Privacy policy

• No accounts. There is no sign-up, no login, no password, and no profile. There is nothing on this site you can create an account for.
• No forms. There is not a single input field, text box or submit button anywhere on doseworth.com. You cannot type anything into this site, so we cannot collect anything you type.
• No newsletter, no comments, no uploads, no user-submitted content.
• No payments. Nothing is sold here. No card details, billing address or payment token ever reaches this domain, because there is no transaction to attach one to.
• Anonymous analytics are on by default. This is a US site, so measurement starts on arrival — and one tap on the notice, or the switch in Section 3, turns it off for good on this device. If your browser sends Global Privacy Control, it is already off.
• We do not sell personal data, and we do not run advertising or retargeting tags of any kind.

The rest of this page is the detail behind those six lines.

One third-party script: Google Analytics 4, loaded through gtag.js and configured with Google Consent Mode v2. That is the entire list. There is no advertising pixel, no session recorder, no heatmap, no chat widget, no A/B testing tool, no social embed and no font or asset loaded from a tracking network.

Before the Google script is fetched, the page sets its consent defaults. This is a US site written for US readers, so measurement is on from first paint, and every advertising purpose is refused outright and never granted:

• analytics_storage — granted, unless you have opted out on this device or your browser sends Global Privacy Control
• ad_storage — denied
• ad_user_data — denied
• ad_personalization — denied

Under Consent Mode v2 that means the tag measures the visit and sets its own analytics cookie. The three advertising signals are denied at the default and this site never grants them at all: there is no button anywhere here that turns them on, because there is nothing here that would use them. Opting out changes analytics_storage and nothing else, in the other direction.

If you have opted out previously, that stored choice is read the moment the page loads — synchronously, before the Google script is fetched — and the default is set to denied instead. Google never observes a granted state for a reader who said no, not even for the instant a later correction would take to arrive. The same check reads Global Privacy Control first, so a browser that sends GPC is opted out without doing anything on this page.

The switch below is live. It reads the setting held on this device and changes it on the spot — there is no form to submit and nothing to email us about.

The small panel in the corner is the same control on your first visit. It appears only if no choice has been recorded in your browser, it is a notice rather than a gate — nothing on this site waits for it — and its two buttons do exactly what they say:

• OK records granted, which is the state already in force. It dismisses the notice and nothing about the measurement changes.
• Opt out records denied, pushes the Consent Mode update that stops measurement, and deletes the Google Analytics cookies already in your browser. All three, not just the first.

Your choice is stored in your own browser, in localStorage, under the key cookie-consent. It is a single word — granted or denied — and it never leaves your device. It is not an identifier, it is not sent to us, and it cannot be used to recognize you.

If your browser blocks localStorage entirely — private mode, a hardened configuration — nothing can be recorded, so the notice shows on every visit and each visit starts measured. Two things soften that: such a browser is also discarding the analytics cookie between sessions, so there is nothing durable to accumulate, and if it sends Global Privacy Control we read that instead and never start.

Global Privacy Control. If your browser or an extension sends the GPC signal, this site treats it as an opt-out before it looks at anything else, on every page, with no click from you. The switch above will say so and will not offer to turn measurement back on: a page that let itself override the signal your browser just sent would be worth less than no signal at all.

With consent granted, GA4 collects the standard measurement set: which pages were viewed and in what order, how long the visit lasted, the referring site or search engine, device and browser type, screen size, and a coarse geographic location derived from IP. Google discards the IP address rather than logging it as part of the event.

We use this to answer editorial questions — which price boards people actually read, whether a comparison is being found at all, whether a page is failing on small screens. We do not attempt to identify individuals, we have no way to do so, and we do not build audiences or export data to any advertising system.

Google processes this data as our analytics provider, under its own terms and privacy policy. How long it retains raw event data is a setting on the Google property, held in Google's systems — not a database we operate.

Provider links do not point straight at the provider. They point at /go/<slug> on this domain, which does three things and then gets out of the way:

1. It looks up the destination for that slug and refuses the request outright if there isn't one.
2. It counts the click. The counter is a single integer, incremented against a key made of this site's domain, the link slug, and the date. There is no row per visitor and no identifier in the key — it is a tally of how many people used a link on a given day. It only runs at all when a key-value store is configured for the deployment; with none configured the counter is skipped and the redirect still works.
3. It redirects you to the provider, adding campaign parameters (utm_source, utm_medium, utm_campaign, and sometimes utm_content) so the provider and the affiliate network can tell the referral came from Doseworth.

Worth being precise about one thing, because it is the part people assume the worst of: the redirect handler reads the forwarded IP address and the user-agent header from your request and hands them to the click logger. The logger uses neither. It increments the counter described above and discards them. No IP address and no user-agent string is written to any store we keep.

Once the redirect fires you are on the provider's site, or on their affiliate network's tracking domain on the way there. From that point their privacy policy applies, not ours. They will typically set their own cookie to attribute the referral, and anything you then enter — your email, your health history, your card — goes to them and never comes back to us. We receive no report from them that identifies you. The commercial side of this arrangement is set out on the disclosure page.

These redirect paths are excluded from search-engine crawling, so the counters reflect readers rather than robots.

The site runs on a commercial hosting platform. Like every web host, it generates ordinary request logs as a by-product of serving pages — the requested URL, a timestamp, a status code, and connection metadata including the originating IP. Those logs exist for delivery, security and debugging, are held on the platform under its own terms, and are retained only for a short operational window.

We do not copy them anywhere, do not join them to anything, and do not maintain a database of visitors of our own. There is no user table on this site because there are no users to put in it.

Three parties, and no others:

• Google — analytics measurement, unless you have opted out. Once you do, no measurement data about you reaches Google from this site.
• Our hosting platform — necessarily, because it serves you the page you are reading.
• A provider, and its affiliate network — only when you choose to follow an outbound link, and only from the moment you do.

We do not sell, rent, license or share personal data. There is no data broker in this picture, no audience list, and no data-for-money arrangement of any kind. We also have nothing worth selling: the only reader-level records that exist are held by Google, under your own consent, and by our host, as delivery logs.

We would disclose information if we were legally required to, or where necessary to protect the site's security — but the honest observation is that we hold almost nothing to disclose.

The controls that actually exist here, in the order they are useful:

• Opt out of analytics. Use the switch in Section 3, or press Opt out on the notice. It stores the choice, stops the measurement, and clears the analytics cookies in the same action. Nothing on this site is gated behind staying opted in.
• Send Global Privacy Control. If your browser offers it, switching it on opts you out here — and everywhere else that honors it — without visiting this page.
• Clear what is stored on your device. Clearing site data removes both the consent key and any Google Analytics cookie. It also clears an opt-out you had stored, so use the switch above if you want the opt-out to survive.
• Block the tag at the browser. Any content blocker stops gtag.js loading. The site is built to work without it and nothing degrades.
• Email us. Send an access, deletion or objection request to editor@doseworth.com and we will respond.

One caveat we would rather state up front than have you discover after writing to us: an access or deletion request will usually come back nearly empty, because there is no account to look up and nothing about you keyed to an identifier we hold. Where a request concerns analytics data, we will tell you plainly that the record sits with Google under this site's measurement settings and point you at the controls that reach it.

We are not going to print a badge saying this site is “GDPR compliant” or “CCPA compliant.” Those are legal conclusions, not facts you can verify by reading a page, and a site that asserts them is asking for trust it has not shown you the basis for. What we can do is describe the practice and tell you how to exercise the rights you have.

California. California law gives residents rights to know what personal information a business collects, to have it deleted, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are used in California law, and we do not run cross-context behavioral advertising — the advertising consent signals on this site are denied and never granted. Analytics measurement is on by default and you may switch it off at any time, using the control in Section 3, the notice on your first visit, or by sending Global Privacy Control, which this site honors as an opt-out. To exercise a right, email editor@doseworth.com; we will not discriminate against you for doing so.

EU and UK. Read this part before you browse further rather than after. This site is written for a US audience and US pricing, it is not offered as a service directed at readers in the EU or UK, and its analytics default is the US one: measurement starts when the page loads and the notice offers the way out, rather than waiting for an opt-in first. If you are in the EU or UK and would rather not be measured at all, use the switch in Section 3 — it takes effect immediately, deletes the analytics cookies already set, and persists on this device — or send Global Privacy Control, which we honor before anything is measured. You have rights of access, rectification, erasure, restriction, objection and portability, and a right to complain to your national supervisory authority. Google Analytics involves processing outside the EEA and UK, which Google carries out under its own transfer mechanisms as described in its terms.

This site is intended for adults. Its subject — prescription weight-loss and metabolic treatment, its cost, and the companies that sell it — is adult subject matter, and the terms of use require you to be at least 18. We do not knowingly collect anything from children, and given that there are no forms and no accounts, there is no mechanism here through which a child could submit information to us.

The site is served over HTTPS. There are no credentials to steal here, no card details, no health information and no user database — the strongest security property this site has is that it holds almost nothing.

On retention: the opt-out value lives in your browser until you clear it. Analytics events are retained by Google according to the property's configured retention period. Hosting logs are retained by the platform for its own short operational window. The outbound click counters are day-keyed integers with no personal data in them.

If we add a tool, change a default, or start doing something this page does not describe, this page changes first and the “Last updated” stamp at the top changes with it. A privacy policy that lags the code is worse than none, because it is a specific, checkable false statement rather than a gap.

Privacy questions and requests: editor@doseworth.com. See also our terms of use, affiliate disclosure and editorial policy.