The short version
MedClinora uses cookies that are strictly necessary for signing in, keeping your account secure, and remembering the clinic location you chose in the dashboard. On the public website only, Google Analytics sets cookies to count visits. We don’t use advertising cookies, and analytics never runs inside the application.
Cookies we use
| Cookie | Purpose |
|---|---|
medclinora.session_token | Keeps you signed in. Set when you sign in; ends when you sign out or after 3 days without activity. |
medclinora.two_factor | Lasts 10 minutes. Remembers that you are part-way through two-step sign-in. |
medclinora.state | Lasts 5 minutes. Protects the Google or Facebook sign-in round trip, only if you choose to sign in with them. |
medclinora.known_device | Lasts 180 days. Set after you sign in: a random device ID and a one-way code derived from your email. Used only so that someone else’s failed sign-in attempts can’t lock your usual browser out. Sent only to the sign-in service. |
medclinora.invitation_handoff | Lasts 15 minutes and is encrypted. Carries a team invitation through Google or Facebook sign-in; deleted when it is used. |
mc_location_<clinic ID> | Lasts 30 days, inside the dashboard only. Remembers which of a clinic’s locations you’re working in; checked against your access on every page. Without it, the clinic’s main location is used. |
These cookies are httpOnly (not readable by page scripts) and are marked Secure when the site is served over HTTPS, where the sign-in cookies’ names start with __Secure-.
Google Analytics (public website only)
The public pages (home, features, pricing, legal pages and similar) load Google Analytics. It sets _ga and _ga_<ID> cookies (up to 2 years) holding a random visitor ID. We send it only the page address — never link codes or query details — and only the website the visitor came from, never that page’s address. Nothing is sent from the application, sign-in, client forms, appointments, or video visits.
You can block or delete these cookies in your browser’s settings, or use Google’s Analytics opt-out browser add-on.
Website chat
If a clinic adds MedClinora’s chat to its website, the chat window keeps one item in the visitor’s browser storage (named medclinora.chat. followed by the clinic’s chat ID) so the conversation continues as the visitor moves between pages. It holds a random session key, not the messages, and the session ends after a day without activity or seven days at most. The chat sets no cookies.
Other browser storage
mc_display_currency(public website): remembers the currency you chose for showing prices. It stays in your browser and is never sent to us.- The online booking widget a clinic embeds on its website sets no cookies and stores nothing in the visitor’s browser.
Managing cookies
You can block or delete cookies in your browser settings, but you won’t be able to sign in without them. Questions? See our Privacy Policy or contact us.