1. Introduction
Purpose and coverage
This Cookie Policy explains how CLINIFLO LTD uses cookies and similar technologies on https://cliniflo.technology (the Site). It should be read together with our Privacy Policy at privacy-policy.html. Terms not defined here have the meaning given in the Privacy Policy where applicable.
CLINIFLO LTD is established at 37 Barrow Road, Loughborough, LE12 8DH United Kingdom. Questions about cookies may be sent to help@cliniflo.technology or raised by telephone on +44 7418 567890. This Policy is designed for users in the United Kingdom and reflects the Privacy and Electronic Communications Regulations (PECR) and UK GDPR requirements relating to storage of and access to information on terminal equipment.
Cookies are small text files placed on your device when you visit a website. Similar technologies include local storage, session storage, pixels, and scripts that store or read identifiers. For simplicity, this Policy refers to all such technologies as cookies unless a distinction is necessary.
This Policy applies only to cliniflo.technology and not to client websites, applications, or staging environments that we may build or host under a statement of work, unless those properties expressly adopt this Policy in writing.
2. What cookies are and how they work
Technology and terminology
When a website sets a cookie, the browser stores a small piece of data associated with the website's domain. On subsequent visits, the browser may send the cookie back to the website, allowing the site to recognise the browser, maintain state, or measure activity. First-party cookies are set by the domain you are visiting. Third-party cookies are set by a different domain, for example an analytics or embedded content provider.
Session cookies expire when you close your browser. Persistent cookies remain for a defined period or until deleted. Cookies may be essential for security and core functionality, or optional for analytics and enhancement. Under PECR, storing or accessing information on a user's device generally requires consent unless the cookie is strictly necessary to provide a service requested by the user.
Cookies themselves typically contain an identifier and metadata rather than your name. However, when combined with other information, cookie identifiers can constitute personal data under UK GDPR. Our processing of such personal data is described in our Privacy Policy.
A cookie may be marked as Secure, meaning it is sent only over encrypted connections, and HttpOnly, meaning it is not accessible to page scripts. Where we control first-party cookies, we apply such flags where they do not break a requested function.
SameSite attributes help limit when cookies are sent with cross-site requests. We prefer restrictive SameSite settings for first-party cookies unless a specific integration requires a different value, in which case the integration is assessed before deployment.
You should treat cookies as part of the information stored on your terminal equipment. You remain free to configure your browser. We do not circumvent browser controls that block cookies.
3. Types of cookies we use
We group cookies into the following categories for transparency. Strictly necessary cookies enable core Site functions such as security, load balancing, network management, and remembering cookie consent choices so that we do not repeatedly ask for the same consent in the same session or consent period. These cookies do not require consent under PECR because they are essential to provide the service you request.
Preference or functionality cookies remember choices you make, such as language or display preferences if those features are offered. Where such cookies are not strictly necessary, we will request consent before setting them.
Security cookies may support fraud detection, bot mitigation, or session integrity. Where they are strictly necessary to keep the Site safe for users who request it, they fall within the PECR exemption. Where they are used for optional measurement beyond security, consent is obtained.
We do not classify cookies as essential merely because they are convenient for us. Convenience, audience measurement, and advertising are not treated as strictly necessary.
4. Purposes of cookie use
Cookies are used to keep the Site secure and available; to distribute traffic efficiently; to remember that you have interacted with a consent banner; to measure aggregated traffic and navigation paths for improvement of content clarity; to diagnose technical issues; and to support accessibility and performance optimisation.
We do not use cookies to sell personal data. Cookie-derived information is processed for the purposes above and in accordance with our Privacy Policy. Where analytics providers process data on our behalf, they act under contractual terms that restrict use to providing the analytics service to CLINIFLO LTD.
Some cookies support continuity of user interface state during a single visit, which improves usability when moving between pages describing our services in custom software engineering, IT systems design, and application development.
Consent-log cookies or local storage entries exist so that we can demonstrate that we respected your choice and so that the banner is not shown on every page load during the validity of that choice.
Load-balancer or content-delivery cookies may associate your session with a particular edge node to reduce latency. Those cookies contain technical tokens, not your name or address.
If we offer a cookie preference centre, cookies may record which categories you accepted. Changing a category later updates that record and may delete cookies belonging to a withdrawn category, to the extent we technically control them.
5. Duration of cookies
Session cookies last only for the browsing session and are deleted when the browser closes. Persistent cookies have a defined lifetime. Consent preference cookies are commonly retained for a period between three and twelve months so that we can remember your choice, after which the banner may be shown again.
Analytics cookies, where consented, typically persist for periods defined by the analytics provider configuration, often from twenty-four hours to twenty-four months depending on the specific cookie. We periodically review cookie lifetimes to ensure they remain proportionate to purpose.
Exact durations for each cookie may vary as we update tooling. A cookie inventory table may be published or made available on request. If durations change materially, we will update this Policy.
Browser features such as intelligent tracking prevention may shorten effective lifetimes independently of our configuration. We do not attempt to restore identifiers that the browser has expired or partitioned.
If you delete cookies manually, durations reset from your perspective. A new consent interaction may occur on the next visit because the previous consent token is gone.
6. Consent and how we request it
Where PECR requires consent, we present a consent mechanism when you first visit the Site, or when consent has expired or been reset. The mechanism allows you to accept or reject non-essential cookies, and where granular controls are available, to choose categories.
Consent must be freely given, specific, informed, and unambiguous. We do not use pre-ticked boxes for non-essential cookies. Continuing to browse alone is not treated as consent for non-essential cookies. You may change your mind at any time by clearing cookies in your browser or using any preference controls we provide on the Site.
We keep a record of consent where required for accountability, which may include a timestamp, the categories accepted or rejected, and a non-identifying or lightly identifying technical reference. Such records are retained for evidence of compliance.
If you reject non-essential cookies, the Site will still function for core browsing, although analytics and optional enhancements will be limited. Strictly necessary cookies will continue to operate.
Equal prominence is given to accepting and rejecting non-essential cookies. We do not design dark patterns that nudge acceptance as the only realistic path.
If you are under sixteen, you should not use the Site to provide consent because the Site is directed at business users. We do not seek children's consent for cookies.
7. Managing cookies in your browser
Most browsers allow you to refuse or delete cookies through settings. You can usually configure the browser to notify you when a cookie is set. Instructions vary by browser and device. Refer to your browser's help documentation for guidance.
Blocking all cookies, including strictly necessary cookies, may prevent parts of the Site from working correctly. If you delete cookies, any stored preferences, including consent choices, may be lost and you may be asked again on a subsequent visit.
Device-level privacy controls, tracking prevention features, and intelligent tracking prevention in certain browsers may automatically limit third-party cookies. Our Site is designed to respect such controls insofar as they are enforced by the browser.
For assistance relating to our cookie practices specifically, contact help@cliniflo.technology. We cannot provide support for third-party browser software beyond general guidance.
Mobile operating systems may offer additional tracking or advertising identifiers outside the classic cookie model. We do not operate a native mobile application as part of the public Site. If that changes, this Policy will address mobile identifiers.
Shared or public computers should be used with care. Log out of any authenticated areas and consider deleting cookies after use so that the next user does not inherit your consent token or session.
8. Third-party cookies and providers
If we enable analytics or embedded content, third-party providers may set cookies when you visit the Site after consent. Those providers process data according to their own privacy notices and our contractual instructions where they act as processors.
Common categories of third parties, if used, include website analytics platforms, font delivery networks, and content delivery networks. Font providers may receive IP addresses as part of serving font files. Content delivery networks may process request metadata to deliver assets efficiently and securely.
We review third-party integrations for privacy impact before enabling them on cliniflo.technology. Where a third party requires consent under PECR, we will not load the associated scripts until consent is obtained.
Links to third-party privacy or cookie notices may be provided when specific providers are active. Because provider lists can change, this Policy focuses on categories and principles. A current inventory can be requested from help@cliniflo.technology.
Google Fonts, if loaded from Google's servers, may involve a request to those servers that discloses your IP address. Depending on configuration, we may self-host fonts to reduce third-party requests. The live Site's network panel is the authoritative view of what is loaded.
We do not permit third parties to use cookies set via the Site for their own independent advertising without disclosure and consent. Processor contracts restrict such use.
Embedded maps, video players, or social widgets, if added, typically set third-party cookies. We will either require consent before loading them or use privacy-enhanced embed modes that delay third-party cookies until interaction.
9. Similar technologies
Local storage and session storage may be used to store small amounts of data in the browser for functionality similar to cookies. Where such storage is not strictly necessary, we treat it as requiring consent under PECR.
Pixels or tags, if used, are small pieces of code that may set or read cookies or collect technical information about page views. We use such technologies only for the purposes described and with consent where required.
We do not knowingly use fingerprinting techniques that seek to identify a device persistently without consent where PECR would require consent for storing or accessing information on the device.
Service workers and cache storage, if introduced for performance, store copies of Site assets. They are used to serve the Site you requested and are treated as strictly necessary when limited to that purpose.
ETags and cache validators may cause a browser to send stored validators. We do not use cache validators as covert unique identifiers for tracking individuals across visits beyond ordinary caching.
Web beacons in emails, if ever used for service messages, would be disclosed and would not be used to track marketing engagement without a PECR-compliant basis. Ordinary service emails about a live project do not rely on beacons.
10. Do Not Track and global privacy controls
Some browsers offer a Do Not Track signal. There is no uniform industry standard for responding to DNT. Where we implement a consent management approach aligned with PECR, your explicit cookie choices on our Site take precedence for non-essential cookies.
If we support Global Privacy Control or similar browser signals in the future, we will describe that support in an updated version of this Policy. Until then, please use our consent mechanism and browser settings to manage preferences.
We honour legally required opt-out mechanisms applicable in the United Kingdom. We do not currently target residents of other jurisdictions with additional statutory cookie banners beyond PECR, because the Site is operated for a UK audience.
Automated crawlers used by search engines may not complete a consent dialogue. We do not set non-essential analytics cookies for traffic that never receives a consent opportunity in a user agent capable of consent.
11. Updates to this Cookie Policy
CLINIFLO LTD may update this Cookie Policy to reflect changes in cookies used, legal requirements, or operational practice. The effective date will be revised when updates are published on the Site. Material changes will be communicated through the Site or, where appropriate, by contacting known users.
We recommend reviewing this Policy periodically. Continued use of the Site after updates constitutes acknowledgment of the revised Policy, without prejudice to consent requirements for non-essential cookies.
If we add a new category of non-essential cookies, we will seek fresh consent rather than relying on an older consent that did not cover that category.
Historic cookie inventories may be retained internally for compliance evidence even after a cookie is retired.
12. Contact
For questions about this Cookie Policy, contact CLINIFLO LTD at help@cliniflo.technology, +44 7418 567890, or by post at 37 Barrow Road, Loughborough, LE12 8DH United Kingdom. Our website is https://cliniflo.technology. Related documents include our Privacy Policy, Terms of Service, and Terms and Conditions, available as relative links from the Frame Table Directory in the site footer.
Please describe the browser, device, and approximate time of visit if you are reporting a cookie that you believe should not have been set. We will investigate configuration and consent gating.
13. Cookie inventory principles and review cycle
We maintain an internal inventory of cookies and similar technologies that records the name or category, provider, purpose, type, and indicative duration. The inventory is reviewed at least annually and whenever a material change is made to the Site's front-end or analytics configuration.
When adding a new non-essential cookie, we assess necessity, data minimisation, third-party involvement, transfer implications, and user transparency before deployment. Scripts that set non-essential cookies are gated behind consent where PECR requires.
If a cookie is deprecated, we remove the associated script and update documentation. Residual cookies already on user devices will expire according to their original lifetime or can be deleted by the user through browser controls.
Clients who embed our deliverables in their own properties are responsible for cookie compliance on those properties. This Cookie Policy applies to cliniflo.technology and not to client websites unless expressly agreed otherwise in writing.
Developers working on the Site are instructed not to add marketing pixels without a recorded privacy review. Staging copies of the Site should not load production analytics with live measurement identifiers.
Third-party tag managers, if used, are configured so that tags requiring consent do not fire before consent. Default-on tags that set advertising cookies are prohibited.
14. Relationship with UK GDPR lawful bases
Setting strictly necessary cookies is typically justified as necessary to provide a requested service and may align with legitimate interests or contract for related personal data processing described in the Privacy Policy. Setting non-essential cookies relies on consent under PECR, and any associated personal data processing relies on consent under UK GDPR where consent is the appropriate lawful basis.
Withdrawing cookie consent does not necessarily require erasure of all historical analytics aggregates that no longer identify you, but it will stop further setting of the relevant cookies going forward, subject to technical limitations of your browser and any strictly necessary cookies.
If you exercise UK GDPR rights in relation to cookie identifiers that constitute personal data, we will respond in accordance with our Privacy Policy. Please include relevant details such as approximate visit dates to help us locate records.
A cookie consent record is itself personal data if it can be linked to you. We retain it for accountability and to honour your choice. You may request access to that record.
International transfers of cookie-derived data follow the transfer section of the Privacy Policy. Analytics providers with non-UK processing will be identified in the inventory upon request.
15. Cookies in client deliverables and staging systems
Software we design for clients may include cookies. Those cookies are the client's responsibility as controller of the client site or application, unless we operate the property as controller, which we do not do for client production systems as a default.
During development and testing, staging domains may set cookies for session management and diagnostics. Access to staging is typically restricted. Staging cookies should not be used for marketing. Credentials for staging must not be placed in public repositories.
If a client asks us to implement a consent banner as part of a deliverable, the functional specification in the statement of work defines behaviour. Acceptance testing should include consent gating tests. Our Cookie Policy for cliniflo.technology is not a substitute for the client's own cookie notice.
We advise clients that PECR applies to UK users of their services independently of UK GDPR. We can provide engineering implementation; legal sign-off of the client's notice remains with the client and their advisers.
16. Security, integrity, and cookie tampering
Users should not attempt to forge consent cookies or security tokens. Tampering may result in inconsistent Site behaviour and may be treated as a security event if it appears to probe session integrity.
We may rotate cookie signing secrets. After rotation, old tokens become invalid and a new consent or session flow may occur.
If we detect a cookie-related vulnerability, we will remediate it and may invalidate sessions. We will not describe exploit techniques in this Policy.
Reporting a suspected cookie security issue can be done through the same contact channels. Please avoid including payloads that execute in your report; describe the behaviour instead.