Privacy and Cookies Policy

Draft produced in Step 10 of the project (analytics and compliance).

This document explains, with the detail we have today, what personal data RehabGuide collects, what we use it for, who we share it with, how long we keep it, and how you can exercise your rights. It follows the structure required by the EU GDPR and the California CCPA, but it has not been drafted or reviewed by a lawyer — do not treat it as a current, binding privacy policy until that review happens.

1. Data controller

As of this draft, RehabGuide is a project under construction with no incorporated legal entity or registered mailing address. This section is intentionally incomplete: we are not inventing a company name, tax ID, or address. Before this policy is published on the live site, it must be completed with the exact legal identity of whoever operates the site (sole proprietor, company, etc.) and their formal contact details — this is one of the mandatory elements of a GDPR-compliant policy (see sources below).

2. What personal data we collect

Based on what the site's code actually does today:

• Data you give us directly: if you use the guide-download form (NewsletterForm.astro), we collect your email address, the language of the form, which guide you requested, and the flag and timestamp of your explicit consent (mandatory checkbox). This data is sent to our email marketing provider (Brevo, see section 5).
• Data collected automatically (only if you accept analytics cookies): pages viewed, the site's language, which guide you're viewing, whether you downloaded a PDF, and an approximate location/device via Google Analytics 4 (GA4), with IP anonymization enabled (anonymize_ip). GA4 does not load at all if you reject or haven't answered the cookie banner yet — see section 8.
• What we explicitly do NOT collect: the form does not ask for your diagnosis, your actual medical condition, or any health data under Article 9 GDPR (special category data). The PDF checklist is generic content, not a health questionnaire — see docs/email/paso-8-email-lead-magnet.md, section 7.

3. Why we use it and under what legal basis

4. Who we share your data with

We do not sell your data. The only third parties that process it on our behalf are:

• Brevo (email marketing provider, formerly "Sendinblue") — processes your email address to send the guide and welcome sequence. Brevo's privacy policy: brevo.com/legal/privacypolicy.
• Google Analytics 4 (Google LLC / Google Ireland Limited) — processes site usage data, only if you accepted the cookie banner. Google's privacy policy: policies.google.com/privacy.
• Cloudflare Pages — hosts the site and the function that processes the form (functions/api/subscribe.js). Cloudflare's privacy policy: cloudflare.com/privacypolicy.

5. International data transfers

Google and Cloudflare process data on servers outside the European Union (the US, among other countries). We have not yet confirmed which transfer mechanism currently applies to this specific account with each provider (e.g. standard contractual clauses, EU-US Data Privacy Framework certification). This must be verified against each provider's up-to-date legal documentation before this policy is published — nothing is assumed or invented here.

6. How long we keep your data

This draft does not set an exact number of days, months, or years because the project has not yet defined a retention policy with Brevo, has not confirmed that platform's default limits, and has not received legal advice on an appropriate period. What we can say with the information available:

• We keep your email while you remain subscribed and haven't unsubscribed.
• If you unsubscribe (link in every email), we stop sending you communications; exactly how long the historical record remains in Brevo after that is something that must be confirmed against that account's real configuration — no specific period is stated here.
• Analytics data (GA4) uses, by default, a configurable user/event data retention setting in Google Analytics (Admin → Data Retention); the project has not yet set that value in a real GA4 account — see docs/analytics/paso-10-analitica-cumplimiento.md.

7. Your rights

If you're in the European Union (GDPR), you have the right to:

• Access your personal data (Art. 15), rectify it (Art. 16), and request its erasure (Art. 17).
• Object to processing (Art. 21) and request restriction of processing (Art. 18).
• Request data portability (Art. 20).
• Withdraw your consent at any time, without affecting the lawfulness of prior processing.
• Lodge a complaint with your country's supervisory authority.

GDPR Article 12(3) requires us to respond to your request within one calendar month of receiving it, extendable by up to two further months for complex cases (source: GDPR text, Art. 12(3) — see sources section).

If you're a California resident (CCPA/CPRA), you additionally have the right to know what information we collect about you, to request its deletion, to correct it, to opt out of the "sale or sharing" of your data (we do not currently sell or share data for advertising purposes, but this right applies regardless), to limit the use of sensitive personal information, and to not be discriminated against for exercising these rights (source: CCPA summaries cited below — we have not confirmed a specific CCPA response deadline for this project; none is invented here).

8. How to exercise your rights

Email us at privacy@rehabguia.com (placeholder address: the domain rehabguia.com hasn't been purchased yet — see Step 11 of the project — so this address doesn't actually exist yet. It must be confirmed/activated before this policy is published). To unsubscribe from the educational emails, use the "unsubscribe" link included in every Brevo email.

9. Cookies and local storage

The site uses its own cookie banner (no third-party libraries) that blocks Google Analytics until you decide. Here's what gets stored:

Neither Google cookie is created if you reject the banner, or if you haven't answered it yet — Google's script (gtag.js) is literally never inserted into the page until you accept (see src/components/CookieConsent.astro). You can change your decision at any time via "Cookie preferences" in the footer.

10. Relationship to the medical disclaimer

This policy covers personal data, not clinical content. The site's educational content (exercises, symptoms, etc.) is covered by its own notice: see Medical disclaimer.

11. Changes to this draft

This document will change as the project moves forward (real domain, real GA4 account, legal review, Step 9 monetization). While it's still marked as a LEGAL DRAFT, content changes are tracked in the project repository's version history, not on this page.

Sources for this structure

• Checklist of mandatory GDPR privacy policy elements — Termly, "Privacy Policy Requirements Checklist for Websites & Apps" (termly.io/resources/checklists/privacy-policy-requirements/).
• GDPR text, Articles 12 (one-month response deadline, Art. 12.3), 13, 15-21 — primary source (eur-lex.europa.eu, Regulation (EU) 2016/679).
• Summary of CCPA/CPRA rights and required disclosures — aggregated search sources (secureprivacy.ai/blog/ccpa-privacy-policy-checklist, cookieyes.com/blog/ccpa-requirements).
• GA4 cookie names and default duration (_ga, _ga_<container-id>, 2 years) — Google Analytics Help, "[GA4] Cookie usage on websites" (support.google.com/analytics/answer/11397207).

[LEGAL DRAFT — pending attorney review, not real legal advice]