Legal
Cookie notice
There are two cookies in Compliance Cockpit, and this page names both of them, says what each holds and how long it lasts. It also explains the part most notices leave out: what has to be true before anything else can be set, and what happens if you say no.
Last updated: 28 July 2026
Every cookie, with its exact settings
A cookie is a small file a site asks your browser to keep and send back on the next request. Both of ours are first-party — set by this site, sent only to this site — and neither is used to build a profile of you, follow you to another site, or sell anything to anybody.
| Name | Purpose | Duration | Type |
|---|---|---|---|
| cc_session | Keeps you signed in to the application after you have authenticated. | 7 days from sign-in. Deleted immediately when you sign out. | First-party. Strictly necessary. |
| cc_analytics_consent | Remembers whether you accepted or declined analytics, so you are not asked again. | 182 days — about six months. | First-party. Strictly necessary (records a preference). |
That is the whole list. There are no advertising cookies, no cross-site tracking cookies and no third-party cookies of any kind — these pages embed no video players, no social widgets, no chat bubble, no third-party map and no externally hosted fonts, so no other domain is asked for anything while you read them.
cc_session
Authentication · strictly necessary
Set when you sign in to the application, and only then — reading the public site never creates it. Its value is an opaque random token generated from 32 bytes of cryptographic randomness. It carries no name, no email address and no practice identifier, and it cannot be decoded into one. The server keeps only a SHA-256 hash of the token, so a copy of the database yields nothing you could sign in with.
Set with HttpOnly, so page scripts cannot read it; SameSite=Lax, so it is not sent on a cross-site request that could be forged; Path=/; and Secure wherever the site is served over HTTPS, which is everywhere except a developer’s own machine on http://localhost.
Seven days is an absolute ceiling rather than a rolling window: the session expires on the seventh day whether or not you have been using it. Signing out deletes both the cookie and the server-side record, and an administrator can revoke every session for a user at once.
Because it is set at Path=/ on the same domain, your browser also sends it while you are reading these public pages. The only use made of that here is on the home page, which sends a signed-in visitor to their dashboard rather than showing them a sales page.
cc_analytics_consent
Preference · strictly necessary
Holds one word — granted or denied — and nothing else. No identifier, no timestamp, nothing that distinguishes you from anyone else who answered the same way. It exists so that a decision, and particularly a refusal, is remembered instead of being asked again on every page.
Set with SameSite=Lax and Path=/, and readable by this site’s own scripts — it is deliberately not HttpOnly, because the thing that has to know whether you already answered is the banner itself. It is not marked Secure: it carries a preference, not a credential, and there is nothing in it worth protecting from being read.
It is written only when you press a button on the consent banner. Nothing writes it in advance, nothing writes it on your behalf, and there is no “implied consent” path that treats scrolling or continued browsing as agreement.
And it only ever comes into existence where a cookie-setting analytics provider has been configured, because the banner is the only thing that writes it and the banner is not rendered otherwise. With no provider configured, this cookie does not exist either.
Analytics
Three states, and the default is none.
Measurement on this site is a configuration decision, not a script somebody pasted into a template. Which of the three states below applies is decided by two settings — NEXT_PUBLIC_ANALYTICS_PROVIDER and NEXT_PUBLIC_ANALYTICS_KEY — and everything that follows from them is in one small module rather than scattered through the pages.
State one · the default
No provider configured
Nothing is rendered at all. No script, no request to any third party, no cookie — and no consent banner, because a banner asking permission for something that is not there is theatre, and it trains people to click through the banners that do matter.
This is what happens when the provider setting is empty, and also when it names something the code does not recognise, or names a provider without supplying a key. Every one of those cases resolves to none rather than to a guess. Failing closed on analytics costs a page view; failing open costs a privacy incident.
State two · recommended
A cookieless provider
Plausible is the provider this product recommends, and it is the only one of the four supported options that the code treats as cookieless: it sets no cookie and stores no identifier on your device. A counter that stores nothing needs no consent under PECR, so it loads and no banner is shown.
The point of choosing it is that the privacy-respecting path is also the useful one: we still get a count of how many people read a page, without anybody having to agree to anything.
State three · consent first
A provider that sets cookies
Google Analytics, PostHog and Microsoft Clarity are supported because a buyer may already have one. Where one of them is configured, the banner appears and nothing loads until you press Accept — the script tag is not on the page, so there is no request to block and no cookie to refuse.
Decline is a real button of the same size and prominence as Accept, not a link in the corner. Press it and nothing loads, then or later. Ignore the banner entirely and nothing loads either: silence is not consent.
Two limits that hold in all three states
The analytics component is mounted on the public site’s layout, not on the application’s. The authenticated product is never measured by a third party, and it cannot be by mistake: a practice’s client names appear in page titles inside the application, and a page title is the first thing an analytics script sends. That boundary is a structural one rather than a setting somebody has to remember.
And if a cookie-setting provider is ever configured for this site, its cookies will be named in the table above before it is switched on. The table is the complete list, kept complete — not a summary of the interesting ones.
Separately, and unrelated to cookies, the product records its own usage events — an event type, the screen it happened on and a company reference — inside your practice’s own data, scoped to your practice and never shared. That is described in the privacy notice.
Changing or withdrawing your consent
Consent that cannot be taken back is not consent. Here is the honest description of how to withdraw it, including the part where there is currently no button for it.
How to withdraw or change your answer
Your answer lives in the cc_analytics_consentcookie on your own device. Delete that cookie — through your browser’s cookie settings, or by clearing site data for this domain — and your previous answer is forgotten. If a cookie-setting provider is configured, the banner will ask again on your next visit and you can answer differently.
There is no “cookie settings” link in the footer that reopens the banner, and we would rather say so than describe a control that does not exist. If you would like one, tell us and we will build it; in the meantime deleting the cookie has exactly the same effect.
The cookie also expires by itself after 182 days, so a decision made once does not bind you indefinitely.
What withdrawal does and does not undo
Withdrawing consent stops anything further from loading. It does not reach back and delete cookies a provider already set while consent was in force — no site can promise that, because those cookies are on your device and only your browser can remove them. Clearing site data for this domain removes them along with ours.
If you declined in the first place, there is nothing to undo: nothing was loaded, so nothing was set.
Declining costs you nothing
Every page works identically whether you accept, decline or ignore the question. Nothing is withheld, no feature is degraded, and you will not be asked again until the cookie recording your answer expires or is deleted.
Controlling cookies in your browser
Your browser is the authority here, not this site. Every major browser lets you see which cookies a site has set, delete them individually or all at once, block them for a particular site, and block third-party cookies everywhere.
Where to look
In Chrome, Edge, Firefox, Safari and Opera the controls live under privacy or security in the browser’s own settings, usually under a heading naming cookies or site data. Most browsers also let you reach the cookies for the page you are on directly, from the padlock or site-information icon at the left of the address bar. Private or incognito windows discard all cookies when the window is closed.
We deliberately do not reproduce the menu path for each browser here. Those paths change with every release, and a set of confidently wrong instructions is worse than none — your browser’s own help pages are the version that stays correct.
What blocking each one actually does
Blocking or deleting cc_session signs you out of the application, and blocking it outright means you cannot sign in at all: the cookie is the mechanism by which the server knows the request is yours. Nothing about the public site is affected.
Blocking or deleting cc_analytics_consent loses your recorded answer and nothing else. Where a banner applies, it returns.
Blocking third-party cookies changes nothing here, because there are none to block.
Do Not Track and Global Privacy Control
This site does not read either signal, and we would rather state that than imply a compliance we have not built. The reason it makes no practical difference is that the default state is the one those signals ask for: no analytics provider, no tracking cookie and no third party to send a signal on to. If a cookie-setting provider is ever configured here, honouring Global Privacy Control will be part of doing so, and this paragraph will change.
The rules we work to, and changes
Why some cookies get a banner and others do not
The Privacy and Electronic Communications Regulations 2003 require consent before storing or accessing information on your device, with an exemption for what is strictly necessary to provide a service you asked for. Both cookies in the table are within that exemption: one keeps you signed in, which is the service, and the other exists only to record your answer about the first — including your refusal, which we would otherwise have no way to remember.
Anything outside that exemption gets a banner and loads nothing beforehand. The UK GDPR standard for consent applies to it: freely given, specific, informed, and as easy to withdraw as it was to give.
Cookies and personal data
Where a cookie identifies you, even indirectly, it is personal data and our privacy notice governs it: what we hold, the lawful basis, how long it stays and your rights over it. The session cookie is linked to your user account and is therefore personal data; the consent cookie holds a single word and identifies nobody.
The technical measures behind the session cookie — token hashing, encryption at rest, the response headers set on every route — are set out on the security page.
Changes to this notice
If a cookie is added, removed, or has its purpose or lifetime changed, this page changes with it and the date below changes too. A new cookie is described here before it is set, not after somebody notices it in their browser.
Questions about anything on this page can go through our contact page.
Last updated: 28 July 2026.
In summary
One cookie signs you in. The other remembers you said no.
There is no third cookie, no advertising network and no cross-site tracking. Analytics are off unless somebody configures a provider; the recommended one stores nothing on your device; and where one would, nothing loads until you accept.
We would rather publish a short cookie notice that is exactly true than a long one that is approximately true. If you find something on this page that does not match what your browser shows you, tell us — that is a defect, and we will fix it.