Cookie Policy

CarePath is a documentation tool, not a healthcare provider. It does not practise medicine, diagnose, triage, prescribe, calculate doses or check interactions, and it never replaces a clinician's own judgment or instructions.

1. 01The short version

   CarePath sets no advertising cookies, no analytics cookies and no cross-site trackers. There is no consent banner because there is nothing to consent to.

   Everything below is either required to keep you signed in or remembers a preference you set. The patient reader page sets nothing at all beyond what is needed to load the page.

2. 02What a cookie is here

   A cookie is a small file a site stores in your browser and reads back on the next request. We also use local storage, which works similarly but never leaves your device. Both are covered by this policy.

3. 03What we set

   Name	Purpose	Type	Lifetime
   Supabase auth session	Keeps you signed in between page loads, and holds the refresh token.	Essential	Session, refreshed on use
   cp_last_org	Remembers which organization you last opened so /dashboard lands in the right place.	Essential	1 year
   cp-theme	Stores your light/dark preference. Kept in local storage, not sent to the server.	Preference	Until cleared

   Session cookies are set with the HttpOnly, Secure and SameSite attributes, so they cannot be read by scripts and are not sent from other sites. Clinic workstations are shared, so an idle session also ends server-side after 30 minutes.

4. 04What we do not set

   • No advertising or retargeting pixels — no Meta, Google Ads, LinkedIn or TikTok tags.
   • No product analytics or heat-mapping, and no session replay. We never record what is on a clinician’s screen.
   • No third-party cookies on the marketing site or in the patient reader.
   • No fingerprinting, and no data brokers.

   Opening a shared comic records only the time and which comic was opened — not an IP address, a device identifier or a fingerprint. See the Privacy Policy.

5. 05Third parties that may set their own

   Two vendors set cookies within their own flows, under their own policies:

   • Stripe — on its hosted checkout and billing portal, for payment processing and fraud prevention. You are on Stripe’s domain at that point.
   • Google — if you choose to sign in with Google, during that sign-in flow only.

   Neither is used to track you across the web on our behalf, and neither runs on the marketing site or the patient reader.

6. 06Controlling cookies

   You can clear or block cookies in your browser settings. Blocking the session cookie will sign you out and stop the application working — there is no way around that, since it is how the service knows who you are.

   Questions about this policy go to support@carepath.com.