Privacy Policy

Last updated October 2026.

This site does not ask you for a name, an email address, or any health information, and it has no accounts to sign into. There is no sign-up, no comment field, no mailing list and no contact form anywhere on it. This policy sets out what is collected when you visit, what it is used for, who else receives it, and what you can require us to do about it.

1. Information we collect

The list below covers everything. It is written as a list rather than as a paragraph so that anything missing from it is visibly missing.

• Information you give us directly. Nothing, unless you write to us. There is no form on this site that sends anything anywhere. If you send us an email we hold your address and whatever you wrote for as long as it takes to deal with it, and for a reasonable period afterward for reference. We operate no mailing list and hold no other addresses.
• Information collected automatically. Google Analytics 4 records which pages were opened, in what order, and the browser and operating system that opened them, together with the coarse location the request implies. We also measure clicks from articles to provider reviews, using the public source page, review destination, link label and link context. These events contain no form input or URL query strings. When analytics is enabled, we also compare two versions of a labeled provider widget. We store its assigned version in browser storage and count visible widget impressions and clicks, with the public page and provider identifier. Opting out stops this measurement and removes the assignment. Our host, Vercel, keeps ordinary request logs for its own operations and for abuse prevention.
• Cookies and similar technologies. Analytics cookies written by Google, and browser storage for your schedule preference, analytics choice and, when analytics is enabled, a widget test assignment. No advertising pixel, no retargeting tag, no data broker, and nothing sold to anyone. Section 3 names all of them.
• Outbound click data. A link to a provider passes through a redirect on this domain, and we write one line about it to our own log. That line is described in full in section 4. What the provider and the affiliate network then record is theirs, not ours, and section 5 describes what reaches them.
• What we do not collect at all. We do not ask for, receive or store health information of any kind: no diagnosis, no prescription, no dose, no lab result, no weight, no insurance member id. The calculators on this site run entirely in your browser. The figures you type into the titration cost tool, and anything you type into a seller search box, are computed on your own device and are never transmitted to us or to anyone else.

2. How we use it

• To operate, maintain and secure the site.
• To reply to an email you send us.
• To understand which pages readers actually use, so that the ones worth expanding can be told apart from the ones nobody opens.
• To count outbound clicks by page and by link, so we can tell what is useful.
• To prevent fraud and abuse and to enforce our terms.
• To comply with a legal obligation that applies to us.

We do not use any of it to build a profile of you, to target advertising at you, or to decide anything about you. We do not sell personal information and we do not share it for cross-context behavioral advertising.

3. Cookies, tracking technologies and your consent choices

This is a United States site and analytics here work the way US privacy law contemplates: on an opt-out basis. Measurement starts on your first visit and you can switch it off at any moment. Your choice is kept in your own browser and is honored on every later visit from that browser.

If you set your week on the schedule track, that single choice is saved in your browser’s local storage so the page can answer at your dose next time. It is a step number and nothing else. It never leaves your browser, it is not sent to us or to anyone else, and you can clear it with the reset control beside the track or by clearing your browser data.

These are the technologies in use, named rather than described in general terms:

• Analytics cookies, on by default and opt-out. Unless you have opted out, Google Analytics writes its own _ga cookies to tell one browser’s visits apart from another’s. Opting out deletes the ones already on your device.
• Functional storage. Two keys, both in your browser’s local storage and neither ever transmitted: tsr.week holds the step you set on the schedule track, and tsr.analytics-consent holds your answer to the analytics question so it survives a reload. A separate consent-gated key, tsr.widget-copy-v1, stores an A/B widget version. The version is included in measurement events and provider-link attribution; opting out removes it.
• Contextual provider advertising. Labeled affiliate widgets may appear on the site. We load no affiliate conversion pixel or retargeting tag on our pages.

Turning analytics off

Analytics is on by default and you can switch it off here. The switch applies immediately, on this page, without a reload — a control that only takes effect on the next page is a control that did nothing on the page you clicked it. Opting out also deletes the _ga cookies already on your device; Consent Mode on its own does not remove them.

If your browser sends Global Privacy Control, analytics is already off here and this site does not override that signal. You do not have to click anything.

Reading your current setting…

You can also block cookies in your browser settings, or install Google’s own opt-out add-on, which switches Google Analytics off across every site that runs it. Parts of this site remember less about your visit if you do, and none of it stops working.

4. Server logs and the click record

Vercel, our hosting provider, keeps ordinary request logs — IP address, user agent, requested path, timestamp — for security and abuse prevention. We do not use them to build a profile of you.

Separately from that, when you click through to a provider we write one line of our own to that log. It records nine things. Each of them is a fact about the page rather than about you: a schema version, the time to the second, which provider you clicked, whether that provider pays us, which page you clicked from, your position in the list if it was a list, the placement — which of our links on that page it was — a widget A/B label when analytics is enabled, and whether you arrived from this site or from somewhere else.

The last one is the only field that touches where you came from, and it holds our own domain or the single word external — never the name of the other site, and never the address you were on. The line contains no IP address — not hashed, not shortened — no user agent, and no cookie, session or visitor identifier of any kind. There is nothing in it that could link two of your clicks to each other. We do not record a click from something that identifies itself as a bot, and a link preview or prefetch is not recorded at all.

This record exists so we can tell which pages and which links are worth keeping. It runs whether or not you have opted out of analytics, because it holds nothing that identifies you and switching it off would not change what is known about any reader. It is not a Google product, it is not sent to Google, and it never reaches the provider you clicked.

5. Outbound links to providers

When you click a link to a provider, you pass through an internal redirect. For providers who pay us, that redirect appends parameters to their link identifying which provider you clicked, which of our pages you clicked from, your position in the list if it was a list, and which link on the page it was — so we can tell which parts of the site are useful. Those parameters describe the link, not you: no identifier of yours is added. Where a provider does not pay us, nothing whatsoever is appended to their link. Once you arrive on a provider’s site, their privacy policy governs, not ours. See disclosure.

A provider you land on, and the affiliate network that attributes the click, may set their own cookies on their own domain and will see the referral for what it is. Those are first-party cookies of the site you are now on, governed by that company’s policy and not by this one. Nothing you ever typed into this site travels with you, because this site has nothing of yours to send.

6. Third parties we share data with

We do not sell personal information. The companies below are the only ones that receive anything, and each one is named here because it is loaded or used at runtime rather than because it is a category a policy ought to mention.

• Google Analytics 4 (Google LLC) — counting page views and which pages get read. Every advertising purpose is switched off permanently and for everyone: ad storage, ad user data and ad personalization are all denied, so nothing here builds an advertising audience

• Hosting and infrastructure (Vercel). This site is served by Vercel, which keeps request logs and runs the bot mitigation that sits in front of every page. A request that looks automated may be challenged before it reaches us.
• Affiliate network (Katalys). Where a provider pays us, their link is a tracking link operated by the affiliate network Katalys, and our redirect adds our publisher id and the labels described in section 5 to it so that the click can be attributed. Katalys operates under its own privacy policy and is responsible for what it records after the hand-off. It receives nothing you gave us, because you gave us nothing.
• Legal and safety. We may disclose information where the law requires it, in response to a valid legal request, or where it is necessary to protect the rights, property or safety of readers or of the public.

7. Your rights and how to exercise them

Wherever you live, you can write to legal@thesemaglutidereport.com and ask what personal information we hold about you, ask us to correct it or delete it, ask for a copy of it, or object to analytics. Say what you are asking for and give us enough detail to match your request against something we actually hold.

Be aware of what that answer will usually be. We hold no account and no contact information for you, so unless you have emailed us there is generally nothing for us to find, export, correct or delete, and we will say so rather than perform a search we know the outcome of. If we do need to verify who you are before acting, we will ask for the least information that would let us do it, and we will not use what you send for anything else.

The fastest way to opt out of analytics is the control in section 3. It takes effect on the page you are reading, and it needs no request and no reply from us.

8. California residents (CCPA and CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the right to know what personal information has been collected about you and how it is used, to request its deletion, to correct inaccurate information, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and to exercise any of those rights without being treated differently for having done so.

Two of those have a short answer here. We do not sell personal information as the CCPA defines the term, and we do not share it for cross-context behavioral advertising: every advertising purpose in the analytics tag is denied permanently and for everyone, which is why there is no “do not sell or share” link on this site to click. We collect no sensitive personal information to limit. A Global Privacy Control signal is treated as a valid opt-out request and is honored automatically, with nothing for you to submit.

To exercise any of these rights, write to legal@thesemaglutidereport.com and say that the request is a California privacy request. An authorized agent may make a request on your behalf with written permission from you.

9. Other US state privacy laws

Comprehensive privacy laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware and a growing list of other states give residents broadly the same set of rights: to confirm whether personal data is processed, to access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, of sale, and of profiling that produces legal or similarly significant effects. Several of them also give you a right to appeal a refusal.

We do not conduct targeted advertising, we do not sell personal data, and we do not profile anyone. The same address handles every one of these requests: write to legal@thesemaglutidereport.com and name the state you are writing from, so the right law is applied to your request. If we refuse a request, we will tell you why and how to appeal it.

10. Visitors from the EU and the UK

This site is operated from the United States and is written for readers in the United States. The prescribing information it describes is the labeling approved by the US Food and Drug Administration, and the sellers it covers dispense against a US prescription. We do not market this site to residents of the European Economic Area, the United Kingdom or Switzerland, and nothing on it is an offer of medication or of care to anyone anywhere.

If you visit from one of those places anyway, the General Data Protection Regulation and the UK GDPR still give you rights of access, rectification, erasure, restriction, portability and objection over anything we process about you, the right to withdraw a consent you previously gave, and the right to complain to your own supervisory authority. Where a lawful basis is needed, ours are these: consent for analytics, which the control in section 3 withdraws immediately; the steps taken at your request when you email us; our legitimate interest in running a secure site and in counting outbound clicks, which the record in section 4 does without holding anything about you; and compliance with a legal obligation where one applies.

We process no special category data under Article 9: no health data is asked for and none is stored, and the tools on this site compute in your browser. We make no decision about anyone by automated processing alone.

11. Children

This site is intended for adults. It is not directed to children under 13, and in line with the Children’s Online Privacy Protection Act we do not knowingly collect personal information from them. There is nothing here for a child to sign up to. If you believe a child has sent us personal information, write to legal@thesemaglutidereport.com and we will delete it. We do not sell or share the personal information of any reader, which includes every reader under 16.

12. How long anything is kept

We keep personal data only for as long as the purpose it was collected for lasts. Correspondence sent to our published addresses is kept for as long as it takes to answer and for a reasonable period afterward. Analytics event data is retained by Google under the retention period set on the property, and can be deleted from your side at any time by opting out, which also removes the cookies that tie one visit to another. The request logs and the one-line click records described in section 4 expire on the hosting platform’s own schedule; we have not set a retention period of our own, and we do not copy either one into a database, because there is no database on this site to copy them into.

13. Security

Every page is served over HTTPS, and the platform in front of it challenges traffic that looks automated. The larger protection is what does not exist here: no account, no password, no payment detail, no health record, and no reader database. There is nothing stored on this site that a breach of it could expose about you. No system is perfectly secure, and we do not claim this one is.

14. International data transfers

We are based in the United States and the service providers named in section 6 may process data in the United States and in other countries; a page is served to you from whichever edge location is nearest, which may not be in your country. Where the law requires a safeguard for a transfer, we rely on the ones our providers put in place, such as standard contractual clauses. What crosses a border here is a page request and an analytics event, not a file about you.

15. Changes to this policy

We will post any revision here with a new “last updated” date, and a change that materially affects what is collected will be described rather than quietly merged into the text. This policy is revised in the same commit as the feature that changes it: a page that lags what the site actually does is worse than no page at all.

16. Contact

Privacy questions, requests and complaints go to legal@thesemaglutidereport.com. Requests are handled by email; this site publishes no postal address and takes no calls. See also our terms of use and our disclosure.