Privacy policy
What this site collects, why, who else sees it, and how to make us delete it. If you read one section, read the one on quiz answers — those describe your health, and they are handled differently from everything else here.
Written by Sarah CollinsLast updated
PCOSguides collects three things and no more: your email address if you ask for the newsletter or a free guide, your quiz answers if you take the phenotype quiz, and ordinary web analytics once analytics is switched on. Quiz answers are treated as sensitive health data. Nothing here is ever sold, and everything here can be deleted by sending one email to support@pcosguides.com.
You can read every article on this site without giving us anything at all. Reading is not collecting. Nothing below applies until you fill in a form, take the quiz, buy something, or write to us.
Who is responsible for your data
PCOSguides is written and published by Sarah Collins from Texas, United States. There is no company in between — one person runs this site, and she is the one who answers when you write in. In GDPR terms she is the data controller. In CCPA terms she is the business.
Contact for anything on this page: support@pcosguides.com. It reaches the same inbox as everything else, described at Contact.
There is no data protection officer. A site this size is not required to appoint one, and naming a role nobody fills would be the sort of decoration this site exists to avoid.
What this site collects, and why
Everything, in one table. The status column is there because most of this site is not wired up yet — a row marked "not connected" describes what will happen when it is, not something already sitting in a database.
| What | When it is collected | Why | Legal basis | How long it is kept | Status |
|---|---|---|---|---|---|
| Your email address | When you subscribe, or ask for a free guide | To send you the guide and the weekly email | Consent — GDPR Art. 6(1)(a) | Until you unsubscribe. After that we keep the address on a suppression list so we cannot accidentally email you again. | Not connected yet |
| Your first name, if you type one | Same form. Optional, and the form works without it | So the email is addressed to a person | Consent — GDPR Art. 6(1)(a) | While you are subscribed | Not connected yet |
| Quiz answers and the phenotype result | When you complete the phenotype quiz | To show your result, and to decide which emails and articles you are sent | Explicit consent — GDPR Art. 9(2)(a) | Answers deleted once the result is generated and stored. The result tag is kept while you are subscribed, or until you ask us to remove it. | Quiz not built yet |
| Subscriber tags — which section you signed up from, which guide you asked for, your quiz result | As you use the site and the emails | To stop sending you things that do not apply to you | Consent — GDPR Art. 6(1)(a) | While you are subscribed | Not connected yet |
| Email opens and link clicks | When you open or click one of our emails | To see which emails were worth writing, and to stop sending to addresses that never open | Legitimate interests — GDPR Art. 6(1)(f) | While you are subscribed | Not connected yet |
| Order details — what you bought, when, and the email you bought it with | When you buy something | To deliver it, to answer support questions, and to keep tax records | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) | As long as tax and accounting rules require records of the sale to be kept | Nothing is for sale yet |
| Card and bank details | Never. The checkout provider takes payment; the details never reach this site | — | — | Never held by us | Not applicable |
| Analytics — pages viewed, the page you arrived from, approximate country, browser and device type | When you read a page, once analytics is switched on | To see which articles get found and which are unreadable on a phone | Legitimate interests — Art. 6(1)(f), or consent where cookies are involved | Reported in aggregate | No analytics running |
| Server logs — IP address, request time, page requested, browser string | Automatically, by the host that serves these pages | To serve the site, and to deal with abuse and outages | Legitimate interests — Art. 6(1)(f) | A short period set by the host, not by us | In use |
| Whatever you write in an email to us | When you email support | To reply to you, and to fix the article if you reported an error | Legitimate interests — Art. 6(1)(f) | While the thread is live, then archived in the mailbox | In use |
What this site never collects
- Government ID numbers — no passport, licence, Social Security or national insurance number
- Financial account or card numbers
- Precise geolocation
- Biometric or genetic data
- Race, ethnicity, religion, sexual orientation, or union membership
- The contents of your messages to anyone other than us
- Anything scraped from a data broker or bought from a list
Your quiz answers are health data, and they are handled that way
The phenotype quiz asks about your cycle, your skin, your energy, your mood and your history with hormonal birth control. It does not ask your weight and it does not ask for lab results. Put together, those answers say that you have or suspect PCOS and which type you look like. That is information about your health. Under GDPR it is special category data. Under California's CPRA it is sensitive personal information. It is also the sort of thing that, handled carelessly, ends up in an advertising segment or an underwriting file — so it gets the strictest handling on this site.
What is stored
Your individual answers are used to work out your result and are then deleted. What stays is one tag on your subscriber record — insulin-resistant, inflammatory, adrenal, post-pill, or unknown — plus the date you took it, so we know when the result is old enough to be worth retaking.
That tag is stored with your email address inside our email provider. It is not stored on this website, because this website is a set of static files with no reader database behind it.
What it is used for
- Showing you your result page and the articles that match it.
- Deciding which emails you get. Someone whose goal is fertility should never receive a weight email — that is the whole reason the tag exists.
- Counting how many people fall into each phenotype, in aggregate, with no name attached.
What it is never used for
- Selling. Your quiz result is not for sale, at any price, to anyone.
- Advertising. It is never passed to an ad network, a data broker, or a social platform, and it is never used to build an advertising audience.
- Anything to do with insurance, employment, or credit. Nobody in those industries receives it.
- Sharing with another company for their own purposes. Our email provider processes it on our instructions and for nothing else.
A quiz result is also not a diagnosis and not a medical record. It is a way of organising symptoms you already recognise so you can ask your clinician a sharper question — see the medical disclaimer.
How to have it deleted
- Email support@pcosguides.com with "delete my quiz answers" in the subject line, from the address you used, or naming that address.
- We remove the phenotype tag and the date from your subscriber record.
- You get a reply confirming it is gone. The aim is a few days; the outside limit we hold ourselves to is 30 days.
Deleting the tag does not unsubscribe you — you keep getting the general emails unless you also unsubscribe, which is one click at the bottom of any of them. You can also just retake the quiz later; the new result replaces the old one.
Because the quiz runs on explicit consent, you can withdraw that consent at any time and withdrawing it is exactly the deletion above. Withdrawal does not undo anything already done with the tag before you asked, which in practice means emails already sent.
As of the date at the top of this page the quiz is live and it is scored entirely in your own browser. Your answers are never transmitted to us, never stored on our servers, and no quiz answer has ever been collected. This section is a commitment written before there is anything to commit about, which is the only order that makes it worth anything.
Cookies and consent
As of the date at the top of this page, PCOSguides sets no cookies of its own. The fonts are served from this domain rather than from Google, there is no tag manager, no advertising pixel, and no third-party script on any page. You can check that in your browser's network tab, which is a better source than this sentence.
That changes only in three ways, and each is described before it happens:
- Analytics. If a cookie-free, privacy-first analytics tool is used, no consent banner appears because there is nothing to consent to. If a cookie-based tool is used instead, a consent banner appears first and nothing loads until you choose.
- Affiliate links. When you click a link to a shop, that shop may set its own cookie on its own site to attribute the sale. That happens after you leave here and under their policy, not ours.
- Checkout. The checkout provider sets what it needs to process your payment and prevent fraud. Those are strictly necessary for a transaction you asked for.
Non-essential cookies will never be set before you agree, for readers in the UK and the EU or anywhere else. You can also block or clear cookies in your browser settings, and if your browser or extension sends a Global Privacy Control signal we treat it as a valid opt-out of any sale or sharing — a right we already honour by not doing either.
Analytics
No analytics is running on this site today. When it is, the intention is a privacy-first tool that does not use cookies, does not build a profile across sites, and does not store your full IP address. The point of it is to see which articles get found and which pages people leave immediately, not to follow you.
Analytics is never joined up with your quiz result or your email address. The two are kept apart on purpose.
Who else sees your data
Only the companies that make the site work, and only the part each one needs. None of them may use your data for their own purposes, and none of them is paid in data.
| Service | What it does | What it receives | Status |
|---|---|---|---|
| Kit (formerly ConvertKit) | Stores the mailing list and sends the emails | Your email address, your first name if you gave one, your tags including your quiz result, and whether you opened or clicked | Not connected yet |
| Lemon Squeezy | Runs the checkout as merchant of record, which means they take the payment and handle the tax | Your name, email, billing country, and payment details. Payment details go to them, never to us. | Nothing is for sale yet |
| An analytics provider — not yet chosen | Counts page views | The page you viewed, the page you came from, approximate country, browser and device type | No analytics running |
| The static host that serves these pages | Delivers the HTML to your browser | Your IP address and the standard request details, in server logs | In use |
| Affiliate merchants and networks | Attribute a purchase to the link you clicked here, so a commission is paid | That you arrived from a link on this site — usually through a cookie they set on their own domain, after you leave | No affiliate links published yet |
Two other situations are worth naming. Data can be disclosed where the law requires it — a court order, a lawful request from an authority. And if this site were ever sold or merged, the subscriber list would move with it; you would be told before that happened, and unsubscribing would still be one click.
Affiliate links
Some links in product comparisons will earn a commission. Clicking one takes you to another company's site, where their privacy policy applies and ours stops. We never send them your email address, your name, or your quiz result — the only thing that travels is the fact that the click came from here. What a commission does and does not change about what a page says is set out at Affiliate disclosure.
If you are in the UK or the EU
The UK GDPR and the EU GDPR give you rights over your data, and they cost nothing to use. The legal basis for each thing we do is in the table above, so you can see which right applies where.
- Access. A copy of everything held about you.
- Rectification. Correction of anything wrong — a misspelled name, the wrong phenotype tag.
- Erasure. Deletion, including your quiz result, subject to records we must keep for tax.
- Restriction. A freeze on using your data while a dispute is sorted out.
- Portability. Your data in a machine-readable file, or sent to another provider.
- Objection. An objection to anything done on the basis of legitimate interests.
- Withdrawing consent. At any time, for the newsletter and for the quiz, without affecting what was already done.
- No automated decisions. Nothing here makes a decision about you with legal or similarly significant effects. The quiz sorts you into a content segment; it does not decide anything about your life.
If we get it wrong you can complain to your national supervisory authority — the Information Commissioner's Office in the UK, or your country's data protection authority in the EU. We would much rather you told us first, but you do not have to.
If you are in California
The CCPA, as amended by the CPRA, gives California residents a specific set of rights. Here are the categories in the statute's own terms, translated into what they actually mean on this site.
| Statutory category | What that is here | Where it comes from | Disclosed to | Sold or shared |
|---|---|---|---|---|
| Identifiers | Email address, IP address | You, and your device | Email provider, host, analytics provider | No |
| Commercial information | What you bought and when | You, through the checkout provider | Checkout provider | No |
| Internet or other electronic network activity | Pages viewed, emails opened and clicked | Your device and your email client | Analytics provider, email provider | No |
| Geolocation data | Approximate country or region, worked out from your IP address. Never precise location. | Your device | Analytics provider, host | No |
| Sensitive personal information — health | Your quiz answers and your phenotype result | You, when you take the quiz | Email provider only | No |
| Inferences | Which phenotype segment you are in, and which topic you care about | Your quiz answers and which guide you asked for | Email provider only | No |
Do Not Sell or Share My Personal Information
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those two terms are defined in the CCPA. We have not done either in the twelve months before the date at the top of this page, and we do not plan to start. There is no opt-out link on this page because there is nothing to opt out of; if that ever changes, the link appears here and in the footer before the change takes effect.
We also do not sell or share the personal information of anyone we know to be under 16.
Sensitive personal information
Your quiz answers are sensitive personal information under the CPRA. They are used only to provide the thing you asked for — your result, and emails that match it — which is a permitted purpose that does not trigger a right to limit. You can still have them deleted at any time, using the steps in the quiz section above, and that is the stronger remedy anyway.
Business purposes, retention, and no retaliation
Everything collected is used for the business purposes named in the table further up: sending what you asked for, delivering what you bought, answering support, and understanding traffic in aggregate. Retention is in the same table, category by category. We do not keep a category of data longer than the purpose it was collected for requires.
Using any of these rights costs you nothing and changes nothing about what you receive. You will not get a worse price, a smaller free guide, or a slower reply for asking.
How to use any of these rights
One route for all of them, wherever you live. We do not run a separate portal, because a portal with one person behind it is just an email address with extra steps.
- Email support@pcosguides.com and say what you want — a copy of your data, a correction, deletion, or all of it.
- Tell us which email address to look up. That address is how your record is found, so a request from a different address will need something that ties the two together.
- We may ask one question to confirm it is you, and only enough to be sure. We will not ask you to send identity documents to prove ownership of an email address.
- The aim is a reply within a few days, and the outside limit is 30 days for California requests and one month for GDPR requests. If a request is genuinely complicated we will tell you before that runs out rather than after.
An authorised agent can make a California request for you, with written permission from you that we can verify.
You can also unsubscribe without emailing anyone: every email has a one-click unsubscribe link at the bottom, and it works immediately.
Children
This site is written for adults and is not directed at children. We do not knowingly collect data from anyone under 13, or under 16 in the UK and the EU. If you believe a child has given us their details, email us and we will delete the record.
Teenagers are diagnosed with PCOS and teenagers read pages like this one, so to be clear: reading is fine and collects nothing. If you are under 16, do not subscribe or take the quiz without a parent or guardian doing it with you.
Where your data is held
This site is published from Texas, United States, and the services it relies on are United States companies. If you are in the UK or the EU, your data is transferred to and stored in the United States.
For each provider, the transfer relies on whatever lawful mechanism that provider offers — standard contractual clauses, or their certification under a framework recognised for UK-to-US and EU-to-US transfers. This draft does not name a mechanism for any specific provider because that has not been verified yet, and stating an unverified one would be worse than stating none. It is on the list for legal review before anything is collected.
How your data is protected
The honest version. This site is a set of static files with no login, no comments, no reader database, and no server-side code that could be tricked into handing anything over — there is nothing here to breach. The email list and any orders live inside the providers named above, under their security, reached from accounts protected by strong unique passwords and two-factor authentication.
No one can promise perfect security, and a privacy policy that does is lying. What we can say is that the amount held is deliberately small, because the safest data is the data that was never collected.
Changes to this policy
The date at the top of this page is the date it last changed. When a service in one of the tables above goes live, its status row changes here first, before it starts collecting.
If a change materially affects how your data is used — a new category collected, a new company receiving it, a new purpose — subscribers are told by email before it takes effect, and the change is noted on the page. Small corrections to wording are made without an announcement.
Questions, and complaints
Email support@pcosguides.com. Sarah Collins reads it. If something on this page is confusing, that is a defect worth reporting — this page is meant to be understood, not merely published.
The rest of the paperwork: Terms, Medical disclaimer, Affiliate disclosure, and how articles get written and corrected at Editorial policy.