Privacy Policy

This policy explains what Heal Within Magazine collects when you visit healwithinmagazine.com, why we collect it, who else can see it, and the rights you have over it. We have tried to write it in plain English. Where a term has a specific legal meaning under the GDPR or the CCPA/CPRA, we use it deliberately.

1. Who we are

Heal Within Magazine is published by Heal Within Media ([Registered address — replace before launch]). For the purposes of the UK and EU General Data Protection Regulation, Heal Within Media is the data controller for personal data processed through this site. You can reach us at privacy@healwithinmagazine.com.

2. The short version

We do not require an account, and you can read everything here without giving us anything.
We do not sell or share your personal information for cross-context behavioural advertising.
Our hosting provider keeps standard server logs, including IP addresses, for security.
If you email us or subscribe to the newsletter, we keep what you send us until you ask us not to.
We honour Global Privacy Control signals as an opt-out request.

3. What we collect

3.1 Information you give us

Email correspondence. Your address, your message, and anything you choose to include in it.
Newsletter subscription. Your email address, the date and IP address of your confirmation (kept as proof of consent), and whether you open or click — if and when our newsletter is running.
Accessibility, correction, DMCA and privacy requests. Whatever you send, plus enough identifying detail for us to respond and to verify a rights request.

3.2 Information collected automatically

Server and CDN logs. Our hosting provider records IP address, user agent, requested URL, referring URL, timestamps and response codes. These are used to serve the site, block abuse and diagnose faults, and are retained on a rolling short-term basis by the provider.
Strictly necessary storage. A single browser storage entry recording your cookie choices, if you make one. It contains no identifier.
Analytics. Currently none. We do not run an analytics product on this site, and no analytics cookie is set.

3.3 What we deliberately do not collect

We do not ask for health information, and we ask you not to send us any. Nothing you read here is logged against your identity, and we do not build interest profiles from your reading.

4. Why we process it, and on what legal basis

Purpose	Data	Legal basis (UK/EU GDPR)
Serving pages and keeping the site up	Server logs	Legitimate interests (Art. 6(1)(f)) — operating a website
Security, abuse and bot mitigation	Server logs, IP	Legitimate interests — network and information security
Replying to your email	Correspondence	Legitimate interests, or steps prior to a contract
Sending the newsletter	Email address, engagement	Consent (Art. 6(1)(a)) — withdrawable at any time
Optional analytics	Aggregate usage	Consent
Handling legal requests and keeping records	Whatever the request contains	Legal obligation (Art. 6(1)(c)) / legitimate interests

5. Cookies and similar technologies

Set out in full in our Cookie Policy. In short: we set no advertising cookies, and any non-essential storage is loaded only after consent.

6. Who else sees your data

We do not sell personal information. We share it only with service providers who process it on our instructions, under contract:

Hosting and CDN — Cloudflare, Inc., which serves this site and provides security filtering.
Email — our mail provider, for correspondence sent to the addresses on this site.
Newsletter delivery — our email service provider, if you subscribe.

We may also disclose information where we are legally required to, or where it is necessary to establish, exercise or defend legal claims. If the publication is ever sold or merged, personal data may transfer as part of that transaction, and this policy will follow it.

7. International transfers

Our providers operate globally, so your data may be processed outside your country, including in the United States. Where personal data of EU/UK residents is transferred out of those regions, we rely on the UK International Data Transfer Agreement, the European Commission's Standard Contractual Clauses, or an adequacy decision, as applicable.

8. How long we keep things

Server logs — a short rolling window set by our hosting provider, typically days.
Email correspondence — up to 24 months after our last exchange, unless the matter is legal, in which case longer.
Newsletter — until you unsubscribe, plus a suppression record so we do not email you again.
Rights requests — records of the request and our response, for as long as we may need to demonstrate compliance.

9. Your rights

9.1 If you are in the UK, EU or EEA

You have the right to access your data; to have it corrected; to have it erased; to restrict or object to processing (including objecting to processing based on legitimate interests); to data portability; and to withdraw consent at any time without affecting processing already carried out. You also have the right to lodge a complaint with your supervisory authority — in the UK, the Information Commissioner's Office; in the EU, the authority in your country of residence.

9.2 If you are a California resident

Under the CCPA as amended by the CPRA you have the right to know what we collect and why, to access a copy, to correct inaccuracies, to delete, to opt out of sale or sharing, to limit use of sensitive personal information, and not to be discriminated against for exercising any of these. We do not sell or share personal information as those terms are defined by the CPRA, and we do not process sensitive personal information for inferring characteristics. See Do Not Sell or Share My Personal Information. Authorised agents may submit requests with written proof of authorisation.

9.3 Other jurisdictions

Residents of Virginia, Colorado, Connecticut, Utah, Texas and other states with comprehensive privacy laws, and residents of countries with equivalent regimes, have broadly similar rights. Ask and we will apply them.

9.4 How to exercise them

Email privacy@healwithinmagazine.com with what you want. We will respond within 30 days (45 for CCPA requests, extendable once where permitted, with notice). We may ask you to confirm control of the email address involved — that is verification, not an obstacle. Exercising these rights is free.

10. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

11. Do Not Track and Global Privacy Control

There is still no agreed standard for Do Not Track headers, so we cannot promise a specific response to them. We do treat a Global Privacy Control signal as a valid opt-out of sale or sharing under the CPRA and equivalent laws.

12. Children

This site is written for adults and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, email privacy@healwithinmagazine.com and we will delete it.

13. Security

The site is served over HTTPS with HSTS. It is a static site with no user accounts, no login and no database of readers, which removes most of the ways a publication like this would otherwise leak data. No system is perfectly secure, and we cannot guarantee the security of information you send us by email.

14. Links to other sites

We link to other publications, health authorities and, on clearly labelled pages, to commercial offers. Once you follow a link, you are on someone else's site under someone else's policy. Read it.

15. Changes

If we change this policy materially we will update the effective date at the top and, where the change affects how we handle data already collected, say so prominently on the homepage.

16. Contact

Privacy questions and rights requests: privacy@healwithinmagazine.com.
Postal: Heal Within Media, [Registered address — replace before launch].