The short version. We collect the email and name you give us when you take a quiz, plus standard analytics. We use it to send the personalized plan you asked for and the educational emails you opted into. We do not sell your data. You can unsubscribe or delete your data anytime by emailing [email protected].
Eczema Academy ("we", "us", "our") provides educational content about eczema, including videos, quizzes, written guides, and online courses. Carolyn Akinyemi is the host and founder. We are the data controller for the information described in this policy.
We collect the minimum information needed to deliver what you asked for and to keep the service running. Specifically:
We rely on the following lawful bases under the UK GDPR / EU GDPR:
We share data only with the processors that run the service:
We do not sell your personal information in the meaning of the California Consumer Privacy Act (CCPA/CPRA) or any equivalent state law.
Our primary servers are in the EU. Some processors (email delivery, payment) may transfer data to the United States. Where they do, transfers are protected by the European Commission's Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework where applicable.
We use only essential and functional cookies by default (session, preference). We do not load analytics or advertising cookies until you give consent via the cookie banner. See our Cookie Notice for details and controls.
Wherever you are, you have the right to:
If you are in California, Colorado, Virginia, Connecticut, Utah, Texas, Oregon, Montana, or any other US state with a privacy law, you have substantially the same rights including the right to opt out of any sale or sharing of personal data (we do neither).
To exercise any of these rights, email [email protected]. We respond within 30 days.
This service is for adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.
We use industry-standard measures including TLS encryption in transit, encrypted backups, restricted server access, and least-privilege staff access. No system is completely secure; if a breach happens that affects your data, we will notify you within 72 hours where required by law.
We will post material changes here and, if they meaningfully affect you, email you. The Effective Date at the top of this page shows when this policy was last revised.
Email: [email protected]
Response time: within 30 days, usually much sooner.
If you are in the UK or EU and you are not satisfied with our response, you have the right to complain to your local supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, your national Data Protection Authority (edpb.europa.eu).