What CurrentCardio keeps, and what it does not

When you enter your address to receive the Weekly, we store it at once with a confirmation link that lives 7 days, and send you that link. Your address is on the list only after you click it, and we record the time of that click as proof of consent. If you never click, the address is deleted when the link lapses.

• Purpose: one e-mail a week with the Featured studies, or the personalised Weekly if you switch to it. Nothing else.
• Legal basis: your consent (GDPR article 6(1)(a)), given by confirming the mail; withdrawn at any time by the link at the end of every e-mail, Unsubscribe from CurrentCardio emails, which stops every Weekly from CurrentCardio and changes nothing else. A sign-in code or a new confirmation link comes only when you request it, whatever your subscription says.
• What is recorded: your address, the time you signed up and the time you confirmed; and for each Monday e-mail one record of the send and of what the mail service reports about its delivery, kept 90 days. If a personalised Weekly was sent, what it linked to is kept for the same time, so the page it points to can show you that week.
• Retention: the address and the times until you unsubscribe; after that the record stays 30 days, so a mail already on its way is not followed by another, and is then deleted. A new sign-up after that is a new consent.
• Bounces and complaints: if your mailbox rejects the Weekly or marks it as unwanted, the address is put on a stop list and nothing more is sent to it. That entry stays until you confirm a new sign-up, because sending to an address that refused us would be wrong.
• Role and country: if you choose to give them, your professional roles and your country, kept with your address once you confirm it and used only to count readers in aggregate; never shown individually. Removed when you unsubscribe, unless you also use My Week.
• The unsubscribe link carries your address in an encrypted form that only CurrentCardio can read, so the link itself shows nothing to anyone who sees it.

If you save an article or a search, follow a topic or a journal, or personalise your week, CurrentCardio asks for your e-mail address and sends a six-digit code to confirm it is yours. From then on this device is remembered for up to 180 days from its last visit, and what you saved follows you to any other device where you enter a code. There is no account, no password unless you choose to set one, and nothing visible to anyone else.

• What is kept: your e-mail address; the topics, journals and study designs you follow; the articles and searches you saved; whether you want a personalised Weekly; and one record per remembered device, holding the browser's own description of itself and the times it was first and last seen, never its network address. If you set a password, only a salted hash of it. If you choose to give them, your professional roles and country, for aggregate statistics only; you can change or remove them in My Week Settings.
• One address, two uses: My Week and the Weekly are kept as separate records, but they are joined by your address: switching the personalised Weekly on or off in My Week changes your subscription, and the Monday mail is composed from what you follow.
• Sister publications: CurrentCardio shares this service with other Current publications. Your address and password are kept once; what you follow and save, and what you receive, are kept separately for each publication and deleted separately. A new password ends the remembered devices of every publication.
• Purpose: to remember your preferences and saved items, and to send the personalised Weekly if you switch it on.
• Legal basis: your consent, given by the action itself and the code.
• Retention: until you delete it. A remembered device expires after 180 days unused; a code after 10 minutes, the link in the same mail after 30; expired ones are deleted by the next day.
• Your choices, from My Week: forget this device; forget all devices; delete what CurrentCardio remembers (your saved items and preferences; the Weekly keeps coming if you have it); or delete everything for CurrentCardio, which also stops its e-mails and lets the address go with the unsubscribed ones after 30 days. One click each. Unsubscribing from e-mail, on its own, deletes nothing you saved.

• Cloudflare runs the site and the mail: its Email Service sends every mail, its database holds the list and the profiles, and its request logs keep a record of each request for a few days. The database and the backups are kept in the EU. Under Cloudflare's data-processing addendum, with any transfer outside the EU covered by its standard contractual clauses.
• Backups: once a week the list is copied, as it is, to a private store in the EU, and the newest 8 copies are kept. Something you deleted can therefore remain in a backup for up to 8 weeks before it is gone everywhere.
• Google: contact@currentcardio.com, the reply address on every mail and the address for your rights below, is a mailbox forwarded to the publisher's Gmail account. A reply or a request you send reaches Google.
• PostHog counts visits, as described next.

No one else processes anything about you. The site loads nothing from any other company: no fonts, no scripts, no images from third parties.

To learn which pages and features are used, CurrentCardio counts visits with PostHog, an analytics service, on its EU servers.

• What is counted: the pages opened, and a few actions: reading a Brief for 30 seconds, 2 minutes or 5 minutes, and how far down it you got; a search (how many words and results, never the words); a filter; a follow added or removed; a saved article; a share; a click to the journal's article; a Weekly sign-up sent and confirmed. A Brief's own facts come with it: its study type, topic and journal. Each event carries what the browser says about itself: browser and operating system with their versions, device type, screen and window size, language, time zone, the page's title and address, and the domain of the site that linked here.
• What is not: no cookie and nothing stored in your browser; no profile; no e-mail address, search terms or link codes; nothing linked to what you save or to your address. PostHog is set to discard your IP address on arrival. Visitors are counted with a figure that changes every day, so a visit cannot be followed from one day to the next.
• Legal basis: our legitimate interest in knowing how the site is used, so we can improve it (GDPR article 6(1)(f)).
• Processor: PostHog, under a data-processing agreement.
• Retention: PostHog keeps the event data for one year, then deletes it.

The Weekly itself has no tracking pixel. Each study link in it counts one click per study for the whole mailing, with nothing about who clicked.

You can ask at any time what we hold about you, have it corrected or deleted, withdraw consent, and complain to the Danish Data Protection Agency (Datatilsynet). The controller is Christian Byskov Fur, who founded and publishes CurrentCardio; write to contact@currentcardio.com.