Cookie Policy

A practical overview of the cookies and similar technologies that support Mediqa's website, booking flows, and reserved SaaS area.

Last updated: 10 September 2026. This version reflects a source-code review for cookies, local storage, analytics tags, and tracking scripts.

What this policy covers

This policy explains the cookies and equivalent browser technologies used by Mediqa on the public website, booking pages, authentication flows, and reserved SaaS area.

Technical cookies

The current codebase uses first-party technical cookies and equivalent technologies for login, session refresh, language preference, workspace and location scope, security, fraud prevention, demo/booking handoff, and reserved-area usability.

These tools are necessary or preference-based and do not require prior consent under the Italian cookie rules.
They are described here to satisfy the information requirement.

Analytics or marketing cookies

Mediqa can load Google Analytics 4, Google Tag Manager, and Meta Pixel only when the related public environment ID is configured and the visitor has given granular consent. Optional tags are blocked by default and are limited to public marketing pages.

Analytics and marketing choices are separate, initially disabled, and can be changed from the floating cookie preferences control.
Rejecting or closing the banner keeps all optional trackers disabled.
Google Tag Manager loads only when both analytics and marketing consent are accepted, unless the container is redesigned and documented for a narrower purpose.
Optional tags are not loaded on booking pages, authentication flows, the reserved workspace, admin pages, billing, contacts, leads, statistics, support, settings, or voice-operations areas.

Third-party embeds

The public pages that offer to book a demo show, in place of the booking calendar, a box that names Calendly (Calendly LLC). The calendar, an iframe served by calendly.com, loads only when the visitor presses «Open the Calendly calendar»: before that click the browser does not contact Calendly at all.

Inside that frame Calendly acts under its own privacy notice (https://calendly.com/legal/privacy-notice) and shows its own cookie banner, which we neither control nor pre-fill.
The click on that box is the choice: the Mediqa cookie panel covers the optional analytics and marketing tags, not this calendar.
The content security policy allows framing only calendly.com, so no other external page can be embedded.

Consent choices

When no optional tracking ID is configured, Mediqa uses only technical cookies and no optional-cookie banner is shown. When an optional analytics or marketing tool is configured, the banner appears before any optional script runs.

Scrolling, inactivity, preselected choices, or forced cookie walls must not be used as consent.
A consent banner must not be shown again at every visit unless processing changes, the prior choice cannot be read, or at least six months have passed.

Retention

Cookie duration depends on purpose: session cookies expire when the session ends, while persistent cookies remain only for the time needed to provide the related function or preference.

Third-party providers

Authentication, hosting, database, payment, telephony, email, voice AI, calendar, and security providers may process technical identifiers when their function is enabled. None of them sets a cookie in your browser: the session cookies above are set on this domain, and every other provider is used server-side or through explicit integration flows. Google Analytics, Google Tag Manager, and Meta Pixel are optional public-page tools and load only after the required consent. Calendly is the exception to the server-side rule: it is embedded client-side in the public home page, as described above.

Contacts

For questions about cookie handling, write to info@mediqa.it.

Technical cookie register

Name	Provider	Purpose	Duration
mediqa_locale	Mediqa	Stores the language preference and helps serve the correct localized interface.	12 months
mediqa_cookie_consent	Mediqa	Stores the visitor's analytics and marketing cookie choices and prevents the banner from being repeated on every visit.	180 days
inbound_ai_session or configured session cookie	Mediqa	Keeps authenticated users signed in to the reserved area. HttpOnly where set by the server.	30 days
mediqa_portal_session	Mediqa	Keeps a patient signed in to the patient portal, where the healthcare organisation has enabled it. HttpOnly, set by the server, and separate from the staff session. The server-side session is the actual gate: it expires regardless of the cookie.	30 minutes
mediqa_medico_session	Mediqa	Keeps a practitioner signed in to the practitioner portal, where a healthcare organisation has given them access to see their own fee shares. HttpOnly, set by the server, and separate from both the staff session and the patient session. The server-side session is the actual gate: it expires regardless of the cookie.	2 hours
inbound_ai_session_admin_workspace	Mediqa	Stores the selected workspace for platform-admin views.	30 days
inbound_ai_session_location_scope	Mediqa	Stores the selected location scope inside a customer workspace.	30 days
sb--auth-token / sb--refresh-token	Mediqa	Manages the signed-in session on this domain.	Managed by the platform's session settings
inbound_ai_session_mfa	Mediqa	Records that the signed-in user has just passed a second authentication factor, so it is not asked again on every page. Signed, HttpOnly, and tied to that user: under another account it is worthless.	12 hours
mq_altre_sessioni_esito	Mediqa	Carries to the security page the outcome of "Sign out the other devices": how many sessions were closed, how many were already closed, how many failed. Signed with the session secret and HttpOnly, limited to that one page, and it expires on its own after thirty seconds.	30 seconds
mediqa-backoffice-v2 / mediqa-pazienti-v2 / mediqa-assistant-v2	Mediqa	Remembers, for this browser, whether the user switched the reserved area's Settings, Patients, or Assistant pages to their new version. HttpOnly, set by the server.	12 months

Optional analytics and marketing register

These tools are dormant unless their environment IDs are configured and the visitor gives the relevant consent.

Name	Provider	Purpose	Duration
_ga	Google Analytics	Distinguishes visitors on public marketing pages after analytics consent.	Default 2 years
_ga_<measurement-id>	Google Analytics	Persists analytics session state on public marketing pages after analytics consent.	Default 2 years
_fbp	Meta Pixel	Supports Meta advertising measurement and remarketing on public marketing pages after marketing consent.	Typically up to 90 days; verify after production scan
_fbc	Meta Pixel	Stores the Meta click identifier when a visitor arrives with a Meta ad click parameter and marketing consent is active.	Typically up to 90 days; verify after production scan
Tags inside GTM container	Google Tag Manager / configured tag vendors	Google Tag Manager is a container. Any cookie depends on the tags configured inside it and must remain consent-gated and documented before activation.	Depends on the contained tag

Equivalent storage register

Name	Storage	Purpose	Duration
mediqa.demo-request.last-id	Mediqa sessionStorage	Keeps the last demo request reference visible during the current browser session.	Browser session
mediqa.demo.scenario.v1	Mediqa sessionStorage	Transfers the lost-calls calculator scenario to the demo request flow.	Browser session or until the demo form clears it
mediqa.command-center.recents.v1	Mediqa localStorage	Stores recent reserved-area commands for faster navigation.	Until deleted by the user/browser
mediqa.submit-feedback.pending	Mediqa sessionStorage	Holds, between a save and the next page, the confirmation to show that the save went through.	Browser session, removed once shown
mediqa:ricarica-build	Mediqa sessionStorage	Remembers when the page last reloaded itself after an app update, so an error page does not reload in a loop.	Browser session
mediqa.dashboard-coda-aperta	Mediqa localStorage	Remembers whether the queue panel on the reserved-area dashboard is open or closed.	Until deleted by the user/browser
mediqa:dashboard:conversion-view:v1	Mediqa localStorage	Remembers, in this browser only, whether the dashboard conversion card shows points or the proportional funnel.	Until deleted by the user/browser
mediqa:manual-clinical-episode-templates	Mediqa localStorage	Keeps, in this browser only, the clinical-episode templates (section titles and text) that the user saves in the clinical record.	Until deleted by the user/browser
mediqa:clinical-scribe:custom-templates:v1	Mediqa localStorage	Keeps, in this browser only, the custom clinical-scribe templates that the user creates.	Until deleted by the user/browser
mediqa.suono-chiamate	Mediqa localStorage	Remembers whether the sound for incoming calls is switched on on this device. Off until the user switches it on.	Until deleted by the user/browser
mediqa.dettato.usato.v1	Mediqa localStorage	Remembers that voice dictation in the support chat has been used in this browser, so the next dictation starts faster (the transcription connection is prepared before the tap, without microphone audio). Removed if the microphone is denied.	Until deleted by the user/browser
mediqa.ultima-chiamata-annunciata	Mediqa sessionStorage	Remembers which live call was announced, so the same call is not announced again immediately after a page reload.	Browser session
mediqa.ultima-chiamata-annunciata-at	Mediqa sessionStorage	Remembers when the latest call reminder appeared, so reminders can resume about once per minute without repeating immediately after a reload.	Browser session

Book a demo