The short version: We collect only the health information you actively provide through our intake forms. We use it solely to deliver your clinical programme. We do not sell it, share it with advertisers, or use it for any purpose other than your care. You have full rights over your data at any time. Contact us at stephen@detective-health.com with any questions or requests.
Detective Health is a trading name of Stephen Duncan, a sole trader based in Edinburgh, Scotland. The data controller for all personal data processed through this website and its associated clinical tools is:
Stephen Duncan, trading as Detective Health
Edinburgh, Scotland
Email: stephen@detective-health.com
Website: detective-health.com
This Privacy Policy applies to the detective-health.com website, all intake forms and clinical tools hosted on the platform, the Test, Don't Guess book purchase via Gumroad, and any direct email communication with us.
The Detective Health Concierge (AIdan) involves additional processing and third-party providers not covered here. Those are set out separately in the Concierge Privacy & Data Practices notice.
We collect personal and health data only when you actively provide it — through our intake questionnaires, contact forms, or direct communication. We do not collect data passively beyond standard server logs.
| Type of Data | What We Collect | Why We Collect It |
|---|---|---|
| Identity | Name, date of birth, email address | To identify you as a client and communicate about your programme |
| Health Data | Symptom responses, health history, lifestyle factors, laboratory test results, questionnaire responses | To deliver functional medicine clinical assessment and programme recommendations — this is the core purpose of the service |
| Biometric | Height, weight, blood pressure (if provided) | Clinical context for health assessment |
| Lifestyle | Diet, exercise, sleep, stress, supplement use | Clinical context for programme design |
| Purchase Data | Email address and purchase confirmation (via Gumroad for book purchases) | To confirm your purchase and deliver your digital product |
| Communication | Emails and messages you send to us | To respond to your enquiries and support your programme |
| Technical | Standard server/access logs (IP address, browser type, pages visited) via Netlify hosting | Site security and performance — not used to identify individuals |
Health data is special category data under GDPR. We process it on the basis of your explicit consent, which you provide when you submit any intake form or engage with our clinical services.
We rely on the following legal bases under UK GDPR:
Explicit Consent (Article 9(2)(a)): For processing special category health data submitted through our intake forms and clinical tools. You may withdraw consent at any time by contacting us.
Contract Performance (Article 6(1)(b)): For processing data necessary to deliver the clinical programme or service you have engaged with us for.
Legitimate Interests (Article 6(1)(f)): For technical server logs used to maintain site security and performance. We have assessed that these interests do not override your rights.
Intake form submissions are processed through Netlify Forms, which stores form data on Netlify's servers (US-based, with EU/UK data protection safeguards). Form notification emails are delivered to a private email account accessible only to Stephen Duncan.
Free self-check quizzes (the gut quiz, the Health Pattern Finder and the Fat Loss Pattern Finder) send your answers, your result and your email address to Stephen through Netlify Forms, so he can follow up if it would help. If you ask for your result by email, a small server run by Detective Health on Cloudflare sends one email through Resend. That email uses only your email address, your first name and which result you got; your answers are not sent to Resend.
New-article emails are sent with Mailchimp, only if you sign up: through the homepage form, or by ticking the separate, unticked box on a quiz. Mailchimp holds your email address, your first name if you gave it, and, for quiz sign-ups, a tag saying which quiz you came from. Your answers and your result are never sent to Mailchimp. Quiz sign-ups are confirmed by a second email before you are added. Every email has an unsubscribe link.
Client programme data may also be held in Practice Better, a HIPAA and GDPR-compliant practice management platform used to deliver your programme.
Book purchases are processed through Gumroad, which operates its own privacy policy for payment and transaction data. We receive only your email address and purchase confirmation — we do not receive payment card details.
We implement the following security measures: HTTPS encryption on all data in transit across detective-health.com, security headers (Content Security Policy, HSTS, X-Frame-Options) to protect against common web vulnerabilities, and access to health data restricted to Stephen Duncan only.
We do not: sell your data to any third party · share your data with advertisers · use your data for any purpose other than those described on this page · run advertising pixels or tracking scripts on this site · store payment card details
We retain client health records for 8 years from the date of last contact, in line with UK healthcare practitioner record-keeping guidance. After this period, data is securely deleted.
Intake form and quiz submissions from individuals who do not proceed to a clinical programme are retained for 12 months and then deleted.
If you sign up for new-article emails, your details stay on the Mailchimp list until you unsubscribe, which removes you from future emails. Ask us and we will delete them from Mailchimp entirely.
Purchase records from Gumroad are retained for the period required under UK tax legislation (currently 6 years).
You may request deletion of your data at any time. Where we are required by law to retain certain records, we will inform you of this.
| Service | Purpose | Data Shared |
|---|---|---|
| Netlify | Website hosting and form processing | Form submissions, server logs |
| Mailchimp (Intuit, USA) | New-article emails, only for people who sign up | Email address, first name if given, which quiz you signed up from. Never quiz answers or results |
| Resend (USA) | Sending a quiz result to you by email, when you ask for it | Email address, first name, the result you got |
| Cloudflare | Runs the small server behind AIdan and the quiz result emails, and its bot check | The request itself and your IP address, briefly, for rate limiting |
| Practice Better | Client programme management | Name, health history, programme notes |
| Gumroad | Digital product delivery (book) | Email address, purchase data |
| Randox / Regenerus Labs / Nordic Labs | Laboratory testing (TDG programme clients only) | Name, date of birth, test requisition data |
| Trace Elements Inc (USA) | Hair tissue mineral analysis (HTMA clients only) | Name, age, sex, occupation, hair colour, hair products, current medications and main symptoms, as required on the laboratory submittal form |
| Google Fonts | Typography (no cookies, no tracking) | IP address (standard CDN request only) |
| Anthropic API (via a Cloudflare Worker operated by Detective Health) | Helping Stephen draft parts of your written reports, such as the summary in your Clinical Summary Report, and his other practitioner analysis tools. Stephen reads and edits everything before you receive it; the AI does not make decisions about your care. Processed in the USA, with Anthropic acting as a processor on Stephen’s behalf. | Your symptoms, test findings and Stephen’s clinical notes, sent without your name or date of birth. By default Anthropic does not use this data to train its models. |
| Anthropic API (via Cloudflare Worker operated by Detective Health) | Food Log meal analysis (client-facing). Used only after you give separate consent inside the tool. Processed in the USA. | Meal photos and descriptions, meal times, how you felt before and after eating, the gut phase and flare status you select, and your food exclusion list. Your name and email are not sent. |
We do not use Google Analytics, Facebook Pixel, or any other behavioural tracking or advertising technology on detective-health.com.
You have the following rights regarding your personal data. To exercise any of these rights, contact us at stephen@detective-health.com. We will respond within 30 days.
Detective-health.com does not use tracking cookies, advertising cookies, or analytics cookies. The only cookies that may be set are strictly necessary functional cookies from Netlify for form submission processing. These are not used for tracking or advertising purposes and do not require your consent under UK law.
We do not use a cookie consent banner because we have no non-essential cookies to consent to.
Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at stephen@detective-health.com and we will delete it promptly.
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and notify affected individuals without undue delay. We maintain an internal record of any data breaches, their causes, and the remedial action taken.
We may update this Privacy Policy from time to time. Material changes will be communicated to active clients by email. The current version is always available at detective-health.com/privacy.html. The "last updated" date at the top of this page indicates when changes were last made.
For any questions, concerns, or requests relating to your data or this Privacy Policy, please contact us:
Data Controller: Stephen Duncan
Practice: Detective Health
Email: stephen@detective-health.com
Website: detective-health.com
If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113