Privacy Policy

Effective Date: May 8, 2026

Mission Based Media LLC ("Company," "we," "us," or "our") respects your privacy and is committed to protecting it through this Privacy Policy.

This Privacy Policy covers HealthPodcast.org and its affiliated websites, including healthpodcastlibrary.com, healthpodcastawards.com, healthpodcastsummit.com, and healthpodcastshow.com (collectively, the "Platform").

When you use the Platform, we collect certain information about you—some you give us directly, some we collect automatically. This policy explains what we collect, how we use it, the legal bases for processing it (where applicable), and your choices.

By using the Platform, you agree to this Privacy Policy. If you don't agree, please don't use the Platform.

Children Under 18

Our Platform is for adults 18 and older. We don't knowingly collect information from anyone under 18. If you're under 18, don't use the Platform or give us any information.

If we learn we've collected information from someone under 18, we'll delete it. If you think we have information about someone under 18, contact us at privacy@healthpodcast.org.

What Information We Collect

Information You Give Us

We collect information when you:

Create an account (name, email, whether you're a healthcare professional)
Fill out forms or contact us
Subscribe to our newsletter
Submit a podcast via RSS feed
Register for events like the Health Podcast Awards or Summit
Make a payment for membership, sponsorship, or promotional placement
Respond to surveys

We use this information to provide our services, improve the Platform, and send you relevant information about podcasts and events.

Information We Collect Automatically

When you use the Platform, we automatically collect:

Device and browser information (user agent, screen size, language)
IP address and approximate location (country / region only — we do not store full IPs)
How you navigate through the Platform (pages viewed, links clicked, referrer)
Which podcasts you follow, search for, or listen to
Performance and error diagnostics (e.g. uncaught JavaScript errors)

Information from Third Parties

We receive limited information from the service providers we use to operate the Platform — for example, payment confirmation from Stripe, or aggregated traffic reports from Google Analytics. We do not buy or rent personal information from data brokers.

Cookies, Analytics, and Similar Technologies

We use cookies and similar technologies (small data files stored in your browser or in localStorage) to remember your preferences, secure your session, understand how the Platform is used, and improve our services.

Consent banner. When you first visit the Platform, we ask whether you accept analytics cookies. If you are visiting from the European Economic Area, the United Kingdom, or Switzerland, no analytics scripts run until you give consent. If you are visiting from elsewhere, analytics may run by default; you can opt out at any time via the floating "Privacy preferences" icon at the bottom right of the page, or via the Cookie Policy.

Google Consent Mode. We implement Google Consent Mode v2. When consent is denied, our analytics tags do not set advertising cookies and Google receives only cookieless, aggregated pings used for modeled measurement.

Global Privacy Control. If your browser sends the Global Privacy Control (Sec-GPC) signal, we treat that as an opt-out of analytics and any "sale/share" of personal information under U.S. state law.

For full detail — a list of cookies, retention windows, and how to withdraw consent — see our Cookie Policy.

How We Use Your Information

We use your information to:

Provide, secure, and improve the Platform
Manage your account and authenticate your sessions
Process podcast submissions and verify ownership
Process payments for memberships, sponsorships, and promotional placements
Send newsletters and updates (if you opted in)
Run the Health Podcast Awards and Summit
Recommend podcasts you might like
Prevent fraud and abuse
Comply with legal requirements

Legal Bases for Processing (EEA / UK / Swiss Residents)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases under the GDPR / UK GDPR / Swiss FADP:

Performance of a contract (Art. 6(1)(b)) — to create and operate your account, deliver the Platform you signed up for, and process payments you have agreed to.
Consent (Art. 6(1)(a)) — for analytics and similar non-essential cookies, marketing emails, and any optional features. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
Legitimate interests (Art. 6(1)(f)) — for security, fraud prevention, defending legal claims, and basic, aggregated service improvement that does not override your rights.
Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, and other applicable laws.

Service Providers and Sub-processors

We share personal data with the following categories of service providers, each of which acts on our instructions under a written agreement and is permitted to use the data only to provide services to us:

Supabase Inc. (PostgreSQL hosting, authentication, file storage) — stores account, content, and operational data. Processing primarily in the United States and the European Union.
Vercel Inc. (web hosting, edge runtime) — serves the Platform and processes request metadata. Global edge network; primary processing in the United States.
Stripe, Inc. (payments) — processes card payments and stores billing data. Processing primarily in the United States.
Google LLC (Google Analytics, Google Tag Manager, optional Google Ads) — measures Platform usage. Processing primarily in the United States; Google is certified under the EU–US Data Privacy Framework.
Functional Software, Inc. d/b/a Sentry (error monitoring, user feedback widget) — captures error reports and crash diagnostics. Processing primarily in the United States.
Resend, Inc. or equivalent transactional email provider — delivers account, transactional, and (with your consent) newsletter emails.

We may also disclose information:

Legal requirements — To comply with the law, respond to lawful requests, enforce our Terms, or protect the rights, property, or safety of any person.

Business transfers — If we're involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction.

We do not sell personal information for money, and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

International Data Transfers

The Platform is operated from the United States. If you access the Platform from outside the United States, your information will be transferred to, stored in, and processed in the United States and other countries where our service providers operate. Privacy laws in those countries may differ from those in your country.

Where we transfer personal data of users in the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on one or more of the following safeguards:

The EU–US Data Privacy Framework, the UK Extension, and the Swiss–US Data Privacy Framework, where the recipient is self-certified (this includes Google LLC).
Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner's Office, where applicable.
Other transfer mechanisms permitted under applicable law.

You may request a copy of the safeguards in place by emailing privacy@healthpodcast.org.

Data Retention

We keep personal data only for as long as necessary for the purposes set out above, then delete or anonymize it. Indicative retention periods:

Account data — for the life of your account, plus up to 90 days after deletion to allow recovery and to handle abuse complaints.
Analytics data (Google Analytics) — the GA4 default of 14 months for event-level data; aggregated reports may be retained longer.
Payment and tax records — 7 years, or longer if required by tax / accounting law.
Error and security logs — up to 90 days, except where a longer period is required to investigate an incident.
Email marketing records — until you unsubscribe, plus a suppression record so we don't email you again.
Backups — rolling backups are typically retained for up to 30 days and then overwritten.

Security

We take reasonable technical and organizational measures to protect your information — including encryption in transit (HTTPS), encryption at rest for our primary database, role-based access controls, and audit logging. No system is 100% secure. Please use a strong, unique password and notify us immediately if you suspect unauthorized access.

Email Communications

We don't sell or rent our email lists.

If you sign up for our newsletter, we'll send you emails about health podcasts, events, and related content. You can unsubscribe anytime by clicking "unsubscribe" in any email, emailing privacy@healthpodcast.org, or updating preferences in your account.

Even if you unsubscribe from promotional emails, we may still send you account-related messages (security alerts, billing receipts, important service notices).

Your Rights and Choices (Everyone)

Access and Update — Log into your account to update your information anytime.

Delete Your Account — Contact us at privacy@healthpodcast.org to request deletion of your account and information.

Manage Cookies — Click the floating "Privacy preferences" icon at the bottom right of any page to change your analytics consent at any time. You can also block cookies through your browser settings.

Your Rights (EEA / UK / Swiss Residents)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the GDPR / UK GDPR / Swiss FADP:

Right of access — obtain a copy of the personal data we hold about you.
Right to rectification — correct inaccurate or incomplete data.
Right to erasure ("right to be forgotten") — ask us to delete your data, subject to certain legal exceptions.
Right to restriction of processing — limit how we process your data in certain circumstances.
Right to data portability — receive your data in a structured, machine-readable format and transmit it elsewhere.
Right to object — object to processing based on legitimate interests, including for direct marketing.
Right to withdraw consent — withdraw consent at any time where processing is based on consent (e.g. analytics, newsletters).
Right not to be subject to a decision based solely on automated processing, where such processing produces legal or similarly significant effects.
Right to lodge a complaint with your local data protection authority. A list of EEA authorities is available at edpb.europa.eu; the UK ICO is at ico.org.uk; the Swiss FDPIC is at edoeb.admin.ch.

To exercise any of these rights, email privacy@healthpodcast.org. We will respond within one month, or tell you why we need more time.

We are based in the United States and have not designated an EU representative under Article 27 of the GDPR. Until we do, you can reach our privacy team using the contact details below.

State-Specific Privacy Rights (United States)

California Residents

If you're a California resident, you have rights under the California Consumer Privacy Act (as amended by the CPRA):

Categories of personal information we collect:

Identifiers (name, email, IP address, account ID)
Customer records (contact information, billing information)
Internet or other electronic network activity (pages viewed, podcasts followed, listening history)
Geolocation data (approximate, derived from IP address)
Inferences drawn from the above (e.g. content recommendations)
Professional information (whether you're a healthcare professional, where you provide it)

Your California rights:

Right to Know — Request what personal information we have collected, used, disclosed, and shared.
Right to Delete — Request deletion of your personal information.
Right to Correct — Request correction of inaccurate personal information.
Right to Opt Out of Sale or Sharing — Opt out of any "sale" or "share" for cross-context behavioral advertising. We do not currently sell or share your personal information; if this changes, we will update this policy and provide an opt-out mechanism. We honor the Global Privacy Control browser signal.
Right to Limit Use of Sensitive Personal Information — We do not use sensitive personal information for purposes that trigger this right.
Right to Non-Discrimination — We will not discriminate against you for exercising any of these rights.

How to exercise your rights: Email privacy@healthpodcast.org. We may verify your identity before responding.

Other States

If you live in Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Nevada, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you have similar rights under your state's privacy laws — generally including rights to access, delete, correct, and opt out of targeted advertising or the sale of personal information. Email privacy@healthpodcast.org to exercise these rights.

Changes to This Policy

We may update this Privacy Policy from time to time. We'll indicate changes by updating the "Effective Date" at the top.

If we make material changes, we'll notify you by email (if you've provided one) and/or through a prominent notice on the Platform.

Continued use of the Platform after changes means you accept the updated policy.

Contact Us

Questions about this Privacy Policy, or to exercise any of your rights:

Mission Based Media LLC
Attn: Privacy
30 N Gould St Ste R
Sheridan, WY 82801-6317

Email: privacy@healthpodcast.org