Legal

Cookies & tracking

There is no consent banner on this site. That is not an oversight — we don't set anything that requires one.

Last updated28 July 2026
Advertising cookiesNone
AnalyticsNone
Third-party trackersNone
Draft pending legal review Written from an inspection of what the site actually does. Accurate as of the date above, but re-check it whenever you add a third-party script — a single analytics tag would make most of this page wrong.

1. What we don't use

No advertising cookies. No analytics. No Google Analytics, no Meta pixel, no Hotjar, no session recording, no heatmaps, no fingerprinting, no cross-site tracking of any kind.

We are not claiming special virtue here. It is simply the correct default for a business whose visitors are researching their own health, where the mere fact of a visit is sensitive. Knowing which biomarker pages you read is not information we need, so we don't collect it.

2. The one thing we do store

When you sign in, we store a single authentication token in your browser's localStorage:

NamePurposeLasts
osiro_token Proves you are signed in, so you don't re-enter your password on every page. Contains your user ID and email, signed so it cannot be altered. Holds no health data. 12 hours, or until you sign out

That is the complete list. It is set only after you deliberately sign in, never on a first visit.

The Privacy and Electronic Communications Regulations require consent for storing information on your device — but exempt storage that is strictly necessary to provide a service you have requested. An authentication token for a service you have just signed into is the textbook example.

So a consent banner here would be theatre: it would ask permission for something exempt, while implying there is more to consent to than there is. We would rather tell you the truth on one short page.

If this changes, so will the banner The moment anyone adds analytics, advertising or any non-essential third-party script, this exemption stops applying and a proper consent mechanism becomes mandatory — one that blocks the script until consent is given, with rejection as easy as acceptance.

4. Third-party requests

Two things on this site are loaded from other companies' servers. Neither sets a cookie, but loading a file from a third party does reveal your IP address to them, so it belongs on this page.

Loaded fromWhatSets cookies?
fonts.googleapis.com
fonts.gstatic.com		 The two typefaces used across the site No
cdn.jsdelivr.net The charting library on the member dashboard No
Recommended change Serving fonts from Google means every visitor's IP address is disclosed to Google before they have done anything. European courts have found this objectionable where a self-hosted alternative exists, and one does. Self-hosting the two font files — and the charting library — removes the disclosure entirely, makes the site faster, and lets this section be deleted. Worth doing.

5. Clearing it

Signing out removes the token immediately. You can also clear it through your browser's settings for this site, or use private browsing, in which case it is discarded when you close the window.

Clearing it only signs you out. It does not affect the record we hold for you — for that, see the rights section of our privacy notice.