Legal
Cookie Policy
Last updated May 23, 2026 · Effective immediately
Cookies are small text files a website stores on your device to remember things across visits. We use cookies sparingly. Analytics and marketing cookies do not fire on your device until you opt in.
Your choices
When you first visit, a banner asks you to choose which categories of cookies you accept. You can change your choices any time from the cookie preferences link in the footer (or by clearing your cookies — we'll ask again on your next visit). We re-ask every 12 months.
Your consent choices are recorded in our consent log with a timestamp and version of this policy, as required by Ontario privacy law.
What we use
Strictly necessary
Always on
Required to keep you signed in, complete a payment, prevent fraud, and remember your cookie choices. We can't run the platform without these.
| Cookie | Set by | Retention |
|---|---|---|
| sb-access-token / sb-refresh-token | Supabase Auth | Session + 30 days refresh |
| __stripe_mid / __stripe_sid | Stripe | 1 year / session — fraud prevention on the checkout step |
| hen2-consent-v1 | Health-E-Now | 12 months — your cookie consent choices |
| hen2-csrf | Health-E-Now | Session — CSRF protection on form submissions |
Analytics
Off until you opt in
Help us understand how people use the site so we can improve flows. We use privacy-respecting product analytics. We do not run cross-site advertising pixels.
| Cookie | Set by | Retention |
|---|---|---|
| ph_* | PostHog | 12 months — pageviews, feature usage; PHI is scrubbed before send |
Marketing
Off until you opt in
Help us measure the effectiveness of email campaigns we send under CASL consent. We do not use third-party retargeting pixels.
| Cookie | Set by | Retention |
|---|---|---|
| hen2-utm | Health-E-Now | 30 days — attribute a sign-up to the campaign that brought you in |
What we do not use
- Third-party advertising pixels (Meta, Google Ads, TikTok, etc.).
- Cross-site tracking.
- Session replay tools that record patient screens.
- Cookies inside the authenticated patient or clinician surfaces beyond the strictly-necessary set above.
Browser controls
You can also control cookies at the browser level — block all, block third parties, clear on close. If you block strictly-necessary cookies, sign-in and payment will stop working.
Changes
We will email registered patients about any material change to this policy at least 30 days before it takes effect, and re-prompt for consent if the change affects which cookies fire.
Contact
Privacy Officer · privacy@health-e-now.com