This website sets nothing of its own until you say so
These pages are static files. They run no analytics, load no fonts from anyone else, embed no video, no map, no chat widget and no social button, and send nothing about your visit to any third party.
That is a design decision and it is checked: a third-party request is also the most common way a page loses its performance budget, so the rule protects two things at once.
So the banner is asking ahead of anything it governs. Nothing in the optional groups is loaded today. The banner exists so that the moment something optional is added it has to ask first, rather than appearing one release after a page that says it will not — and so your answer is already on record. Refusing costs you nothing today and nothing later.
There is exactly one third-party script on this site, it is on one page, it is not optional to the page it is on, and it is described next.
If a third-party request other than the one below appears, something has been added that this page no longer describes. Tell us at hello@titraclinic.co.uk.
The anti-spam check on the contact form
The contact page carries a message form, and the form is protected by Cloudflare Turnstile. It is the only thing on this website loaded from another company’s servers, it loads on that page only, and every other page still loads nothing from anybody.
Why it is there. The form sends email on our behalf to an address whoever fills it in has chosen. Without a check, that is a thing to be abused — by volume, and by using our name to send messages we did not write. Turnstile establishes that a person rather than a script is filling the form in.
Why this one. It is the alternative to a CAPTCHA that profiles you. Turnstile does not ask you to identify traffic lights, does not track you across sites, and is not used by us or by Cloudflare to build an advertising profile.
What it receives. Cloudflare’s Turnstile Privacy Addendum lists what the check collects: your network (IP) address, a TLS fingerprint, your browser’s user-agent string, and our site key together with the address of the page it was used on. Cloudflare states that it cannot directly identify an individual from these, including from the IP address, and that they are used to tell a person from a script and to improve that detection — not for advertising and not to follow you between sites.
What it stores. We use the standard Turnstile widget and have not enabled its Pre-Clearance
option, so it does not issue the cf_clearance cookie that option exists to set. Cloudflare does not
publish a named cookie for the standard widget; it may hold a small amount of data in your browser
for the duration of the check itself.
It is strictly necessary and there is no consent to give. You meet it only if you choose to use the form, and it is the thing that makes the form safe to offer at all — so there is nothing to switch off. If you would rather not use it, email us directly at hello@titraclinic.co.uk, which reaches the same people.
Cloudflare processes this on our instructions under a written contract.
Our web server’s logs
Our hosting provider records the ordinary information any web server records when a page is requested — the address requested, the time, the browser’s user-agent string and a truncated network address — for security and to keep the service running. These logs are not used to build a profile of you and are not shared for anyone else’s marketing.
The patient application
The consultation, your account and your orders are on a separate address, and that application does use storage in your browser. It is described here so that this page covers the whole service.
Strictly necessary, and set without consent because the service cannot work without them:
| What | Why | How long |
|---|---|---|
| Session identifier | Keeps you signed in while you use the application, and is scoped to the browser tab you signed in on | Until you close the tab or sign out |
| Refresh token | Lets your session continue without signing in again on every page | 14 days, renewed each time you use it, to a maximum of 60 days |
| Sign-in selector | Names which of your sessions the refresh token above belongs to, so signing out of one tab does not end the others | With the refresh token |
| Staying signed in | Lets you come back to your treatment without signing in again, on this browser only, if you are a patient | 30 days, renewed each time you return, to a maximum of 60 days |
| Consent record | Remembers which of the choices below you made, so you are not asked repeatedly | 12 months |
We do not set a separate anti-forgery token. The protection it would provide comes from how the two above are built instead: the refresh cookie is restricted to this site alone and is not sent when another site links to us, and the session identifier is read by our own code and sent as a header, which a form on another site cannot do.
Signing out removes the “staying signed in” cookie, and ends every session on every device. That cookie is the only one in the table that outlasts the visit, so it is worth being plain about it: it is set when you sign in, it cannot be read by any script on the page, it is never set for clinic staff, and signing out is how you get rid of it. Use sign out rather than just closing the tab if you are on a device other people use. Changing your password also ends it everywhere.
Everything else is off until you turn it on. Analytics and any marketing measurement load only after you have accepted them, are grouped so you can accept one and refuse another, and nothing in either group runs before you choose. You can change your mind at any time from the footer of this website, and doing so takes effect on the next page you load.
The question is asked here rather than inside the patient application, because this is where anything optional would be loaded. The application stores only the strictly necessary things in the table above — they are what signing in is made of, and there is nothing there to consent to. Your account page links back to this page for the same reason.
We record which version of this policy you consented to. If the policy changes in substance, we ask again rather than assuming the old answer still stands.
Blocking cookies yourself
Every browser lets you block or delete cookies — the instructions are in your browser’s help. Note that blocking the strictly necessary ones above will stop you being able to sign in, which is not something we can work around.
Changes
When this page changes in substance, the date at the top changes with it.