Cookie Policy

This Cookie Policy explains how Cogent Clinic Ltd uses cookies and similar technologies in connection with Cogent Clinic and the related marketing pages.

1. Who Cogent Clinic Ltd is

Cogent Clinic Ltd operates Cogent Clinic.

Company number: SC887432
Registered address: Mearns Castle Golf Academy, Waterfoot Road, Glasgow, G77 5RR
Privacy contact: privacy@cogent.clinic
Website: www.cogent.clinic

2. What cookies are

Cookies are small text files placed on your device when you visit a website, and they can support core site functions, remember preferences, help measure usage, or enable certain marketing or performance features. Similar technologies include local storage, pixels, tags, SDKs, and scripts that perform related functions.

3. Cogent's cookie approach

Cogent Clinic runs a strict-necessary-only posture for client-side storage. The only cookies set are first-party cookies that are strictly necessary to sign you in and keep your session secure; these are listed by name in the table below. No marketing or advertising trackers are set on either the marketing site or the authenticated product.

Product-usage analytics do run on the authenticated application, but they run server-side: the analytics provider's browser SDK is never loaded, so no analytics cookie or other client-side storage is set in your browser, and the measurement does not rely on PECR consent. Only non-content metadata is recorded (which feature was used, the document type, timestamps, and an account identifier); no draft, chat, transcript, or client-identifying content is sent. The provider is named on the sub-processor register.

4. Cookies in use

Strictly necessary cookies

These are first-party cookies required to operate the authenticated product. They are set by Cogent Clinic's own authentication layer (there is no third-party sign-in provider), are not used for tracking, and do not require consent because they are necessary to deliver the service you have asked for. In production they carry the __Secure- prefix and are flagged Secure, HttpOnly where applicable, and SameSite.

Cookie	Provider	Purpose	Duration
__Secure-better-auth.session_token	Cogent Clinic (first-party)	Keeps you signed in and identifies your session server-side	Session; expires 8 hours after sign-in, renewed on activity
__Secure-better-auth.dont_remember	Cogent Clinic (first-party)	Marks a session that should not persist beyond the browser session	Cleared at the end of the session
__Secure-better-auth.two_factor	Cogent Clinic (first-party)	Carries the short-lived state between password entry and two-factor verification	A few minutes, until two-factor verification completes
__Secure-better-auth.trust_device	Cogent Clinic (first-party)	Set only if you tick "trust this device", so that browser can skip the second factor	30 days

The marketing site sets no cookies of its own beyond what is strictly necessary to serve the pages.

Analytics

Product-usage analytics run server-side and set no cookie or other client-side storage in your browser (see section 3). The marketing site is not instrumented with a consent-requiring analytics cookie.

Functional and preference cookies

Cogent does not currently set optional functional or preference cookies. If that changes, this policy and the table above will be updated, and any cookie that is not strictly necessary will be set only with consent.

Marketing cookies

Cogent does not run marketing or remarketing cookies on either the marketing site or the authenticated product, and there is no intention to introduce intrusive advertising technology into any clinically-adjacent surface.

5. How consent works

Where consent is required, users can accept or reject non-essential cookies, change preferences later, access clear information about each category, and refuse marketing or analytics cookies without losing access to core website functions. Consent is obtained before any non-essential cookie is placed.

6. How to manage cookies

Because Cogent currently sets only strictly-necessary cookies, there is no consent banner to dismiss. You can still clear or block cookies through your browser or device settings, with the understanding that blocking the strictly-necessary cookies above will prevent you from signing in. If Cogent introduces any non-essential cookie in future, a consent mechanism will be provided before it is set.

7. Third-party services

Where you make a payment, the billing flow uses Stripe, which may set its own cookies to operate the payment and for fraud prevention; these are governed by Stripe's own cookie and privacy notices. Cogent's authentication is first-party, so there is no third-party sign-in provider setting cookies. The named sub-processors are listed in the sub-processor register.

8. Changes to this policy

This policy may be updated to reflect legal, technical, or operational changes, with the latest version published alongside a revised date in the in-product compliance notes.

9. Contact

Questions about this Cookie Policy can be sent to privacy@cogent.clinic.