Privacy policy
What this site collects, why, who else sees it, and how to make us delete it. If you read one section, read the one on quiz answers — those describe your health, and they are handled differently from everything else here.
Written by Sarah CollinsLast updated
PCOSguides collects three things and no more: your email address if you ask for the newsletter or a free guide, your quiz answers if you take the phenotype quiz, and ordinary web analytics through Google Analytics. Quiz answers are treated as sensitive health data. Nothing here is ever sold, and everything here can be deleted by sending one email to support@pcosguides.com.
You can read every article on this site without giving us anything at all. Reading is not collecting. Nothing below applies until you fill in a form, take the quiz, buy something, or write to us.
Who is responsible for your data
PCOSguides is written and published by Sarah Collins from Wyoming, United States. There is no company in between — one person runs this site, and she is the one who answers when you write in. In GDPR terms she is the data controller. In CCPA terms she is the business.
Contact for anything on this page: support@pcosguides.com. It reaches the same inbox as everything else, described at Contact.
Postal address: 30 N Gould St, Sheridan, WY 82801
There is no data protection officer. A site this size is not required to appoint one, and naming a role nobody fills would be the sort of decoration this site exists to avoid.
What this site collects, and why
Everything, in one table. The status column is there because most of this site is not wired up yet — a row marked "not connected" describes what will happen when it is, not something already sitting in a database.
| What | When it is collected | Why | Legal basis | How long it is kept | Status |
|---|---|---|---|---|---|
| Your email address | When you subscribe, or ask for a free guide | To send you the guide and the weekly email | Consent — GDPR Art. 6(1)(a) | Until you unsubscribe. After that we keep the address on a suppression list so we cannot accidentally email you again. | In use |
| Your first name, if you type one | Same form. Optional, and the form works without it | So the email is addressed to a person | Consent — GDPR Art. 6(1)(a) | While you are subscribed | In use |
| Your nine quiz answers | Never. They are scored in your browser and are not sent anywhere | — | — | Never held by us. Closing the tab discards them. | In use — and collects nothing |
| Your phenotype result — one of four type names, and how strongly it matched | Only if you tick the box under your result and ask for the write-up by email | To send the write-up for that type, and to decide which emails and articles follow it | Explicit consent — GDPR Art. 9(2)(a) | While you are subscribed, or until you ask us to remove it | In use |
| Subscriber tags — which section you signed up from, which guide you asked for, your quiz result | As you use the site and the emails | To stop sending you things that do not apply to you | Consent — GDPR Art. 6(1)(a). Explicit consent — Art. 9(2)(a) — for the quiz-result tag. | While you are subscribed | In use |
| Email opens and link clicks | When you open or click one of our emails | To see which emails were worth writing, and to stop sending to addresses that never open | Legitimate interests — GDPR Art. 6(1)(f) | While you are subscribed | In use |
| Order details — what you bought, when, and the email you bought it with | When you buy something | To deliver it, to answer support questions, and to keep tax records | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) | As long as tax and accounting rules require records of the sale to be kept | In use |
| Card and bank details | Never. The checkout provider takes payment; the details never reach this site | — | — | Never held by us | Not applicable |
| Analytics — pages viewed, the page you arrived from, approximate country, browser and device type, and a random ID stored in a cookie so repeat visits from one browser count as one reader | When you read any page | To see which articles get found and which are unreadable on a phone | Consent where the cookie rules require it. No consent banner is built yet, which is a gap we are naming rather than papering over. | Google keeps the event data for the retention period set on the property; we only ever read it in aggregate | In use — Google Analytics 4 |
| Session recordings and heatmaps — a replay of how you moved, scrolled and clicked through a page | When you read any page except the quiz, which is excluded on purpose | To see where a page confuses people or breaks on a phone, which a page-view count cannot show | Consent where the cookie rules require it. No consent banner is built yet — the same gap as the row above. | Microsoft keeps recordings for 30 days by default, then deletes them | In use — Microsoft Clarity |
| Server logs — IP address, request time, page requested, browser string | Automatically, by the host that serves these pages | To serve the site, and to deal with abuse and outages | Legitimate interests — Art. 6(1)(f) | A short period set by the host, not by us | In use |
| Whatever you write in an email to us | When you email support | To reply to you, and to fix the article if you reported an error | Legitimate interests — Art. 6(1)(f) | While the thread is live, then archived in the mailbox | In use |
What this site never collects
- Government ID numbers — no passport, licence, Social Security or national insurance number
- Financial account or card numbers
- Precise geolocation
- Biometric or genetic data
- Race, ethnicity, religion, sexual orientation, or union membership
- The contents of your messages to anyone other than us
- Anything scraped from a data broker or bought from a list
Your quiz answers are health data, and they are handled that way
The phenotype quiz asks about your cycle, your skin, your energy, your mood and your history with hormonal birth control. It does not ask your weight and it does not ask for lab results. Put together, those answers say that you have or suspect PCOS and which type you look like. That is information about your health. Under GDPR it is special category data. Under California's CPRA it is sensitive personal information. It is also the sort of thing that, handled carelessly, ends up in an advertising segment or an underwriting file — so it gets the strictest handling on this site.
What is stored
Your individual answers are never sent anywhere. They are scored on your own device, they are gone when you close the tab, and no version of this site has ever received one. What can be stored — and only if you tick the box under your result and ask for the write-up — is one tag on your subscriber record: insulin-resistant, inflammatory, adrenal, post-pill, or unknown, plus how strongly it matched and the date you took it, so we know when the result is old enough to be worth retaking.
That tag is stored with your email address inside our email provider. It is not stored on this website, because this website is a set of static files with no reader database behind it. Tick nothing and nothing is stored: the result stays on the page in front of you and goes no further.
What it is used for
- Showing you your result page and the articles that match it.
- Deciding which emails you get. Someone whose goal is fertility should never receive a weight email — that is the whole reason the tag exists.
- Counting how many people fall into each phenotype, in aggregate, with no name attached.
What it is never used for
- Selling. Your quiz result is not for sale, at any price, to anyone.
- Advertising. It is never passed to an ad network, a data broker, or a social platform, and it is never used to build an advertising audience.
- Anything to do with insurance, employment, or credit. Nobody in those industries receives it.
- Sharing with another company for their own purposes. Our email provider processes it on our instructions and for nothing else.
A quiz result is also not a diagnosis and not a medical record. It is a way of organising symptoms you already recognise so you can ask your clinician a sharper question — see the medical disclaimer.
How to have it deleted
- Email support@pcosguides.com with "delete my quiz answers" in the subject line, from the address you used, or naming that address.
- We remove the phenotype tag and the date from your subscriber record.
- You get a reply confirming it is gone. The aim is a few days; the outside limit we hold ourselves to is 30 days.
Deleting the tag does not unsubscribe you — you keep getting the general emails unless you also unsubscribe, which is one click at the bottom of any of them. You can also just retake the quiz later; the new result replaces the old one.
Because the quiz runs on explicit consent, you can withdraw that consent at any time and withdrawing it is exactly the deletion above. Withdrawal does not undo anything already done with the tag before you asked, which in practice means emails already sent.
As of the date at the top of this page the quiz is live and it is scored entirely in your own browser. Your answers are never transmitted to us, never stored on our servers, and no quiz answer has ever been collected. The one thing that can leave the page is the four-word result those answers produced, and only when you tick the box under it and ask us to email you the write-up — that tick is the whole of the consent, and unticked, nothing moves. The session-recording tool described under "Analytics" is switched off for the whole of the quiz for exactly this reason: a replay would capture which answer you ticked, and that would make the first sentence of this paragraph false.
Cookies and consent
PCOSguides sets cookies for two measurement tools and nothing else. Google Analytics sets_ga and a second cookie named after the measurement property. Microsoft Clarity sets _clck and _clsk, and Microsoft's own domains may set identifiers of their own — CLID, MUID, ANONCHK — when the Clarity script loads. All of them hold a random number rather than your name or your email, and they exist so that four pages read in one sitting count as one reader rather than four. Those two tools are the only third-party scripts on the site. The fonts are served from this domain rather than from Google, and there is no tag manager. You can check all of that in your browser's network tab, which is a better source than this sentence.
Those cookies are not strictly necessary, and under UK and EU rules they should be set only after you agree. The consent banner that would ask you is not built yet, so at the moment they are set as soon as the page loads. That is a gap, it is ours, and it is written here rather than left for you to discover in the network tab. Until the banner ships you can block the cookies in your browser settings or with any content blocker, and nothing on the site breaks if you do — the pages are plain HTML and do not need JavaScript to be read.
Two other things may set cookies, and each is described before it happens:
- Affiliate links. When you click a link to a shop, that shop may set its own cookie on its own site to attribute the sale. That happens after you leave here and under their policy, not ours.
- Checkout. The checkout provider sets what it needs to process your payment and prevent fraud. Those are strictly necessary for a transaction you asked for.
Non-essential cookies will never be set before you agree, for readers in the UK and the EU or anywhere else. You can also block or clear cookies in your browser settings, and if your browser or extension sends a Global Privacy Control signal we treat it as a valid opt-out of any sale or sharing — a right we already honour by not doing either.
Analytics
This site uses Google Analytics 4. It records which page you looked at, which page or search sent you here, the country your IP address resolves to, and your browser and device type. It does not record your name, your email address, or your precise location, and Google discards the IP address itself after working out the country.
The point of it is to see which articles get found and which pages people leave immediately, not to follow you. In Google Analytics the advertising and cross-site features — Google Signals, ad personalisation, remarketing — are not switched on, and we do not use anything measured here to target advertising at you.
The site also uses Microsoft Clarity, which is a different kind of tool: it records a replay of your visit. That means the movement of your pointer, what you scrolled past, what you clicked, and the order you moved through the pages in. Text you type into a field is masked in your own browser before anything is sent. The purpose is to find the paragraph where people give up and the button that does not work on a small screen.
Two honest caveats about Clarity, because they are the reason to think twice about it.Clarity is not loaded on the quiz — not on the questions and not on the result pages — so no replay of it exists and the promise above holds. And Clarity belongs to Microsoft, whose terms let them use what it collects for their own purposes, including advertising. We do not do that and we get nothing from it, but we cannot promise on Microsoft's behalf, so we do not.
Google Analytics was chosen over a cookie-free tool because it is what Search Console data joins to. The cost of that choice is the cookie described above and the consent gap named with it. If you would rather not be counted, block the cookies or install any tracker blocker; both work, and neither costs you anything on this site.
Analytics is never joined up with your quiz result or your email address. The two are kept apart on purpose.
Who else sees your data
Only the companies that make the site work, and only the part each one needs. None of them may use your data for their own purposes, and none of them is paid in data.
| Service | What it does | What it receives | Status |
|---|---|---|---|
| Brevo (Sendinblue SAS, France) | Holds the mailing list and sends every email this site sends — the write-up for your quiz result, the weekly letter, and the receipt for anything you buy | Your email address, your first name if you gave one, your phenotype result and how strongly it matched, the sentence you consented to and the time you agreed to it, which list you are on, and whether you opened or clicked. Never your individual quiz answers. | In use |
| Stripe (Stripe, Inc., United States) | Takes the payment at checkout. Stripe is not the merchant of record — PCOSguides is the seller, so your contract is with us, not with Stripe | Your name, email, billing address, and your card details. Card details go to Stripe and never reach this site. | In use |
| Google Analytics 4 (Google LLC) | Counts page views and where readers arrive from | The page you viewed, the page you came from, approximate country, browser and device type, and the random ID in its cookie. Google works out the country from your IP address and does not store the address itself. | In use |
| Microsoft Clarity (Microsoft Corporation) | Records session replays and builds heatmaps, so we can see which parts of a page get used and which get skipped | A replay of your visit — mouse movement, scrolling, clicks, the pages you moved between — plus browser, device and approximate country. Text you type is masked before it leaves your browser. Clarity is not loaded on the quiz at all. | In use |
| The static host that serves these pages | Delivers the HTML to your browser | Your IP address and the standard request details, in server logs | In use |
| Affiliate merchants and networks | Attribute a purchase to the link you clicked here, so a commission is paid | That you arrived from a link on this site — usually through a cookie they set on their own domain, after you leave | No affiliate links published yet |
Two other situations are worth naming. Data can be disclosed where the law requires it — a court order, a lawful request from an authority. And if this site were ever sold or merged, the subscriber list would move with it; you would be told before that happened, and unsubscribing would still be one click.
Affiliate links
Some links in product comparisons will earn a commission. Clicking one takes you to another company's site, where their privacy policy applies and ours stops. We never send them your email address, your name, or your quiz result — the only thing that travels is the fact that the click came from here. What a commission does and does not change about what a page says is set out at Affiliate disclosure.
If you are in the UK or the EU
The UK GDPR and the EU GDPR give you rights over your data, and they cost nothing to use. The legal basis for each thing we do is in the table above, so you can see which right applies where.
- Access. A copy of everything held about you.
- Rectification. Correction of anything wrong — a misspelled name, the wrong phenotype tag.
- Erasure. Deletion, including your quiz result, subject to records we must keep for tax.
- Restriction. A freeze on using your data while a dispute is sorted out.
- Portability. Your data in a machine-readable file, or sent to another provider.
- Objection. An objection to anything done on the basis of legitimate interests.
- Withdrawing consent. At any time, for the newsletter and for the quiz, without affecting what was already done.
- No automated decisions. Nothing here makes a decision about you with legal or similarly significant effects. The quiz sorts you into a content segment; it does not decide anything about your life.
If we get it wrong you can complain to your national supervisory authority — the Information Commissioner's Office in the UK, or your country's data protection authority in the EU. We would much rather you told us first, but you do not have to.
If you are in California
The CCPA, as amended by the CPRA, gives California residents a specific set of rights. Here are the categories in the statute's own terms, translated into what they actually mean on this site.
| Statutory category | What that is here | Where it comes from | Disclosed to | Sold or shared |
|---|---|---|---|---|
| Identifiers | Email address, IP address | You, and your device | Email provider, host, analytics provider | No |
| Commercial information | What you bought and when | You, through the checkout provider | Checkout provider | No |
| Internet or other electronic network activity | Pages viewed, emails opened and clicked | Your device and your email client | Analytics provider, email provider | No |
| Geolocation data | Approximate country or region, worked out from your IP address. Never precise location. | Your device | Analytics provider, host | No |
| Sensitive personal information — health | Your phenotype result, and only if you ask for the write-up by email. Never your individual answers — those stay in your browser. | You, when you tick the box under your result | Email provider only | No |
| Inferences | Which phenotype segment you are in, and which topic you care about | The result your answers produced in your browser, and which guide you asked for | Email provider only | No |
Do Not Sell or Share My Personal Information
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those two terms are defined in the CCPA. We have not done either in the twelve months before the date at the top of this page, and we do not plan to start. There is no opt-out link on this page because there is nothing to opt out of; if that ever changes, the link appears here and in the footer before the change takes effect.
We also do not sell or share the personal information of anyone we know to be under 16.
Sensitive personal information
Your quiz answers are sensitive personal information under the CPRA. They are used only to provide the thing you asked for — your result, and emails that match it — which is a permitted purpose that does not trigger a right to limit. You can still have them deleted at any time, using the steps in the quiz section above, and that is the stronger remedy anyway.
Business purposes, retention, and no retaliation
Everything collected is used for the business purposes named in the table further up: sending what you asked for, delivering what you bought, answering support, and understanding traffic in aggregate. Retention is in the same table, category by category. We do not keep a category of data longer than the purpose it was collected for requires.
Using any of these rights costs you nothing and changes nothing about what you receive. You will not get a worse price, a smaller free guide, or a slower reply for asking.
How to use any of these rights
One route for all of them, wherever you live. We do not run a separate portal, because a portal with one person behind it is just an email address with extra steps.
- Email support@pcosguides.com and say what you want — a copy of your data, a correction, deletion, or all of it.
- Tell us which email address to look up. That address is how your record is found, so a request from a different address will need something that ties the two together.
- We may ask one question to confirm it is you, and only enough to be sure. We will not ask you to send identity documents to prove ownership of an email address.
- The aim is a reply within a few days, and the outside limit is 30 days for California requests and one month for GDPR requests. If a request is genuinely complicated we will tell you before that runs out rather than after.
An authorised agent can make a California request for you, with written permission from you that we can verify.
You can also unsubscribe without emailing anyone: every email has a one-click unsubscribe link at the bottom, and it works immediately.
Children
This site is written for adults and is not directed at children. We do not knowingly collect data from anyone under 13, or under 16 in the UK and the EU. If you believe a child has given us their details, email us and we will delete the record.
Teenagers are diagnosed with PCOS and teenagers read pages like this one, so to be clear: reading is fine and collects nothing. If you are under 16, do not subscribe or take the quiz without a parent or guardian doing it with you.
Where your data is held
This site is published from Wyoming, United States, and the services it relies on are United States companies. If you are in the UK or the EU, your data is transferred to and stored in the United States.
For each provider, the transfer relies on whatever lawful mechanism that provider offers — standard contractual clauses, or their certification under a framework recognised for UK-to-US and EU-to-US transfers. This draft does not name a mechanism for any specific provider because that has not been verified yet, and stating an unverified one would be worse than stating none. It is on the list for legal review before anything is collected.
How your data is protected
The honest version. This site is a set of static files with no login, no comments, no reader database, and no server-side code that could be tricked into handing anything over — there is nothing here to breach. The email list and any orders live inside the providers named above, under their security, reached from accounts protected by strong unique passwords and two-factor authentication.
No one can promise perfect security, and a privacy policy that does is lying. What we can say is that the amount held is deliberately small, because the safest data is the data that was never collected.
Changes to this policy
The date at the top of this page is the date it last changed. When a service in one of the tables above goes live, its status row changes here first, before it starts collecting.
If a change materially affects how your data is used — a new category collected, a new company receiving it, a new purpose — subscribers are told by email before it takes effect, and the change is noted on the page. Small corrections to wording are made without an announcement.
Questions, and complaints
Email support@pcosguides.com. Sarah Collins reads it. If something on this page is confusing, that is a defect worth reporting — this page is meant to be understood, not merely published.
The rest of the paperwork: Terms, Medical disclaimer, Affiliate disclosure, and how articles get written and corrected at Editorial policy.