What happens to your information

Last updated September 7, 2026.

The short version

We are an advocacy organization. We do not sell your information and we never have. What we know about you is what you typed into a form, the small amount of information your browser sends to any website it visits, and a count of how many people read each page. We do not run advertising tags. We do not collect health information about you.

If you want to change something or ask us to delete what we hold, use our contact form and tell us. You can turn analytics off at any time on Your privacy choices.

Who we are, and what we are not

Personalized Health Association is a 501(c)(4) advocacy organization. We publish policy analysis and we engage with federal and state policymakers.

We are not a doctor's office and we are not covered by HIPAA. We do not provide care, we do not hold medical records, and nothing you send us is protected health information. Please do not send us test results, diagnoses or anything else about your own health. If you do, it lands in an ordinary email inbox.

What you give us directly

Our forms ask for your name and email address. Depending on which one you are filling in they may also ask for your organization, your role, and a phone number, and they always give you somewhere to write a message. Only the fields marked as required are required. Anything else is yours to leave blank.

We ask for your role because it tells us who should reply to you, and it saves us writing back to ask.

Every form records what it told you at the time. There is a line above the send button explaining what we may do with your details, and a box you can tick to agree to it. Ticking it is optional and you can send the form either way. We store the exact wording you were shown, whether you ticked it, and when, so the record is what you actually saw rather than a note that you agreed to something.

If you did not tick it, we will still reply to what you sent us. We will not add you to anything else.

At a conference, if you scan one of our codes, that form asks separately whether we may email you and whether we may call you, and it records those the same way.

Alongside every submission we store the page you were on when you submitted it and the site that referred you, so we know which work brought people in. That is stored next to your email address in our database.

We also record roughly where you were. Cloudflare, which serves this site, works out an approximate country and state from your internet connection, and we store that with your submission. We do not ask you for it, and we do not keep your IP address. It is an estimate, not a fact about you: a VPN, a work network or a hotel will all give the wrong answer. We use it to tell which state a coalition sign-up came from, so we do not have to ask you a question your connection can usually answer.

One exception, so that sentence is exact. The conference form runs a spam check, and to do that it passes your connection details to Cloudflare at the moment you submit. We do not receive them back and we do not write them down.

Cookies, analytics and what runs on this site

Three things run here. Two of them are counting tools and one of them remembers your privacy choice.

A cookieless page count runs on every visit. It records that a page was loaded. It sets no cookie and it does not identify you.

Google Analytics records which pages are read, roughly where in the world the reader is, and how they arrived. It sets cookies. Whether it runs depends on where you are, which is the next section.

One cookie of our own stores your answer about analytics, so we do not have to ask again. If we could not store it we would have to ask on every page.

We do not run advertising or conversion tags today. There is no Meta pixel, no Google Ads tag, no LinkedIn, TikTok or Reddit tag on this site. If we ever add one, we will name the platform on this page before the first tag runs, and you will be able to switch advertising off in advance on Your privacy choices.

Whether analytics runs, and how you change it

This depends on where you are, because the law does.

In Washington, Nevada, Connecticut and Maryland, and anywhere outside the United States, we ask first. You see a banner, and analytics does not run until you answer it. If you never answer, it never runs.

Everywhere else in the United States, analytics runs unless you turn it off. You will not see a banner. You can switch it off at any time on Your privacy choices, and we will remember that.

Global Privacy Control. If your browser or an extension sends a Global Privacy Control signal, we treat that as you telling us no, wherever you are, and analytics does not run. You do not have to do anything else.

Do Not Track. Browsers also send an older signal called Do Not Track. There is no agreed standard for what a site should do about it, so we do not rely on it. We honour Global Privacy Control instead, which is the signal with a legal meaning.

The rule about health topics

Advertising tags never load on a page about a health topic. Not throttled, not anonymized. They do not load. This is enforced in the code that builds every page, not by a policy someone has to remember, and it holds whether or not you have agreed to anything.

We are telling you this now, before we run any advertising at all, because the rule is the point rather than the current absence of tags.

Who else sees it

Four companies handle information on our behalf, and none of them is paid for your data. Cloudflare serves this site and stores form submissions. Google provides the analytics described above. Sanity stores the articles you read. Resend delivers email we send you.

We do not sell your personal information. We do not run advertising or conversion tags, so nothing on this site passes information to an advertising platform for cross-context behavioural advertising. Google Analytics collects what is described above about your visit to this site.

We will hand over information if a law requires it. If that ever happens and we are permitted to tell you, we will.

How long we keep it

Newsletter subscriptions we keep until you ask us to stop. Contact and partner messages we keep while the conversation is useful and then for as long as we might reasonably need the record. Analytics is aggregated and is not tied to your name.

If you want something deleted, ask us on the contact form and we will delete it and tell you when it is done.

Children

This site is written for adults working on health policy. We do not direct it at children and we do not knowingly collect information from anyone under 13. If you believe a child has sent us something, tell us and we will remove it.

Security

Everything is served over an encrypted connection. Form submissions go into a database that is not publicly readable. We use reputable providers and we keep the number of them small on purpose. No website can promise perfect security and we are not going to.

When this changes

If we change this page we will change the date at the top. If a change is significant we will say so here rather than editing quietly.

How to reach us

The fastest route is the contact form. For anything that needs to arrive in writing: