Cookie Policy
NACRT / DRAFT — pending review by qualified Croatian legal counsel. Not for publication in this form.
This is a courtesy English translation provided for convenience. The Croatian version is the sole binding version.
This Cookie Policy explains which cookies and related technologies the medkit.ltd platform (the "Platform") uses, for what purpose, and for how long. It is written to reflect the Platform's actual technical behaviour: we set only the first-party cookies needed to provide the service (the clinic-staff sign-in cookie and a functional language cookie); there are no analytics, marketing, or advertising cookies, and no third-party cookies are set. Pages with a map load map tiles from a third-party server (CARTO) — a network request that discloses the visitor's IP address to that provider, but CARTO sets no cookies on our pages (Section 7).
1. Who we are
The Platform is operated by [ legal entity name and legal form], with registered seat at [ registered address], registered in the court register [ court of registration and MBS number], OIB: [ OIB] ("Medkit", "we"). For questions about this Policy or the processing of personal data, contact us at privacy@medkit.ltd.
2. What cookies and related technologies are
Cookies are small text files that a website stores in your browser so that the site can function or remember certain information between visits. Related technologies covered by this Policy are browser local storage (localStorage) and a service worker; we describe those below as well, because we want to give a complete and accurate picture of what is stored on your device.
3. The cookies we set
The Platform sets only first-party cookies (cookies of the medkit.ltd domain), namely:
- sign-in and session cookies for clinic staff (administrators, reception staff, and other users with an account), without which staff cannot sign in or stay signed in, and
- a functional cookie remembering your chosen interface language. It is set only when you change the language yourself and is used solely to display the Platform in the language you chose; it is not used for tracking (see Section 8).
The Platform has no analytics cookies, no marketing or advertising cookies, and no visitor-tracking technologies, and no third-party cookies are set. The Platform's security policy (Content Security Policy) technically prevents third-party scripts from loading, so third parties cannot set cookies via scripts on our pages. Map tiles are loaded from a third-party server (CARTO) as a plain network request, but CARTO sets no cookies on our pages in doing so (Section 7).
To measure site usage the Platform uses a cookieless analytics tool (Vercel Web Analytics) that measures aggregate usage without setting any cookies or storing identifiers on your device; we therefore mention it here for completeness, but it adds no cookie to the table above [ counsel to confirm ePrivacy treatment of cookieless analytics].
Cookie table
| Cookie | Set by | Purpose | When it is set | Duration |
|---|---|---|---|---|
| `sb-qhbeloduixpcgwkxlkjc-auth-token` (may be split into parts suffixed `.0`, `.1`, etc.) | medkit.ltd (first party; Supabase technology, our processor for storage and authentication) | Authentication: maintaining the clinic staff sign-in session for the management interface | Only after a clinic staff member signs in; visitors and patients do not receive it | [ auth cookie duration — verify in browser before publication] |
| `NEXT_LOCALE` | medkit.ltd (first party) | Functional: remembering the chosen interface language, solely to display the Platform in the chosen language | Set only when you change the language yourself (choose a language different from the automatically detected one) | [ NEXT_LOCALE presence and duration — verify in browser before publication] |
Note: the staff sign-in process may temporarily set additional cookies whose names begin with `sb-` (for example a security cookie used during sign-in via an emailed link). The exact list of cookie names and durations will be confirmed by a technical in-browser check before this Policy is published.
4. Patients: booking without an account and without sign-in cookies
Patients book appointments on the Platform without a user account and without signing in. No sign-in or identification cookie is therefore set for patients; a patient accesses their own appointment solely via the link in the confirmation email. The only cookie that may relate to visitors without an account is the functional language cookie described above. Search and booking work without cookies.
5. Local storage (localStorage)
The Platform uses exactly one entry in your browser's local storage:
| Key | Content | Purpose |
|---|---|---|
| `medkit:autoAreaSearch` | "1" or "0" | Remembers whether you want the map search to re-run automatically when you move the map |
This entry contains no personal data, remains in your browser, and is never sent to our servers.
6. Service worker and app installation
The Platform registers a minimal service worker (`/sw.js`) whose sole purpose is to make the Platform installable as an app (PWA) on your device. This service worker does not intercept network requests, does not cache any content, and does not store any data, including personal data.
7. Third-party content: map tiles
When you use the map on the search pages, your browser loads map tiles directly from the servers of the provider CARTO; in doing so, your IP address and the displayed map area are disclosed to that provider. This is described in more detail in our Privacy Notice. This is solely a third-party network request: there are no third-party scripts on the Platform, and CARTO sets no cookies on our pages when map tiles load.
8. Why we do not show a cookie consent banner
Under Article 5(3) of the ePrivacy Directive (2002/58/EC), as implemented in the Croatian Electronic Communications Act (Zakon o elektroničkim komunikacijama, NN 76/22), consent is not required for cookies that are strictly necessary to provide an information-society service explicitly requested by the user. The sign-in cookie is necessary for clinic staff to sign in and use the service they requested. The functional language cookie is set only when you change the language yourself and serves solely to display the Platform in the language you chose; we treat it as necessary for providing the service you thereby requested, and it is not used for tracking [ counsel to confirm ePrivacy treatment]. The Platform therefore does not show a cookie consent banner.
9. Managing cookies
You can view, delete, and block cookies in your browser settings (see your browser's documentation for instructions). If you delete or block the sign-in cookie, clinic staff will not be able to sign in or stay signed in to the management interface; patient-facing functionality (search and booking) works without cookies.
10. Changes to this Policy
We will update this Policy whenever the way the Platform uses cookies or related technologies changes. To measure site usage the Platform currently uses only the cookieless analytics described above (Vercel Web Analytics), which sets no analytics cookie. We expressly commit that, should any cookie-based or identifier-based analytics or marketing technology ever be introduced in future, this Policy will be amended first and an appropriate consent mechanism implemented before it.
11. Governing language
The Croatian version of this Policy is the sole authentic (binding) version; translations into other languages are provided for convenience only.
---
Last updated: [ date]
NACRT / DRAFT — pending legal review.