Cookie Policy

1. What Are Cookies?

Cookies are small text files placed on your device (computer, mobile or tablet) when you visit a website. They help the site recognise your device and remember your preferences and actions.

2. Types of Cookies We Use

3. How to Control or Delete Cookies

Browser Settings: You can set your browser to refuse all or some cookies, or to alert you when websites set or access cookies.

Consent Banner: On your first visit, you’ll be prompted to accept or decline non-essential cookies. Essential cookies cannot be disabled via the banner but can be managed through your browser.

4. Cookie Duration

5. Third-Party Cookies

We do not serve advertising cookies. Analytics cookies are set by Google; for details, see Google’s Privacy & Terms – Analytics.

1. Who We Are

Nutrition Evidence Database is an online platform that curates peer-reviewed evidence in nutrition science for health professionals, researchers, and the public.

For any privacy-related inquiries, you can contact us at:

📧 [email protected]

2. What Data We Collect

We collect and store the following personal information depending on your interaction with our platform:

For NED Subscribers (mailing list opt-ins):

• Full Name
• Email Address
• Profession
• Country of Residence
• Associated Institution

For NED Account Holders (logged-in users):

• Email Address
• Password (securely stored using one-way hashing; we are unable to view, retrieve, or revise this data in any form)

We also collect anonymised technical data via cookies and third-party analytics tools (see Cookie Policy).

3. How We Use Your Data

We use your data for the following purposes:

• To provide and manage user accounts, including features such as saved searches, history, and favourites
• To send periodic “NED Alerts” and newsletters via MailerLite (only if you opt in)
• To monitor website performance and user behaviour via Google Analytics
• To analyse usage trends, including storing aggregated and anonymised search data, for platform improvement and research
• To comply with legal obligations and maintain platform security

We do not sell or share your personal data with third parties, affiliates, or advertisers. Our NED Alerts may occasionally include promotional banners from trusted partners, but these are not based on your personal data.

4. Legal Basis for Processing

We rely on the following legal grounds under the UK GDPR:

• Consent – for newsletter subscriptions and marketing communications
• Contractual necessity – to provide registered-user services
• Legitimate interests – to understand platform usage and maintain/improve service performance

5. International Users

While we welcome users from around the world, all personal data is stored and processed within the United Kingdom. We do not transfer your personal data internationally.

6. Your Rights

Under the UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct any inaccuracies in your data
• Delete your data (unsubscribe or delete your account)
• Object to or restrict certain processing activities
• Lodge a complaint with the UK Information Commissioner’s Office (ICO)

You can unsubscribe from emails via the link in any newsletter. To delete your account, use your account management page. Please note that account deletion will permanently erase your search history, saved articles, and other user-specific data.

7. Data Retention

Subscribers

Your data is kept until you choose to unsubscribe.

Account Holders

Your account data is retained until you delete your account.

Once deleted, your data is permanently removed from our systems and cannot be retrieved.

8. Security Measures

We employ a combination of technical, administrative, and physical safeguards to protect your data. Key measures include:

• Secure Authentication & Password Handling: User passwords are never stored in plain text. We ensure one-way, salt-ed hashing.
• Encrypted Transport: All data in transit is protected using industry-standard TLS (HTTPS) to prevent interception or tampering.
• Least Privilege & Role-Based Access Control: Internal systems and services enforce role-based access controls. Permissions follow the principle of least privilege, and privileged accounts are protected with multi-factor authentication (MFA).
• Application Security (Laravel): We keep dependencies up to date, apply security patches promptly, and take advantage of built-in protections against common web vulnerabilities (e.g., CSRF, XSS, SQL injection).
• Monitoring & Logging: System and application events are logged and monitored to detect anomalies, investigate incidents, and support forensic analysis.
• Secure Configuration & Hardening: Services and servers are configured according to best practices, minimising exposed attack surface and disabling unnecessary features.

9. Third-Party Services

We use the following trusted services:

MailerLite

For managing newsletters and email alerts (see their Privacy Policy).

Google Analytics

For anonymised site analytics (see their Privacy Policy).

These providers may collect or process data in line with their own privacy practices.

10. Updates to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the date at the top of this page and notify users of material changes where appropriate.

11. Contact Us

If you have questions or concerns about this Privacy Policy or your personal data, please contact:

📧 [email protected]