Cookie Policy
Effective Date: 1 September 2026
Product: RehabDesk AI
Effective Date: 1 September 2026
Last Updated: 1 September 2026
1. What Are Cookies?
Cookies are small text files placed on your device (computer, tablet, smartphone) when you visit a website or use a web application. They allow the website to remember information about your visit — such as your preferred settings, your logged-in state, or how you used the site. Cookies do not contain executable code and cannot spread viruses.
Similar technologies include:
- Local Storage / Session Storage — browser-based storage used by web applications (used in our app for theme preferences)
- Pixels and beacons — tracking pixels embedded in emails or web pages (we describe our usage below)
2. What Cookies Does RehabDesk AI Use?
RehabDesk AI operates two distinct digital properties that use cookies differently:
2.1 The RehabDesk AI Marketing Website (rehabdesk.app)
The marketing website uses cookies primarily for:
| Cookie Category | Specific Cookies | Purpose | Duration |
|---|---|---|---|
| Strictly Necessary | Session cookie (Supabase Auth) | Maintains your login session so you don't have to log in on every page | Session (deleted when browser closes) |
| Strictly Necessary | CSRF token | Protects against cross-site request forgery attacks | Session |
| Analytics | Analytics Provider Cookie | Anonymous website usage statistics (pages visited, traffic sources, time on page) | 30 days |
| Functional | rd_theme | Remembers your light/dark mode preference | 365 days |
We do not use: Advertising cookies, retargeting cookies, or third-party social media tracking cookies on our marketing website. We do not build advertising profiles from cookie data.
2.2 The RehabDesk AI Application (rehabdesk.app)
The web application (the dashboard used by clinic staff) uses cookies and browser storage for:
| Technology | Purpose | Duration |
|---|---|---|
| Supabase Auth session cookie | Authenticates your identity and maintains your logged-in session. Without this, you would be logged out on every page navigation. | Until you log out, or session expires (typically 7 days of inactivity) |
| CSRF protection token | Protects all server-side form submissions from cross-site request forgery | Session |
Local Storage: rehabdesk_theme | Remembers your UI theme preference (light/dark) — stored in browser local storage, not a cookie | Persistent until cleared by you |
What we do NOT use in the application:
- Third-party analytics cookies that track you across the web
- Advertising or remarketing cookies
- Social media tracking pixels
3. Strictly Necessary Cookies
Strictly necessary cookies are essential for the application to function. Without them, core functions such as user authentication, session maintenance, and security protection cannot work.
You cannot opt out of strictly necessary cookies while using the platform. If you disable all cookies in your browser, the RehabDesk AI application will not function correctly — you will not be able to log in or use the Service.
Strictly necessary cookies we use:
| Cookie Name | Purpose | Duration |
|---|---|---|
sb-*-auth-token | Supabase Auth session token — identifies your authenticated session | 7 days (refreshed on activity) |
sb-*-auth-token.0, .1 (chunked) | Supabase Auth token chunks (used when token exceeds single cookie size limit) | 7 days |
These cookies contain an encrypted JWT session token — they do not contain your password, personal health data, or any sensitive personal data directly readable from the cookie.
4. Analytics Cookies (Marketing Website Only)
We use privacy-respecting analytics on our marketing website to understand how visitors use the site and improve our content. Analytics data is aggregated and anonymized.
Our analytics approach:
- We use industry-standard privacy-focused analytics tools which is designed to be privacy-first (no cross-site tracking, no personal data fingerprinting, GDPR-compliant by design)
- OR: If Google Analytics 4 is used, it is configured with IP anonymization enabled and data retention minimized
Analytics cookies do not track you across different websites. They do not identify you personally.
5. How to Control Cookies
5.1 Browser Settings
You can control cookie behaviour through your browser settings. Most browsers allow you to:
- View cookies stored on your device
- Delete all or specific cookies
- Block future cookies from specific websites
- Block all third-party cookies
Instructions for common browsers:
- Chrome: Settings > Privacy and Security > Cookies and other site data
- Firefox: Settings > Privacy & Security > Cookies and Site Data
- Safari: Preferences > Privacy > Manage Website Data
- Edge: Settings > Cookies and site permissions
Note: Blocking strictly necessary cookies will prevent you from using the RehabDesk AI application.
5.2 Opting Out of Analytics
If you wish to opt out of analytics tracking on our marketing website:
- Use a browser extension such as uBlock Origin or Privacy Badger
- Use a browser with built-in tracking protection (Firefox, Brave)
- Contact us at legal@rehabdesk.app to request exclusion from analytics
5.3 Do Not Track
We respect browser "Do Not Track" (DNT) signals on our marketing website — when a DNT signal is detected, we do not deploy analytics cookies. DNT signals have no effect on strictly necessary cookies required for application function.
6. Local Storage Usage
As noted in Section 2.2, the RehabDesk AI application uses browser local storage (not cookies) to store:
- Your UI theme preference (
rehabdesk_theme)
Local storage data is not transmitted to our servers — it remains in your browser only. To clear local storage, clear your browser's site data for rehabdesk.app.
7. Third-Party Cookies
The RehabDesk AI application does not embed third-party widgets, social media buttons, advertising networks, or any third-party scripts that would place third-party cookies on your device.
The marketing website may include:
- A YouTube embed for product demo videos — YouTube may set cookies if you click the play button; you can control this through YouTube's cookie settings
- Links to third-party resources — following such links to other websites means those websites' cookie policies apply
8. Cookie Consent on the Marketing Website
When you first visit the RehabDesk AI marketing website, you will be shown a cookie consent banner. You can:
- Accept all cookies — enables analytics cookies in addition to strictly necessary cookies
- Reject non-essential cookies — only strictly necessary cookies are set
- Manage preferences — choose specific cookie categories
Your cookie preference is stored for 365 days. You can change your preference at any time using the cookie settings link in the footer of our marketing website.
9. Changes to This Cookie Policy
We may update this Cookie Policy when we add or change features on our website or application, or when applicable law requires us to. When we make material changes, we will update the "Last Updated" date at the top and, where appropriate, display a new consent notice.
10. Contact
For questions about our use of cookies:
Email: legal@rehabdesk.app
Grievance Officer: grievance@rehabdesk.app
This Cookie Policy was last reviewed on 1 September 2026.