Privacy notice

There is no account on this site, no newsletter, no comment form, and no field anywhere that asks who you are. We do not want your personal information and we have not built anywhere to put it.

What we do receive is ordinary and limited:

• Analytics. Which pages are read, roughly where in the world the reader is, the device and browser type, and the page or search that led here. This is collected in aggregate by Google Analytics and only when you have not declined it.
• Server logs. Our host records the usual request details, including an IP address, for security and abuse prevention.
• Outbound clicks. When you follow a paid link it passes through our own address first, which records that the click happened and which page and module it came from. Nothing identifying about you travels with it.
• Your privacy choice. Stored in your own browser, not on our servers.

We do not collect health information. Please do not send us any: an email describing your treatment is health information, and we would rather not hold it.

To count how many people read the register and which parts of it are useful, to keep the site working and defended, and to understand which pages produce clicks so we know what to maintain. That is the whole list.

We do not build profiles, we do not run behavioral advertising, and we do not use anything collected here to target you anywhere else.

On your first visit a notice offers Accept or Decline. Declining stops the analytics tag from loading at all, rather than merely recording a preference. Your choice is kept in your browser’s local storage and you can clear it by clearing this site’s data.

We use Google Consent Mode, and advertising storage, advertising user data, and advertising personalization are set to denied at all times regardless of your choice, because we run no advertising.

We honor Global Privacy Control where your browser sends it. We do not use fingerprinting, session recording, heatmaps, or cross-site trackers.

• Vercel hosts the site and processes requests.
• Google Analytics receives analytics events, when permitted.
• Katalys and the merchant receive a click when you follow a paid link, which is how a commission is attributed.

That is the complete list. We have no data broker relationships and no advertising partners.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act as amended by the CPRA. We have never done so and we have no mechanism to.

Because there is nothing to opt out of, our Do Not Sell or Share page exists to say so plainly and to give you an address if you want that in writing.

If you live in California you may request to know what personal information we hold about you, request its deletion, request its correction, and opt out of sale or sharing. You may not be discriminated against for exercising any of these rights.

In practice we hold no account and no identifiers tied to you, so most requests will be answered with a statement to that effect. Write to privacy@treatmentregistry.com with the subject “California Privacy Request”. We respond within 45 days.

Where the UK GDPR or EU GDPR applies, our lawful basis for analytics is your consent, which you may withdraw at any time by declining in the privacy notice or clearing this site’s data. Our lawful basis for server logs and click records is legitimate interest in operating and defending the site.

You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to your supervisory authority. Write to privacy@treatmentregistry.com.

This site is for adults. It is not directed to anyone under 18, and it is never directed to children under 13. We do not knowingly collect information from children, and we do not knowingly share the personal information of anyone under 16 for cross-context behavioral advertising.

If you believe a child has sent us information, write to privacy@treatmentregistry.com and we will delete it.

Analytics are retained on Google’s default schedule. Server logs are retained by our host on theirs. Click records are kept in aggregate for as long as they are useful for deciding what to maintain. None of it is tied to a named person, so none of it is retrieved by name.

The site is served over HTTPS and is entirely static, with no database and no user accounts, which removes most of what there is to breach. No system is perfectly secure, and we do not claim otherwise.

The site is hosted in the United States and our processors are US companies. If you read this from outside the United States, your request is handled there.

We may revise this notice. The effective date above changes when we do, and a material change will be noted on the change log. Continued use after a revision takes effect is acceptance of it.

Privacy questions and requests: privacy@treatmentregistry.com.

Other addresses: corrections@treatmentregistry.com for a figure here is wrong, data@treatmentregistry.com for reuse and licensing, press@treatmentregistry.com for journalists.