Privacy policy

Last updated 30 September 2026

This policy explains what I collect through drcorydugan.com, why, where it is kept, and how you can see, correct or delete it. Some of what the Iron Risk Check collects is health information, so I treat it with extra care.

Dr Cory Dugan, trading as drCWDugan

I am Dr Cory Dugan, a sole trader operating as drCWDugan, ABN 24 585 381 878. In this policy, "I" and "me" mean me. I run this site and I am the person who handles your information. I follow the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Contact for anything in this policy: hello@drcorydugan.com.

Information collected, and its uses

• Iron Risk Check, if you ask for your summary by email. Your email address, your answers to the questions, the summary category your answers produced, and the page you used. I use them to email you your summary. If you also tick the box for notes, I send you the occasional note on iron and women's health, which you can stop at any time.
• Personality and DISC assessments, if you ask for your summary by email. I send clients the links to these two pages. If you ask for your summary by email, I receive your email address, your answers to the statements and the page you used. I use them to email you your summary and to prepare for our work together. While you answer, your answers stay in your browser, and if you close the page without asking for the email, I never receive them.
• R Starter Pack. Your email address and the page you used. I use them to send you the download link, and the occasional note when I add a script only if you tick the box for it.
• Booking a call. Bookings go through Google Calendar appointment scheduling. Google collects the details you enter and the time you choose, and passes them to me so I can hold the call on Google Meet.
• Paying for a service. Payments are processed by Stripe. You enter your card details on Stripe's secure page, and I never see or store them. I receive your name, email, the amount and whether the payment went through, so I can confirm your booking and keep tax records.
• Emails you send me. Whatever you choose to include. I use it to reply to you.
• One-to-one or consulting clients. What you tell me during the work, and any results or documents you choose to share. I use it only to deliver the service you engaged me for.
• Site usage. Usage data through Google Analytics, described below.

You do not have to give me any of this. You can read every guide and use the free tools without giving your name or email. The Iron Risk Check asks for your email, because that is where your summary is sent. If you would rather not use your real name when you email me, that is fine too.

The Iron Risk Check and your health information

The Iron Risk Check asks about things like your periods, pregnancy, diet, blood donation and symptoms. That is health information.

• While you answer, your answers stay in your browser. Nothing is sent to me.
• If you close the page before selecting "Email me my summary", I never receive your answers.
• If you enter your email and select "Email me my summary", your answers, your summary category and your email are sent to me together. By doing that you consent to me collecting them for the purposes above.
• Google Analytics is told that someone reached the end of the check. It is not sent your answers or your summary category.

I do not sell your information, and I do not use your health information to advertise to you on other sites.

Storage, including overseas

This site runs on Cloudflare. Form submissions go to a Google Apps Script in my Google account, which saves them to a private Google Sheet and sends me an email alert that includes what you submitted. My email accounts are Google accounts. Your summary email is sent to you from my Google account.

Google, Cloudflare and Stripe store data on servers that may be outside Australia, including in the United States.

Analytics and cookies

This site uses Google Analytics 4, which sets cookies in your browser to count visits and show which pages are used. I also record a few events so I can tell whether the site is working: a click on a booking link, a form being sent, and someone finishing the Iron Risk Check or one of the assessments. None of these events carry your answers, your email or your summary category.

You can block or delete cookies in your browser settings, or install Google's Google Analytics opt-out browser add-on. The site works the same either way.

Emails from me

If you ask for your summary or the Starter Pack, I email it to you. I only send you the occasional note related to what you signed up for if you ticked the box asking for it. Every email tells you who it is from, and you can reply to any of them to unsubscribe. I will remove you straight away.

Sharing with service providers

I do not sell, rent or trade your information. It is handled by the service providers that run this site, my email and payments (Google, Cloudflare and Stripe), only so those services work. I will only disclose it to anyone else if you ask me to, or if the law requires it.

Retention and security

I keep your information only for as long as I need it, and I delete it sooner whenever you ask:

• Iron Risk Check answers: 12 months from the date you send them, then deleted. Your email address stays only while you remain subscribed to notes.
• Personality and DISC assessment answers: 12 months from the date you send them, then deleted.
• R Starter Pack requests: your email address is kept while you remain subscribed, and deleted within 30 days of you unsubscribing.
• One-to-one and consulting clients: for the length of our work together plus 12 months, then deleted, unless a law requires me to keep them longer.
• Invoices and payment records: 5 years, because Australian tax rules require most business records to be kept that long.
• Enquiries that go no further: 12 months, then deleted.

The Sheet holding form submissions is private to my Google account and is not shared with anyone.

If there is ever a data breach likely to cause you serious harm, I will tell you and the Office of the Australian Information Commissioner as the law requires.

Access, correction and deletion

Email hello@drcorydugan.com and ask. I will tell you what I hold about you, correct anything that is wrong, or delete it. I will not charge you for this.

Complaints

If you are unhappy with how I have handled your information, email me first at hello@drcorydugan.com and I will respond. If you are not satisfied with my response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

If I change how I handle your information, I will update this page and the date at the top.