Cookie Policy

2.1 Cookies are small text files placed on your device when you visit a website. They allow the site to recognise your device, remember your preferences and keep you signed in.

2.2 This policy also covers similar technologies (local storage, session storage, pixels and software development kits), which we refer to collectively as cookies.

3.1 Our use of cookies is governed by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), together with the UK General Data Protection Regulation and the Data Protection Act 2018.

3.2 Under PECR, we may only store information on your device, or access information already stored on it, if:

• (a) it is strictly necessary to provide the service you have requested; or
• (b) you have given your consent.

3.3 Strictly necessary means necessary for the service to function: keeping you signed in, or protecting a form against cross-site request forgery. It does not include cookies that are merely useful to us, and it does not include analytics. The ICO has been explicit that analytics cookies are not strictly necessary.

3.4 Every cookie we set falls within the strictly necessary exemption in Regulation 6(4). That is why we do not ask for consent, not because we have decided consent is unnecessary, but because we set nothing that requires it.

3.5 Consent is not available to us as a shortcut in either direction. If we introduce a cookie that is not strictly necessary, PECR requires consent before it is set, and legitimate interests is not an alternative basis.

4.1 All of the cookies below are strictly necessary. None can be disabled without breaking the service, and none requires consent.

4.2 The greyed rows above have not yet been verified against a signed-in session. The public website sets no cookies at all; those two session cookies are expected on the authenticated application and must be confirmed (along with any load-balancing, routing or authentication cookie not listed) before this policy is treated as settled.

4.3 Where you hold an account with us, we also use your browser's local storage to keep you signed in and to hold the state of the product between page loads. Clause 2.2 brings that within the meaning of "cookies" for this policy, and PECR regulation 6 applies to it in the same way. Each item below is strictly necessary, none is used for analytics, profiling or advertising, and none is read by a third party.

4.4 Local storage is not sent to our servers automatically the way a cookie is. It stays in your browser until you sign out or clear site data for this domain, and clearing site data removes all of it.

4.5 Stripe. We use Stripe to process payments. Stripe sets its own cookies for payment processing and fraud prevention when you reach a payment page. Those cookies are necessary to take payment securely and to prevent fraudulent transactions. Stripe's cookie notice is at stripe.com/legal/cookies-policy. Whether Stripe scripts load on every page or only at checkout is being confirmed. If they load site-wide, the fraud-prevention cookies may fall outside the strictly necessary exemption on pages where no payment is possible, and that would require consent.

5.1 We do not use:

• Analytics cookies: no Google Analytics, no PostHog, no product analytics of any kind
• Advertising or remarketing cookies: no Google Ads, no Meta pixel, no LinkedIn Insight Tag
• Social media tracking pixels
• Cross-site tracking or data brokering of any kind

5.2 We do not sell or share personal data for advertising purposes.

5.3 This position was checked against the deployed site on 24 August 2026: no cookie was set on a first request, and no analytics, tag manager, advertising or consent-platform script was present in any deployed bundle. Clause 8.2 sets out how often that check is repeated.

5.4 Providers that receive data from our servers rather than from your browser set nothing on your device and so fall outside a cookie policy. They are covered by our Privacy Policy, which sets out the categories of recipient and how to obtain the named register. The two documents are updated together.

6.1 Do Not Track. The Do Not Track standard was never finalised and is no longer supported by major browsers. We do not respond to Do Not Track headers. As we set no tracking cookies, there is nothing for the signal to disable.

6.2 Global Privacy Control. We do not currently act on Global Privacy Control signals, for the same reason. If we introduce non-essential cookies we will reconsider this, and we will say so here.

6.3 The United Kingdom does not currently give Global Privacy Control binding legal effect: neither PECR nor the UK GDPR requires a site to recognise it. That is why this clause describes our position rather than asserting a legal obligation.

7.1 You can control cookies through your browser settings, including deleting existing cookies and blocking future ones.

7.2 Blocking the cookies listed in clause 4 will prevent you from signing in, because they are what maintains your session. Clearing site data for this domain also clears the local storage in clause 4.3, which will sign you out and lose any unfinished onboarding progress. Blocking cookies from other sites will not affect AIPTx.

7.3 Guidance for common browsers:

7.4 We do not list advertising opt-out links here. Those links are only meaningful for sites running the corresponding advertising scripts, and as clause 5.1 records, we run none.

8.1 If we introduce any cookie that is not strictly necessary (analytics, advertising or otherwise), we will:

• (a) update this policy before the cookie is set;
• (b) implement a consent mechanism that meets the UK GDPR standard, offering rejection as prominently as acceptance, with no category pre-selected;
• (c) record what was consented to, when, and the version of this policy in force, so that consent can be demonstrated under Article 7(1) of the UK GDPR; and
• (d) not set the cookie for any visitor who has not consented.

8.2 We review the cookies actually set by our website and application against this policy at least every 6 months, and whenever we add or change a third-party service. Where a review finds a cookie not listed here, we correct this policy and, if the cookie is not strictly necessary, remove it or seek consent before it is set again.

9.1 We may update this policy to reflect changes to the cookies we use or to the law.

9.2 Material changes are notified on this page, and where clause 8.1 applies, before the change takes effect.

9.3 Previous versions and effective dates are recorded in the version history at the foot of this policy.

Questions about this policy

• Email: [email protected]
• Data protection: [email protected]

Registered office

• 167-169 Great Portland Street
• Fifth Floor
• London, W1W 5PF
• United Kingdom

Registered in England and Wales.

Complaints

You may complain to the Information Commissioner's Office about our use of cookies.

• Information Commissioner's Office
• Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Telephone: 0303 123 1113
• ico.org.uk