Statistics, security and Christine
SAS Doctors Review uses limited information to understand its educational resources, deliver requested functions, control costs and protect genuine users. Detailed reports are available only to the authenticated site owner. We do not sell these records or use them for advertising.
Optional audience statistics
These start only when you enable statistics in the cookie settings. They include page views, broad device categories, referral categories, approximate country and region, visible-page time, scroll milestones, resource link clicks and opening search, videos or the flipbook. We do not record your search query. Opening a resource does not prove you read or completed it.
For optional statistics, the cookie named __Host-sas-stats lasts 24 hours. We derive a different protected browser identifier for each UTC day to avoid counting the same browser repeatedly that day. Daily identifiers are deleted after 30 days; aggregate daily counts can remain for 397 days. These are browser estimates, not counts of identifiable people. We do not use browser fingerprinting. You can withdraw statistics permission using Cookie settings in the footer; subsequent optional events are ignored and the statistics cookie is removed where your browser permits it.
Essential service and security records
When you request a code, use Christine or download the handbook, we count operational outcomes, approximate country and timestamps. Download counts represent file responses prepared by the server, not proof of a completed transfer. Sending a code successfully does not prove delivery to your inbox.
Protected browser and network identifiers support rate limits and investigation of repeated failures. Raw network addresses are used transiently to derive keyed identifiers rather than saved in our reporting tables. Network-only security keys change daily. Browser identifiers can link relevant Christine activity for a limited period. Pseudonymised records are still treated as personal information where they can be linked. Shared hospital networks and VPNs mean a network address or location does not establish a person's identity or employer.
We rely on legitimate interests for proportionate security and service monitoring: protecting users, preventing misuse and controlling the cost of this free service. We assess necessity, less intrusive options and the effect on people's rights. Essential controls do not depend on accepting optional statistics. Suspected misuse may result in a temporary browser restriction; a refusal or failed code is not treated as proof of misconduct.
Christine and feedback
We record question outcome categories, guest or verified access, response time, source identifiers, token usage and estimated cost. Broad question topics are recorded only where statistics are enabled, and topic reports suppress groups below five. We do not save question text, answers or chat transcripts in these reports. No name, readable email address or patient information belongs in telemetry.
Optional Helpful, Not helpful and Concern about sources buttons save only that category against the response record, not the conversation. Feedback is retained for up to 40 days. To raise a detailed concern, contact editor@sasdoctors.com without sending identifiable patient or colleague material.
Questions and limited recent conversation are processed by OpenAI to generate answers. Requesting no saved response state does not mean the provider has zero retention. Verification emails are processed by Resend and human checks by Cloudflare Turnstile. Hosting and these providers may have their own operational and security logs. Read the Christine privacy and allowance explanation.
Retention and access
Security detail is retained for 30 days; AI request outcomes and feedback for 40 days; owner access and control audit records for 90 days; and aggregate trends for 397 days. Verification codes and access grants retain their shorter expiry periods. Only the owner can retrieve monitoring reports or apply dashboard restrictions. Aggregate exports exclude protected security identifiers and restriction records.
Housekeeping runs during service activity and when the owner opens reporting, with a manual cleanup control. Expiry eligibility and actual deletion are different: records awaiting housekeeping may persist until the next run. We do not claim unattended scheduled deletion unless that hosting facility is configured and verified.
Your choices and questions
Use Cookie settings to change optional statistics. You may contact editor@sasdoctors.com about your information, object to processing based on legitimate interests, or raise a restriction you believe is mistaken. We will assess applicable rights, including access and erasure, while taking account of legitimate security needs. You can also raise concerns with the Information Commissioner's Office. We may need enough information to locate a protected record; we do not maintain a directory of visitors' real identities.