This Privacy Policy explains how Josi Clary Coaching (“we,” “us”) handles information in connection with the Understanding Bone Health website (the “Site”) and, in the section “Information you share as a coaching client,” information you share with Josi directly as a coaching or Medical Advocacy client. This policy describes our practices; it is not a contract. This version is effective as of October 6, 2026.
Who we are
The Site is operated by Josi Clary Coaching, the health-coaching practice of Josi Clary, an Integrative Nutrition Health Coach based in California, United States. Josi Clary Coaching is the party responsible for the personal information described in this policy (the “controller,” where that term applies). The simplest way to reach us about anything in this policy is the contact form; our postal address is available on request through the same form.
Information we collect
- Information you give us. The free guide downloads directly from the Site; no email address is required. If you choose to give us your email address to receive occasional updates, we receive that address. If you request an access code for the Advocacy Guide, we receive the email address you enter and the answers described under “Access requests and donations” below. If you contact us, we receive the information in your message.
- Automatically collected information. Like most websites, our hosting provider may automatically log technical data such as IP address, browser type, device information, and pages visited, for security and to operate the Site. Our contact endpoint, our access-code request endpoint, and our unlock endpoint each keep a short-lived, in-memory count of attempts per network address so that one sender cannot flood our inbox or guess codes; those counts are not stored and clear within minutes.
- Interactive tools and the Medical Advocacy intake form stay on your device. The personalized appointment checklist, the printable advocacy packs, the quizzes, the calculators and simulations (including the calcium estimator), the home fall-hazard checklist, and the Medical Advocacy program’s intake form all run entirely in your browser. Nothing you select or type in them is uploaded to us, saved on our servers, connected to your identity, or sent to analytics. What you enter exists only on your screen and disappears when you close or refresh the page, unless you print or save a copy yourself. The intake form also offers an explicit, off-by-default option, “Save a draft on this device,” which stores a copy in your browser’s local storage, unencrypted, on that device only. We never receive it, it is not synced or backed up by us, and anyone with access to that browser could open it. You can remove it at any time with the form’s “Clear saved draft” control, by clearing your browser’s site data, or by using a private window, which discards it when closed. Printed or PDF copies you create are under your control and may contain your personal health information; please store and share them with that in mind.
How we use information
- To send you occasional educational updates, if you asked for them.
- To operate, secure, maintain, and improve the Site.
- To count page views in aggregate, without cookies, so we can see which pages help people most (unless you turn this off).
- To respond to your questions.
- To send you the Advocacy Guide access code you asked for, and to re-send it if you lose it.
- To comply with legal obligations.
Where the GDPR or a similar law applies, our legal basis is your consent for updates you sign up for (which you can withdraw at any time), your request when you ask for an Advocacy Guide access code, our legitimate interest in answering you for messages and consultation requests you send us, our legitimate interest in keeping the Site secure and working for technical logs, and our legitimate interest in knowing which pages are useful for the cookieless page-view counts, which you can turn off at any time with “Cookie settings” or Global Privacy Control.
We do not sell your information
We do not sell or rent your personal information. We do not use it for third-party advertising.
Do Not Track
We do not track visitors across sites. If your browser sends a Global Privacy Control (GPC) signal, we treat it as “Don’t count my visits”: the page-view counts described below are never sent from that browser. We do not respond to the older Do Not Track signal, which most browsers have dropped; GPC and the choice in our cookie notice do that job instead. No third party collects personal information on the Site except as described below for hosting and page-view counts, translation, form delivery, and access-code requests.
Third-party services
The Site relies on a few reputable third parties, each with its own privacy practices:
- Hosting and page-view counts (Vercel). The Site is hosted on Vercel, which may process technical/log data on our behalf. We also use Vercel Web Analytics to count page views in aggregate: which pages are visited, which site or search engine linked to them (when your browser shares that), from roughly where (country or region), and on what kind of device and browser. It sets no cookies and stores nothing on your device; a visitor is recognised only by a hash of the request that changes daily and is discarded after 24 hours, so you cannot be followed across days or across other websites. Of the page’s own address we send only the path: query strings and anything after a “#” are removed in your browser before the count is sent, and nothing you type or select in any tool or form is ever included. You can turn this off for your browser with “Cookie settings” at the bottom of every page, and browsers that send Global Privacy Control are never counted. See Vercel’s Web Analytics privacy notes.
- Translation (Google). The Site offers Google’s website translation. Google’s script does not load when a page opens; it loads only after you open the “Language” menu in the site header (or on a later visit if a language you chose is remembered by Google’s googtrans cookie). Once loaded, Google processes page content in your browser and may set its own cookies. See Google’s privacy policy at policies.google.com/privacy.
- Form delivery (FormSubmit) and our inbox (Google). The contact form, the consultation request, the updates sign-up, and Advocacy Guide access-code requests are all delivered to us by email through a third-party form-relay service, FormSubmit (or Web3Forms, if we configure it later), into our business email inbox, which is hosted by Google. The relay keeps its own copy under its own retention policy; our copy is kept in our inbox as described below.
- Updates sign-up. If you give us your email address for occasional updates, it is delivered to us by email through the same third-party form-processing service as our contact form and kept in our business email inbox. We do not currently use a newsletter platform; updates are sent by Josi directly. You can opt out at any time by replying to any update or by contacting us, and we will remove your address. Every update tells you how to opt out, and we honor opt-outs within 10 business days.
- Contact form. Messages sent through our contact form are delivered to us by email through a third-party form-processing service and are kept only as long as needed to respond to you. Please do not submit medical records, lab or scan reports, insurance identifiers, or details of urgent symptoms through the form — it is not a secure medical channel. You can ask us to delete your message at any time.
- Consultation requests. If you request a consultation for the Medical Advocacy program, we receive only your name, your email address, your phone number if you give it, your preferred contact times, one line describing what you hope to get help with, and your acknowledgment that the program is coaching and advocacy support rather than medical care. The request is delivered to us by email through the same third-party form-processing service as our contact form, is used solely to reply and arrange a first session, and is kept only as long as needed for that. Please do not include diagnoses, test results, medication names, insurance identifiers, or other health details in a consultation request; it is not a secure medical channel. You can ask us to delete your request at any time.
- Access requests and donations. When you ask for an Advocacy Guide access code, we receive the email address you enter, your answer to “Did you donate?”, whether you ticked the box for occasional updates, and the access code itself. That request is delivered to Josi by email through the same relay as the contact form and is kept so we can send or re-send your code, and to send you updates only if you opted in. If email delivery is configured, the code is also sent to you through a transactional email provider, Resend, under its own privacy policy at resend.com/legal/privacy-policy. The access code is generated on our server from your email address and is not stored on this Site. Donations for the guide happen on Venmo, under Venmo’s own terms and privacy policy; we receive no payment details, and Venmo tells us nothing about you unless you choose to donate.
- Donations to the Buck Institute. Those donations are made directly on the Buck Institute’s website. We do not collect or process your payment information; the Buck Institute’s own privacy policy applies to your gift.
Information you share as a coaching client
If you become a coaching or advocacy client, the health history and other personal details you choose to share with Josi, in conversation, on a printed or PDF intake form you bring, or in records you choose to show her, are shared with her directly and off this website. You keep your own records; we do not hold copies of your medical records and we ask you not to email them to us. Josi keeps working notes so she can do the work you have asked for. She uses them only to provide that coaching, does not sell or share them, and does not share them with your clinicians, insurers, or any program without your explicit written permission, except where the law requires. Josi Clary Coaching is not a healthcare provider and is not a HIPAA covered entity; coaching notes are not held in a medical-records system, and the HIPAA rights described elsewhere on this site apply to your clinicians’ records, not to coaching notes. You may ask Josi how she stores her notes, ask for a copy, or ask that they be deleted, at any time.
Information about another person
If you contact us or complete the intake form on behalf of a parent, spouse, or other adult, you confirm that you are doing so with their knowledge and permission or as their legally authorized representative (for example, under a health care power of attorney). The person receiving care signs the intake acknowledgments, or their authorized representative does and brings documentation to the first session. Josi works for the person receiving care; where their wishes and a helper’s differ, theirs govern.
Your choices and rights
- You can opt out of updates at any time by replying to any email from us or by contacting us; we will remove your address.
- You can turn off cookieless page-view counting for your browser at any time with “Cookie settings” at the bottom of every page, or by turning on Global Privacy Control in your browser.
- You may request access to, correction of, or deletion of the personal information we hold about you by contacting us. We do not sell or share personal information, as those terms are defined in California law, and we do not currently meet the thresholds that make a business subject to the California Consumer Privacy Act. We still honor requests to access, correct or delete your information. If you live elsewhere (for example, in the EU or UK), you may have additional rights, including the right to complain to your data-protection authority.
Children’s privacy
The Site is intended for adults and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, please contact us.
Data retention & security
We keep personal information only as long as needed for the purposes described here:
- Contact messages and consultation requests: kept in our inbox while we are corresponding with you and for up to twelve months after the last exchange, then deleted — sooner if you ask.
- Updates sign-up addresses: kept until you opt out or ask us to remove them, which we do promptly and always within 10 business days.
- Coaching working notes: kept for the duration of your engagement and for as long as needed to finish the work you asked for; deleted on request at any time.
- Access requests: the email in which Josi receives your access request is kept in our inbox so that your code can be re-sent on request; deleted when you ask. If you opted in to updates, your address is kept as described under “Updates sign-up addresses.” Venmo keeps its own records of any donation under its own policy; we hold none.
- Technical logs: held by our hosting provider under its own retention schedule; we do not keep separate copies.
- Interactive tools and the intake form: nothing is retained by us, because nothing is sent to us.
We use reasonable measures to protect the information we hold. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.
Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above.
Contact
Questions or requests? You can contact us.