Privacy policy
The most important thing to know: the navigators run entirely in your browser and send nothing to us. We never receive, store or see your answers.
Effective date: 10 September 2026. Last reviewed: 10 September 2026.
1. Who we are
[LEGAL ENTITY NAME] ("we", "us") operates wheretostarthealth.com. We are the data controller for the limited personal data described below. Contact: [CONTACT EMAIL], [REGISTERED ADDRESS]. [If you appoint a UK/EU representative under UK GDPR Art. 27, name them here.]
2. What we do not collect
- Navigator answers (symptoms, height, weight, mood, diet, and anything else you select or type) are processed only in your browser's memory and are discarded when you leave or restart. They are not transmitted, logged or stored by us.
- We do not use accounts, logins, forms that store health information, or advertising cookies.
- We do not process any "special category" health data under UK GDPR, and we do not knowingly collect any personal data from anyone under 18.
3. What we do collect, and why
| Data | Source | Purpose and legal basis (UK GDPR) | Retention |
|---|---|---|---|
| Server and security logs (IP address, user agent, requested URL, timestamp, country) | Cloudflare, our hosting and security provider | Keeping the site online and defending it against abuse and attacks. Legitimate interests, Art. 6(1)(f). | Typically under 30 days, per Cloudflare's retention |
| Aggregate, cookieless analytics (page views, referrer, device type, country) | Cloudflare Web Analytics | Understanding which pages are used so we can improve them. No individual is identified. Legitimate interests, Art. 6(1)(f). | Aggregated; no personal data retained |
| Email correspondence (your address and what you write) | You, when you email us | Replying to you. Legitimate interests, Art. 6(1)(f), or steps at your request. | Up to 24 months after the last message, then deleted |
We do not build profiles, sell personal data, or use data for automated decision-making with legal or similar effects.
4. Third parties who may receive data
- Cloudflare, Inc. (hosting, security, analytics) — processes traffic data on our behalf under its data-processing terms, with UK/EU transfer safeguards.
- Google Fonts — typefaces are loaded from Google's servers, which receive your IP address when the page loads. [Recommended: self-host the fonts before UK launch and delete this bullet.]
- Affiliate partners and networks (Impact.com, CJ Affiliate, Awin/ShareASale, Rakuten Advertising, and the brands themselves) — when you click a link marked Sponsored, you leave our site. The network and brand may set cookies on their own domains to attribute a purchase to us, and receive your IP and browser information. We receive only aggregate, non-identifying reports (clicks, sales counts, commission). Their processing is governed by their own privacy policies, linked from their sites.
5. Cookies
We set no cookies of our own. Cloudflare may set a strictly necessary security cookie. Details are in our cookie policy.
6. International transfers
Our providers operate in the United States. Where personal data of UK or EU residents is transferred, we rely on the UK International Data Transfer Agreement / Addendum, EU Standard Contractual Clauses, and the UK–US Data Bridge or EU–US Data Privacy Framework where the provider is certified.
7. Your rights
United Kingdom and EEA (UK GDPR / GDPR): you can ask to access, correct, erase or restrict personal data we hold, object to processing based on legitimate interests, and ask for portability. You can complain to the Information Commissioner's Office (ico.org.uk) or your local authority.
Canada (PIPEDA and provincial laws): you can ask what personal information we hold about you, request corrections, and withdraw consent where consent is the basis. Complaints can be made to the Office of the Privacy Commissioner of Canada.
California (CCPA/CPRA) and other US states: you have the right to know what personal information we collect and how it's used, to request deletion, to correct inaccuracies, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information for inferences. We will not discriminate against you for exercising any right. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with privacy laws have equivalent rights.
To exercise any right, email [CONTACT EMAIL]. We respond within 30 days (45 days for California requests) and may need to verify your identity. Because we hold almost no personal data, most requests will simply confirm we have nothing on file.
8. Children
WhereToStart is for adults aged 18 and over. We don't knowingly collect data from children; if you believe a child has emailed us, contact us and we'll delete it.
9. Security
The site is served over HTTPS with security headers, web-application firewall and bot protection. Because no user data is stored, the risk to you from a breach of our systems is limited to the log and email data described above.
10. Changes
We'll post changes here with a new effective date. Material changes affecting UK or EU users will be highlighted on the homepage for 30 days.
11. Contact
[LEGAL ENTITY NAME], [REGISTERED ADDRESS]. Email: [CONTACT EMAIL].