COOKIE POLICY

1.  Introduction

This Cookie Policy explains how Hospitual uses cookies, browser storage and similar technologies across the Hospitual public website and the Hospitual platform (the authenticated web application), and how visitors and users can manage or opt out of them. This Cookie Policy should be read together with the Hospitual Privacy Notice and the country addendum that applies to you. The applicable addendum identifies the responsible Hospitual entity and explains any country-specific requirements. If this Cookie Policy conflicts with an applicable country addendum, the country addendum takes precedence to the extent of that conflict.

2.  What Are Cookies and Similar Technologies?

Cookies are small text files stored on your device by your browser when you visit a website or use a web application. They let the site remember information about your visit – for example, keeping you signed in between page loads or remembering your display preferences. Local storage and session storage are browser features that allow websites to store small amounts of information directly within your browser, similar in purpose to cookies but accessible only by the website that set them. In this Cookie Policy, the term ‘cookies’ is used to refer collectively to cookies, local storage, session storage and similar client-side technologies, unless otherwise stated.

3.  Our Approach

Hospitual aims to keep the use of cookies and similar technologies to a strict minimum across both the public website and the platform. Specifically:

• We do not use cookies or similar technologies for advertising, marketing pixels or cross-site tracking.
• We do not use analytics platforms such as Google Analytics, Facebook Pixel, Hotjar or comparable tracking services.
• We do not sell or share personal data collected through cookies with advertising networks or data brokers.
• The cookies and storage described in this Policy are limited to those required to operate the website and platform securely, maintain authenticated sessions, protect forms from automated abuse and remember a small number of visitor preferences.

4.  Categories of Cookies and Storage We Use

4.1  Strictly Necessary

Strictly necessary cookies are required for the website or platform to function correctly and to be protected against abuse. This includes cookies that keep you securely signed in to the Hospitual platform and those that protect public-facing forms from automated submissions. These cookies cannot be switched off without affecting the functionality they support.

4.2  Functionality and Preferences

Functionality and preference storage is used to remember choices you make, such as your selected colour scheme on the public website. This storage is only created after you actively make a choice.

4.3  Analytics, Advertising and Marketing

Hospitual does not currently use analytics, advertising or marketing cookies on either the public website or the platform. If this changes in the future, this Cookie Policy will be updated and, where required by applicable law, appropriate consent will be sought before any such cookies are set.

5.  Inventory of Cookies and Storage

The following table lists the cookies and browser storage described by Hospitual across the public website and the platform as at the effective date. The ‘Scope’ column indicates where each item is active.

Name	Scope	Type / Provider	Purpose	Duration	Category
refresh_token	Platform (app)	First-party HTTP cookie; Hospitual; HttpOnly and Secure	Keeps you signed in by allowing Hospitual to renew your session without asking you to log in on every request.	30 days; cleared upon logout	Strictly necessary
trusted_device	Platform (app)	First-party HTTP cookie; Hospitual; HttpOnly and Secure	Set only if you choose ‘Remember this device’ during multi-factor authentication, so Hospitual does not prompt you for an MFA code again on the same device for a limited time.	7 days	Strictly necessary
Cloudflare Turnstile cookies	Public website (/join-as-a-specialist/ only)	Third-party cookies; Cloudflare, Inc.; challenges.cloudflare.c om	Detects automated or abusive form submissions on the specialist application form. The cookies are set by Cloudflare during the challenge and are not readable by Hospitual.	Short-lived (typically minutes to 30 days, set by Cloudflare)	Strictly necessary
theme	Public website	First-party browser local storage; Hospitual	Remembers the visitor’s preferred colour scheme (light or dark) so the site renders consistently across visits. Stored only after the visitor uses the theme toggle.	Until cleared or ‘System’ is selected	Functionality / preferences

6.  Third-Party Services

6.1  Cloudflare Turnstile (Public Website)

Cloudflare Turnstile is loaded only on the specialist application form at /join-as-a-specialist/ to detect automated or abusive submissions. The service is provided by Cloudflare, Inc. and may set short-lived cookies on the challenges.cloudflare.com domain during the challenge. Further information about Cloudflare’s use of cookies and the data Cloudflare processes is available in the Cloudflare Privacy Policy and the Cloudflare Turnstile documentation. Visitors who do not wish to interact with Cloudflare Turnstile may choose not to submit the specialist application form or contact Hospitual using the contact details below to enquire about alternative submission methods.

6.2  Stripe (Platform – Payments)

Hospitual does not set third-party advertising, analytics or social-media cookies on the platform. If you make a payment, Hospitual’s payment provider, Stripe, may set its own cookies on the Stripe-hosted payment page. Those cookies are governed by Stripe’s own cookie policy.

7.  How to Manage or Opt Out

7.1  Platform Session Cookies

The refresh_token cookie is cleared automatically when you log out of the Hospitual platform. The trusted_device cookie expires automatically after 7 days. Blocking either cookie will prevent you from remaining signed in, meaning core features of the platform will not work as intended.

7.2  Theme Preference (Public Website)

The theme preference stored in browser local storage can be removed at any time by selecting ‘System’ on the theme toggle in the website header. Selecting ‘System’ clears the stored value and returns the site to following your operating system’s colour scheme. The value is also removed when you clear browser storage for this site.

7.3  Cloudflare Turnstile (Public Website)

Cloudflare Turnstile is only loaded on the specialist application page at /join-as-a-specialist/ and is not present elsewhere on the website. Visitors who do not wish to load Cloudflare Turnstile can avoid visiting that page or contact Hospitual to enquire about alternative submission methods.

7.4  Browser-Level Controls

Most modern browsers allow you to view, manage, block or delete cookies and browser storage for individual websites. These controls are usually found within browser settings under sections such as ‘Privacy’, ‘Cookies and site data’ or ‘Clear browsing data’. Please note that blocking strictly necessary cookies or browser storage may affect parts of the website and platform, including the ability to remain signed in and use the specialist application form.

8.  Do Not Track and Global Privacy Control

Because Hospitual does not use analytics, advertising or marketing cookies on either the public website or the platform, no additional tracking occurs that would need to be disabled in response to Do Not Track or Global Privacy Control signals. If analytics or similar technologies are introduced in the future, this position will be reviewed and this Policy updated accordingly.

9.  Changes to This Cookie Policy

Hospitual may update this Cookie Policy from time to time to reflect changes to the cookies and similar technologies used, operational changes or changes in legal or regulatory requirements. If a change introduces non-essential cookies, Hospitual will ask for consent before setting them where applicable law requires it. The most recent version of this Cookie Policy will be made available through the Hospitual website or platform.

10.  Applicable Addenda

• Schedule 1 – United Kingdom Cookie Addendum
• Schedule 2 – Canada Cookie Addendum

11.  Contact Us

Data Protection: [email protected] General Enquiries: [email protected] The applicable postal address is provided in the relevant country addendum.