Draft v0.1 · Document A5
Your Privacy Choices
How to opt out, limit use, withdraw consent and make a request; how Global Privacy Control is honored.
Part 1. Page copy (publish at /your-privacy-choices)
Your Privacy Choices
Effective date: [EFFECTIVE DATE] | Version: [VERSION] | Last updated: [LAST UPDATED]
You decide how WellPeps uses your information. This page lists your choices and shows how to use them. It applies to everyone in the United States, whatever state you live in.
1. Your choices at a glance
Your choice | What it does | How to use it |
|---|---|---|
Opt out of sale, sharing and targeted advertising | Stops any sale of your information, any sharing for cross-context behavioral advertising and any targeted advertising. | We do none of these today. If that changes, you will find a switch on this page before any such tool turns on, and a Global Privacy Control signal will count as your choice. |
Limit the use of your sensitive information | We use your health information only to provide the services you asked for. | Tell us in Section 5 and we will record your choice and honor it. |
Withdraw consent | Takes back a consent you gave us to collect or share health-related information. | Section 6. |
Unsubscribe from marketing email | Stops marketing email. We do not send marketing text messages. | Use the link at the bottom of any email, or Section 2. |
Access, correct, delete or get a copy of your information | Shows what we hold, fixes it, deletes it or gives you a portable copy. | Section 7. |
Appeal a decision | Asks us to look again if we said no. | Section 7. |
2. How to make a request
Use any of these:
- Use the Your Privacy Choices page on wellpeps.com.
- Email [PRIVACY EMAIL].
- Use our web form: [PRIVACY REQUEST WEBFORM].
- Write to WellPeps, Attn: Privacy, [BUSINESS ADDRESS].
- By phone: [SUPPORT PHONE AND HOURS, ONLY IF LIVE] (delete this line unless a staffed line exists; no phone line is live today).
Tell us what you want, the email address you used with us and your state. Please do not put health details in a request. You do not need an account.
How we check it is you. We match what you tell us with what we hold, and we may send a link to your email address. For information in the patient portal we may ask you to sign in. We do not ask for your Social Security number. Opting out, limiting, withdrawing consent and unsubscribing need less checking than access or deletion.
How fast. We confirm we received your request within [10 business days]. We act on opt-outs, limits, withdrawals and unsubscribes within [15 business days] (marketing email within [10 business days]). We answer access, correction, deletion and copy requests within [45 days], and we may extend once by up to [45 days] and tell you why [VERIFY: periods per state]. There is no charge.
3. Opt out of sale, sharing and targeted advertising
Some state laws count it as a “sale” or “sharing” when a website sends your information to an advertising company, even if no money changes hands. WellPeps does not do this. We do not use advertising or analytics tools on wellpeps.com today.
Before we turn on any tool that is not essential, we will ask for your permission, build the control for it on this page, and list the tool in the Cookie and Tracking Technologies Notice. Nothing will load before you say yes.
4. Global Privacy Control
Global Privacy Control (GPC) is a browser setting, or an extension you can add, that tells websites you want to opt out of sale, sharing and targeted advertising. Because wellpeps.com does not do any of these today, a GPC signal does not change what the site does. Before we turn on any tool that is not essential, we will build and test handling for GPC and describe it here.
You do not need GPC to use your choices today. Use Section 2 at any time.
5. Limit the use of your sensitive information
Health information is sensitive personal information. We use it only to provide the services you asked for, keep our systems secure, prevent fraud and meet legal duties. We do not use it for advertising. If you want us to keep our use to that and nothing more, tell us in Section 2. We will record your choice and honor it within [15 business days]. Protected health information held by the Practice is covered by the Notice of Privacy Practices.
6. Withdraw your consent
Some health-related information is collected or shared with your consent, for example the topic of a free guide tied to your email address. You can take back that consent at any time. Use Section 2 and say which consent. We will stop the collection or sharing it covered within [15 business days]. Withdrawing does not undo what happened before. If we need the information to provide a service you asked for, we will tell you that withdrawing may end the service. To take back a permission you gave the Practice for protected health information, follow the Notice of Privacy Practices and the HIPAA Authorization Forms.
7. Access, correct, delete, copy and appeal
You can ask to see the information we hold about you, get a portable copy, correct it or delete it. Use Section 2. We may keep what the law requires us to keep, and we will tell you what and why. Records held by the Practice are covered by the Notice of Privacy Practices.
If we say no in whole or in part, you can appeal within [60 days]. Email [PRIVACY EMAIL] with “Appeal” in the subject line. A person who did not decide the first request will review it, and we will answer in writing within [45 days]. If we deny your appeal, you can contact your state attorney general. The Consumer Health Data Privacy Policy lists the offices.
8. Authorized agents
You can ask another person to make a request for you. We will ask for your signed permission, or a power of attorney, and may confirm with you directly.
9. No unfair treatment
We will not deny you service, charge you a different price or give you lower quality because you used a privacy choice.
10. More information
Read the Privacy Policy, the Consumer Health Data Privacy Policy, the Cookie and Tracking Technologies Notice and the Notice of Privacy Practices. Questions: [PRIVACY EMAIL].
Element | Copy |
|---|---|
Banner title | Your privacy choices |
Banner text | We use a few tools that help us understand how our site is used and measure our ads. They stay off unless you say yes. Essential cookies always run. We do not use these tools on pages about specific health topics. |
Banner buttons (same size, same style) | Accept all | Reject all | Choose |
Preference center heading | Choose your settings |
Essential | Always on. These keep the site working and secure. (No switch.) |
Analytics | Off unless you turn it on. Helps us count visits and improve the site. Tools: (list from Cookie notice 9.1). (Switch: Analytics) |
Advertising and sharing | Off unless you turn it on. Lets advertising companies measure our ads and show ads. Under some state laws this counts as a sale or sharing of personal information. Tools: (list from Cookie notice 9.2). (Switch: Advertising and sharing) |
Save button | Save my choices |
Saved message | Saved. Your choices apply to this browser. To apply them to your email address as well, use the request form. |
GPC detected | We detected your Global Privacy Control signal. We treat it as your choice to opt out of advertising, sale and sharing, so that setting is off. |
GPC conflict | Your browser’s Global Privacy Control signal says opt out, but you earlier chose to allow advertising on this site. We are following your browser’s signal. Do you want to allow advertising anyway? Buttons: Allow | Keep it off |
Storage blocked | We could not save your choice because your browser blocks storage. We will treat analytics and advertising as off. |
Withdraw | Change your privacy choices (footer link). The center has a Withdraw all button: “Turn everything off and delete my saved choices.” |
Request received | Thank you. We sent a message to your email address to confirm it is you. We will answer within [45 days]. Your request number is (request number). |
Global Privacy Control (replaces Section 4). We honor Global Privacy Control. When your browser sends the signal, we treat it as a request to opt out of sale, sharing and targeted advertising for that browser, and for any account or email address we can connect to it. We apply it before any non-essential tool loads, and we show a message that we detected it. If the signal conflicts with a choice you made on our site, we follow the signal and may ask whether you want to opt in again.
Contact
Privacy requests | WellPeps, a Wyoming corporation Attn: Privacy ([PRIVACY OFFICIAL]) [BUSINESS ADDRESS] Email: [PRIVACY EMAIL] Web form: [PRIVACY REQUEST WEBFORM] |
Technical and drafting notes
Held wording and when it takes effect
Part 2. Build specification for the control (engineering; do not publish)
2.1 Purpose, scope and timing
This specification says what the privacy control must do and what it must log, so that the promises in Part 1, the Cookie and Tracking Technologies Notice and the Consumer Health Data Privacy Policy are true when a non-essential tool goes live. It has six parts: (a) the footer link and this page; (b) a consent manager (banner and preference center); (c) tag gating; (d) Global Privacy Control handling; (e) a consent log; (f) a request and appeal form with a workflow and a request log.
Timing. Parts (a) and (f) are needed now. Parts (b) to (e) must ship together with the first non-essential tool. No analytics, advertising or replay tool goes live without them. wellpeps.com is a static site, so the gate runs in the browser; add the server-side checks in requirements 5 and 7 if a server or edge layer is added.
2.2 Requirements
2.3 What it must log
Consent event log (one row for each event)
Field | Type | Notes |
|---|---|---|
event_id | UUID | Unique for the event. |
consent_id | Random ID | The pseudonymous ID in the consent cookie. Never an email address or a device fingerprint. |
occurred_at | UTC timestamp | |
action | Text | accept_all, reject_all, custom, withdraw, gpc_auto_optout, gpc_conflict_allow, gpc_conflict_keep_off, reprompt_after_expiry, reprompt_after_version_change. |
analytics, advertising | True or false | The state after the event. |
gpc_detected | True or false | Whether a GPC signal was present. |
notice_version, banner_version | Text | Which text the person saw. |
page_path | Text | Path only. No query string, no identifiers. |
user_agent | Text | Browser family only [DECISION: counsel]. |
ip_address | Text or null | [DECISION: counsel: store, truncate or omit]. |
email_hash | Text or null | Only if the person is known through the request form or the portal [VERIFY: counsel]. |
Keep for at least [24 months], longer where a law sets a longer proof period. Limit access. Make it exportable for access requests. Do not log health information.
Request log (one row for each request or appeal)
Field | Notes |
|---|---|
request_id, received_at, channel | Webform, email or mail. |
request_types, state | One or more types; state if given. |
identity_verified | Yes or no, method and date. |
agent | Yes or no, proof received. |
due_dates, extension | Each deadline; extension used, reason and the date the person was told. |
systems_touched | Each system and processor, and the date each confirmed the action. |
decision, reason, response_sent_at | Granted, partly granted or denied; reason for any denial. |
appeal_received_at, appeal_decision, appeal_sent_at | If any. |
notes | No health details. |
Keep for at least [24 months] after closing [VERIFY: counsel].
2.4 Acceptance tests
- With no stored choice, an automated browser loads every public page. Zero requests go to any host that is not on the essential or listed allow-list.
- The same test with the Sec-GPC: 1 header and with navigator.globalPrivacyControl set to true gives the same result, and the Advertising setting reads off.
- After Accept all, only the tools in the Cookie notice load, and only on allowed pages. On every sensitive page no advertising request fires and no analytics request fires without the separate consent.
- After Reject all and a reload, zero non-essential requests fire.
- After Accept all and then withdrawal, the tools stop in the same session, their cookies and storage entries are cleared where possible, and the vendor opt-outs were called.
- With cookies and storage blocked, nothing non-essential loads and the Storage blocked message shows.
- A consent log row is written for accept all, reject all, custom, withdraw, GPC auto opt-out and each re-prompt, with the fields in Section 2.3.
- The request form creates a ticket, sends the acknowledgment and the verification link, computes every due date, writes the request log, and writes to the suppression list for opt-outs.
- A keyboard-only run and a screen reader run can finish every task on the banner, the center and the form.
- The tools shown in the control equal the tools in the Cookie notice (an automated diff of the tag inventory against the notice).
- The build fails if a replay, heatmap or form-capture SDK is added or enabled.