Draft — pending legal review

This document is a draft. Operator details shown in [square brackets] have not been filled in yet, and the text has not been reviewed by counsel.

Cookie Policy

Last updated:: 2 November 2026
Effective:: [Effective Date]
Version:: 2026-11-02

The cookies and browser storage the Platform uses, and why.

1. Summary

GP Emergency Referral uses only strictly necessary cookies and browser storage — needed to sign you in, keep the service secure and remember choices you make. We do not use analytics, advertising, social-media or other tracking cookies, and we do not allow third parties to place tracking cookies through our pages. Because these cookies are essential to the service you request, they do not need consent; you can still block them in your browser, but you will not be able to sign in.

2. Cookies we set

Cookies set by the Platform
Name	Purpose	Duration
`__Host-gp_at`	Keeps you signed in: a short-lived signed access token. httpOnly, Secure, SameSite=Lax.	15 minutes
`__Host-gp_rt`	Renews your sign-in without asking for your password again (rotating refresh token). httpOnly, Secure, SameSite=Lax.	Up to 30 days (ends after 7 days without use, or when you sign out)
`gp_hosp`	Remembers which of your hospitals is active when you belong to more than one. httpOnly, Secure, SameSite=Lax.	1 year

On local development builds served over plain http the sign-in cookies are named gp_at and gp_rt (without the __Host- prefix, which requires HTTPS). Signing out deletes both sign-in cookies.

3. Browser storage

Local and session storage used by the Platform
Key	Type	Purpose
`theme`	Local storage	Your light / dark / system theme choice.
`app-shell:sidebar-collapsed`	Local storage	Whether you collapsed the sidebar.
`dashboard:auto-locate-declined`	Session storage	Remembers, for this tab only, that you declined automatic location so we do not ask again.
`rtc.deviceId`	Session storage	A random identifier for this browser tab, so an in-app call is routed to the tab that answered.

A service worker is installed so the browser can show push notifications and incoming call alerts. It does not cache pages, because pages contain patient information.
The mobile app stores its sign-in tokens in the device's secure storage (iOS Keychain / Android Keystore), not in cookies.

4. Payment gateway checkout

When a hospital admin pays online, the billing page loads the checkout script of our payment gateway (Razorpay or Cashfree). The gateway may set its own cookies, needed for fraud prevention and to complete the payment, under its own cookie and privacy policies. This happens only on the billing page when you start a payment.

5. Managing cookies

You can view and delete cookies and site data in your browser settings. Deleting them signs you out and resets your preferences. For more on how we handle personal data see the Privacy Policy.