Email updates
Signup forms ask for an email address and sometimes an optional name. They record the update request, consent choice, time, and limited security information needed to protect the form.
The simple version
Your choices
Health privacy
Collect less. Explain why. Prove the choice.
Accounts and membership
The account system can hold identity, verification, session, membership, provider-standing, course, community, and entitlement state. Payment-card details are intended to stay with the payment provider, not this site.
Wellness and Signal.OS
The Signal Integrity Map and Signal.OS can involve wellness answers, derived results, profile context, and lab-like information. That deserves a separate, specific consent and retention boundary. Do not put personal health details in a public signup or community post.
Providers and community
Provider applications can include professional identity and standing information. Community use can include posts, votes, moderation, and course activity. Role, audience, access, removal, appeal, and retention must remain visible.
Anonymous site analytics
Anonymous site analytics are off by default. If enabled, they run only on thewayin.me after a separate choice. Do Not Track and Global Privacy Control keep them off.
What each lane is for
| Lane | Why it exists | How it works |
|---|---|---|
| Email request | Send the doctrine, reading updates, or private-prelaunch news the person asked for. | The form records your request and returns a receipt. Marketing email can be sent only while your consent is active, and every message must include an unsubscribe path. |
| Anonymous site analytics | Measure page use and browser performance so the site can be improved. | Off by default. If you opt in, analytics may send page paths without query strings, referrer origin and path, a short-lived random identifier, device class, screen size, browser language, time, performance measurements, and allowlisted event labels to the SNRG-operated command service. Form values, account identity, email, wellness answers, and free-form text are excluded. |
| Account and security | Sign in, verify control of an email, manage sessions, protect private areas, and respond to abuse. | Used to verify your email, keep private areas private, manage sessions, sign out devices, and respond to abuse. |
| Courses and commerce | Show access, record progress, fulfill purchases, handle refunds and disputes, and preserve provider economics. | Used to show course access and progress, fulfill purchases, reconcile refunds and disputes, and keep provider economics connected to the same order. |
| Signal.OS | Provide personalized research and education with source, uncertainty, safety, and next-actor context. | Uses the wellness and lab-like context you choose to share for a private research and education experience. |
| Community and providers | Support role-labeled discussion, moderation, professional standing, course authorship, enforcement, and appeal. | Used for posts, votes, moderation, professional standing, course authorship, enforcement, and appeals. |
The controls this system must make real
Say yes clearly
Email updates require a separate checkbox. The form returns a receipt showing whether your request was recorded. An email address without that choice is not a marketing subscription.
Change your mind
You can unsubscribe from marketing updates. That stops future marketing email while preserving the minimum record needed to honor your choice.
See, correct, export, or delete
Use your account or Support to ask for access, correction, export, or deletion. You receive a status receipt and an explanation of anything that must be kept.
Know who receives data
This notice names the service categories, purposes, locations, and retention that apply to your data. Support can answer questions about a specific lane.
Choose anonymous analytics separately
Analytics stays off without a specific versioned choice. Choosing no, using Do Not Track or Global Privacy Control, visiting from a preview or local address, or using a noncanonical hostname keeps collection off. A person who previously chose yes can reopen Privacy choices in the footer and choose no; that removes the local analytics session identifier and blocks later sends from the page.
HIPAA is not a slogan.
Whether HIPAA applies depends on the actual relationship among the platform, a provider, and the service being performed. A health app outside HIPAA may still face Federal Trade Commission privacy, security, and breach-notification duties. The final operating model needs qualified legal review of the exact data flows and provider relationships, not a badge placed on the site.
Official grounding: HHS covered entities and business associates, FTC Health Breach Notification Rule guidance, and FTC email opt-out guidance.