One request leaves your browser to NSAG, and it carries a page path.
This is a reading site. It has no accounts, no forms, no checkout, and nothing to submit. Rather than describe data handling in the abstract, this notice lists what actually happens when you open a page here, read from the site's own source and response headers on 29 August 2026.
The one request that leaves
On most pages, a single POST is sent to nsag-api.vercel.app/api/pageview. Its entire body is the path of the page you are on — for example {"path":"/m3"}. It carries no cookie, no identifier, no referrer field, no query string, and nothing you typed. It is sent with keepalive so it does not delay the page, and if it fails it is discarded silently.
NSAG's servers necessarily see what any web server sees when that request arrives: the originating IP address and the ordinary transport metadata that comes with an HTTP request. That is used for aggregate operational visibility — whether anyone is reading a page — and is not used to build a profile of you. There is no advertising tag, no analytics vendor, no A/B testing tool, and no session recorder anywhere on this site.
The site's content security policy is served with every page and permits outbound connections only to this origin and to that one endpoint. Framing this site inside another page is refused, plugin and object embedding is disabled, and camera, microphone, and geolocation are switched off by policy header, so no page here can request them.
What is not stored in your browser
Nothing. The published pages set no cookies, write nothing to local or session storage, and keep no campaign, referral, or identifier values between visits. This is a property of the code rather than a promise: the served pages contain no cookie or storage calls at all.
Two typefaces are requested from Google Fonts, which means Google receives a request from your browser when a page loads. That is the only host other than NSAG's own that a page contacts while you read.
The one field that accepts anything
Eight pages — the CE specialty tracks for law, nursing, medicine, pharmacy, social work, psychology, public health, and facilitators — offer a programme overview PDF and show an optional email field beside it. If you type an address there and press the button, that address is sent to nsag-api.vercel.app/api/lead along with which track you asked for and a timestamp. Nothing else is sent, and no cookie or identifier accompanies it. It is used to tell you when accreditation for that track completes.
The PDF is not gated, and you should not feel obliged to trade an address for it. Each of those pages now carries a direct download link that skips the field entirely, and the files are, and always were, plainly reachable under /ce/pdfs/. If you would rather have the overview without giving NSAG anything, take the direct link.
That is the only input on the site. There is no <form> element anywhere, no login, and nothing else that accepts typing.
What is not accepted anywhere
Several NSAG concepts once implied otherwise, so it is worth listing plainly:
- Assessment answers are not accepted. The fifteen module self-assessments are retired. Nothing scores you, and no tier report is produced or stored.
- There is no newsletter or subscription enrolment, and no list is being collected in the meantime. See the Brief status page.
- No payment checkout is active, and no price shown in an earlier version of this site is offered, reserved, or charged.
- Automated reports, digests, benchmarking, and follow-up sequences are paused, along with the Data Rights Unit collection workflow. The full list is on the product register.
Do not enter sensitive or confidential information anywhere on this site. If a legacy prototype page ever appears to accept input, it is not connected to anything and should not be used.
Links that leave this site
The site sends a referrer policy of strict-origin-when-cross-origin, so an external destination learns that you arrived from nsag-site.vercel.app but not which page you were reading. That matters on the module pages, where the subject you were reading about — burnout, psychedelic harm reduction, trauma in legal settings — can itself be sensitive.
Two destinations do collect information, and both are labelled where they appear. Email links open your own mail client. The discovery-call link opens Microsoft's booking service, which is operated by Microsoft rather than by NSAG; read its own notice before entering anything there.
If you email
NSAG receives whatever you choose to include. Contact enquiries are expected to state a purpose, and are intended to be retained for no longer than 90 days in the supported service. Ordinary email is not a secure channel — do not send records about identifiable individuals, clinical information, or anything held under a confidentiality obligation.
Access, correction, and deletion
You can read every page on this site without submitting anything, which is the strongest privacy control available and it costs nothing. If you have written to NSAG and want to know what is held, want it corrected, or want it deleted, write to contact@nsag.org and say which of the three you want. A request to delete correspondence is honoured without asking you to justify it.
Send a privacy request What is and is not running
Inventory read from this site's published pages, stylesheet, and live response headers on 29 August 2026. Page counts verified by counting the published HTML files and those containing the page-view call. Previously reviewed 15 August 2026.