Cookie Policy
Last updated: September 29, 2026.
What Are Cookies?
Cookies are small text files stored on your device. We use essential cookies to run the platform and, only if you accept them, Google Analytics and Google Ads cookies to measure our advertising. Embedded YouTube videos may set YouTube's own cookies once a video plays (see Third-Party Services).
Essential Cookies (always active)
| Name | Purpose | Duration | Set by |
|---|---|---|---|
| sb-*-auth-token | Authentication (Supabase session) | Until you sign out or the session ends (at most 400 days) | Supabase |
| __csrf | CSRF protection (double-submit pattern) | 24 hours | PhysioSense |
| preferred_locale | Remembers your chosen display language | 1 year | PhysioSense |
| NEXT_LOCALE | Remembers the page language when it differs from your browser's language (set by the next-intl library) | Until you close the browser | PhysioSense |
| ps_rpt_claim | Lets a buyer without an account return to their Literature Review order in this browser | 45 days | PhysioSense |
| password_reset_pending | Keeps you on the password-reset page until you have set a new password | 30 minutes | PhysioSense |
| signup_pending | Lets the registration page detect that you have confirmed your email address | 30 minutes | PhysioSense |
Analytics
Umami and Vercel Analytics give us aggregate traffic data. Neither sets cookies, and both run whatever you choose in the cookie banner. Umami receives the page address and the referring page with only campaign parameters left in their query strings (utm_* tags and ad click identifiers such as gclid), the page title, your screen size and browser language and, from the request, your IP address and browser information, from which it derives country, browser, operating system and device type. Vercel Analytics receives the page address including its query string, the referring page and page-speed measurements, and derives your approximate location, browser, operating system and device type from the request. Google Analytics 4 and Google Ads measure our advertising campaigns and set cookies only after you accept (see below). On PeopleSense pages that name a condition or a body region — and on a page you open from one — Google Ads does not run, and Google Analytics receives the page address and title with a placeholder instead of the condition name. Sentry is used for error reporting and removes personal links, credentials and email addresses before a report is sent.
Pages whose address contains a personal link — such as patient and team invitations, booking management, password reset, email confirmation and unsubscribe links — send no page view or other measurement to Umami, Vercel Analytics or Google. Umami may later receive such a page as the referring page, but only with the personal link removed.
Third-Party Services
- Card payments — when you pay by card, you leave PhysioSense for the payment page of our card payment gateway, which Bankart (Slovenia) operates for our partner bank in Montenegro. That page is not ours: PhysioSense sets no cookies there, and any cookies on it are set by the gateway.
- Cloudflare Turnstile — a bot check on the login, registration, password-reset and patient-invitation pages. It receives your IP address and browser signals.
- YouTube — embedded videos use YouTube's privacy-enhanced mode (youtube-nocookie.com). When an embedded video loads, YouTube (Google) receives your IP address and browser information; once a video plays, YouTube may set cookies or store data on your device.
Umami and Vercel Analytics set no cookies and do not follow you across other websites. Vercel Analytics recognises a visit by a hash created from the request, which it discards after 24 hours; Umami counts visits without cookies, from request data. Google analytics and advertising cookies are set only after you accept them, and declining costs you no functionality.
Managing Cookies
When you first visit PhysioSense, a banner asks whether you accept Google analytics and advertising cookies. Your choice is saved in your browser's local storage, not in a cookie; if you clear this site's data in your browser, the banner asks again. Essential cookies are required for the platform to work and cannot be disabled.
Legal Basis
Essential cookies: legitimate interest (Art. 6(1)(f) GDPR) — necessary for platform operation. Cookieless analytics (Umami, Vercel Analytics): legitimate interest (Art. 6(1)(f) GDPR). Google analytics and advertising cookies: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by clearing this site's cookies and stored data in your browser.
What Happens if You Decline
If you decline, Google sets no cookies. The Google tag still loads, in Google's advanced consent mode, and may send Google cookieless signals, such as that a page was viewed. Because the tag is loaded from Google's servers, Google also receives your IP address and browser information when a page loads, whatever you choose. Essential cookies remain, because the platform cannot function without them. Cookieless analytics continues either way.
Contact
For questions about cookies, contact us at: privacy@physiosense.net
PhysioSense d.o.o., Vladimira Rolovića 2a, 85000 Bar, Montenegro — Tax ID (PIB): 04409175