This policy explains what MediPal stores on your device when you visit our website at medipal-ai.co.uk, and when you sign in to the MediPal application as a clinician.
It sits alongside our Website Privacy Policy, which covers the personal data we collect when you contact us. If you are a patient whose GP uses MediPal, our Privacy Notice for patients applies to you instead of this policy.
MediPal Limited, a company registered in England and Wales (company number 17395504), registered with the Information Commissioner's Office (registration number ZC227252). Our Data Protection Officer can be contacted at anas@medipal-ai.co.uk.
We do not use cookies anywhere. We do not use analytics software of any kind, and we do not use advertising or tracking pixels.
Our website stores nothing at all on your device. Our application stores three small items so that you can stay signed in. Those three are listed below.
We set no cookies. Our website, our application, our servers and our content delivery network are all configured not to set them, and we have confirmed this by inspecting each layer.
Because we set no cookies, there is nothing for you to accept or reject. That is why you will not see a cookie banner on our website.
Our website at medipal-ai.co.uk stores nothing on your device. It sets no cookies, writes nothing to your browser's storage, and runs no analytics or tracking scripts.
We do not embed content from other companies. Our fonts are served from our own domain rather than from an external font service, so opening a page on our website does not send your IP address to anyone else.
We do not keep access logs for our website.
The MediPal application is used by clinicians at practices that have signed up for it. It is not open to the public.
Signing in stores three items in your browser's local storage. Local storage is not a cookie, but the law on storing information on your device applies whatever the technology, so we set the three out in full here.
medipal_token The token that keeps you signed in. Removed when you sign out.medipal_user Your name, email address, role and practice, so the interface can display them without asking our servers again. Removed when you sign out.medipal_mfa_nudge_dismissed_at The date you dismissed the prompt asking you to turn on two-factor authentication, so that it stays hidden for 30 days rather than appearing every time you sign in. Expires after 30 days.The first two are necessary to deliver a service you have asked for. Without them you cannot stay signed in.
The third records a preference you expressed by dismissing a prompt. We treat it as strictly necessary to provide the interface you asked for, on the same basis as remembering any other choice you have made while using a service.
None of the three is used to track you, to build a profile, or to share anything with another company. The only one that leaves your device is the sign-in token, which goes to our own servers so they can confirm who you are.
We use no analytics software. We use no advertising or tracking pixels, and no tag manager.
We embed no third-party content in our website or our application. There are no external fonts, maps, videos, chat widgets or embedded forms.
When you use the application, our servers record the IP address and browser identification of requests. This forms part of the audit trail a clinical system is required to keep, and it lets us limit abusive traffic. It is not done using cookies, and our Website Privacy Policy explains how we handle that information.
You can clear local storage through your browser's settings, usually under privacy or site data. Clearing it will sign you out of the MediPal application and you will need to sign in again.
Because we set no cookies, blocking cookies in your browser will not change how our website or our application behaves.
If we ever begin using cookies, analytics or third-party content, we will update this policy before that change goes live, and we will ask for your consent where the law requires it.
If you have questions about this policy, contact anas@medipal-ai.co.uk. You can also raise concerns with the Information Commissioner's Office at ico.org.uk.