Template — have a qualified lawyer review this before launch This policy is written to be accurate and usable, but it has not been reviewed by a data protection lawyer, and the cookie table below must be checked against the cookies the final build actually sets. Complete every HeliosCheck.com placeholder, run a cookie scan on the live site, and confirm the consent banner blocks non-essential cookies until consent is given.
Four categories, and where we sit in each
Most cookie policies bury the important line. Here it is first: the only cookies that need your permission on HeliosCheck.com are analytics, and nothing on this site is used for advertising.
Strictly necessary
Without these, the site does not work. They hold your session while you book, carry the security token that ties a submitted form to your browser, route your request to the right server, and remember the cookie choice you just made. They set no identifiers we could use to follow you elsewhere, and under the UK Privacy and Electronic Communications Regulations they do not require consent.
Preference
Small conveniences: your time zone so appointment slots display correctly, a reduced-motion setting if your device asks for one, and whether you have already dismissed a notice. Decline them and the site still works — it just forgets these choices between visits.
Analytics
Aggregated measurement of which pages are read, how people arrive, and where they give up. We use it to decide which conditions pages to expand or rewrite. These cookies are never set unless you accept them, and the data is never joined to a clinical record.
Advertising and tracking
We do not use any. No advertising networks, no retargeting pixels, no social media tracking tags, no data brokers, no cross-site profiling. Nothing on helioscheck.com exists to follow you to another website.
On this page
- What cookies are
- Why we use them
- The cookies we set
- How consent is managed
- Controlling cookies in your browser
- What stops working
- What we deliberately avoid
- Changes and contact
1. What cookies are
A cookie is a small text file that a website asks your browser to store and hand back on your next request. It usually holds nothing more interesting than a random string — an identifier the site uses to recognise the same browser from one page to the next. HTTP is stateless: the web server has no memory of you between clicks, so without something like a cookie a booking form would forget your answers on every page.
“Cookies” in a policy like this one is shorthand for a wider set of technologies that behave the same way: local storage and session storage in your browser, and, on some sites, tracking pixels and software development kits. The law that matters — the Privacy and Electronic Communications Regulations in the UK, the ePrivacy Directive across the EU — treats all storage on your device the same way, whatever it is called. So do we.
Cookies are also either first party, set by the site you are visiting, or third party, set by another domain whose code the site has embedded. Third-party cookies are the ones that make cross-site tracking possible. Almost everything on HeliosCheck.com is first party; the exceptions are named explicitly in the table below.
2. Why HeliosCheck.com uses them at all
Three reasons, and no others. First, to make the site function: holding a booking session together, protecting a form against forgery, keeping you on the same server while you fill something in. Second, to remember a small number of preferences so the site behaves consistently for you. Third — and only if you agree — to measure which of our health information pages are actually read.
That third purpose is not vanity. Our conditions pages are reviewed and updated on a schedule, and knowing which ones people reach, which ones they abandon, and which questions bring them there tells us where the writing is failing and which guidance to recheck. Guidance moves: bodies such as NICE publish and revise recommendations continually, and we would rather spend the update effort on the pages people genuinely rely on. How that review works is set out in our editorial policy.
What analytics data never does is touch clinical information. Measurement runs on the public pages of helioscheck.com. It does not run inside the intake form, the consultation, or the follow-up messaging, and analytics data is never joined to a patient record. That separation is described in more detail in our privacy policy.
3. The cookies we set
Cookie names change when providers update their software, so treat this as the current list rather than a permanent one. Where a provider has not yet been finalised, the placeholder is shown rather than a guess.
| Cookie | Set by | What it does | Category | Expires |
|---|---|---|---|---|
hc_session | HeliosCheck.com (first party) | Keeps you signed in through a booking so you do not have to re-enter details on each step. | Strictly necessary | Session — deleted when you close the browser |
hc_csrf | HeliosCheck.com (first party) | Security token that ties a submitted form to your browser and blocks cross-site request forgery. | Strictly necessary | Session |
hc_consent | HeliosCheck.com (first party) | Stores the cookie choices you made in the banner, so you are not asked again on every page. | Strictly necessary | 12 months |
hc_route | HeliosCheck.com load balancer | Sends your requests to the same server for the length of a visit, so a part-completed form is not lost. | Strictly necessary | Session |
hc_prefs | HeliosCheck.com (first party) | Remembers display preferences such as your time zone and a reduced-motion setting. | Preference | 6 months |
HeliosCheck.com | [ANALYTICS PROVIDER — to be confirmed] | Distinguishes one visitor from another so a single person reading five pages is not counted as five people. | Analytics — consent required | 13 months |
HeliosCheck.com | [ANALYTICS PROVIDER — to be confirmed] | Groups page views into one visit and records the referring source. | Analytics — consent required | 30 minutes |
HeliosCheck.com | [VIDEO CONSULTATION PROVIDER — to be confirmed] | Maintains the encrypted call session while a consultation is in progress. Set only on the call page, only when you join. | Strictly necessary | Session |
We also use browser local storage for one thing: saving a part-completed intake form on your own device so you can finish it in two sittings. That draft stays in your browser until you submit the form or clear your browsing data, and clearing site data will discard it.
4. How we ask for consent, and how you change your mind
The first time you visit helioscheck.com you are shown a banner with three equally weighted choices: accept the optional cookies, reject them, or open the settings and decide category by category. Rejecting takes exactly one click — the same as accepting.
- Nothing optional loads before you choose. Preference and analytics cookies are blocked until you consent. They are not set “pending” your decision and then tidied up afterwards.
- No pre-ticked boxes. Every optional category starts switched off. Consent has to be a positive action to count as consent at all.
- Granular control. You can accept preference cookies and refuse analytics, or the reverse. It is not all or nothing.
- Withdrawing is as easy as giving. The Cookie settings link in the site footer reopens the same panel on any page, and a change takes effect immediately.
- Your choice expires. We keep the record for 12 months and then ask again, rather than treating a decision you made once as permanent.
- We keep a record of the consent itself — which categories you accepted, when, and against which version of this policy — because accountability under the GDPR requires us to be able to demonstrate it.
If your browser sends a Global Privacy Control signal, we treat it as a refusal of optional cookies and do not show the banner as though no decision has been made.
5. Controlling cookies in your browser
Our banner controls the cookies we set. Your browser controls all of them, on every site, and it overrides us. The menu paths below are current at the date of this policy; browser vendors move these settings from time to time, so search your browser’s own help if a path has changed.
- Chrome (desktop): Settings → Privacy and security → Third-party cookies, and Settings → Privacy and security → Delete browsing data to clear what is already stored.
- Safari (macOS): Safari → Settings → Privacy, where you can block all cookies and manage stored website data site by site.
- Safari (iPhone and iPad): Settings → Apps → Safari → Advanced → Block All Cookies, or Clear History and Website Data.
- Firefox: Settings → Privacy & Security → Enhanced Tracking Protection, and Cookies and Site Data → Manage Data.
- Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data.
- Chrome (Android): Tap the three-dot menu → Settings → Site settings → Third-party cookies, and Delete browsing data to clear storage.
Private or incognito windows discard cookies when you close them, which is a reasonable option on a shared computer — particularly if you are reading about something you would rather not leave in a browsing history. It is worth knowing that private browsing hides activity from others using the same device, not from the websites themselves.
Cookie statements are worth comparing. Large public health bodies publish theirs in the same format, and the NHS website’s policies are a useful reference point for what a health service should be telling you.
6. What stops working if you block cookies
Blocking optional cookies costs you almost nothing here. Blocking all cookies, including strictly necessary ones, is a different matter.
- Block analytics: nothing changes for you. We simply see less about which pages are working.
- Block preference cookies: the site forgets your time zone and any notice you dismissed, so appointment times may display in the wrong zone until you set it again.
- Block all cookies: booking and secure messaging will not work. The forms cannot verify that a submission came from the browser that loaded the page, so they will refuse it. You will also be asked to make a cookie choice on every page, because we cannot remember the last one.
If you would rather not use the site while blocking cookies, you can still reach us. Every route is listed on our contact page, and the stages of an appointment are explained on how it works.
7. What we deliberately do not do
It is easy to list what a site uses. The more useful list is what it has chosen to leave out.
- No advertising or retargeting cookies, on any page.
- No social media tracking pixels, including the ones usually embedded with share buttons.
- No selling or sharing of personal data with data brokers or advertising networks.
- No cross-site profiling, device fingerprinting or probabilistic matching.
- No third-party cookies inside the consultation, the intake form or follow-up messaging.
- No use of health topics you read about to target you with anything, anywhere.
This matters more in women’s health than in most sectors. What someone reads about fertility, pregnancy loss, contraception or menopause is sensitive, and an advertising cookie set on a page about one of those subjects can reveal it far beyond the browser it was set in. Not placing one is the only reliable way to prevent that.
8. Changes to this policy, and how to contact us
We review this page whenever we add, remove or replace a tool that sets cookies, and at least once a year regardless. The date at the top reflects the current version. Where a change introduces a new category of cookie, we ask for consent again rather than relying on a consent you gave to a different arrangement.
Read next: our privacy policy, which covers health data in full, our terms of service, and our medical disclaimer. If you are weighing up whether an online appointment is right for your question, our FAQ and services page are the places to start.
A question this page does not answer?
Ask us directly. We will tell you what a given cookie does, or send you the most recent scan of the site — whichever is more useful to you.