Cookie Policy
Last updated: August 16, 2026
§ 1. What are cookies
Cookies are small text files saved by the browser on the user's device when visiting websites. They contain information used, among other things, to ensure the proper operation of the site, analyze its usage and personalize content.
This policy also covers technologies that work the same way, namely the browser's local storage (localStorage) and tab storage (sessionStorage). The Service relies on them more than on cookies themselves, and the law treats them alike, because in each case information is stored on the user's device.
The legal basis is Art. 399 of the Polish Electronic Communications Law of 12 July 2024, which replaced Art. 173 of the repealed Telecommunications Law on 10 November 2024, and - with regard to personal data - Art. 6(1)(a) or (f) GDPR.
§ 2. Types of cookies
The Service uses the following categories of cookies:
Necessary
Entries required for the Service to work and to deliver a feature the user has asked for. These include your choice in the cookie banner (the cookie_consent key, without which we would ask for consent on every visit) and the state of the tools you use in the Service, such as ticked items in the clinic opening checklist.
Legal basis: Art. 399(3)(2) of the Electronic Communications Law (storage necessary to deliver a service requested by the user) and, for personal data, Art. 6(1)(f) GDPR. No consent required.
Analytics
Files used to analyze traffic in the Service and how users interact with it. They help us improve the site. We use Google Analytics.
Once this consent is given, we additionally store in the browser's tab storage the list of pages visited together with the time spent on each. The list is attached to the contact form if the user submits it and serves to prepare an answer to the inquiry. It disappears when the tab is closed and is not combined with Google Analytics data.
Legal basis: user consent given via the cookie banner.
Marketing
If you reached us from a Google ad, its address carries a click identifier (the gclid, gbraid or wbraid parameter). Once this consent is given, we store it in the browser's local storage for 90 days and attach it to a submitted form, so we know which campaign an inquiry came from. We show no ads in the Service, do not profile users and build no audiences on this basis. Without this consent the identifier is neither stored nor passed on anywhere.
Legal basis: user consent given via the cookie banner.
Full list of entries
Everything the Service stores on your device, by key name. Entries outside the “necessary” category are created only after the matching consent.
| Name | Type | Category | Set by | Duration |
|---|---|---|---|---|
cookie_consent | local storage | necessary | ZenMed | 12 months |
zenmed-open-checklist-v1 | local storage | necessary | ZenMed | until the user clears it |
zenmed-open-unlocked-v1 | local storage | necessary | ZenMed | until the user clears it |
zenmed-lang-hint-v1 | local storage | necessary | ZenMed | until the user clears it |
zm_journey | tab storage | analytics | ZenMed | until the tab is closed |
_ga | cookie | analytics | Google (Google Analytics 4) | 2 years |
_ga_* | cookie | analytics | Google (Google Analytics 4) | 2 years |
zm_click_id | local storage | marketing | ZenMed | 90 days |
_gcl_au | cookie | marketing | Google (Google Ads) | 90 days |
cookie_consent- Your choice in the cookie banner with its date and consent ID. Without it the banner would ask on every visit.zenmed-open-checklist-v1- Ticked items in the clinic opening checklist, i.e. the state of a tool the user asked for.zenmed-open-unlocked-v1- A note that the full checklist has already been unlocked on this device.zenmed-lang-hint-v1- A note that the hint about the other language version has already been dismissed or used on this device. Without it the same hint would come back on every visit. We store a date, not an identifier.zm_journey- The list of visited pages with time spent on each, attached to a submitted contact form._ga- Distinguishing users in traffic statistics._ga_*- Session state for a specific GA4 data stream.zm_click_id- Google ad click identifier (gclid, gbraid or wbraid), attached to a submitted form to match an inquiry to its campaign._gcl_au- Links an ad click to an event on the site on Google’s side. Created only after marketing consent, once the Google script is running.
Measurement with no device storage
The Service is delivered through the Cloudflare network, which runs its own traffic measurement (Cloudflare Web Analytics). It collects the visited page address, the referring address, browser type and load timings. We reviewed the script's code: it neither writes nor reads anything on your device - no cookies, no local storage, no tab storage. It also builds no identifier that could recognize you on a later visit or on another site.
That is why this measurement needs no consent and has no toggle in the banner: Art. 399 of the Electronic Communications Law covers storing information on a device, and none happens here. Processing of personal data (including the IP address, which we do not retain on our side) rests on legitimate interest: we want to know how our site performs and how fast it loads. You may object under Art. 21 GDPR at the address in § 6.
Legal basis: Art. 6(1)(f) GDPR. No consent required.
The Service uses no functional cookies - the language follows from the page address, not from an entry on the device. We also use no third-party advertising cookies or tracking pixels (Meta, LinkedIn, Hotjar and the like). The toggles in the banner match only what we actually store.
§ 3. Third-party cookies
The Service may use third-party cookies:
- Cloudflare (Cloudflare, Inc.) - the network delivering the Service and the traffic measurement described above, with no device storage. Privacy policy: cloudflare.com/privacypolicy
- Google Analytics (Google LLC) - for analytics purposes. Privacy policy: policies.google.com/privacy
These third parties may process data for their own purposes in accordance with their privacy policies.
Once marketing consent is given we pass a consent signal to Google (Consent Mode: ad_storage, ad_user_data, ad_personalization) so its advertising system can match a conversion to the campaign. Without that consent all three stay at “denied”. Analytics consent raises analytics_storage only.
The ad click identifier is stored by us, in our own browser storage; it is not a third-party cookie. Today it goes only into the content of a form submission. Should we start reporting conversions back to Google, we will describe it here before doing so.
§ 4. Retention period
Cookies are retained for a period appropriate to their purpose:
- Session cookies - deleted when the browser is closed,
- Persistent cookies - retained for a period specified in their parameters or until manually deleted by the user,
- Analytics cookies (GA4) - up to 26 months,
- List of visited pages - until the browser tab is closed,
- Ad click identifier - 90 days,
- Your choice in the banner - 12 months, after which we ask for consent again.
§ 5. Managing cookies
Users can manage their cookie preferences in two ways:
- Via the cookie banner - on the first visit to the Service, a banner appears allowing acceptance, rejection or customization of preferences. You can return to these settings at any time by clicking the "Cookies" link in the Service footer.
- Via browser settings - every browser allows you to manage cookies. Detailed instructions are available in your browser's documentation.
Blocking cookies may affect the functionality of the Service.
Every choice made in the banner is also recorded on our server as evidence of consent: date and time, the scope of consents, the banner text version, language, page address, a shortened IP address and browser type. Each record gets a random identifier, shown in the cookie settings panel, which you can quote when asking us about your consent. We store no e-mail address there and nothing that points directly at a person. Legal basis: Art. 7(1) in connection with Art. 5(2) GDPR (the duty to demonstrate consent). Records are kept for 24 months, longer than the 12-month validity of the consent itself.
§ 6. Contact
For matters relating to cookies, please contact: [email protected].
More information on personal data processing can be found in our Privacy Policy.