Cookie and Tracking Notice

Cookie and Tracking Notice

This notice explains what Suwa Care stores on your device when you use our website or apps, and which other services your browser connects to. It goes with our Privacy and Data Protection Notice. Words with capital letters have the meaning given in our Terms of Service.

1. In short

• We set a few cookies of our own: one remembers your language, and the others keep you signed in on the website. The payment and map services we use may set their own — section 7 lists them.
• We also use your browser's storage to make parts of the website work.
• We use no analytics, advertising, social media or session-recording tools.

2. What these words mean

A cookie is a small file a website saves in your browser. Local storage is similar but has no expiry: items stay until they are removed or you clear them. Session storage goes when you close the tab. Our apps use your phone's secure storage. Necessary below means the website cannot work without it. Items marked "Necessary: no" are conveniences: you can delete or block them at any time (section 10) and the website will still work.

3. The cookies we set

• NEXT_LOCALE — remembers the language you chose, and is set only when you choose one. Lasts 1 year. Necessary: no, but without it the website forgets your language.
• mcaccesstoken — keeps you signed in. Our server sets it when you sign in; the sign-in code inside it works for 15 minutes and is replaced while you keep using the website. Your browser sends it only to our server, and no script on the website can read it. Lasts 15 minutes. Necessary: yes.
• mcrefreshtoken — lets us renew your sign-in without asking for your password again. Our server sets it, your browser sends it only to our server, and no script on the website can read it. Lasts 7 days, or until you sign out. Necessary: yes.
• mc_session — tells the website that you may be signed in, so it can show your account straight away. It holds no sign-in code. Lasts 90 days, or until you sign out. Necessary: yes.

4. What we keep in your browser's local storage

• mc_visits — counts your visits, so we know when to offer the "install the app" message. Necessary: no.
• mcinstalldismissed — remembers that you closed that message. Necessary: no.
• mcaccountdeletion_requested (Doctors and staff only), followed by your user ID — remembers that you asked us to close your account, so we can keep showing that message. Necessary: no. We will take the user ID out of this item and clear it when you sign out. [[NOT YET BUILT: change to this stored item — must be done before publication]]

5. What we keep in session storage

Both are cleared when you close the tab.

• mcnavdepth — remembers how far into the website you have gone, so the back button takes you to the right page. Necessary: yes, for navigation.
• mcaccountclosed_message — shows the one-off message confirming that your account has been closed. Necessary: no.

6. Offline files

Our website saves a copy of its own pages on your device, so that it still opens if your connection drops. It never saves your account details, messages or health information. It has no fixed expiry, and clearing your site data removes it. Necessary: no.

7. Other services your browser connects to

• Our payment providers. The payment page loads the script of the provider that takes your money, PayHere for payments in LKR or Stripe for payments in USD, and you enter your card details with that provider, under its own privacy and cookie policies. Stripe's script may set its own cookies to help prevent fraud.
• Map images: maps come from OpenStreetMap (the OpenStreetMap Foundation, United Kingdom), through a worldwide network of servers. Your browser fetches them directly, so OpenStreetMap receives your IP address and the part of the map you are viewing.
• Calls: during a Consultation your browser connects to our own video and voice server, on servers we rent in France, in the European Union. It carries the call and is not used for tracking.
• Notifications: we do not send browser notifications today. If we offer them and you allow them, your browser registers with its own notification service (Google, Mozilla or Apple).
• We load no advertising or social media scripts, and our fonts come from our own website.

8. Our mobile apps

• Your sign-in details and a few app settings are kept in your phone's secure storage (the Keychain on iPhone, the Keystore on Android), and the apps contain no analytics, advertising or crash-reporting tools.
• Maps come from Google Maps on Android and Apple Maps on iPhone, and those companies' privacy policies apply to them.
• The app uses your location only while you are using it, and only if you allow it.
• The in-app payment screen comes from Stripe, whose privacy policy applies to it. The apps cannot take payments through PayHere yet; those are made on our website.

9. We do not track you

We use no analytics tools, advertising cookies, social media pixels, session recording or crash reporting, on our website or in our apps. Nothing we store follows you across other websites.

We do not show a cookie banner, because nothing we store is used for advertising or tracking and you can clear or block everything marked "Necessary: no" (section 10). We follow the Personal Data Protection Act No. 9 of 2022. Its main duties on organisations begin on 1 January 2027, and we will review this decision before then.

10. How to clear or block this, and what stops working

• Your browser settings let you delete or block cookies and site data for suwa.care, and a private window clears everything when you close it.
• If you clear cookies you are signed out; if you block cookies for suwa.care you cannot sign in to the website, because your sign-in is kept in them.
• If you delete the language cookie, the website will not remember your language.
• If you delete the visit counter or the dismissed-message flag, the "install the app" message may appear again.
• If you block session storage, the back button may take you to the wrong page; if you block the payment provider's script you cannot pay; if you block map images, maps will not appear.
• On a phone, sign out before deleting the app, so your sign-in details are removed. If you turn off the location permission, the "use my location" option stops working.

11. Changes, and how to contact us

If what we store changes, we will update this notice; the version and date are at the top. Questions: privacy@suwa.care or support@suwa.care.