Cookie Policy

Strictly necessary

These are required for the Service to work and cannot be switched off. The names below are the ones used on the live site.

• Session cookie (__Host-authjs.session-token): keeps you signed in to your clinic account. It keeps the device signed in until you sign out, and ends by itself only if the device is not used for a year.
• Sign-in security cookie (__Host-authjs.csrf-token): protects the sign-in form against forged requests. Deleted when you close the browser.
• Sign-in return cookie (__Host-authjs.callback-url): remembers which page to return you to after you sign in. Deleted when you close the browser.
• Consent cookie (mc-cookie-consent): remembers the choice you make in the cookie banner, so we don't ask again. Kept for one year.
• Security check (Cloudflare Turnstile) on the sign-in, registration, password reset and contact forms: Cloudflare may store data in your browser and receives your IP address, to tell people apart from automated abuse.
• Unsaved changes (keys beginning with ms-draft:, session storage, apart from the two listed next): a copy of what you are typing into a patient record or a price offer, so that it is not lost if the page reloads. It can hold the patient details typed into the form, stays in that browser tab, and is put back only for the user who typed it. Deleted when you save or discard the changes, when you sign out in that tab or when you close the tab; a record copy older than 24 hours, or an offer copy older than 10 minutes, is never put back.
• Paper record warning seen (keys beginning with ms-draft:paper-seen:, session storage): notes that a paper record's warning has already been shown in that tab, so that it is shown once. It holds the record's id and nothing about the patient. Deleted when you sign out in that tab or when you close the tab; a note older than 24 hours is never used, so the warning is shown again.
• Open batch of pages (keys beginning with ms-draft:paper-batch:, session storage): a random id that ties that browser tab to the batch of pages it has open, so that a reload finds it again. It holds nothing about the patient. Written when the capture form or Add pages opens. Deleted when you sign out in that tab or when you close the tab; an id older than 24 hours is never used.
• Photographed paper records (IndexedDB database paper-local, with the markers ms.paper.local and ms.paper.swept in local storage): the pages you photograph from a paper patient record, with the patient's name and date of birth as typed beside them, kept on that device only until they reach your clinic's records, so that a page is not lost if the connection drops or the tab closes. The markers hold no patient data: the first only says the database may hold pages, and the second only how many old pages the sign-in page removed, until the dashboard has said so. A page is deleted from the device once it is uploaded, when you discard it, or when you sign out. Pages of a record that was never saved are deleted after 24 hours, and pages of a saved record that are still waiting to upload after 7 days. These two limits are applied the next time the sign-in page or the dashboard is opened in that browser, and pages left by another account are removed the next time someone signs in and reaches the dashboard there. Until then the pages stay on the device. A page in a form still open in a browser tab stays until that tab is closed.
• Medical Solutions staff cookies (three cookies): used only by our own staff, to sign in to the platform's own back office, from which we run the Service, and to recognize the devices they use there. They are never set for clinics or visitors.

Preferences

These remember a choice you make in the interface, or that the intro animation has already played. Each one is saved in your browser, is never sent to us, and holds nothing about patients.

• Theme (theme, local storage): light or dark. Kept until cleared.
• Side menu (ms.rail.collapsed, local storage): whether you folded the menu. Kept until cleared.
• Setup guide (ms.guide.collapsed, local storage): whether you folded the setup guide. Kept until cleared.
• Two-factor reminder (ms-2fa-reminder-hidden-until, local storage): when you pressed Not now on the reminder to turn on two-factor authentication, so it asks again a week later. Kept until cleared.
• Verification phone reminder (ms-recovery-phone-hidden-until, local storage): when you pressed Not now on the banner asking you to add a phone number for your account's security, so it asks again a week later. Kept until cleared.
• Intro animation (mc-intro-seen, session storage): notes that the intro animation on the home page has already played, so it plays only once in each tab. Deleted when you close the tab.

Functional (optional)

These make the Service more convenient but aren't required for it to work. You can decline them and still use Medical Solutions normally.

• Language cookie (NEXT_LOCALE): remembers whether you last used the site in English or Albanian, so you don't have to switch every visit. Kept for one year.

Your choices

When you first visit the site, a banner lets you accept all cookies or continue with strictly necessary cookies only. You can change your mind at any time from the link at the bottom of this page or in the site footer. You can also delete cookies and browser storage for this site in your browser's settings at any time; you will then be signed out and your preferences reset.

Changes to this policy

If the cookies or storage we use change, we will update this page and its date and, where the change is significant, ask for your consent again.

This policy is published in Albanian and English. If the two versions differ, the Albanian version prevails.