Privacy Policy

Last updated: 22 August 2026

1. Who we are

ClearOnHealth is a health information website at https://clearonhealth.com. If you have questions about this policy, contact us at privacy@clearonhealth.com.

2. What data we collect and why

2a. Browsing the site — no cookies, no third-party trackers

When you visit any page on this site, no cookies are set in your browser. We do not use Google Analytics, Facebook Pixel, or any other third-party tracking tool, and we do not sell or share your data with advertisers.

We do keep basic visitor statistics on our own server. When you open a page we record, against your IP address:

• a count of how many pages you have opened that day, and how many searches you made
• which pages you opened (the address of the page, without any search terms)
• your browser's user agent string (browser and operating system)
• the address of the site you arrived from, if you followed a link (the "referrer")
• the language and encoding your browser says it accepts

We use this to understand how much of our traffic is real readers rather than automated crawlers, and to keep the article-generation limits working. We do not use it to build a profile of you as an individual, we do not attempt to identify you, and we do not combine it with data from anywhere else. We do not use browser fingerprinting.

Each visit is scored automatically as likely human or likely automated, using only the information above — the browser string, whether standard request headers were sent, how many pages were opened, and whether the same browser string appears across many addresses. This classifies the request, not you: it produces no decision about you personally, has no effect on what you can read or do on this site, and is used solely so our visitor counts aren't distorted by crawlers.

A short one-way signature is derived from your IP address and these browser headers, purely to tell apart different people sharing a single connection. It is not read from your device and changes whenever your IP address changes.

Our web server (Nginx) may record standard access logs containing your IP address, the page requested, and the date and time. These logs are used solely for server security and troubleshooting and are automatically rotated after 90 days.

2b. Searching for a health topic

When you search for a topic that isn't already in our database, our server generates an article using our medical research and verification service. To prevent abuse and control API costs, we apply a daily limit on new articles per visitor. To enforce this we store your IP address alongside a date and a request counter. This data is used solely for rate limiting and is automatically deleted after 90 days. The legal basis for this processing is legitimate interest (Article 6(1)(f) GDPR) — preventing API abuse while not outweighing your privacy rights given the strictly limited purpose and short retention period.

You may request deletion of your IP address record at any time within the 90-day retention window by contacting privacy@clearonhealth.com.

The search query text you type (e.g. "headache") is sent to our medical research and fact-checking service, which retrieves and verifies health information on our behalf. This service does not receive any personal information about you.

2b-2. Search queries — logged anonymously for analytics

Search queries (the topic you type, e.g. "headache") are logged anonymously alongside the outcome (whether the article was cached, generated, or not found). No IP address, no user identifier, and no personal information is attached to these logs. They are used solely to help us understand which health topics are in demand and improve the content library. You can view what is logged at our analytics policy.

2c. Bookmarks — stored in your browser only

If you bookmark a topic, that information is saved in your browser's localStorage. It never leaves your device and is never sent to our server. You can clear it at any time by clearing your browser's site data or using the bookmark remove button.

2d. Ratings and flags

If you submit a star rating or flag an article, we store the rating value or flag type linked to the article. We do not store any information that identifies you personally alongside a rating or flag.

2e. Fonts

This site uses fonts that are hosted on our own server. No request is made to Google Fonts or any other external font service when you visit.

2f. Hostname lookups

From the admin pages we can look up the hostname registered against a visiting IP address (a reverse DNS query). This is a standard internet lookup handled by the naming system rather than a data transfer to a company we have chosen, and it reveals nothing about you beyond what the operator of that address block has already published. The result is cached on our server so the same address is not looked up repeatedly.

3. Legal basis for processing (GDPR)

Where we process personal data, the legal basis is:

• Legitimate interests (Article 6(1)(f)) — for IP addresses, server access logs, visitor counts, browser user agent, referrer and accepted language/encoding.
  The interest: keeping the service available and preventing abuse. This site generates articles on demand at our own cost, so we need to identify automated crawlers and scrapers, enforce a daily generation limit per visitor, and detect attempts to bypass that limit.
  Why this data is necessary: a request cannot be told apart from an automated one without looking at how it behaved — which address it came from, what browser it claims to be, whether it sent the standard headers a browser sends, whether it arrived from a link, and which pages it opened in what order. Volume alone is not enough: a reader and a scraper can produce the same number of requests, and only the pattern of pages separates them. Recording less would mean acting on volume alone, which would restrict legitimate readers along with automated traffic.
  Balancing: the data is limited to what the request itself reveals, is not combined with anything else, is not used to advertise to you or to make any decision about you, is not shared, and is deleted after 90 days. We consider this proportionate, but you may object at any time — see section 5.
• Contract performance (Article 6(1)(b)) — passing the topic you searched for to the service that writes the article is necessary to provide what you asked for.

3a. Health-related information

Why page addresses are necessary, and not just page counts. A count on its own cannot distinguish a reader from a crawler: ten page views may be one person reading around a topic, or an automated script working through the site. What separates them is which pages were opened and in what pattern. A person reads a handful of related articles; a scraper works through the library in sequence, or requests pages no reader would arrive at unprompted. Without the addresses we cannot tell these apart.

This matters for three reasons. This site writes articles on demand at our own expense, so systematic copying of the library is a direct cost we need to be able to detect. Attempts to evade the daily generation limit show up as the same sequence of pages requested from changing addresses, which is only visible if the pages are recorded. And most importantly for you: if we could only act on counts, we would have to restrict anyone whose volume looked unusual — including someone genuinely reading a lot. Being able to see the pattern means we can identify the automated traffic specifically and leave ordinary readers alone.

Because this site is about health, the address of a page you opened can imply something about your health. We therefore keep this to the minimum that the purpose above requires:

• we record the page address only, never the search terms you typed;
• it is used solely to distinguish real readers from automated crawlers and to investigate abuse — never to build a picture of any individual;
• it is visible only to the site administrator, is never shared, and is deleted automatically after 90 days;
• it is currently stored against your IP address. Enabling IP hashing in the site settings would store it against a one-way hash instead.

If you would prefer your visits not to be recorded in this way, you may object at any time — see section 5.

3b. Automated processing

Each visit is scored automatically as likely human or likely automated. This is not automated decision-making within the meaning of Article 22: it produces no legal or similarly significant effect, it does not change what you can read or do here, and it is used only so our visitor statistics are not distorted by crawlers.

4. How long we keep data

• Raw IP rate-limit records — 90 days, then automatically deleted
• Nginx server access logs (IP, pages visited, timestamps, browser/device type) — 90 days, then rotated
• Browser user agent string, referrer, and accepted language/encoding — stored alongside visitor records for 90 days
• Daily page-view and search counts per IP address — 90 days, then automatically deleted
• Which page addresses were opened, per IP address — 90 days, then automatically deleted
• Cached country, provider and hostname for an IP address — kept until manually cleared
• Ratings and flags — retained while the associated article exists
• Bookmarks — stored in your browser; deleted when you remove them or clear site data

5. Your rights

Under the GDPR you have the right to:

• request a copy of the personal data we hold about you (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased (Article 17);
• restrict how we process it (Article 18);
• receive it in a portable format (Article 20);
• object to processing based on legitimate interests (Article 21) — this applies to everything described in section 3 above, and you may exercise it at any time by contacting us.

Tell us the IP address you used and we can locate or delete the matching records within the 90-day retention window. To exercise any right, email privacy@clearonhealth.com.

You also have the right to lodge a complaint with a data protection supervisory authority.

Providing this data is not a statutory or contractual requirement. It is collected automatically as a consequence of making a request to the site, and there is no obligation on you to provide it.

6. Third parties

We use the following third-party services:

• Medical research and verification service — used to retrieve, verify and compile health information for each topic. Search query text is sent to this service on our behalf. No personal data about you is shared.

We do not sell, rent, or share your data with any other third parties.

7. Cookies

This site sets no cookies for regular visitors. The admin panel sets a session cookie — this is only set if you log in to the administration area and is not relevant to ordinary site visitors.

8. Children

This site is intended for general audiences. We do not knowingly collect data from children under 13. If you believe a child has submitted personal data, contact us and we will delete it promptly.

9. Changes to this policy

If we make material changes we will update the "Last updated" date above. Continued use of the site after changes constitutes acceptance.