Privacy

Privacy Policy

This page explains what personal data Cardinal collects through this website, why, on what legal basis, and how you can control it. Last updated 11 August 2026.

1. Who is responsible

The data controller for this website is:

ControllerAsher Halsey

AddressTykistökatu 4, 20520 Turku, Finland

Emailhello@getcardinal.live

Email is the fastest way to reach us about anything on this page.

2. Why we process data, and on what basis

Waitlist managementRecording your interest, holding your place, and contacting you about waitlist status. Legal basis: legitimate interest in managing a waitlist you asked to join (Art. 6(1)(f) GDPR).

Product development interestUnderstanding, in aggregate, the interest and spending context of people who sign up. Legal basis: legitimate interest in developing the product (Art. 6(1)(f) GDPR).

Development updatesSending occasional email updates. Legal basis: your consent (Art. 6(1)(a) GDPR), given through a separate, unchecked box and withdrawable at any time.

Clinician enquiriesReplying to questions and feedback submitted on the science page. Legal basis: legitimate interest in answering professional enquiries (Art. 6(1)(f) GDPR).

We do not combine these purposes. Joining the waitlist never signs you up for updates.

3. What data we collect

Waitlist formName, email address, country, approximate monthly supplement spend (a range), interest level, and whether you consented to development updates.

Clinician enquiriesName, email address, institution or practice (optional), area of expertise, preferred method of contact, phone number (optional), and your message.

Consent recordsA timestamp, the purposes you agreed to, and the exact wording shown to you at the time — kept so we can demonstrate what was consented to.

Technical dataStandard server request data needed to deliver and secure the site. We do not build profiles from it.

Please do not submit patient-identifying information or health data about yourself or others through these forms.

4. How long we keep it

Waitlist entries and consent records are kept until the product launches or until you ask us to erase them, whichever comes first. We review the list annually and delete entries that are no longer relevant. Clinician enquiries are kept for as long as needed to handle the correspondence and are then deleted.

If you withdraw consent to updates, we delete the newsletter consent immediately and keep only the record that consent was withdrawn.

5. Who else processes your data

We use a hosting and database provider to run this website and store form submissions. They act as a processor on our instructions, under a data processing agreement with appropriate confidentiality and security obligations.

We do not sell personal data, do not share it for advertising, and do not use it for automated decision-making or profiling.

6. International transfers

Data is stored within the European Union. If a processor needs to handle data outside the EU or EEA, that transfer takes place only on the basis of a European Commission adequacy decision or the Commission's Standard Contractual Clauses, with supplementary safeguards where required. You can ask us which safeguard applies at any time.

7. Cookies and tracking

This site loads no analytics, no advertising pixels, no social media widgets and no third-party tracking scripts. Fonts are served from this site, not from a third party.

Only strictly necessary technical cookies may be used to deliver and secure the site. No consent banner is shown because there is nothing non-essential to consent to. If we ever introduce non-essential tracking, it will be blocked until you give explicit consent.

8. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you
Have inaccurate data corrected
Have your data erased
Restrict how we process your data
Object to processing based on legitimate interest
Receive your data in a portable, machine-readable format
Withdraw consent to development updates at any time

To exercise any of these, email hello@getcardinal.live from the address you signed up with, or tell us which address to look up. Every update email also carries a one-click unsubscribe link. We respond within one month.

9. Complaints

If you believe we have handled your data unlawfully, you can lodge a complaint with your national supervisory authority. In Finland this is the Office of the Data Protection Ombudsman:

AuthorityTietosuojavaltuutetun toimisto (Data Protection Ombudsman)

AddressPO Box 800, 00531 Helsinki, Finland

Phone+358 29 566 6700

Websitehttps://tietosuoja.fi/en

10. Changes to this policy

If we change how we handle personal data, we will update this page and its date. Where a change affects consent you have given, we will ask again rather than assume.