NeuraClinic

Cookie and similar technologies policy

Operational document pending legal review. This policy describes the currently known technical state. It does not constitute an absolute regulatory compliance statement.

Last updated: August 26, 2026

1. Technologies we use

A cookie is a file stored by a site in the browser. NeuraClinic also uses similar technologies such as localStorage and sessionStorage. This policy distinguishes them and does not call every browser storage mechanism a cookie.

2. Public site

The public site uses Google Analytics 4 optionally to obtain usage statistics and improve content, navigation, and performance. GA4 loads only after a visitor accepts optional analytics; if they reject it, NeuraClinic does not load the Google Analytics tag. Personalized advertising, remarketing, and marketing pixels are not enabled as part of this policy.

3. Privacy preferences

On the first visit, when no choice exists, NeuraClinic shows options to accept or reject optional analytics. The nc-consent-analytics key is stored in localStorage to remember the choice. It can later be changed through “Manage cookies”, separately from essential authentication cookies.

After consent, GA4 may process visited pages, sessions and interactions, acquisition source, browser, device, approximate geographic location, URL, and a pseudonymous Analytics identifier. An IP address may be used during collection, but GA4 does not log or store it as an Analytics dimension. NeuraClinic does not configure GA4 to send names, emails, phone numbers, clinical identifiers, or clinical content.

4. Authenticated application

The application may use the following technologies for necessary functions:

• access_token and refresh_token: first-party HttpOnly cookies for clinical authentication and sessions. They are not advertising cookies.
• __Host-admin_access and __Host-admin_refresh: first-party HttpOnly cookies for the administrative panel session when that surface is enabled. They are not advertising cookies.
• neuraclinic.web.language, neuraclinic.web.theme, neuraclinic.web.patients.list.view and neuraclinic.web.patients.notes.view: localStorage for language, theme and presentation preferences.
• billing_email and billing_checkout_session_id: sessionStorage to continue checkout during a browser session.
• neuraclinic.admin.mfa.challenge: sessionStorage to temporarily preserve an administrative MFA challenge.

Session cookies expire according to authentication settings. Session storage normally disappears when a tab or session closes; persistent preferences remain until removed or changed.

5. Third-party services

Google Sign-In may load Google resources when a user starts that authentication flow. Stripe manages its own checkout when payment is used. Facebook Login is not active in production. Google Analytics is active only after consent on the public site; Meta Pixel and Hotjar are not loaded.

6. Managing preferences

You do not need to accept analytics to browse the landing. Open “Manage cookies” in the footer to accept, reject, or change the stored choice. When rejecting after acceptance, the site updates consent, attempts to remove known GA4 cookies, and reloads the page. This does not guarantee deletion of data already sent previously.

7. Future changes

If analytics or another optional technology changes, this policy will be updated with its provider and purpose, and the consent mechanism will be reviewed before it loads. Changes appear through the last-updated date.

Read the Privacy Notice.