What the studio keeps

There are no reader accounts here, and no comments, newsletter or forms.

Our pages set no cookies of their own.

Every file our pages use is the studio’s own: no ads, no analytics, no outside scripts, and no fonts or images from other sites.

A plan can list aims with tick boxes. Your ticks are saved only if you ask, and then only by your own browser; they stay on your device and never reach the studio.

The studio stores the photos our editors put in session plans. Each file loses its hidden data, such as the place it was taken, before any reader sees it.

Arriving through a link in an answer service (ChatGPT, Perplexity, Gemini, Copilot or Claude, for example) raises that day's tally for the service and the page by one.

Three things go into that count: the date, the name of the service and the address of the page. A cookie, your IP address, your browser details and the full referring address are never part of it, and it is deleted after 400 days.

The studio counts page loads by where they come from. Each time a page opens, its count for the day rises by one under one of five sources: a listed search engine (Google or Bing, say), a listed social site (Facebook or Reddit, say), an answer service, another website, or no link.

Clicking a link between two of our pages is not counted. If you go back to a page, or reload it, we may count that load again, since your browser can ask for the page once more as you first reached it.

To sort a load, the studio reads the address you came from and your browser details, which serve only to filter out automated page loads. No cookie, no IP address, no referring address and no browser details go into the count: it stores the date, the page and the source alone. After 400 days a count is deleted.

When a known crawler asks for a page (Googlebot, Bingbot, GPTBot or ClaudeBot, for example), the studio adds it to that day's tally, split by crawler, by kind of page and by the kind of answer the crawler got. Crawlers are the programs that search engines and answer services use to read the web.

To spot a crawler, the studio reads a request's browser details for the crawler's name alone; a request without such a name is not counted. The count holds the date, the crawler's name, the answer it got and the kind of page, and keeps no page address, no IP address and no browser details. Each count is deleted after 90 days.

If a session plan changes address, its old address keeps working and forwards you to the new one. Our editing software counts the uses of each old address and notes when the last one was.

When someone asks for an address that does not exist, the software logs that address, how often it was asked for, and the dates it was first and last asked for, so we can repair broken links. The log keeps 10,000 addresses at most, dropping the one asked for least recently first.

What neither log ever stores: your network address, your browser details, the page you came from.

Cloudflare's network delivers our pages to you. The studio's own code writes down nothing about who reads them.

Email you send us arrives in a mailbox outside this site, and the site stores no copy.

The studio records, for each health reviewer, who added them and when, who checked the qualification and when, and who deactivated them and when. It also keeps their name, their qualification, the body that issued it and an address where it can be checked, then the review areas they cover, the date they agreed to be named and the editor account they sign in with.

Readers see only a reviewer's name, qualification and review areas, and only in two places: the Plan reviewers page and the plans that reviewer approved.

Each decision on a plan, approve or reject, keeps the reviewer's statement and the confirmation they gave with an approval. With them go the version, its address and the subject and review areas it covers; their name and qualification at the time; and the account that decided and the time.

To keep reviewers away from any plan they edited, the studio records, for each plan, which editor accounts saved its text and when each first did.

These records last at least seven years, and the studio never changes or deletes these records. Each night the studio copies every decision into its private archive repository, which never removes one; the nightly encrypted backup of the whole site, kept for 90 days, holds them as well.

A grievance you email goes to the grievance officer's own mailbox, outside this site; the site stores no copy.

A sign-in cookie goes to no reader: only editors and reviewers sign in, and only to a private area.