Privacy Policy

Effective Date: October 13, 2026

Mission Based Media LLC ("Company," "we," "us," or "our") respects your privacy and is committed to protecting it through this Privacy Policy.

This Privacy Policy covers HealthPodcast.org and its affiliated websites, including healthpodcastlibrary.com, healthpodcastawards.com, healthpodcastsummit.com, and healthpodcastshow.com (collectively, the "Platform").

When you use the Platform, we collect certain information about you—some you give us directly, some we collect automatically. This policy explains what we collect, how we use it, the legal bases for processing it (where applicable), and your choices.

By using the Platform, you agree to this Privacy Policy. If you don't agree, please don't use the Platform.

Children Under 18

Our Platform is for adults 18 and older. We don't knowingly collect information from anyone under 18. If you're under 18, don't use the Platform or give us any information.

If we learn we've collected information from someone under 18, we'll delete it. If you think we have information about someone under 18, contact us at privacy@healthpodcast.org.

What Information We Collect

Information You Give Us

We collect information when you:

• Create an account (name, email, whether you're a healthcare professional)

• Fill out forms or contact us

• Subscribe to our newsletter

• Submit a podcast via RSS feed

• Register for events like the Health Podcast Awards or Summit

• Make a payment for membership, sponsorship, or promotional placement

• Respond to surveys

We use this information to provide our services, improve the Platform, and send you relevant information about podcasts and events.

Information We Collect Automatically

When you use the Platform, we automatically collect:

• Device and browser information (user agent, screen size, language)

• IP address and approximate location (country / region only — we do not store full IPs)

• How you navigate through the Platform (pages viewed, links clicked, referrer)

• Which podcasts you follow, search for, or listen to

• Performance and error diagnostics (e.g. uncaught JavaScript errors)

Information from Third Parties

We receive limited information from the service providers we use to operate the Platform — for example, payment confirmation from Stripe, or aggregated traffic reports from Google Analytics. We do not buy or rent personal information from data brokers.

Cookies, Analytics, and Similar Technologies

We use cookies and similar technologies (small data files stored in your browser or in localStorage) to remember your preferences, secure your session, understand how the Platform is used, and improve our services.

Consent banner. When you first visit the Platform, we ask whether you accept analytics cookies. If you are visiting from the European Economic Area, the United Kingdom, or Switzerland, no analytics scripts run until you give consent. If you are visiting from elsewhere, analytics may run by default; you can opt out at any time via the floating "Privacy preferences" icon at the bottom right of the page, or in the cookie details below.

Google Consent Mode. We implement Google Consent Mode v2. When consent is denied, our analytics tags do not set advertising cookies and Google receives only cookieless, aggregated pings used for modeled measurement.

Global Privacy Control. If your browser sends the Global Privacy Control (Sec-GPC) signal, we treat that as an opt-out of analytics and any "sale/share" of personal information under U.S. state law.

Cookie details

This Cookie Policy explains how Mission Based Media LLC ("we," "us," or "our") uses cookies and similar technologies on HealthPodcast.org and its affiliated websites (the "Platform"). It is part of our Privacy Policy.

What Cookies Are

Cookies are small text files placed on your device by websites you visit. We also use related technologies — localStorage, sessionStorage, and pixel tags — that work in similar ways. Throughout this policy, "cookies" covers all of these.

Categories of Cookies We Use

1. Strictly Necessary

Required for the Platform to function. They cannot be switched off through our consent banner. Examples:

• Authentication cookies set by Supabase, so you stay signed in.
• CSRF tokens that protect form submissions from cross-site request forgery.
• Cookie-consent record (cookie-consent in localStorage) so we remember your preference and don't ask again on every visit.
• Theme preference (light / dark) stored in localStorage.

2. Analytics (with your consent)

Help us understand how the Platform is used so we can improve it. We use Google Analytics 4 (GA4). Examples of cookies set by GA4:

• _ga — distinguishes unique users; retention up to 2 years.
• _ga_<CONTAINER-ID> — used by GA4 to persist session state; retention up to 2 years.
• _gid — distinguishes users for 24 hours.

We have configured GA4 with IP anonymization, EU data residency where available, and we have signed Google's Data Processing Amendment. We have disabled "Google Signals" advertising features by default.

3. Functional

Improve the user experience but are not strictly required. Examples include remembering UI state across page loads and language preferences.

Google Consent Mode v2

We implement Google Consent Mode v2. When the page loads, all consent signals (analytics_storage, ad_storage, ad_user_data, ad_personalization, functionality_storage, personalization_storage, security_storage) start in the denied state. They are updated only after you accept analytics in the consent banner. If you decline, Google receives only cookieless, aggregated pings used for modeled measurement; no advertising or analytics cookies are set on your device.

How We Ask for Consent

The first time you visit the Platform, we show a consent banner.

• Visitors from the European Economic Area, the United Kingdom, or Switzerland see a strict opt-in banner. No analytics cookies are set until you click "Accept all" or enable analytics in the Settings panel. Refusing is just as easy as accepting.
• Visitors from elsewhere (including the United States) see a notice that analytics is enabled by default and can be turned off through the same Settings panel or by sending the Global Privacy Control signal.

Global Privacy Control

If your browser sends the Sec-GPC header (Global Privacy Control), we treat that as a binding opt-out of analytics cookies and of any "sale" or "share" of personal information under U.S. state privacy laws — regardless of which banner you would otherwise see.

How to Manage or Withdraw Your Consent

• Privacy preferences icon. Click the floating shield icon at the bottom right of any page (just above the feedback button) to re-open the consent panel and change your choice at any time.
• Browser settings. All major browsers let you block or delete cookies. See the help pages for Chrome, Firefox, Safari, or Edge.
• Google Analytics opt-out add-on. Install the Google Analytics Opt-out Browser Add-on to prevent any GA data being sent from your browser, on every site you visit.
• Do Not Track / GPC. If your browser sends the GPC signal, we honor it automatically.

If you block strictly necessary cookies, parts of the Platform may not work — for example, you may not be able to stay signed in.

Changes to This Cookie Policy

We may update this policy as our practices change or as legal requirements evolve. The "Effective Date" above will reflect the most recent revision. Material changes will be announced through the consent banner.

Contact

Questions about cookies? Email privacy@healthpodcast.org.

How We Use Your Information

We use your information to:

• Provide, secure, and improve the Platform

• Manage your account and authenticate your sessions

• Process podcast submissions and verify ownership

• Process payments for memberships, sponsorships, and promotional placements

• Send newsletters and updates (if you opted in)

• Run the Health Podcast Awards and Summit

• Recommend podcasts you might like

• Prevent fraud and abuse

• Comply with legal requirements

Legal Bases for Processing (EEA / UK / Swiss Residents)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases under the GDPR / UK GDPR / Swiss FADP:

• Performance of a contract (Art. 6(1)(b)) — to create and operate your account, deliver the Platform you signed up for, and process payments you have agreed to.

• Consent (Art. 6(1)(a)) — for analytics and similar non-essential cookies, marketing emails, and any optional features. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

• Legitimate interests (Art. 6(1)(f)) — for security, fraud prevention, defending legal claims, and basic, aggregated service improvement that does not override your rights.

• Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, and other applicable laws.

Service Providers and Sub-processors

We share personal data with the following categories of service providers, each of which acts on our instructions under a written agreement and is permitted to use the data only to provide services to us:

• Supabase Inc. (PostgreSQL hosting, authentication, file storage) — stores account, content, and operational data. Processing primarily in the United States and the European Union.

• Vercel Inc. (web hosting, edge runtime) — serves the Platform and processes request metadata. Global edge network; primary processing in the United States.

• Stripe, Inc. (payments) — processes card payments and stores billing data. Processing primarily in the United States.

• Google LLC (Google Analytics, Google Tag Manager, optional Google Ads) — measures Platform usage. Processing primarily in the United States; Google is certified under the EU–US Data Privacy Framework.

• Functional Software, Inc. d/b/a Sentry (error monitoring, user feedback widget) — captures error reports and crash diagnostics. Processing primarily in the United States.

• Resend, Inc. or equivalent transactional email provider — delivers account, transactional, and (with your consent) newsletter emails.

• Cloudflare, Inc. (Cloudflare Turnstile, bot protection on sign-in, sign-up and password forms) — checks that a real person, not an automated program, is using these forms. Cloudflare processes limited technical information about your browser, device and connection for this purpose only. Processing primarily in the United States; Cloudflare is certified under the EU–US Data Privacy Framework.

• PostHog, Inc. (product analytics) — with your explicit consent only, measures how the Platform is used and, within the signed-in member portal, records masked session replays and interaction heatmaps. Inputs and dynamic text are masked; embedded players and application errors are excluded. You can withdraw consent at any time in Privacy preferences. Processing in the United States. If you are signed in, this information is linked to your account.

We may also disclose information:

Legal requirements — To comply with the law, respond to lawful requests, enforce our Terms, or protect the rights, property, or safety of any person.

Business transfers — If we're involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction.

We do not sell personal information for money, and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

International Data Transfers

The Platform is operated from the United States. If you access the Platform from outside the United States, your information will be transferred to, stored in, and processed in the United States and other countries where our service providers operate. Privacy laws in those countries may differ from those in your country.

Where we transfer personal data of users in the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on one or more of the following safeguards:

• The EU–US Data Privacy Framework, the UK Extension, and the Swiss–US Data Privacy Framework, where the recipient is self-certified (this includes Google LLC).

• Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner's Office, where applicable.

• Other transfer mechanisms permitted under applicable law.

You may request a copy of the safeguards in place by emailing privacy@healthpodcast.org.

Data Retention

We keep personal data only for as long as necessary for the purposes set out above, then delete or anonymize it. Indicative retention periods:

• Account data — for the life of your account, plus up to 90 days after deletion to allow recovery and to handle abuse complaints.

• Analytics data (Google Analytics) — the GA4 default of 14 months for event-level data; aggregated reports may be retained longer.

• Payment and tax records — 7 years, or longer if required by tax / accounting law.

• Error and security logs — up to 90 days, except where a longer period is required to investigate an incident.

• Email marketing records — until you unsubscribe, plus a suppression record so we don't email you again.

• Backups — rolling backups are typically retained for up to 30 days and then overwritten.

Security

We take reasonable technical and organizational measures to protect your information — including encryption in transit (HTTPS), encryption at rest for our primary database, role-based access controls, and audit logging. No system is 100% secure. Please use a strong, unique password and notify us immediately if you suspect unauthorized access.

Email Communications

We don't sell or rent our email lists.

If you sign up for our newsletter, we'll send you emails about health podcasts, events, and related content. You can unsubscribe anytime by clicking "unsubscribe" in any email, emailing privacy@healthpodcast.org, or updating preferences in your account.

Even if you unsubscribe from promotional emails, we may still send you account-related messages (security alerts, billing receipts, important service notices).

Your Rights and Choices (Everyone)

Access and Update — Log into your account to update your information anytime.

Delete Your Account — Contact us at privacy@healthpodcast.org to request deletion of your account and information.

Manage Cookies — Click the floating "Privacy preferences" icon at the bottom right of any page to change your analytics consent at any time. You can also block cookies through your browser settings.

Your Rights (EEA / UK / Swiss Residents)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the GDPR / UK GDPR / Swiss FADP:

1. Right of access — obtain a copy of the personal data we hold about you.

2. Right to rectification — correct inaccurate or incomplete data.

3. Right to erasure ("right to be forgotten") — ask us to delete your data, subject to certain legal exceptions.

4. Right to restriction of processing — limit how we process your data in certain circumstances.

5. Right to data portability — receive your data in a structured, machine-readable format and transmit it elsewhere.

6. Right to object — object to processing based on legitimate interests, including for direct marketing.

7. Right to withdraw consent — withdraw consent at any time where processing is based on consent (e.g. analytics, newsletters).

8. Right not to be subject to a decision based solely on automated processing, where such processing produces legal or similarly significant effects.

9. Right to lodge a complaint with your local data protection authority. A list of EEA authorities is available at edpb.europa.eu; the UK ICO is at ico.org.uk; the Swiss FDPIC is at edoeb.admin.ch.

To exercise any of these rights, email privacy@healthpodcast.org. We will respond within one month, or tell you why we need more time.

We are based in the United States and have not designated an EU representative under Article 27 of the GDPR. Until we do, you can reach our privacy team using the contact details below.

State-Specific Privacy Rights (United States)

California Residents

If you're a California resident, you have rights under the California Consumer Privacy Act (as amended by the CPRA):

Categories of personal information we collect:

• Identifiers (name, email, IP address, account ID)

• Customer records (contact information, billing information)

• Internet or other electronic network activity (pages viewed, podcasts followed, listening history)

• Geolocation data (approximate, derived from IP address)

• Inferences drawn from the above (e.g. content recommendations)

• Professional information (whether you're a healthcare professional, where you provide it)

Your California rights:

1. Right to Know — Request what personal information we have collected, used, disclosed, and shared.

2. Right to Delete — Request deletion of your personal information.

3. Right to Correct — Request correction of inaccurate personal information.

4. Right to Opt Out of Sale or Sharing — Opt out of any "sale" or "share" for cross-context behavioral advertising. We do not currently sell or share your personal information; if this changes, we will update this policy and provide an opt-out mechanism. We honor the Global Privacy Control browser signal.

5. Right to Limit Use of Sensitive Personal Information — We do not use sensitive personal information for purposes that trigger this right.

6. Right to Non-Discrimination — We will not discriminate against you for exercising any of these rights.

How to exercise your rights: Email privacy@healthpodcast.org. We may verify your identity before responding.

Other States

If you live in Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Nevada, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you have similar rights under your state's privacy laws — generally including rights to access, delete, correct, and opt out of targeted advertising or the sale of personal information. Email privacy@healthpodcast.org to exercise these rights.

Changes to This Policy

We may update this Privacy Policy from time to time. We'll indicate changes by updating the "Effective Date" at the top.

If we make material changes, we'll notify you by email (if you've provided one) and/or through a prominent notice on the Platform.

Continued use of the Platform after changes means you accept the updated policy.

Contact Us

Questions about this Privacy Policy, or to exercise any of your rights:

Mission Based Media LLC
Attn: Privacy
30 N Gould St Ste R
Sheridan, WY 82801-6317

Email: privacy@healthpodcast.org