The notice that applies now.

Who is responsible

NextConsensus, Inc., a Delaware corporation, is the controller for the personal data described here. Reach us at legal@nextconsensus.com.

What this site collects

Three things, and nothing else.

• The contact form. Your work email, the therapeutic domain, the authority decision you are asking about, when you need to know by, and the optional context you choose to add about who would use the forecast and what decision it feeds. The form also records which page you submitted from and the time you submitted.
• The newsletter form. Your email address, if you enter one.
• Aggregate traffic measurement. We use Cloudflare Web Analytics, which is cookieless and does not fingerprint visitors or build a profile of you. It reports page-level counts, not individuals.

What this site does not do

• No advertising or tracking cookies, and no third-party trackers.
• No cross-site tracking, data brokers, or sale of personal data.
• No PHI, patient data, or special-category health data — we ask you not to send it, and the form is not designed to receive it.
• The only browser storage we set is your light or dark theme choice, kept on your device and never transmitted.

Why we process it, and on what basis

• Answering your enquiry — because you asked us to, and to take steps toward a possible agreement at your request. GDPR Art. 6(1)(b).
• Newsletter — your consent, given by opting in, withdrawable at any time. Art. 6(1)(a).
• Aggregate traffic measurement and abuse prevention — our legitimate interest in knowing whether the site works and in keeping the form from being abused, weighed against a method that identifies nobody. Art. 6(1)(f).

Who else sees it

Cloudflare hosts this site, filters bot traffic on the form, and carries submissions onward. GitHub holds the source code and contains none of your data. Both are listed on Security & Compliance, which stays current with this notice. We do not share your data with anyone else, and no third-party AI provider is in the path.

How long we keep it

• Contact form submissions: two years from our last exchange with you, then deleted.
• Newsletter address: until you unsubscribe, which every email lets you do.
• Aggregate analytics: retained by Cloudflare on their schedule; it is not tied to you and cannot be traced back.

Your rights

If you are in the UK, EU, or a US state with a privacy statute, you can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in portable form. Withdrawing consent for the newsletter does not affect anything done before you withdrew it. Email legal@nextconsensus.com and we will reply as quickly as we can, and within the period the applicable law allows. You may also complain to your data protection authority.

Where the data goes

We are a US company using a US-headquartered provider, so your data may be processed in the United States. Transfers out of the UK or EEA rely on the 2021 Standard Contractual Clauses in our agreement with Cloudflare.

Children

This site is for professional use and is not directed at anyone under 16. We do not knowingly collect their data.

Changes

If this notice changes, the effective date at the top changes with it, and the previous version stays available on request.

What remains public

The public site describes the general evidence boundary, registration discipline, and limitations of the work. It does not publish customer context or negotiated terms.

What is confirmed privately

Program-specific data handling, confidentiality, ownership, liability, delivery, and applicable security requirements are reviewed with the parties and documented before delivery.