Privacy Notice

Who is responsible

HERA Analytics is not currently a separately incorporated company.

Information we collect

• Signup information such as first name and email address
• Your consent choices and related timestamps
• Survey answers, including optional free-text responses and general health-context answers
• Research-interview or future-contact preferences
• Technical and attribution data such as timestamps, landing page, referrer, and campaign parameters when present
• Security and delivery data such as IP address, browser/device information, requested path, response status, and related request metadata
• Your selected language for the participant flow and aggregate reporting by language

Information we do not request

• Actual blood-test or biomarker values
• Laboratory documents or medical records
• Information for diagnosis, treatment, or individualized patient care

Why we use information

• Operate signup, survey, resume, and completion workflows
• Conduct aggregate research and evaluate the HERA concept
• Invite consenting participants to research interviews or relevant follow-up
• Maintain security, data quality, auditability, and privacy operations
• Present the website, survey, and transactional emails in the selected language and review aggregate completion patterns by language
• Measure aggregate website and campaign performance when optional tracking consent is given

Consent and lawful handling

HERA records the consent choices presented during signup and survey participation. You may withdraw consent or request deletion by contacting us. Optional tracking consent is separate from consent to store research responses and contact you about the research.

Participation is limited to adults aged 18 or older. Signup requires confirmation that the participant meets this age requirement.

Service-provider categories

• Cloud hosting and database providers that operate the website, API, and research records
• Transactional email providers that deliver signup, survey-completion, and staff-account messages
• Campaign-measurement providers that load only after optional tracking consent
• Source-code providers and operational security, DNS, content-delivery, and traffic-protection providers

Meta Pixel, Google Analytics, and Cloudflare Web Analytics are disabled during the closed prelaunch. HERA will not enable optional campaign measurement unless its legal, consent, provider, and operational review is completed first.

Cloudflare helps route and protect traffic to HERA. As part of this essential role, it may process IP addresses, request metadata, and content transmitted through proxied requests for delivery, abuse prevention, security monitoring, and operational troubleshooting. Cloudflare Web Analytics and its browser-based real-user measurement beacon are not enabled.

Data sharing

• Individual user data is not sold
• Individual responses are not sold to supplement companies
• Individual responses are not publicly disclosed
• Data may be processed by service providers acting for HERA for the purposes above
• Free-text responses are not shared externally without an authorized review process because participants may enter identifying information

Tracking and cookies

Meta Pixel, Google Analytics, and Cloudflare Web Analytics are currently disabled. If optional campaign measurement is introduced later, it will remain subject to an explicit tracking choice and will be limited to aggregate website and campaign measurement. Personal form answers, health information, scores, and segments must not be sent to measurement providers.

HERA stores your tracking choice in your browser. Temporary browser storage may retain campaign attribution and the signup-to-survey handoff, while local browser storage may retain your functional language preference and an opaque survey-resume credential so you can continue saved progress. Protected staff access uses secure session and anti-forgery cookies. Essential storage and Cloudflare traffic protection are not controlled by the optional Meta choice.

Authorized access and exports

Access to research records is restricted by staff role. Authorized staff may review information needed for research operations, data quality, support, and privacy requests. Exports are permission-controlled and audited, and free-text material requires human review because participants may enter identifying information.

Retention

Signup records without a survey start, incomplete surveys, and invalid or attention-check-failing completions are normally kept for up to 90 days. Valid completed research records are normally kept for up to 24 months. Transactional email events and ordinary operational audit records are normally kept for up to 12 months; minimized records needed to demonstrate deletion, consent withdrawal, or critical security actions may be kept for up to three years.

Controlled test records are normally removed within 30 days after the relevant test activity. Downloaded free-text exports must be deleted after their approved review and no later than seven days. Routine database backups use a rolling maximum retention of 30 days. If a backup is restored, completed deletion and consent actions must be reapplied before normal use resumes.

HERA may delete or irreversibly anonymize information earlier when it is no longer needed or when a verified deletion request is completed. A period may be extended only where a documented legal obligation, active security investigation, or other justified overriding need applies. Retention periods and criteria are reviewed when the research purpose or provider setup changes.