unsubscribe link in any email or by contacting us.
• •Performance of a Contract (Article 6(1)(b)): When you complete the quiz and request your result, processing your quiz answers and email address is necessary to deliver the service you requested.
• •Legitimate Interest (Article 6(1)(f)): We process aggregated usage analytics and approximate geolocation data to improve site performance and content relevance. We have conducted a balancing test and determined that this processing does not override your rights, as the data is aggregated and no individual tracking occurs.

Third-Party Services

• •Klaviyo (USA) · Email marketing platform. Stores your email address, first name, quiz result, and quiz profile properties (dietary goals, plan style, content preference, obstacle, discovery channel, identity context, confidence score) for email segmentation and personalized content delivery. Klaviyo acts as a data processor under a Data Processing Agreement. Privacy policy: klaviyo.com/legal/privacy.
• •Neon via Vercel Marketplace (USA) · PostgreSQL database hosting. Stores quiz profiles, consent records, and audit logs. Neon acts as a sub-processor provisioned through Vercel. Privacy policy: neon.tech/privacy.
• •Vercel (USA) · Website hosting, serverless functions, Vercel Analytics (privacy-respecting, cookieless, first-party analytics), and Speed Insights. Vercel processes request headers (including IP address, which we hash before any database storage) to serve pages and compute approximate geolocation. Privacy policy: vercel.com/legal/privacy-policy.
• •Microsoft Clarity (USA) · Session replay and behavioral analytics. Clarity records anonymized session interactions (clicks, scrolls, mouse movements, page navigation) with all form inputs and personally identifiable text masked at capture, so we do not see your name, email, or quiz answers in recordings. We use Clarity to find usability issues, broken flows, and rage-click patterns. Microsoft acts as a data processor; aggregated, anonymized data may be used by Microsoft to improve their products. Clarity sets first-party cookies (_clck, _clsk) for ~1 year and ~1 day respectively to associate session segments. Privacy policy: privacy.microsoft.com/privacystatement.
• •YouTube via youtube-nocookie.com (USA) · Privacy-enhanced video embeds. YouTube's no-cookie domain does not set cookies until you actively play a video. When you play a video, YouTube's own privacy policy applies. Privacy policy: policies.google.com/privacy.
• •Sanity (Norway/USA) · Headless content management system for articles, pages, and media. Sanity stores editorial content only. No user personally identifiable information is sent to or stored in Sanity.

Data Retention

• •Active newsletter subscribers: Your email, name, and quiz profile properties are retained in Klaviyo until you unsubscribe. Upon unsubscription, your data is removed from active lists and suppressed within 30 days.
• •Quiz profiles: Retained for 2 years from your last interaction (quiz completion, email open, or link click). Profiles inactive for 2 years are automatically deleted from our database.
• •Consent records: Retained for 3 years from the date consent was given or withdrawn, to demonstrate compliance with GDPR Article 7(1) and CCPA record-keeping requirements.
• •Audit logs: Server-side logs containing hashed IP addresses and request metadata are retained for 3 years for security and abuse prevention, then permanently deleted.
• •Vercel Analytics data: Aggregated and anonymized at collection. No individual-level data is retained.
• •Microsoft Clarity data: Session recordings and heatmap data are retained for up to 13 months by Microsoft, after which they are automatically deleted. Recordings are anonymized at capture (form inputs and PII text masked).

Your Rights

• •Under GDPR (for EEA, UK, and Swiss residents): You have the right to access your personal data and receive a copy in a portable format (Articles 15 and 20). You have the right to rectification of inaccurate data (Article 16). You have the right to erasure ('right to be forgotten') of your personal data (Article 17). You have the right to restrict processing of your data (Article 18). You have the right to object to processing based on legitimate interest (Article 21). You have the right to withdraw consent at any time without affecting the lawfulness of prior processing (Article 7(3)). You have the right to lodge a complaint with your local data protection authority.
• •Under CCPA (for California residents): You have the right to know what personal information we collect, use, disclose, and sell (Civil Code 1798.100). You have the right to delete your personal information, subject to certain exceptions (Civil Code 1798.105). You have the right to opt out of the sale or sharing of your personal information (Civil Code 1798.120). You have the right to non-discrimination for exercising your CCPA rights. We will not deny you services, charge different prices, or provide a different quality of service (Civil Code 1798.125).
• •To exercise any of these rights, email privacy@paulsaladinomd.com with the subject line 'Data Rights Request.' We will verify your identity by matching the email address on file and respond within 30 days (GDPR) or 45 days (CCPA). For CCPA requests, you may also designate an authorized agent to submit a request on your behalf.

Do Not Sell or Share My Personal Information

• •We do not sell your personal information as defined under the California Consumer Privacy Act (CCPA).
• •We share personal information (email address, first name, and quiz profile properties) with Klaviyo for the business purpose of email marketing and segmentation. This sharing is disclosed here and governed by our Data Processing Agreement with Klaviyo. Under CCPA, this constitutes a disclosure for a business purpose, not a sale.
• •We do not share your personal information with third parties for cross-context behavioral advertising.
• •To submit a 'Do Not Sell or Share' request, email privacy@paulsaladinomd.com.

Financial Incentive Notice (CCPA)

• •We offer a free dietary guide in exchange for providing your email address and completing our quiz. Under CCPA Section 1798.125(b), this constitutes a financial incentive program.
• •The categories of personal information collected for this incentive are: email address, first name, quiz answers, quiz result, and confidence score.
• •The value of the incentive is reasonably related to the value of your data to us, which we estimate based on the cost of producing and delivering the guide content and the value of an engaged email subscriber for educational content delivery.
• •You may opt into this incentive by completing the quiz email gate. You may withdraw at any time by unsubscribing from our email list, which will not affect your ability to access the website. To request deletion of all data collected through this incentive, email privacy@paulsaladinomd.com.

Automated Decision-Making

• •Disclosure under GDPR Article 22: Our dietary quiz uses an automated algorithm to determine which dietary path recommendation you receive (e.g., Food for Humans Foundation, Animal-Based, or Elimination Reset). This recommendation is based solely on your answers to the seven behavioral questions.
• •The algorithm calculates dimensional scores across multiple factors, including dietary goals, symptom patterns, baseline diet, readiness for structure, food reactivity, and plan style, and assigns you to the path with the highest confidence score.
• •This automated processing produces a dietary content recommendation only. It does not constitute medical advice, does not diagnose or treat any condition, and has no legal or similarly significant effect on you.
• •You have the right to request human review of your quiz result, express your point of view, and contest the recommendation by emailing privacy@paulsaladinomd.com.

Cookies and Tracking Technologies

• •Essential cookies: We use only cookies that are strictly necessary for site functionality, such as session management and security. These cannot be disabled.
• •Vercel Analytics: We use Vercel Analytics for aggregated, privacy-respecting usage measurement. Vercel Analytics is cookieless: it does not set any cookies and does not track individual users across sessions or sites.
• •Microsoft Clarity (session replay): Clarity sets two first-party cookies (_clck, valid ~1 year, and _clsk, valid ~1 day) to associate a single visitor's session segments for usability analysis. Clarity does not track you across other sites and does not power advertising. All form fields and personally identifiable text are masked at capture.
• •We do NOT use advertising cookies, retargeting pixels, social media tracking scripts, or any third-party cookies for behavioral advertising.
• •YouTube no-cookie embeds: Video embeds use youtube-nocookie.com, which does not set cookies until you actively play a video.
• •You can control essential cookies through your browser settings, though disabling them may affect site functionality.

Children's Privacy

• •This website and our services are intended for individuals who are 18 years of age or older, as stated in our Terms of Service.
• •We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete that information promptly.
• •If you are a parent or guardian and believe your child has provided personal information to us, please contact us immediately at privacy@paulsaladinomd.com.

International Data Transfers

• •Our website is hosted in the United States, and our third-party processors (Klaviyo, Neon, Vercel) operate primarily in the United States. Sanity operates in Norway and the United States.
• •If you are accessing this website from the European Economic Area (EEA), United Kingdom, or another jurisdiction with data protection laws that differ from United States law, your personal information will be transferred to and processed in the United States.
• •For transfers from the EEA and UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Information Commissioner's Office, as incorporated into our Data Processing Agreements with each processor.
• •By using this website and providing your information, you acknowledge this transfer. We take reasonable measures to ensure your data is treated securely and in accordance with this Privacy Policy.

Changes to This Policy

• •We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.
• •When we make material changes, we will update the 'Last updated' date at the top of this page and, where required by law, notify you via email or a prominent notice on our website.
• •Continued use of the site after changes are posted constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

Contact Us

If you have questions or concerns about this privacy policy, our data practices, or wish to exercise any of your rights described above, please contact us at privacy@paulsaladinomd.com.

Data Controller: Paul Saladino MD, operating paulsaladinomd.com.

For GDPR inquiries, you may also contact your local data protection authority. A list of EEA authorities is available at edpb.europa.eu.