Privacy policy

What this website collects, why, who handles it and the choices you have.

Last updated: September 2026

This website, drseanhall.com, is operated by Dr Sean Hall (“we”, “us”). We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, where they apply to you, the EU and UK General Data Protection Regulation and US state privacy laws such as the California Consumer Privacy Act.

Summary

You can browse the whole public website without giving us any personal information.
We collect information only when you contact us, subscribe, create a student account, buy a course or listen to a podcast.
We do not sell or rent personal information, and we do not use advertising cookies. We use Google Analytics to understand how the site is used; you can opt out (see Cookies).
You can ask to see, correct or delete your information at any time.

What we collect and why

When	What	Why
Enquiries (contact form)	Name, email, organisation (optional), enquiry type and your message.	To reply to you. Stored in our database and emailed to Dr Hall.
Mailing list	Email address, optionally your first name, and where you signed up (e.g. footer, podcast page).	To send occasional updates about new courses, episodes and research.
Emails we send you	Whether an update email was opened (via a tiny image) and which links in it were clicked, with dates.	To see which topics are useful and to stop emailing people who never read them. Every update email has a one-click unsubscribe link.
Student account	Email address, and optionally your name and profession.	To sign you in (by emailed link or code) and to show your name on certificates.
Course learning records	Enrolments, lessons viewed and completed (with dates), quiz answers and scores, certificates issued, and a log of sign-ins and course activity.	To deliver courses, save your progress, mark quizzes, issue and verify certificates, provide support and keep an audit record of course completion.
Purchases	Name, email, billing country/address details you enter at checkout, amount, date and the course bought.	To process payment, grant access and meet tax and accounting obligations. Card details go directly to Stripe and never reach this website.
Podcast listening statistics	For each download: the episode, the date, the listening app (e.g. Apple Podcasts, Spotify, website) and a one-way scrambled code made from your IP address and device type.	To count downloads without double-counting repeat plays. The code cannot be turned back into your IP address, and raw IP addresses are not stored in our database.
Website visit statistics	Page visited, the website or campaign that referred you, country (from your IP address), device and browser type, and a scrambled code made from your IP address and browser that changes every day.	To count visitors and see which pages are useful, without cookies. The code cannot be turned back into your IP address or used to follow you across days or other websites. We do not record visits if your browser sends a Do Not Track or Global Privacy Control signal.
Google Analytics	Pages viewed, how you arrived, approximate location (city/country), device, browser and a randomly generated identifier stored in a cookie. Google Analytics does not store your full IP address.	To understand which content is useful and improve the site. Loaded on public pages only, never on the course player, account or admin pages.
Technical data	IP address, browser and device type, pages requested and timestamps, recorded in our hosting provider's server logs.	To run the site securely, prevent abuse and diagnose faults.

We do not ask for, and ask you not to send, health information about yourself through the contact form. This website does not provide clinical services, and any health information you choose to include in a message is used only to reply to you.

Legal bases (EU/UK visitors)

Contract: providing a course you bought or an account you created.
Consent: the mailing list and Google Analytics cookies; you can withdraw at any time.
Legitimate interests: replying to enquiries, site security, course audit records, cookie-free website statistics, email open and click statistics, and anonymised podcast statistics.
Legal obligation: keeping payment and tax records.

Cookies

We use essential cookies to keep you signed in to your student account; they are removed when you sign out. On public pages we also use Google Analytics (loaded through Google Tag Manager), which sets first-party cookies such as_ga to count visits; these expire after up to 2 years. Advertising features are switched off. If you are in the EEA, UK or Switzerland, or your browser sends a Do Not Track or Global Privacy Control signal, Google Analytics runs without cookies. You can also block these cookies in your browser settings or with Google's opt-out add-on at tools.google.com/dlpage/gaoptout. Our own built-in visit statistics work without cookies. There are no advertising or social-media cookies. Embedded YouTube videos use YouTube's privacy-enhanced mode, which does not set cookies until you press play; after that, Google's own privacy policy applies.

Who we share it with

We share information only with the service providers that run this website, under their data-processing terms, and only as needed for the purpose described:

Vercel Inc. (USA)	Website hosting and server logs
Supabase Inc. (USA)	Database, sign-in, file and audio storage
Stripe (USA / Australia)	Payment processing
Resend (USA)	Sending emails (sign-in links, receipts, replies, updates)
Google LLC (USA)	Google Tag Manager and Google Analytics: website usage statistics (public pages only)
YouTube / Google (USA)	Only if you press play on an embedded YouTube video

We may also disclose information if required by law, or to protect our rights (for example, investigating misuse of course materials). We never sell personal information or share it for others' marketing.

Where it is stored (overseas disclosure)

Our providers store and process data on servers that may be outside Australia, including in the United States and the European Union. Where information leaves Australia, the EU or the UK, we rely on those providers' contractual safeguards (such as standard contractual clauses) to protect it.

How long we keep it

Enquiries: up to 2 years after our last contact, then deleted.
Mailing list: until you unsubscribe. After that we keep only your email address on a do-not-email list, so you are never emailed again by mistake.
Website visit statistics: kept as anonymised counts; the daily scrambled codes cannot identify you.
Google Analytics: event data is kept by Google for 14 months, then deleted.
Student accounts and learning records: while your account is active, plus 7 years so certificates remain verifiable; deleted sooner on request where the law allows.
Payment records: 7 years, as required for tax purposes.
Podcast statistics: kept as anonymised counts; the scrambled codes cannot identify you.
Server logs: kept by our hosting provider for a short period (typically days to weeks).

Security

Data is encrypted in transit (HTTPS) and at rest by our providers. Course content and records are protected by access controls so students can see only their own information. Sign-in uses one-time email links or codes, so we never store a password for you. No system is completely secure; if a breach likely to cause serious harm occurs, we will notify affected people and regulators as the law requires.

Your rights

Depending on where you live, you can ask us to:

tell you what personal information we hold about you, and give you a copy;
correct information that is wrong or out of date;
delete your information (subject to records we must keep by law, such as payments);
stop or restrict certain uses, or object to them;
transfer your information to you in a portable format.

To unsubscribe from updates, use the link in any email. For anything else, email drsmhall@gmail.com or use the contact form. We will respond within 30 days. We will not charge you or treat you differently for exercising your rights.

Children

This website and its courses are intended for adults. We do not knowingly collect personal information from anyone under 16; if you believe we have, please contact us and we will delete it.

Complaints

If you have a concern about how we handle your information, please contact us first so we can try to resolve it. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au), the UK Information Commissioner's Office (ico.org.uk) or your local EU data-protection authority.

Changes

We will update this policy when our practices change and show the date at the top. Significant changes will be highlighted on this page and, for account holders, by email.