Cookie-Richtlinie

This policy explains which cookies and which browser storage Medova uses, why, on what legal basis, and how to change it. We apply the ePrivacy Directive (2002/58/EC), Article 173 of the Polish Telecommunications Act and the GDPR (Regulation 2016/679).

By default we set no analytics or marketing cookies at all. Until you click consent in the banner, Google consent mode stays at „denied” and the Meta conversion pixel does not load.

Cookies are small text files a site stores on your device and sends back to the server with every request.

Browser storage (localStorage, sessionStorage) keeps data only in the browser and is never sent to the server. It does not expire on its own, so it has to be cleared manually. In legal terms we treat it exactly like cookies, because it is also a record stored on the user's device.

Medova uses both, and we keep your consent state in localStorage rather than in a cookie, so that public pages can be served from a content delivery network cache and an anonymous response sets no cookie at all.

The full, current list is below this text, in the „Cookies” and „Browser storage” cards. It is generated directly from the register kept in the service's source code, so it cannot drift from what the browser actually stores.

It covers the key name, provider, purpose, consent category and lifetime. The panel for signed-in providers additionally stores view preferences (a collapsed menu, the selected calendar view, an unsent message draft); these are interface settings only, fall under the essential category and are not used for tracking.

Two tools measure traffic without storing anything on your device and without an identifier that could follow you across sites. They therefore require no consent for device storage and are not in the list above:

• Our own visit statistics, running on our server in Germany. They count page views and referral sources, set no cookies and build no user profile.
• Ahrefs Web Analytics, used to measure search visibility. It sets no cookies and does not identify individuals.

Both process an IP address to distinguish visits, on the basis of legitimate interest (Article 6(1)(f) GDPR). You may object by writing to dpo@medova.health.

The content delivery network through which the service is served may set a technical cookie to protect against attacks; it is necessary for the site to operate safely.

On pages where the URL itself would say something about your health, we load no third-party analytics or marketing scripts regardless of the consent you have given. This covers in particular the appointment booking wizard, provider profiles and the provider search.

The reason is simple: an address such as „booking an appointment at clinic X” reveals health information by itself, and that information has no business reaching an external advertising vendor.

• In the service: open „Cookie settings” in the footer. Changes take effect immediately, and withdrawing consent stops the scripts from loading right away.
• In your browser: you can delete or block cookies in the browser settings. Browser storage entries can be cleared in developer tools (Application → Local Storage) or by clearing all site data.
• What blocking does: blocking essential cookies makes signing in and remembering your language impossible.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. We ask again when the list of providers or the scope of measurement changes, because earlier decisions no longer describe what is happening.

The providers named in the list process data under their own privacy policies, and any transfer outside the European Economic Area relies on standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.

The full list of processors, with data location and transfer basis, is in the Privacy Policy.

For anything about cookies and privacy, write to our Data Protection Officer: dpo@medova.health.

What the 16 September 2026 version changed: the list was brought into line with what the service actually stores; Meta conversion cookies and browser storage entries not previously listed were added; measurement that works without cookies was described; the rule about loading no third-party scripts on health-related paths was added; and the entry describing a separate consent store, which has not existed since the banner and the policy page were unified, was removed.