Privacy Policy

The short version

This site uses Google Analytics to count visits and to see which pages get read. It sets cookies in your browser and it tells Google that a visit happened. That is a change: until September 2026 this site ran no analytics at all, and this policy said so in plain terms, so we would rather point at the change than let you find it. Our Analytics property is also linked to our Google Ads account, so Google Ads can tell us which ad clicks led someone to the contact page or to send the form. A second change followed in October 2026: we now advertise on Instagram and Facebook, and a handful of pages run Meta’s advertising pixel so we can tell whether those ads bring anyone here. Since October 20, 2026 it runs on every page of the site, the journal and the condition and lab pages included. For two days in October 2026 we tried a lighter touch: the contact form asked before Meta was told about an inquiry, then Meta was told nothing at all, and your browser’s Global Privacy Control signal switched off every third-party measurement here. From October 17, 2026 that is reversed, and we would rather say so than let you find it: everything described below runs for every visitor, Meta is told when an inquiry is sent, and Global Privacy Control switches off the Meta Pixel and nothing else. We have chosen to measure the site and our advertising rather than to ask first. There is a separate Consumer Health Data Privacy Policy, written for the Washington and Nevada laws that treat even an inquiry to a health practice as health data; it says the same thing. We still do not sell your personal information, and the fonts are still served from our own servers rather than from a font network.

The only information you actively give us is what you type into the contact form and send. Everything else described here is collected in the background by the site, by our host, by Google Analytics and Google Ads, by Ahrefs Web Analytics and by Meta.

Who this policy covers

This policy covers wildlyprimal.com. It does not cover our Instagram profile, which is governed by Meta’s privacy policy, or any laboratory, supplier or scheduling service you may deal with separately.

It also does not cover the information you give us once you become a client. That is handled under the intake and privacy terms you receive when the engagement begins, which are more protective than this page because the information is more sensitive.

What we collect

When you submit the contact form, we receive what you chose to enter:

• Your name
• Your email address
• Which service you are interested in, if you selected one
• The message you wrote

What our hosting provider records

Like every website, ours runs on servers that keep operational logs. Our host, Vercel, records standard request data (IP address, browser and device type, the page requested, referring page and a timestamp) for delivery, security and abuse prevention.

We do not use these logs to build a profile of you, we do not combine them with contact-form submissions, and we do not have a way to identify you from them.

Analytics

We use Google Analytics 4 (measurement ID G-SFVMMVZCY7) to understand how this site is used: how many people arrive, which pages they read, roughly where they are and what brought them here. We use it to decide what to write next and what to fix. We do not use it to work out who you are.

To do that, your browser loads a script from googletagmanager.com and sends information to Google, which processes it for us in the United States. That information includes the pages you view, the site that referred you, your browser and device type, your IP address, from which Google derives an approximate location — a city or region, not an address — and a randomly generated identifier kept in the cookies described under Cookies below.

We do not switch off Google Signals or Google’s advertising features on the tag itself. Whether Google uses them for this site is set in our Analytics account, and we may turn them on to understand our visitors better; if we do, Google can tie visits here to signed-in Google accounts for its own reporting to us.

Google Analytics also records some interactions on its own, without us switching them on one by one: how far down a page you scroll, clicks on links that lead off this site, file downloads, searches and video plays. That is measurement of what happens on these pages. It is not session recording: we cannot see your screen and we cannot replay your visit.

We also ask Google Analytics to record a few things about the contact form: that one of the buttons leading to it was clicked and from which page; that someone pressed send; which field, by its name alone, stopped the send if it was empty or mistyped; whether the form then sent or failed, and if it failed, whether it timed out, was refused by our server or could not connect; that the link to schedule a consultation directly was clicked; and which of the listed options was selected. We never send it your name, your email address or anything you write in the message, and an inquiry about returning-client support is recorded only as “other”.

We also use Ahrefs Web Analytics, a second and simpler visit counter, to see how people who find us through search move around the site. Your browser loads a script from analytics.ahrefs.com and sends Ahrefs the page you are on, the site that referred you, your screen size and your browser’s language setting, along with the address of any link you click and the fact that a form was submitted, never what was typed into it; like any request on the web, that also passes your IP address to Ahrefs. It sets no cookies and stores nothing in your browser, so it has no identifier with which to recognise a returning visitor.

Our Google Analytics property is linked to our Google Ads account. For a visitor who arrived by clicking one of our Google ads, that lets Google Ads count whether they went on to view the contact page or to send the contact form, and report those counts back to us against the ad. Since October 18, 2026 the same script also carries our Google Ads tag (AW-18451613415), which reports the sending of the contact form to Google Ads directly as a conversion, and sets the _gcl_au cookie described under Cookies below. Google Ads receives no more about the form than Analytics does: never your name, your email address or anything you write.

We also use Vercel Web Analytics, our host’s own visit counter, to see how many people visit and which pages they read. It records the page, the site that referred you, and coarse details such as browser, device type, operating system and country. Vercel states that it sets no cookies and keeps no identifier that follows you from one day to the next, and its script is served from this site rather than from anyone else’s network.

Separately, we use Vercel Speed Insights to measure how quickly pages actually load for the people visiting them, because a slow page is a real problem and lab tests run on our own machines do not show it. Each measurement records the page, the timing itself and coarse details — browser, device type, operating system, connection speed and country. Vercel states these data points are anonymous, are not tied to an individual visitor or IP address, and cannot be joined up into a session across pages. It sets no cookies, and its script is served from this site rather than from anyone else’s network.

Analytics tells us that a page was read and that the contact form was used. It does not tell us who used it, we cannot connect a visit to a contact-form message, and we do not try to.

Advertising measurement

We run ads on Instagram and Facebook, which belong to Meta. To learn whether those ads lead anyone to get in touch, and so Meta can show them to people more likely to find them useful, this site uses the Meta Pixel and Meta’s Conversions API.

The pixel runs on every page of this site, including the journal and the pages about conditions and lab tests, so Meta is told which of those you read. Until October 20, 2026 it ran only on seven pages that were not about a health topic; we widened it to every page to give Meta more to measure our advertising with. On every page, your browser loads a script from connect.facebook.net and tells Meta that the page was viewed, along with its address, the site that referred you, your browser and device, your IP address and an identifier kept in the cookies described under Cookies below. That report goes to facebook.com and also to two servers Meta operates for this purpose in Google’s and Amazon’s clouds; the recipient is Meta either way.

When you send the contact form and it reaches us, we tell Meta that an inquiry was sent: once from your browser, and once from our server so that it is counted even if the pixel was blocked. The server’s report carries your email address only as a one-way SHA-256 hash, which Meta uses to match the inquiry to a Meta account, together with your IP address, your browser and the same cookie identifiers. We never send Meta your name, the option you chose, or anything you write in the message. We do not ask your permission first. Washington’s and Nevada’s health-data laws treat an inquiry to a health practice as consumer health data, and we have chosen to measure our advertising and to tell you plainly, here and in our Consumer Health Data Privacy Policy, rather than to put a consent box on the form.

Meta receives this as an independent company, under its own terms and privacy policy, and may use it to measure and improve advertising, including ads it shows you elsewhere. Under some state privacy laws that counts as “sharing” personal information for targeted advertising, and you have the right to opt out of it.

To opt out, turn on Global Privacy Control in your browser (built into Firefox, Brave and DuckDuckGo, and available as an extension for others). When your browser sends it, the pixel does not load and our server sends Meta nothing about your inquiry. Blocking or clearing cookies, or an ad blocker, also stops the pixel, and you can manage how Meta uses ad data in your Facebook or Instagram settings. To have what Meta already received deleted, email us: we will ask Meta, though we cannot promise what an independent company does with its own records.

What we do not collect

We want to be specific rather than vague, because “we may collect” language in privacy policies usually means “we do”. On this site we do not:

• Run advertising pixels from anyone but Meta
• Load fonts or images from third-party networks
• Use session recording or heatmaps
• Buy or receive personal information about you from data brokers
• Ask for health information through this website, or use what you read here to infer anything about your health
• Sell your personal information, or share it for advertising with anyone but Meta, as described under Advertising measurement

Why we use what we collect

We use contact-form submissions to read your inquiry, reply to it, and (if we go on to work together) to set up that engagement. That is the whole purpose.

We use server logs to keep the site available and to deal with abuse. Where a legal basis is required, ours is our legitimate interest in operating a secure website, and, for your inquiry, taking steps at your request before entering into a contract.

Who else sees it

We do not sell, rent or trade your personal information, and apart from the Meta advertising measurement described above, we do not share it for anyone’s marketing. A small number of service providers process it on our behalf, under contract, only to provide their service to us. Meta is not one of them and is described under Advertising measurement: it receives what we send, as an independent company under its own terms.

• Vercel: hosts the site, runs the contact form endpoint, counts visits and measures page speed
• Resend: delivers the contact-form email to our inbox, and sends an automated confirmation to the address you entered
• Google (Analytics and Ads): receives and processes the site-usage information described above, and counts which ad clicks led to the contact page or to an inquiry
• Ahrefs (Web Analytics): receives and processes the visit information described above
• Google (Gmail): the inbox that receives and stores our email
• GitHub: stores the site’s content and images, which the site is built from

We may also disclose information if the law requires it, or where it is necessary to establish or defend a legal claim, or to protect someone’s safety.

Cookies

Google Analytics sets two cookies here: _ga and _ga_SFVMMVZCY7. Both are first-party cookies, set on wildlyprimal.com rather than on another company’s domain, and both hold a randomly generated number that lets Analytics tell a returning browser from a new one. Neither holds your name, your email address or anything you typed. Google’s published expiry for both is two years.

Our Google Ads tag sets one more first-party cookie, _gcl_au, which holds a random number that lets Google Ads tell that the browser which sent the contact form is the one that clicked an ad. Google’s published expiry is 90 days. It is set by the same script, so the two ways of refusing the Analytics cookies below refuse it too.

You can refuse them. Blocking or clearing cookies in your browser settings works, and so does Google’s own opt-out add-on at tools.google.com/dlpage/gaoptout. Nothing here breaks if you do; no part of this site needs them to work.

The Meta Pixel (see Advertising measurement) sets a first-party cookie called _fbp, which holds a randomly generated number that lets Meta recognise a returning browser, and, if you arrived by clicking one of our ads, a second called _fbc, which records that click. Meta’s published expiry for both is 90 days. Neither is set when your browser sends Global Privacy Control.

One further cookie exists, and only administrators of the practice ever receive it: a sign-in cookie for the private content-management area at /admin. It is strictly necessary for signing in, holds only a signed session token, expires after eight hours, and is marked HttpOnly, Secure and SameSite=Strict. Visitors never receive it.

Separately from cookies, the site keeps one note in your browser’s local storage, named wp-consult-prompt, once it has shown you the card inviting you to book a complimentary consult, or once you have opened the contact form. It holds only the date, so that the card is not shown to you again. It holds nothing about you, it is never sent to us or to anyone else, and it stays until you clear this site’s data in your browser.

We do not currently show a cookie banner. That reflects a judgement about who visits this site and which rules reach them, and we keep it under review. It is not a claim that no rule could ever apply.

How long we keep it

Contact-form emails stay in our inbox so we have a record of the conversation. We review them periodically and delete inquiries that did not become an engagement, and in any case we will delete yours sooner on request.

Google Analytics keeps what it collects for the retention period set on the property, after which Google deletes it. The two cookies expire on the schedule under Cookies above, or sooner if you clear them. Meta keeps what it receives under its own data policy, and its two cookies expire as described under Cookies.

Server logs are retained by our host on their standard schedule, which is a matter of days to a few weeks, and then rotated out. Administrator account records exist for as long as that person administers the site.

How we protect it

The whole site is served over HTTPS. The contact form is validated on the server and screened by a hidden-field check, and the credentials for our email provider never reach your browser. It is not rate-limited; we say so on our security page too.

Administrator passwords are stored only as salted scrypt hashes, never in readable form. Sessions are signed, short-lived and compared in constant time.

No system is perfectly secure, and we will not claim otherwise. What we can say is that this site holds very little worth stealing, by design.

Health information

Health coaching, as we practice it, is generally not a HIPAA-covered service; we do not bill health insurance and we are not a covered entity or a business associate. That means the health information you send us is not protected by HIPAA, which is exactly why we ask you not to send it through this website. Separately, the health-data laws of Washington and Nevada treat even an inquiry to a health practice as consumer health data, and our Consumer Health Data Privacy Policy explains what that means for yours.

Please keep your contact-form message to what you would like to discuss. Symptoms, diagnoses, medications and lab results belong in the secure intake process, not in an email.

If you have already sent us health details through the form and would like them removed, email us and we will delete the message.

Your rights

Depending on where you live (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and a growing number of other states), you have rights over the personal information a business holds about you. We extend the following to every visitor, regardless of state, because drawing lines by geography seemed worse than simply honoring them:

• Know what personal information we hold about you and why
• Get a copy of it in a portable form
• Correct anything inaccurate
• Delete it
• Opt out of sharing for targeted advertising, by sending Global Privacy Control as described under Advertising measurement (we do not sell personal information), and switch off the analytics described above at any time, by either method under Cookies
• Not be discriminated against for exercising any of these rights
• Exercise the rights in our Consumer Health Data Privacy Policy, which we extend to every visitor and not only to residents of Washington and Nevada

To exercise any of them, email us from the address you contacted us with, or tell us enough to find your message. We will respond within 45 days, and will tell you if we need longer. If we decline a request, we will say why, and you may appeal by replying to that response.

Do Not Track and Global Privacy Control

We honor Global Privacy Control as an opt-out of sharing for targeted advertising. When your browser sends it, the Meta Pixel described under Advertising measurement does not load, and our server sends Meta nothing about your inquiry. Do Not Track is not read; most browsers have retired it in favor of Global Privacy Control.

The limit of that is worth stating plainly rather than burying: the Google Analytics and Ahrefs Web Analytics described above do not read a Do Not Track or Global Privacy Control signal, and they will not switch themselves off when your browser sends one. For two days in October 2026 they did; we reversed that on October 17, 2026 because we want the measurement. If you want Google Analytics off, the two methods under Cookies do work, and they work regardless of what your browser is signalling.

Children

This site is not directed to children, and our services are for adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has sent us information through the contact form, email us and we will delete it.

Visitors outside the United States

Our practice is in Florida and our service providers are in the United States. If you contact us from outside the country, your information will be processed in the United States, where privacy laws differ from those where you live.

The analytics described above runs for every visitor wherever they are, which means it sends that information to Google in the United States, and to Ahrefs; so does the Meta measurement, on every page. Nothing on this site asks for consent first, wherever you are.

We are not currently offering services outside the United States. If you are in the European Economic Area or the United Kingdom and would like your inquiry deleted, email us and we will do it.

Changes to this policy

If we change this policy we will update the date at the top of the page. If a change materially affects how we handle information already collected, we will make a reasonable effort to notify the people affected directly.

Contact

Privacy questions and requests go to the email address below. A person reads them.