Cookie Policy

Last updated 14 September 2026

Change your cookie settings

Summary of key points

This summary is provided for convenience. It does not replace the detailed sections below.

• We use cookies and similar technologies on our website (www.healthnarrator.com) and in our application (app.healthnarrator.com).
• Nothing beyond the necessary category runs without your permission. Statistics and marketing cookies are blocked until you give consent through our cookie banner. You can change or withdraw your choice at any time using the Change your cookie settings button on this page, or from the Cookie Declaration below.
• We never share clinical or case data with advertisers. Patient records, consultation recordings, transcripts, chronologies and other case material are never shared with marketing or statistics providers, and marketing technologies never run inside our application. See Section 11.
• One of our statistics tools stores nothing on your device at all, and runs alongside Google Analytics, which runs only with your consent.
• Our marketing partners are Google and LinkedIn. If you consent, these providers set cookies that let us measure our advertising and show relevant ads to people who have visited our website. Both act as independent controllers of the data they collect.
• We identify visiting organisations, not individuals. With your consent, we use a service that tells us which business a visitor came from, so that our team can follow up. It does not identify you personally.
• Your rights depend on where you are. We explain your rights and how to complain in the UK, EEA, Switzerland and the United States in Section 15.

---

Table of contents

1. About this policy and who we are
2. What this policy covers
3. What cookies and similar technologies are
4. How we categorise cookies
5. Your consent and how to change it
6. Necessary cookies and technologies
7. Statistics
8. Marketing
9. Cookies and storage in the Health Narrator application
10. Third parties who set cookies through our services
11. Our commitments on clinical and case data
12. International transfers
13. How long cookies last and how long we keep consent records
14. Controlling cookies through your browser and the platforms
15. Your rights and how to complain
16. Changes to this policy
17. Contact us

---

1. About this policy and who we are

This Cookie Policy explains how Health Narrator Limited ("Health Narrator", "we", "us", "our") uses cookies and similar technologies, what choices you have, and how to exercise them.

Health Narrator Limited is a company registered in England and Wales under company number 15481701, with its registered office at Hammer Tower, Penshurst Road, Penshurst, Tonbridge, England, TN11 8HZ. We are registered with the UK Information Commissioner's Office under registration number ZB659767.

For the purposes of UK and EU data protection law, Health Narrator Limited is the controller of the personal data described in this policy, except where we state that a third party acts as an independent controller of data it collects through its own technologies (see Section 10).

This policy should be read together with our Privacy Policy and our Terms of Use. Where this policy uses a term defined in our Privacy Policy, that definition applies here.

2. What this policy covers

This policy applies to:

• our website at www.healthnarrator.com, including all pages and subpages; and
• the Health Narrator application at app.healthnarrator.com (the "Application").

The website and the Application are treated separately throughout this policy, because they use different technologies for different purposes. In particular, we do not run any marketing technologies inside the Application.

This policy does not apply to third-party websites we link to. If you follow a link from our website to an external service — for example to book a meeting through our scheduling provider, or to our profiles on social platforms — that service's own cookie and privacy policies apply to your visit.

3. What cookies and similar technologies are

Cookies are small text files that can be used by websites to make a user's experience more efficient.

The law states that we can store cookies on your device if they are strictly necessary for the operation of this site. For all other types of cookies we need your permission.

This site uses different types of cookies. Some cookies are placed by third party services that appear on our pages.

You can at any time change or withdraw your consent from the Cookie Declaration on our website.

We also use other technologies that work in a similar way to cookies. These are covered by the same rules and the same consent choices:

• Local storage, session storage and IndexedDB — data stored in your browser by a website or application, which may persist between visits. Our Application relies on these rather than on traditional cookies.
• Pixels and tracking images — small image files (sometimes called web beacons or tracking GIFs) embedded in a page. When the image loads, it tells the provider that the page was viewed. One of our marketing providers includes a pixel that operates where JavaScript is disabled in your browser.
• Tags and software development kits — code included in our pages that allows a third-party service to run.

Where this policy refers to "cookies", it means all of these technologies unless we say otherwise. In the UK and the EEA, the rules on consent — the Privacy and Electronic Communications Regulations 2003 in the UK, and national laws implementing the ePrivacy Directive in the EEA — apply to any storage of information on, or access to information already stored on, your device, not only to cookies.

4. How we categorise cookies

We use the following categories. You control every category except Necessary.

We do not currently use any Preferences cookies on our website. The category appears so that your choice is recorded if we introduce one. Storage used inside the Application to remember your in-product preferences is described separately in Section 9.

Our Cookie Declaration

The declaration below lists every cookie currently in use on our website — its name, provider, purpose, type and duration — and is updated automatically each time our website is scanned. It also shows the consent you have given and lets you change or withdraw it at any time.

The sections that follow explain what the main cookies do and why we use them. Where the declaration and the tables in this policy differ — for example because a provider has changed a cookie's duration — the declaration reflects what is currently set on your device. The declaration covers our website; storage used inside the Application is described in Section 9.

5. Your consent and how to change it

We manage consent using Cookiebot, a consent management platform provided by Cybot A/S (part of Usercentrics).

Before you choose. When you first visit our website, a banner asks how you want us to handle cookies beyond the Necessary category. Until you make a choice, only Necessary cookies operate. No statistics or marketing cookies are set, no marketing pixels load, and our marketing providers receive no information about your visit.

Making your choice. You can accept all categories, reject all categories beyond Necessary, or choose category by category. Rejecting is as easy as accepting — both options appear with equal prominence on the first layer of the banner. We do not use pre-ticked boxes, and we do not treat continued browsing, scrolling or closing the banner as consent. Access to our website is not conditional on you accepting cookies.

Changing your mind. You can withdraw or change your consent at any time, and it is as easy to withdraw as it was to give. Use the Change your cookie settings button at the top of this page, or the Cookie Declaration below, to reopen your choices and change them. You can reach this page from the Cookie Policy link in the footer of any page. Withdrawing consent stops further processing but does not affect processing that took place before you withdrew.

How long your choice lasts. We remember your choice for up to 12 months, after which we ask again. We also ask again if we materially change how we use cookies — for example if we add a new provider or a new purpose.

Records of consent. So that we can demonstrate compliance with our obligations under Article 7(1) of the UK GDPR and EU GDPR, our consent platform records the choices you made, the date and time, the web address where you gave consent, your browser type, an anonymous encrypted key, and your IP address in anonymised form. The record does not contain your name, email address or any other directly identifying information. Please state your consent ID and date when you contact us regarding your consent.

Google Consent Mode. Our tags are managed through Google Tag Manager (container GTM-N9G5LNZF) and are configured so that consent signals default to "denied" before any Google tag loads. If you consent, the signals are updated accordingly. This applies to all four signals used by Google: ad_storage, ad_user_data, ad_personalization and analytics_storage.

Global Privacy Control. Where your browser or an extension sends a Global Privacy Control (GPC) signal, our consent platform recognises it and treats it as an opt-out of marketing and of any sharing of personal information for cross-context behavioural advertising.

6. Necessary cookies and technologies

These operate at all times and cannot be switched off through our banner, because our services cannot be provided without them.

Our contact form. Submissions from our contact form are processed by Formspree Inc. Formspree does not set cookies on our website; it receives the information you choose to submit to us. We retain contact form submissions for two years from your last contact with us, unless you become a customer, in which case retention follows our Privacy Policy.

Fonts. Typefaces used on our website are served from our own domain. We do not load fonts from a third-party font service, so no font provider receives your IP address when you visit us.

7. Statistics

Statistics cookies — often called analytics cookies — help us understand how our website and Application are used so that we can improve them.

7.1 Plausible Analytics — no consent required

We use Plausible Analytics to understand, in aggregate, how many people visit our website and which pages they read.

Plausible is materially different from most analytics tools:

• it sets no cookies and stores nothing on your device — no cookies, no local storage, no device identifiers;
• it does not track you across websites and does not build a profile of you;
• it does not store your IP address; and
• it is hosted in the European Union, so no analytics data about your visit is transferred outside the EEA.

Because Plausible stores nothing on, and accesses nothing already stored on, your device, the consent requirement under the UK's PECR and the EU ePrivacy rules is not engaged, and it does not appear in our Cookie Declaration. To the extent any personal data is processed transiently in producing aggregate statistics, we rely on our legitimate interests (Article 6(1)(f) UK GDPR / EU GDPR) in understanding and improving our website. You may object to this processing at any time using the contact details in Section 17.

7.2 Google Analytics — consent required

We use Google Analytics 4 (measurement ID G-PNG45FYFVM) on our website to understand how visitors find and use our pages. Google Analytics runs only if you consent to statistics cookies.

These cookies contain a randomly generated identifier for your browser. Reports available to us are aggregated, and we do not use Google Analytics to identify you by name or contact details. Browsers may shorten these lifetimes in practice: Chrome caps cookie lifetime at 400 days without a return visit, and Safari limits script-set cookies to 7 days.

Legal basis: consent (Article 6(1)(a) UK GDPR / EU GDPR, and PECR regulation 6 / national ePrivacy rules).

7.3 Microsoft Clarity — Application only, consent required

We use Microsoft Clarity inside the Application to understand how our product is used so that we can improve it. Clarity does not run on our website, and it is not covered by the website cookie banner: consent for Clarity is requested and managed within the Application itself.

Clarity operates only where a user of the Application has consented to it. We pass that consent to Microsoft using Microsoft's consent signals, and Clarity's default state is "denied". For users in the UK, EEA and Switzerland, Clarity sets no cookies until valid consent is received, and deletes any existing Clarity cookies if consent is refused.

Clarity is configured with masking enabled, so that text content and form inputs are masked. It is not used to capture the content of medical records, transcripts, chronologies or any other clinical or case material — see Section 11.

Data collected through Clarity is retained until you change your consent, or until your data is deleted in line with the retention periods set out in our Privacy Policy. Microsoft treats consent as valid for up to nine months, after which we ask again.

Legal basis: consent (Article 6(1)(a) UK GDPR / EU GDPR, and PECR regulation 6 / national ePrivacy rules).

8. Marketing

If — and only if — you consent to marketing cookies, we use technologies from Google and LinkedIn on our website. These let us measure whether our advertising works, and show our advertising to people who have already visited us.

We use these technologies to reach a professional audience: clinicians, medico-legal practitioners, solicitors and healthcare organisations. We do not target advertising on the basis of health conditions, and we do not use special category data for advertising.

Our marketing tags are deployed through Google Tag Manager (container GTM-N9G5LNZF), which is a container for tags and does not itself set cookies or collect personal data.

8.1 Google Ads

We use Google Ads conversion tracking and remarketing (advertiser ID AW-18430123593) to measure campaign performance and to show our advertising to people who have visited our website.

Google acts as an independent controller for the data it collects through these technologies. See Google's Privacy Policy and how Google uses information from sites that use its services.

8.2 LinkedIn Insight Tag

We use the LinkedIn Insight Tag (partner ID 9668330) for conversion tracking, retargeting through Matched Audiences, and Website Demographics, which gives us aggregated information about the professional characteristics of our website visitors — for example their industry or job function. Website Demographics reports are aggregated and do not identify individual visitors to us.

The Insight Tag also includes a tracking pixel that operates where JavaScript is disabled in your browser (px.ads.linkedin.com). This pixel is subject to the same consent requirement and does not load unless you have consented.

LinkedIn Ireland Unlimited Company is the controller of the personal data of visitors in the UK, EEA and Switzerland collected through the Insight Tag, and acts as an independent controller for its own purposes. See LinkedIn's Cookie Policy and LinkedIn's Privacy Policy. LinkedIn members can control the use of their data for advertising in their LinkedIn advertising preferences.

Legal basis for all marketing technologies: consent (Article 6(1)(a) UK GDPR / EU GDPR, and PECR regulation 6 / national ePrivacy rules).

8.3 Audience matching using business contact details

In addition to the cookie-based marketing described above, we may provide business contact details — such as a work email address, in a hashed and irreversible form — to Google or LinkedIn so that we can show our advertising to a defined professional audience, or exclude an audience from a campaign. This is separate from cookies and does not depend on your visit to our website.

We use only business contact details for this purpose. We do not use patient or case data, and we never provide clinical content of any kind to an advertising platform. The lawful basis for this processing, and how to object to it, are explained in our Privacy Policy.

8.4 Website visitor identification

We use Apollo.io to identify the organisation associated with a visit to our website, so that our team can prioritise follow-up with businesses that have shown an interest in us. Apollo's script sets a first-party cookie and stores data in your browser's local storage, and matches technical information about your visit — including your IP address — against Apollo's database of business information.

We identify organisations only. Apollo also offers a feature that identifies individual people rather than organisations. We have not enabled it, and we do not use it for visitors anywhere, including in the UK, EEA, Switzerland and the United States. This technology tells us that someone at a given organisation visited our website. It does not tell us who you are.

This technology runs only where you have consented to marketing cookies. Apollo processes information about your visit on our behalf in order to provide this service, and separately operates its own database of business information, of which it is the controller. See Apollo's Privacy Policy.

Legal basis: consent (Article 6(1)(a) UK GDPR / EU GDPR, and PECR regulation 6 / national ePrivacy rules) for the storage of and access to information on your device, and our legitimate interests (Article 6(1)(f)) in identifying organisations that may have an interest in our services.

8.5 Technology we plan to introduce

We will update this policy, and seek consent again, before the following goes live:

• Server-side measurement. We plan to send conversion measurements to Google and LinkedIn from our own servers, rather than only from your browser, using a subdomain of healthnarrator.com. Server-side measurement can set cookies with longer lifetimes than browser-set cookies. It remains subject to the same consent requirement: if you have not consented to marketing, no measurement is sent.

9. Cookies and storage in the Health Narrator application

The Application is a professional tool used by clinicians and legal practitioners, and it is treated differently from our website:

• No marketing technologies run in the Application. Google Ads, the LinkedIn Insight Tag and visitor identification operate only on www.healthnarrator.com.
• The only statistics technology in the Application is Microsoft Clarity, described in Section 7.3, which runs only with your consent, requested within the Application itself.

Apart from the Clarity cookies described above, the Application does not use traditional browser cookies. It uses browser local storage, session storage and IndexedDB to operate the service, keep you signed in, and remember your preferences.

9.1 Authentication — necessary

We use Google Firebase Authentication to sign you in. Firebase stores your authentication session — including your user identifier and security tokens (an ID token and a refresh token) — in your browser's IndexedDB, with local storage as a fallback. This is required to keep you securely signed in between page loads and visits. Without it, you could not use the Application.

Stored by Google Firebase; see Google's Privacy Policy. This data persists until you sign out or clear your browser storage.

9.2 Service operation — necessary

9.3 Preferences

These remember choices you have already made inside the Application, so that it behaves consistently for you. They contain no marketing or tracking identifiers and are set only for signed-in users.

9.4 Managing storage in the Application

Other than Microsoft Clarity, which you control through your consent choice in the Application, these technologies are essential to how the Application works and cannot be disabled while using it. You can clear all stored data at any time through your browser's settings — typically under "Clear browsing data" and then "Cookies and other site data" — though doing so will sign you out and reset your preferences.

10. Third parties who set cookies or storage through our services

Where a provider is described as an independent controller, it determines how it uses the data it collects, and its own privacy policy governs that use. Where a provider is a processor, it acts only on our instructions under a written data processing agreement.

11. Our commitments on clinical and case data

Because of the nature of our work, we make the following commitments explicitly:

1. No patient or case data is ever shared with marketing or statistics providers. Medical records, consultation recordings, transcripts, chronologies, reports and any other clinical or case material uploaded to or generated within the Application are never transmitted to Google, LinkedIn, Microsoft or any advertising provider.
2. Marketing technologies never run inside the Application. They operate only on our website.
3. We do not target advertising on the basis of health information. We do not use special category data as defined in Article 9 of the UK GDPR and EU GDPR for advertising, and we do not target our advertising by health condition, diagnosis, or any inference about a person's health.
4. Product analytics are masked. Microsoft Clarity is configured so that text and form inputs are masked, so that clinical content is not captured.

Where we use business contact details to reach a professional audience, as described in Section 8.3, those details are business contact information only. No clinical or case data is used for that purpose, and the visitor identification described in Section 8.4 operates only on our website, never within the Application.

12. International transfers

Some of the providers described in this policy are located outside the UK, the EEA and Switzerland, principally in the United States. This applies to Google, LinkedIn, Microsoft, Netlify, Formspree and Apollo.

Where personal data is transferred outside the UK, EEA or Switzerland, we rely on one or more of the following safeguards:

• adequacy — where the receiving country, or a certification framework covering the recipient, has been recognised as providing an adequate level of protection, including the EU–US Data Privacy Framework, its UK Extension, and the Swiss–US Data Privacy Framework, where the recipient is certified;
• the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, for transfers from the UK;
• the EU Standard Contractual Clauses for transfers from the EEA; and
• the Standard Contractual Clauses as recognised by the Swiss Federal Data Protection and Information Commissioner for transfers from Switzerland.

Our website analytics provider and our consent platform host data in the European Union, so data held by those providers does not leave the EEA.

You can request further information about the safeguards applying to a specific transfer using the contact details in Section 17.

13. How long cookies last and how long we keep consent records

The duration of each cookie is set out in the tables above. Durations are set by the provider and may change; we review this policy and the technologies in use at least annually, and whenever we add or remove a provider.

Session cookies and session storage are cleared when you close your browser or tab. Persistent cookies and local storage remain until they expire or until you delete them.

We keep records of consent for 24 months from the date consent is given or withdrawn, so that we can demonstrate that consent was validly obtained, and then delete them.

14. Controlling cookies through your browser and the platforms

Our banner and the Cookie Declaration on this page are the simplest way to control cookies on our services. You can also:

Use your browser settings to block or delete cookies. Most browsers let you refuse all cookies, refuse third-party cookies only, or delete cookies already stored. Blocking all cookies may prevent parts of our website and Application from working, including our ability to remember your cookie preferences.

• Google Chrome
• Safari
• Mozilla Firefox
• Microsoft Edge

Use platform controls:

• Google Ads Settings
• LinkedIn advertising preferences
• Microsoft advertising opt-out
• Your Online Choices (UK and EU) and YourAdChoices (US)

Send a Global Privacy Control signal. If your browser or an extension sends a GPC signal, we honour it as an opt-out of marketing.

15. Your rights and how to complain

15.1 United Kingdom and EEA

You have the right to access your personal data; to have inaccurate data corrected; to have data erased; to restrict or object to processing; to data portability; and to withdraw consent at any time. To exercise any of these rights, contact us using the details in Section 17. Please state your consent ID and date when you contact us regarding your consent.

If you are unhappy with how we have handled your personal data, you can complain to a supervisory authority:

• United Kingdom: the Information Commissioner's Office, ico.org.uk, telephone 0303 123 1113.
• EEA: the data protection authority in the country where you live or work, or where you believe the issue arose. A list is maintained by the European Data Protection Board.

We would be grateful for the chance to address your concerns before you approach a supervisory authority, so please do contact us first if you are willing to.

15.2 Switzerland

If you are in Switzerland, the Swiss Federal Act on Data Protection gives you rights of access, correction and deletion, and the right to object to processing. You may raise a concern with the Federal Data Protection and Information Commissioner.

15.3 United States

If you are a resident of California or another US state with comprehensive privacy legislation, you may have the right to know what personal information we collect, to request its deletion or correction, and to opt out of the "sale" or "sharing" of personal information for cross-context behavioural advertising.

Our use of marketing technologies for remarketing, and the audience matching described in Section 8.3, may constitute "sharing" under those laws. You can opt out by rejecting marketing cookies in our banner, through the Cookie Declaration on this page, or by sending a Global Privacy Control signal from your browser, which we honour automatically. We do not sell personal information for money, and we do not knowingly process the personal information of anyone under 16 for advertising purposes.

16. Changes to this policy

We review this policy at least annually, and whenever we add, remove or materially change a cookie, a similar technology, or a provider. When we make a change, we update the date at the top of this policy. Where the change is material, we ask for your consent again rather than relying on consent given previously.

17. Contact us

For any question about this policy, or to exercise your rights:

Health Narrator Limited
Hammer Tower, Penshurst Road, Penshurst, Tonbridge, England, TN11 8HZ
Email: hello@healthnarrator.com
Telephone: +44 20 3769 6368

ICO registration number: ZB659767