Cookie Notice

A cookie is a small piece of text a website asks your browser to keep and send back on your next request. Cookies became controversial because of what they are usually used for — following people between sites to build advertising profiles — rather than because of what they are. Some are genuinely necessary; most of the ones you are asked about are not.

This cookie notice — a cookie policy, if you are looking for that name — describes every cookie this website sets, which makes it shorter than most. There is one.

When a member of our staff signs in to the administration dashboard, the site sets a session cookie so that the next page they open knows they are signed in. It contains a random token and nothing else — no name, no email address, no advertising identifier, and nothing that could be used to follow anybody anywhere. It is marked so that scripts running in the browser cannot read it, it is sent only over an encrypted connection, and it expires on its own.

If you are reading this site as a visitor rather than working on it, you never receive that cookie. Nothing is written to your device by these pages at all.

We also do not use the technologies people reasonably worry about alongside cookies: no tracking pixels, no browser fingerprinting, no local storage used to identify you, and no advertising identifiers.

Because there is nothing to ask you about, and a banner asking you to consent to nothing would be theatre rather than transparency.

The rule people are used to seeing enforced comes from the ePrivacy Directive, carried into national law across the EEA and mirrored in the UK. It says that storing information on somebody's device requires their consent, with one exception: where the storage is strictly necessary to provide a service the user has explicitly asked for. Strictly necessary cookies are therefore exempt, and ours is the only one here. Keeping a member of staff signed in after they have chosen to sign in falls squarely inside that exception. Analytics does not. Advertising certainly does not.

So we are not relying on a loophole, and we are not quietly tracking you behind a banner that says we are not. We simply do not do the thing that needs consent.

This has one consequence worth stating plainly. Because we run no analytics, we genuinely do not know how many people read a page, how long they stayed, or where they came from. That costs us something — it makes it harder to know which of these pages are useful. We think that is the right trade for a site where the readers are patients, many of them entering serious medical details, in countries where being identified as seeking a particular treatment can carry real consequences.

If we ever change this, we will ask before setting anything, not afterwards, and the banner will let you say no as easily as yes.

It is easier to trust a short list of what a site does when you can see what it has deliberately left out. All of the following are absent from this website, and their absence is a decision rather than an oversight.

There is no web analytics of any kind — no Google Analytics, no Plausible, no Matomo, nothing counting visits. There is no advertising or conversion tracking: no Meta pixel, no Google Ads tag, no TikTok or LinkedIn pixel. There are no social media share buttons that load code from a social network, because those set cookies on that network's behalf whether or not anybody clicks them.

There is no session recording or heatmap tool, which is the category most people find most unpleasant when they learn it exists — those replay what you typed and where you moved, and on a form where somebody is describing their illness that would be indefensible.

There are no embedded third-party frames: no YouTube or Vimeo players, no Google Maps, no chat widget, no font loaded from somebody else's server. Each of those makes your browser talk to a company you did not choose to visit, which is exactly what the rules exist to prevent.

And there is no advertising network, no data broker relationship, and no sale or sharing of personal information as the US state privacy laws define those terms.

If you inspect this site with a browser extension that counts trackers, you should find nothing. If you ever find something, tell us — it would be a bug, and we would want to fix it.

You do not need our permission to control what your browser stores, and you should not have to take our word for what we set.

Every major browser lets you see the cookies a site has set, delete them, block them for a particular site, or block them all. In Chrome, Edge, Firefox and Safari the browser settings for this sit under privacy or site settings, and every one of them will show you exactly what this domain has stored. We encourage you to look, because a claim like the one on this page is worth verifying rather than believing.

Blocking cookies for this site will not stop you reading anything. Every information page here works with cookies switched off entirely, because none of them depends on one. The only thing that will break is the staff sign-in, which is not something a reader uses.

If you want to go further, browsers offer private or incognito windows that discard everything at the end of the session, and tracker-blocking extensions work fine here — they simply will not find much to block.

One thing to be aware of that is not about cookies at all: like every website, our server records the requests it receives, including an address and a browser identifier, because that is how a web server works and how attacks are recognised. Those records are kept briefly and used for security, never to build a profile of you. Our privacy policy covers them.