1. Who we are
This Cookie Policy explains cookies and similar technologies used on the Valixe website and patient platform. It should be read alongside our Privacy Policy, which explains the handling of personal information.
- Legal operator
- [Legal company or sole-trader name]
- Contact
- [Privacy contact email]
To complete before launch: confirm the operator and contact details and audit the live website, patient account and checkout.
2. What cookies and similar technologies do
Cookies are small pieces of information stored on your device by a website. They can help keep you signed in, protect forms, remember choices or measure website use.
Similar technologies include local storage, tracking pixels and techniques that access information on your device. The relevant rules apply to the purpose of storage or access, not just whether it is called a cookie.
Session cookies generally last for a browsing session. Persistent cookies remain until their expiry or until you delete them. First-party cookies are set for the website you visit; third-party technologies may be supplied by another organisation.
3. Account, security and essential functions
The patient platform may require cookies to maintain a signed-in session, protect forms against misuse and support functions you request. A technology can be treated as strictly necessary only where its particular purpose meets the applicable exception.
Blocking these cookies may prevent sign-in, form submission or checkout from working. A cookie is not essential simply because it is useful to the business.
The names and durations depend on the live application settings. These must be checked and listed below rather than assumed from framework defaults.
4. Analytics and other optional technologies
The supplied Valixe website header includes Google Analytics. This service can measure website visits and interactions. Its actual data collection, cookies, identifiers and sharing depend on the settings used.
Analytics is not automatically exempt from consent. A narrow statistical-purpose exception may apply only where all its conditions are met, including clear information and a simple, free way to object. If it does not apply, consent is required before the relevant storage or access takes place.
Advertising, cross-site tracking and advertising measurement require consent where they use storage or access technologies. They cannot be treated as necessary to provide patient care.
To complete before launch: confirm the Analytics settings, purposes, recipients and retention. Check whether any advertising features, social trackers, embedded services or other optional technologies are enabled, and implement the appropriate choices before using them.
5. Cookie and technology inventory
| Technology / provider | Purpose | Name and duration | Choice / status |
|---|---|---|---|
| Valixe account session | Maintain account access during a requested session | [Confirm actual session-cookie name and configured lifetime.] | Assess strictly necessary purpose. |
| Valixe form protection | Help protect submitted forms against forged requests | [Confirm whether a cookie such as XSRF-TOKEN is set and its lifetime.] | Assess strictly necessary purpose. |
| Google Analytics | Measure website use according to configured settings | [Check for _ga and _ga_* or other identifiers; confirm actual expiry and storage.] | Script identified in supplied header. Consent or a fully applicable exception must be assessed. |
| Cookie-choice storage, if implemented | Remember the choices you make | [Confirm cookie or local-storage key, provider and duration.] | No choice-storage implementation verified in this draft. |
| Stripe checkout | Support the payment service and relevant security functions | [Audit the checkout used; confirm identifiers, purposes and duration.] | Assess each purpose separately; do not assume all provider cookies are exempt. |
| Other embedded or third-party services | [Identify any live use.] | [Add verified names, providers and durations, or remove this row.] | [Confirm required controls.] |
Third-party providers may process personal information under their own privacy notices. See Google's Privacy Policy and Stripe's Privacy Policy where those services are used.
To complete before launch: replace this draft inventory with a verified list covering names, providers, purposes, durations, relevant recipients and applicable consent or exception arrangements. Include local storage and other technologies, not only cookies.
6. Your choices
Where consent is required, you must be able to make an informed choice before the relevant technology is used. Continuing to browse or accepting general website terms does not, by itself, provide cookie consent.
The live website must provide appropriate controls to accept or reject consent-based technologies, choose relevant categories and change or withdraw your choice. Refusing optional tracking must not prevent access to the core service you request.
If a statistical or appearance exception is relied upon, any required objection control must be clear, easy to use and free of charge. A contact email alone should not be presented as a substitute for the required immediate website control.
Controls to complete: [Confirm the live consent/objection tool and the location of its settings control.] This policy page does not itself set preferences, block tracking scripts or implement a consent banner.
7. Managing cookies in your browser
Your browser settings can let you view, block or delete cookies and stored website data. Check the browser's help information for instructions specific to your version.
Deleting cookies may sign you out or remove saved preferences. Blocking all cookies may prevent parts of your account or checkout from working.
Browser controls are additional to any choices the website must provide. Deleting a cookie does not necessarily remove information already received by a provider, and a cookie may be set again on a later visit unless the relevant use is stopped.
8. Patient information and tracking
Patient pages, treatment choices and URLs may reveal sensitive health information. Analytics and tracking configurations must be assessed carefully in that context.
Assessment answers, private messages, progress photos and other clinical records should not be sent to analytics or advertising services as ordinary event data. Any proposed use of information revealing health requires a separate lawful assessment and clear privacy information.
Our Privacy Policy explains the proposed handling of account and health records. Cookie choices do not authorise unrelated use of patient information.
9. Changes to this policy
We will update this page when the technologies, providers or purposes change. The version and date at the top identify the policy you are reading.
Where a new purpose requires consent, updating the policy alone does not provide it. Any necessary new choice must be obtained before the relevant use begins.
10. Questions and concerns
Contact us through our contact page or the privacy contact above if you have a question about cookies or personal information.
You can also visit the Information Commissioner's Office cookie guidance or use its complaint process.