This policy covers craigedwardstewart.com and every section of it: the health and patient advocacy pages, the Inspired Conversations podcast pages, the blogs, the questionnaires and tools, the speaking and booking pages, and the real estate and Above The Fold pages.
Section 01Who we are
This website is owned and operated by Craig Edward Stewart, based in Auckland, New Zealand. Craig is the person who reads the enquiries, moderates the comments and administers the site. There is no marketing team behind this.
We handle personal information in line with the New Zealand Privacy Act 2020 and its information privacy principles. If you are in the European Union or the United Kingdom, see section 16.
Section 02The short version
- We collect what you type into a form, and very little else.
- We do not sell your information, and we never have.
- Health information you share is treated as confidential and is never published in an identifying form without your consent.
- Our own analytics do not use cookies and do not identify you.
- Google Analytics and the Meta pixel do use cookies. You can block them.
- You can ask to see what we hold, correct it, or have it deleted, at any time.
Section 03What you give us
We only get this information because you chose to send it.
| Where | What is collected |
|---|---|
| Newsletter signup | Your email address, and your name if you give one. |
| Contact form | Your name, email address, phone number if you give one, subject and message. |
| Speaking booking | Your name, email, phone, organisation and the event details you provide. |
| Research Hub access | Your name, email and whatever you tell us about your interest in the Cluster Headache Research Hub. |
| Confidential enquiries | The details you submit on a confidential or career enquiry form. These are routed to a private inbox and are not published anywhere. |
| Article comments | Your nickname, your email address, your comment, the time, and the IP address the comment came from. Only the nickname, the comment and the date are ever shown publicly. |
| Questionnaires and tools | Your answers, and any status you select, such as whether you have cluster headache. See section 4. |
| Email and social | Whatever you send us directly. |
Forms are protected by anti spam measures, including a honeypot field, timing checks, Cloudflare Turnstile and a short lived per address rate limit. That rate limit stores a scrambled form of your IP address in temporary server storage for a few minutes and then discards it.
Section 04Health information
Health information is the most sensitive thing anyone sends this site. It is treated as confidential, kept separate from marketing, and never published in a form that identifies you unless you have specifically agreed to that.
People contact this site to describe attacks, treatments, oxygen problems and diagnoses. Some of that arrives through the contact form, some through comments, some through questionnaires. In every case:
- We do not add health details to the newsletter list or to any advertising audience.
- We do not pass them to Google, Meta or any advertising platform.
- Where an experience is used in an article, a report or a podcast, it is anonymised, or it is used with the person's consent, or the person is a named public figure who published the material themselves.
- Private community reports are held behind access controls and are not indexed by search engines.
Questionnaires and pooled results
Some articles include a questionnaire that shows you how a group of respondents scored once you have completed it yourself. When you submit one, we store your answers, the status you selected, such as cluster headache, migraine, other, none or unsure, and the time of submission. Answers are stored against a random identifier, not your name or your email address. We do not ask for either.
To stop the same person being counted twice, a random token is placed in a cookie on your browser. That token is not linked to any other information about you. Results are reported only as group averages and counts.
These questionnaires are not diagnostic and are not a clinical assessment. See the terms of use.
Section 05What is collected automatically
Our own analytics
The site runs a small self hosted analytics script. It records the page path, the page title, a broad source category for where you arrived from, such as search, social or direct, the referring domain, and a device size band. It also records aggregate counts of interactions such as newsletter signups and contact clicks. It uses no cookies, stores no personal data, and counts one view per page per browser session. Obvious bots are excluded.
Server logs
Our hosting provider keeps standard web server logs, which include IP addresses, request times and browser user agent strings. These are used for security, troubleshooting and abuse prevention.
Third party services on the site
- Google Analytics. Measures traffic and behaviour across the site. It uses cookies and collects a truncated IP address and device information.
- Meta pixel. Measures the effect of Facebook and Instagram promotion. It uses cookies and reports page views back to Meta.
- Cloudflare Turnstile. Runs on forms to block bots. It checks the browser rather than the person, and does not use tracking cookies.
- Google Fonts. Fonts are requested from Google's servers, which means Google sees the request and your IP address.
- YouTube. Video embeds are click to load. Nothing is requested from YouTube, and no YouTube cookie is set, until you click play. After that, YouTube's own privacy terms apply.
These providers are independent controllers of the data they collect and are governed by their own privacy policies.
Section 07How we use it
- To reply to your enquiry, booking request or application.
- To send the newsletter you asked for.
- To moderate and publish comments.
- To produce pooled, anonymised research and community reports.
- To understand which articles are useful and improve the site.
- To protect the site from spam, abuse and attack.
- To meet legal obligations.
We do not sell personal information, we do not rent or trade mailing lists, and we do not use health information for advertising.
Section 08Our basis for using it
Under New Zealand law we collect personal information for a lawful purpose connected to running this website, and we collect it directly from you. Where the European or United Kingdom rules apply, our bases are consent for the newsletter, analytics and advertising tools, and for any health information you volunteer; performance of a request you made for enquiries and bookings; and legitimate interests for site security, spam prevention and basic measurement. Where we rely on consent, you can withdraw it at any time.
Section 10Where it is stored
Site data, including the subscriber list, comments and questionnaire responses, is stored on the web server in files that are blocked from public access and readable only through the administrator panel, which is protected by a Google sign in restricted to approved accounts.
Our hosting, analytics and advertising providers operate servers outside New Zealand, which means some information is held or processed overseas. We take reasonable steps to ensure it is protected by comparable safeguards.
Section 11How long we keep it
- Newsletter details are kept until you unsubscribe or ask to be removed.
- Enquiries, bookings and applications are kept as email records for as long as they are useful for the relationship, and then deleted on request.
- Comments are kept while published. Rejected comments are deleted.
- Questionnaire responses are kept indefinitely as part of a pooled dataset, because their whole value is the group picture. They contain no name or email address.
- Analytics records are aggregate counts and are kept as long as they are useful.
- Rate limiting records are temporary and expire within minutes.
Section 12Security
The site is served over HTTPS with a content security policy and standard security headers. Data files holding personal information are blocked from web access and excluded from routine deployments. The administrator panel requires a Google sign in limited to approved accounts. Credentials are held in a private secret store, never in the website's public code.
No website can promise perfect security. If a breach affecting your information ever occurred, we would notify you and the Office of the Privacy Commissioner as the Privacy Act requires.
Section 13Your rights and choices
You can ask us to:
- tell you what personal information we hold about you
- give you a copy of it
- correct anything that is wrong
- delete it, including a comment you have posted
- stop sending you email
- stop using something you shared, even if you agreed to it earlier
Just ask. Use the contact page or email [email protected]. We will reply within 20 working days, which is the New Zealand statutory limit. There is no charge. We may need to confirm it is really you before acting on a request.
Every newsletter has an unsubscribe option. Questionnaire responses cannot always be traced back to an individual once pooled, so tell us the approximate date and details if you want one removed and we will do our best.
Section 14Complaints
If you are unhappy with how your information has been handled, please raise it with us first so we can put it right. If you are still not satisfied, you can complain to the Office of the Privacy Commissioner in New Zealand at privacy.org.nz, or to your local data protection authority if you are outside New Zealand.
Section 15Children
This site is written for adults and is not directed at children. We do not knowingly collect information from anyone under 16. If a child has sent us something, tell us and we will delete it.
Section 16Visitors outside New Zealand
This site is operated from New Zealand and is subject to New Zealand law. If you are in the European Union or the United Kingdom, we will honour requests for access, correction, erasure, restriction, portability and objection, and you can withdraw consent for analytics and advertising at any time by blocking cookies in your browser or by asking us.
Section 17Updates to this policy
We may update this policy. The current version always lives at this address, with the effective date at the top of the page. If a change materially affects how your information is used, we will say so in the newsletter.
Section 18Contact
Privacy questions, access requests and deletion requests all go to the same place. Use the contact page or email [email protected].
Craig Edward Stewart
Auckland, New Zealand