Cookie Policy
NACRT / DRAFT — pending review by qualified Croatian legal counsel. Not for publication in this form.
This is a courtesy English translation provided for convenience. The Croatian version is the sole binding version.
This Cookie Policy explains which cookies and related technologies the medkit.hr platform (the "Platform") uses, for what purpose, and for how long. It is written to reflect the Platform's actual technical behaviour: we set only the first-party cookies needed to provide the service (the sign-in cookie — for clinic staff, and for patients who choose to sign in — and a functional language cookie); there are no analytics, marketing, or advertising cookies. The only third-party cookie is g_state, set by Google's sign-in script only if you actively engage the optional "Sign in with Google" button (that script is not loaded until you click it — see Section 3). Pages with a map load map tiles from a third-party server (CARTO) — a network request that discloses the visitor's IP address to that provider, but CARTO sets no cookies on our pages (Section 7).
1. Who we are
The Platform is operated by [ legal entity name and legal form], with registered seat at [ registered address], registered in the court register [ court of registration and MBS number], OIB: [ OIB] ("Medkit", "we"). For questions about this Policy or the processing of personal data, contact us at privacy@medkit.ltd.
2. What cookies and related technologies are
Cookies are small text files that a website stores in your browser so that the site can function or remember certain information between visits. Related technologies covered by this Policy are browser local storage (localStorage) and a service worker; we describe those below as well, because we want to give a complete and accurate picture of what is stored on your device.
3. The cookies we set
The Platform sets first-party cookies (cookies of the medkit.hr domain), namely:
- sign-in and session cookies for signed-in users — clinic staff (administrators, reception staff, other account holders) and any patient who chooses to sign in (via Google or an emailed one-time code) — without which a signed-in user cannot sign in or stay signed in, and
- a functional cookie remembering your chosen interface language. It is set only when you change the language yourself and is used solely to display the Platform in the language you chose; it is not used for tracking (see Section 8).
The Platform has no analytics cookies, no marketing or advertising cookies, and no visitor-tracking technologies. It sets no third-party cookies on page load. There is one third-party cookie — Google's g_state — but it is set only after you actively click the optional "Sign in with Google" button: the Platform's security policy (Content Security Policy) allows the Google sign-in script from accounts.google.com, and that script is loaded only on that click (a "click-to-load" gate), at which point Google's script may set g_state. Until you engage that button, no Google script runs and no g_state cookie exists. Map tiles are loaded from a third-party server (CARTO) as a plain network request, but CARTO sets no cookies on our pages in doing so (Section 7).
To measure site usage the Platform uses a cookieless analytics tool (Vercel Web Analytics) that measures aggregate usage without setting any cookies or storing identifiers on your device; we therefore mention it here for completeness, but it adds no cookie to the table above [ counsel to confirm ePrivacy treatment of cookieless analytics].
Cookie table
| Cookie | Set by | Purpose | When it is set | Duration |
|---|---|---|---|---|
sb-qhbeloduixpcgwkxlkjc-auth-token (may be split into parts suffixed .0, .1, etc.) | medkit.hr (first party; Supabase technology, our processor for storage and authentication) | Authentication: maintaining the sign-in session | After any user signs in — clinic staff, or a patient who chooses to sign in (via Google or an emailed one-time code). Anonymous visitors and patients who do not sign in do not receive it | Session cookie set on sign-in; the middleware refreshes the Supabase session and re-sets the cookie on requests, so the expiry is effectively rolling (technical check 2026-07-23) |
NEXT_LOCALE | medkit.hr (first party) | Functional: remembering the chosen interface language, solely to display the Platform in the chosen language | Set only when you change the language yourself (choose a language different from the automatically detected one) | Session cookie, set automatically when you switch language (technical check 2026-07-23) |
g_state | accounts.google.com (Google, third party) — Google's sign-in script | Google sign-in / One Tap session state (e.g. remembering that you dismissed the sign-in prompt) | Only after you click the optional "Sign in with Google" button, which loads Google's sign-in script (click-to-load); never on page load | Set and controlled by Google's script; see Google's own documentation [ counsel to confirm g_state duration/description] |
Note: the staff sign-in process may temporarily set additional cookies whose names begin with sb- (for example a security cookie used during sign-in via an emailed link). The exact list of cookie names and durations will be confirmed by a technical in-browser check before this Policy is published.
4. Patients: booking needs no account; signing in is optional
Patients book appointments on the Platform without a user account and without signing in — booking never requires an account, and a patient can always access their own appointment solely via the link in the confirmation email. If you do not sign in, no sign-in or identification cookie is set for you, and search and booking work without cookies (the only cookie that may relate to you is the functional language cookie described above).
Optionally, a patient may choose to sign in — with Google or with an emailed one-time code — to see all their appointments in one place. If you choose to sign in, you receive the same sign-in session cookie as staff (the sb-…-auth-token cookie in Section 3), and, if you sign in with Google, the g_state cookie set by Google's script (Section 3). This happens only as a result of your own choice to sign in; it never happens to a patient who simply books or browses.
5. Local storage (localStorage)
The Platform may use the following entries in your browser's local storage:
| Key | Content | Purpose |
|---|---|---|
medkit:autoAreaSearch | "1" or "0" | Remembers whether you want the map search to re-run automatically when you move the map |
medkit:booking-details | your name, email address and phone number (never any health data, and never the reason for the visit) | Opt-in "remember my details on this device": stored only if you tick that box in the booking form, so the form is pre-filled on your next booking on the same device. You can clear it from the form at any time |
medkit-tour-done | a flag | Clinic staff only: remembers that a staff user has dismissed the product tour in the management interface |
Except for medkit:booking-details, these entries contain no personal data. medkit:booking-details does contain your contact details, but it is stored only at your request (the opt-in box), it remains in your browser, and it is never sent to our servers. None of these entries is ever transmitted to us.
6. Service worker and app installation
The Platform registers a minimal service worker (/sw.js) whose sole purpose is to make the Platform installable as an app (PWA) on your device. This service worker does not intercept network requests, does not cache any content, and does not store any data, including personal data.
7. Third-party content: map tiles
When you use the map on the search pages, your browser loads map tiles directly from the servers of the provider CARTO; in doing so, your IP address and the displayed map area are disclosed to that provider. This is described in more detail in our Privacy Notice. This is solely a third-party network request; CARTO sets no cookies on our pages when map tiles load. Aside from the optional Google sign-in script — which loads only after you click the "Sign in with Google" button (Sections 3–4) — the Platform runs no third-party scripts.
8. Why we do not show a cookie consent banner
Under Article 5(3) of the ePrivacy Directive (2002/58/EC), as implemented in the Croatian Electronic Communications Act (Zakon o elektroničkim komunikacijama, NN 76/22), consent is not required for cookies that are strictly necessary to provide an information-society service explicitly requested by the user. The sign-in cookie is necessary for a signed-in user — clinic staff, or a patient who chooses to sign in — to sign in and use the service they requested. The functional language cookie is set only when you change the language yourself and serves solely to display the Platform in the language you chose; we treat it as necessary for providing the service you thereby requested, and it is not used for tracking [ counsel to confirm ePrivacy treatment].
As for the Google sign-in widget and its g_state cookie: the widget is not loaded until you actively click the "Sign in with Google" button (a click-to-load gate), so no Google script runs, and no g_state cookie is set, without your own deliberate engagement of that optional feature. We treat that click as the user action that both requests the sign-in service and constitutes engagement with the Google widget, so the Platform loads no third-party sign-in technology, and stores nothing on your device via it, before you choose to use it [ counsel to confirm this click-to-load treatment of the Google sign-in social plug-in under Art. 5(3) ePrivacy]. The Platform therefore does not show a cookie consent banner. This posture holds only for as long as the Platform loads no third-party analytics, advertising, or auto-loading third-party embeds; any such addition would require a consent mechanism first.
9. Managing cookies
You can view, delete, and block cookies in your browser settings (see your browser's documentation for instructions). If you delete or block the sign-in cookie, clinic staff will not be able to sign in or stay signed in to the management interface; patient-facing functionality (search and booking) works without cookies.
10. Changes to this Policy
We will update this Policy whenever the way the Platform uses cookies or related technologies changes. To measure site usage the Platform currently uses only the cookieless analytics described above (Vercel Web Analytics), which sets no analytics cookie. We expressly commit that, should any cookie-based or identifier-based analytics or marketing technology ever be introduced in future, this Policy will be amended first and an appropriate consent mechanism implemented before it.
11. Governing language
The Croatian version of this Policy is the sole authentic (binding) version; translations into other languages are provided for convenience only.
Last updated: [ date]
NACRT / DRAFT — pending legal review.