Cookie Policy

This Cookie Policy explains how Sefton ("Sefton," "we," "us," or "our") uses cookies and similar tracking technologies on our website and platform. This policy should be read in conjunction with our Privacy Policy.

Important: Sefton is a healthcare business administration platform built to support HIPAA compliance. We do NOT use cookies to store Protected Health Information (PHI) or any sensitive healthcare data. All PHI is stored securely in our backend database, never in browser storage or cookies accessible to JavaScript.

Cookies are small text files that are placed on your device (computer, tablet, or mobile) when you visit a website. They are widely used to make websites work more efficiently and provide information to website owners.

Cookies can be "persistent" (remain on your device until deleted or expired) or "session" cookies (deleted when you close your browser).

3.1 Essential Cookies (Required)

These cookies are strictly necessary for the website to function and cannot be switched off. They are usually set in response to actions made by you, such as setting your privacy preferences, logging in, or filling in forms.

• Authentication Cookies: HttpOnly, Secure, SameSite cookies used for user authentication and session management
• Security Cookies: Cookies that help prevent security threats and unauthorized access
• Session Management: Cookies that maintain your session while using the platform

Important: Our authentication cookies are HttpOnly, meaning they cannot be accessed by JavaScript. This ensures that PHI and authentication tokens are never exposed to client-side code, maintaining HIPAA compliance.

3.2 Functional Cookies (Optional)

These cookies enable enhanced functionality and personalization. They may be set by us or by third-party providers whose services we have added to our pages.

• User Preferences: Cookies that remember your preferences (language, display settings)
• Feature Flags: Cookies that enable or disable certain features based on your account type

Note: User preferences are primarily stored in our secure backend database, not in cookies. Cookies are only used for temporary session preferences.

3.3 Analytics Cookies (Public Website Only)

On our public marketing website only, we use Google Analytics, a service provided by Google LLC, to understand how visitors find and use the site. Google's script sets two cookies on the sefton.health domain, _ga and _ga_HRP7XB4DVT. They hold a random identifier, never health information, and last up to two years. Data collected through them is sent to Google.

Pages inside the Service (the provider app, the patient portal, and our iOS app), pages for patients, and website pages that signed-in users or patients reach from the Service, such as payment confirmations, the referral page, and our legal documents, never load Google Analytics. Because the website and the Service share the sefton.health domain, your browser may also send these cookies to the Service. When a provider registers an account, our server reads only the random identifiers in the _ga and _ga_HRP7XB4DVT cookies and sends Google Analytics a single "sign_up" event tied to them, with no name, email address, practice, or account information. It does this only if the _ga cookie exists and the browser did not send a Global Privacy Control signal. The Service makes no other use of these cookies. Google signals and ad personalization are turned off. Google has not signed a Business Associate Agreement with us, which is why Google Analytics is limited to the public website.

To opt out, turn on Global Privacy Control or Do Not Track in your browser, and our website will not load Google Analytics; block or delete these cookies in your browser settings; or install Google's Google Analytics opt-out browser add-on. The website works the same either way.

3.4 Attribution cookie (sef_ft)

When you first arrive at our website or the Service, we set one first-party cookie named sef_ft. It records the site that referred you, the first page you landed on, and any campaign tags in the address (utm_source, utm_medium, utm_campaign, utm_term, utm_content). It lasts 90 days, is set only for the sefton.health domain, uses SameSite=Lax and is sent only over HTTPS. If you then register a provider account, these values are saved with the new account so we can see how practices find us. It never holds health information, is never shared with a third party, and is not used for advertising or to follow you to other websites. It is readable by our own pages so the sign-up form can include it; it is not an authentication cookie. Delete it at any time in your browser settings; the Service works the same without it. If your browser sends the Global Privacy Control signal, we do not set this cookie at all, and we remove one set earlier.

To maintain HIPAA compliance and protect your privacy, Sefton does NOT use:

• Marketing Cookies: We do not use cookies for marketing or advertising purposes
• Third-Party Tracking in the Service: We do not use third-party analytics or advertising cookies in the Service. Google Analytics runs on the public website only (section 3.3), and we use no advertising cookies anywhere
• Social Media Cookies: We do not use social media tracking cookies
• Browser Storage for PHI: We NEVER store PHI in localStorage, sessionStorage, or JavaScript-accessible cookies
• Cross-Site Tracking: We do not use cookies to track you across different websites

5.1 Browser Settings

Most web browsers allow you to control cookies through their settings preferences. However, limiting cookies may impact your ability to use Sefton, as essential cookies are required for authentication and security.

You can manage cookies in your browser settings:

• Chrome: Settings → Privacy and Security → Cookies and other site data
• Firefox: Options → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Cookies and website data
• Edge: Settings → Privacy, search, and services → Cookies and site permissions

5.2 Impact of Disabling Cookies

If you disable essential cookies, you may not be able to:

• Log in to your Sefton account
• Access secure areas of the platform
• Use features that require authentication
• Maintain your session while using the platform

We recommend keeping essential cookies enabled to ensure full functionality of Sefton.

The Google Analytics cookies described in section 3.3 are set on the sefton.health domain by Google's script, on the public website only, and the data collected through them is sent to Google.

If we add a third-party service that requires cookies to the Service, we will:

• Use only third-party services in a HIPAA-eligible configuration
• Maintain Business Associate Agreements (BAAs) with all third-party service providers
• Ensure no PHI is transmitted via third-party cookies
• Update this Cookie Policy to disclose any third-party cookie usage

Sefton's cookie usage is designed to maintain HIPAA compliance:

• HttpOnly Cookies: Authentication cookies are HttpOnly, preventing JavaScript access to authentication tokens
• Secure Cookies: All cookies are transmitted over encrypted HTTPS connections only
• SameSite Protection: Cookies use SameSite attributes to prevent cross-site request forgery (CSRF) attacks
• No PHI in Cookies: Protected Health Information is NEVER stored in cookies
• Backend Storage: All PHI and sensitive data are stored in secure backend databases, never in browser storage

Cookie retention periods:

• Session Cookies: Deleted when you close your browser
• Authentication Cookies: Expire based on your session timeout settings (typically 24 hours of inactivity)
• Preference Cookies: May persist for up to 1 year, but preferences are primarily stored in our backend database

We may update this Cookie Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of material changes by:

• Posting the updated Cookie Policy on this page
• Updating the "Last Updated" date
• Sending email notification to registered users (for material changes)

Your continued use of Sefton after changes become effective constitutes your acceptance of the updated Cookie Policy.

If you have questions about this Cookie Policy or our use of cookies: