Privacy Policy

Information We Collect

• •Identifiers (CCPA Category A): Email address and first name, provided when you complete our dietary quiz or subscribe to our newsletter. We also collect a one-way SHA-256 hash of your IP address, and the raw IP address is never stored.
• •Referral Measurement Identifier (CCPA Category A): A randomly generated visitor identifier (psmd_cid), stored in your browser's local storage and in a first-party cookie. We use it only to measure which pages of this site send visitors to the two brands Dr. Saladino co-founded. It is a random value that contains no information about you, and we do not link it to your email address, name, or quiz answers. See 'Do Not Sell or Share My Personal Information' below for how it is used and how to opt out.
• •Internet or Network Activity (CCPA Category F): Referrer domain, device type (desktop, mobile, tablet), usage analytics collected through Google Analytics 4 (event-level data associated with a random cookie identifier), aggregated usage analytics collected through Vercel Analytics (a cookieless, first-party analytics service), session interaction data collected through Microsoft Clarity (clicks, scrolls, mouse movements, and a visual replay of your visit, with all form inputs and personally identifiable text masked at capture), first-touch attribution data (the referring domain, the page you first landed on, and any campaign parameters from that first visit, stored in your browser and included in links you click through to the affiliated brands described below), and outbound click events recording which link you followed to an affiliated brand.
• •Geolocation Data (CCPA Category G): Country and region, auto-detected from Vercel request headers. This is approximate location only. We do not collect precise geolocation.
• •Inferences (CCPA Category K): Quiz result assignment, confidence score, and raw dimensional scores generated by our quiz algorithm based on your answers.
• •Quiz Behavioral Responses: Answers to seven behavioral questions covering your dietary goals, current symptoms, diet baseline, readiness for dietary structure, food reactivity patterns, preferred plan style, and biggest practical obstacle (such as cooking time, sourcing, family buy-in, budget, or social situations).
• •Discovery and Preference Data: How you found Paul (e.g., podcast, YouTube, friend referral), who the quiz is for (self, partner, family, or practitioner), and your preferred content format (podcasts, videos, articles, or quick tips).
• •We do NOT collect any medical or health data such as height, weight, age, BMI, diagnoses, or treatment history.

How We Use Your Information

• •To deliver your personalized quiz result and recommended dietary path based on your answers.
• •To send you the free dietary guide associated with your quiz result, if you opted in via the email gate.
• •To send our newsletter and related educational content about ancestral health, nutrition, and dietary optimization.
• •To segment email communications so you receive content relevant to your goals, dietary baseline, and preferred format, powered by quiz profile properties stored in Klaviyo.
• •To analyze aggregated, anonymous site traffic and quiz completion patterns to improve our content and user experience.
• •To measure which pages and traffic sources of this site send visitors to the affiliated brands described in 'Do Not Sell or Share My Personal Information' below, using the psmd_cid referral identifier and first-touch attribution data.
• •To detect and prevent abuse, spam, and fraudulent submissions.
• •To comply with legal obligations, including maintaining consent records and responding to data subject access requests.

Legal Basis for Processing (GDPR)

• •Consent (Article 6(1)(a)): We rely on your freely given, specific, informed consent, collected via an explicit opt-in checkbox, for all email marketing communications, including our newsletter and guide delivery. You may withdraw consent at any time by clicking the unsubscribe link in any email or by contacting us.
• •Performance of a Contract (Article 6(1)(b)): When you complete the quiz and request your result, processing your quiz answers and email address is necessary to deliver the service you requested.
• •Legitimate Interest (Article 6(1)(f)): We process usage analytics (Google Analytics 4 and Vercel Analytics), session interaction data (Microsoft Clarity), approximate geolocation data, the psmd_cid referral measurement identifier, and first-touch attribution data to understand site performance, improve content relevance, and measure which pages send visitors to the affiliated brands described below, including disclosing that identifier and first-touch record to those brands when you click through to them. We have conducted a balancing test and concluded that this processing does not override your rights: the identifiers involved are random values that we do not link to your name or email address, and you may object at any time (see 'Your Rights') or opt out of the referral identifier through the Global Privacy Control signal.

Third-Party Services

• •Klaviyo (USA) · Email marketing platform. Stores your email address, first name, quiz result, and quiz profile properties (dietary goals, plan style, content preference, obstacle, discovery channel, identity context, confidence score) for email segmentation and personalized content delivery. Klaviyo acts as a data processor under a Data Processing Agreement. Privacy policy: klaviyo.com/legal/privacy.
• •Google Analytics 4 (USA) · Website and event analytics. Collects page views, referring source, approximate location, device and browser information, conversion events for quiz and newsletter signups, quiz interaction events (including your answers to the quiz questions, your quiz result, and its confidence score), and outbound clicks to the affiliated brands described below, including the tagged destination address of those clicks, which contains the psmd_cid referral identifier. Google Analytics sets first-party cookies (_ga and _ga_2LX1XQMVTT) valid for up to 2 years to recognize returning visitors. We do not send your email address or name to Google Analytics; the quiz data above is associated with that random cookie identifier, never with your name or email. Privacy policy: policies.google.com/privacy.
• •Neon via Vercel Marketplace (USA) · PostgreSQL database hosting. Stores quiz profiles, consent records, and audit logs. Neon acts as a sub-processor provisioned through Vercel. Privacy policy: neon.tech/privacy.
• •Vercel (USA) · Website hosting, serverless functions, Vercel Analytics (privacy-respecting, cookieless, first-party analytics), and Speed Insights. Vercel processes request headers (including IP address, which we hash before any database storage) to serve pages and compute approximate geolocation. Privacy policy: vercel.com/legal/privacy-policy.
• •Microsoft Clarity (USA) · Session replay and behavioral analytics. Clarity records anonymized session interactions (clicks, scrolls, mouse movements, page navigation) with all form inputs and personally identifiable text masked at capture, so we do not see your name, email, or quiz answers in recordings. We use Clarity to find usability issues, broken flows, and rage-click patterns. Microsoft acts as a data processor; aggregated, anonymized data may be used by Microsoft to improve their products. Clarity sets first-party cookies (_clck, _clsk) for ~1 year and ~1 day respectively to associate session segments. Privacy policy: privacy.microsoft.com/privacystatement.
• •YouTube via youtube-nocookie.com (USA) · Privacy-enhanced video embeds. YouTube's no-cookie domain does not set cookies until you actively play a video. When you play a video, YouTube's own privacy policy applies. Privacy policy: policies.google.com/privacy.
• •Sanity (Norway/USA) · Headless content management system for articles, pages, and media. Sanity stores editorial content only. No user personally identifiable information is sent to or stored in Sanity.

Data Retention

• •Active newsletter subscribers: Your email, name, and quiz profile properties are retained in Klaviyo until you unsubscribe. Upon unsubscription, your data is removed from active lists and suppressed within 30 days.
• •Quiz profiles: Retained for 2 years from your last interaction (quiz completion, email open, or link click). Profiles inactive for 2 years are automatically deleted from our database.
• •Consent records: Retained for 3 years from the date consent was given or withdrawn, to demonstrate compliance with GDPR Article 7(1) and CCPA record-keeping requirements.
• •Audit logs: Server-side logs containing hashed IP addresses and request metadata are retained for 3 years for security and abuse prevention, then permanently deleted.
• •Vercel Analytics data: Aggregated and anonymized at collection. No individual-level data is retained.
• •Google Analytics data: Event and user-level data is retained by Google for up to 14 months, after which it is automatically deleted. Aggregated reporting remains available beyond that period.
• •Referral measurement identifier (psmd_cid) and first-touch record: The psmd_cid cookie expires 2 years after your most recent visit and is refreshed on each visit. The local storage copies of the identifier and the first-touch record do not expire on their own and remain until you clear your browser's site data, or until we erase them because your browser sent a Global Privacy Control signal. Neither is stored in our database, and neither is linked to any profile we hold.
• •Microsoft Clarity data: Session recordings and heatmap data are retained for up to 13 months by Microsoft, after which they are automatically deleted. Recordings are anonymized at capture (form inputs and PII text masked).

Your Rights

• •Under GDPR (for EEA, UK, and Swiss residents): You have the right to access your personal data and receive a copy in a portable format (Articles 15 and 20). You have the right to rectification of inaccurate data (Article 16). You have the right to erasure ('right to be forgotten') of your personal data (Article 17). You have the right to restrict processing of your data (Article 18). You have the right to object to processing based on legitimate interest (Article 21). You have the right to withdraw consent at any time without affecting the lawfulness of prior processing (Article 7(3)). You have the right to lodge a complaint with your local data protection authority.
• •Under CCPA (for California residents): You have the right to know what personal information we collect, use, disclose, and sell (Civil Code 1798.100). You have the right to delete your personal information, subject to certain exceptions (Civil Code 1798.105). You have the right to opt out of the sale or sharing of your personal information (Civil Code 1798.120). You have the right to non-discrimination for exercising your CCPA rights. We will not deny you services, charge different prices, or provide a different quality of service (Civil Code 1798.125).
• •To exercise any of these rights, email privacy@paulsaladinomd.com with the subject line 'Data Rights Request.' We will verify your identity by matching the email address on file and respond within 30 days (GDPR) or 45 days (CCPA). For CCPA requests, you may also designate an authorized agent to submit a request on your behalf.

Do Not Sell or Share My Personal Information

• •We do not sell your personal information as defined under the California Consumer Privacy Act (CCPA).
• •We share personal information (email address, first name, and quiz profile properties) with Klaviyo for the business purpose of email marketing and segmentation. This sharing is disclosed here and governed by our Data Processing Agreement with Klaviyo. Under CCPA, this constitutes a disclosure for a business purpose, not a sale.
• •Affiliated brands: Heart & Soil (heartandsoil.co) and Lineage Provisions (lineageprovisions.com) were co-founded by Dr. Saladino and are under common ownership with this website. This site links to both. When you click one of those links, we add campaign parameters, the randomly generated visitor identifier (psmd_cid) described above, and a first-touch record (the domain that referred you to this site, the page you first landed on here, any campaign parameters from that first visit, and its date) to the destination address, so those stores can see which page and which traffic source sent you and we can measure how our content performs. We do not include your email address, name, or quiz answers. Those stores are separate companies, and they may associate the identifier with an order you later place with them, under their own privacy policies.
• •We receive no commission, revenue share, or other payment for this disclosure, it is used for referral measurement only, and it is not made for cross-context behavioral advertising, so we do not treat it as a sale or as sharing under the CCPA. Because these stores are nonetheless separate companies rather than service providers acting on our behalf, we honor the Global Privacy Control signal and any 'Do Not Sell or Share' request as an opt-out of this transmission.
• •Global Privacy Control: We honor the Global Privacy Control (GPC) signal for the transmission described above. If your browser or a browser extension sends GPC, we do not create or transmit the psmd_cid visitor identifier or the first-touch record, we erase any copy already stored in your browser, and links to the affiliated brands carry campaign parameters only, with nothing specific to you. This signal governs the referral identifier. The analytics and email providers listed under 'Third-Party Services' process data on our behalf and are not recipients of a sale or sharing.
• •We do not share your personal information with third parties for cross-context behavioral advertising.
• •To submit a 'Do Not Sell or Share' request, email privacy@paulsaladinomd.com.

Financial Incentive Notice (CCPA)

• •We offer a free dietary guide in exchange for providing your email address and completing our quiz. Under CCPA Section 1798.125(b), this constitutes a financial incentive program.
• •The categories of personal information collected for this incentive are: email address, first name, quiz answers, quiz result, and confidence score.
• •The value of the incentive is reasonably related to the value of your data to us, which we estimate based on the cost of producing and delivering the guide content and the value of an engaged email subscriber for educational content delivery.
• •You may opt into this incentive by completing the quiz email gate. You may withdraw at any time by unsubscribing from our email list, which will not affect your ability to access the website. To request deletion of all data collected through this incentive, email privacy@paulsaladinomd.com.

Automated Decision-Making

• •Disclosure under GDPR Article 22: Our dietary quiz uses an automated algorithm to determine which dietary path recommendation you receive (e.g., Food for Humans Foundation, Animal-Based, or Elimination Reset). This recommendation is based solely on your answers to the seven behavioral questions.
• •The algorithm calculates dimensional scores across multiple factors, including dietary goals, symptom patterns, baseline diet, readiness for structure, food reactivity, and plan style, and assigns you to the path with the highest confidence score.
• •This automated processing produces a dietary content recommendation only. It does not constitute medical advice, does not diagnose or treat any condition, and has no legal or similarly significant effect on you.
• •You have the right to request human review of your quiz result, express your point of view, and contest the recommendation by emailing privacy@paulsaladinomd.com.

Cookies and Tracking Technologies

• •Essential cookies: Cookies that are strictly necessary for site functionality, such as session management and security. These cannot be disabled.
• •Vercel Analytics: We use Vercel Analytics for aggregated, privacy-respecting usage measurement. Vercel Analytics is cookieless: it does not set any cookies and does not track individual users across sessions or sites.
• •Google Analytics 4: Sets two first-party cookies (_ga and _ga_2LX1XQMVTT, both valid up to 2 years) to recognize returning visitors and attribute a visit to the source that sent it. These are analytics cookies. They are not used for advertising.
• •Klaviyo: Klaviyo's onsite script, which renders our signup forms, sets its own first-party cookie (__kla_id) to recognize a returning visitor and associate a form submission with the browsing session that led to it.
• •Referral measurement (psmd_cid): We store a randomly generated visitor identifier in your browser's local storage and in a matching first-party cookie (psmd_cid, valid up to 2 years), used only to measure which pages send visitors to Heart & Soil and Lineage Provisions. It contains no personal information and is never used for advertising. If your browser sends a Global Privacy Control signal, we do not set it, and we erase any copy already stored. You can clear it at any time through your browser's site data settings.
• •Microsoft Clarity (session replay): Clarity sets two first-party cookies (_clck, valid ~1 year, and _clsk, valid ~1 day) to associate a single visitor's session segments for usability analysis. Clarity does not track you across other sites and does not power advertising. All form fields and personally identifiable text are masked at capture.
• •We do NOT use advertising cookies, retargeting pixels, social media tracking scripts, or any third-party cookies for behavioral advertising.
• •YouTube no-cookie embeds: Video embeds use youtube-nocookie.com, which does not set cookies until you actively play a video.
• •You can control essential cookies through your browser settings, though disabling them may affect site functionality.

Children's Privacy

• •This website and our services are intended for individuals who are 18 years of age or older, as stated in our Terms of Service.
• •We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete that information promptly.
• •If you are a parent or guardian and believe your child has provided personal information to us, please contact us immediately at privacy@paulsaladinomd.com.

International Data Transfers

• •Our website is hosted in the United States, and our third-party processors (Klaviyo, Neon, Vercel, Google) operate primarily in the United States. Sanity operates in Norway and the United States.
• •If you are accessing this website from the European Economic Area (EEA), United Kingdom, or another jurisdiction with data protection laws that differ from United States law, your personal information will be transferred to and processed in the United States.
• •For transfers from the EEA and UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Information Commissioner's Office, as incorporated into our Data Processing Agreements with each processor.
• •By using this website and providing your information, you acknowledge this transfer. We take reasonable measures to ensure your data is treated securely and in accordance with this Privacy Policy.

Changes to This Policy

• •We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.
• •When we make material changes, we will update the 'Last updated' date at the top of this page and, where required by law, notify you via email or a prominent notice on our website.
• •Continued use of the site after changes are posted constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

Contact Us

If you have questions or concerns about this privacy policy, our data practices, or wish to exercise any of your rights described above, please contact us at privacy@paulsaladinomd.com.

Data Controller: Paul Saladino MD, operating paulsaladinomd.com.

For GDPR inquiries, you may also contact your local data protection authority. A list of EEA authorities is available at edpb.europa.eu.