Към основното съдържание
MediSend
Open with codeRegister clinic
Open with code
← All review drafts
Archived draftNot effective

MediSend · 2026-10-12.review-1

Cookies and browser storage

Technologies for requested sign-in, security and preferences; no medical content in browser storage.

Draft date: Accepted versions remain unchanged.
Legal review required.

Draft for qualified Bulgarian/EU legal review. It is not effective and does not replace accepted documents. Reading it records no acceptance. Publication requires confirmed suppliers, retention periods and an approved notification and acceptance process.

Legal review required. Draft for qualified Bulgarian/EU legal review. It is not effective and does not replace accepted documents. Reading it records no acceptance. Publication requires confirmed suppliers, retention periods and an approved notification and acceptance process.

This earlier draft is preserved as written. It was not an accepted edition and has not been made effective.

Read draftRead current edition · v2026-09-02.2

1. Requested functions and choice

The reviewed code uses technologies for sign-in, security, a selected workflow and interface preferences. It introduces no advertising tags or optional analytics. This does not verify external production scripts, which require review before publication. Optional technologies require the applicable choice before loading and an easy withdrawal mechanism.

2. Protected cookies

The session cookie holds encrypted authentication until server-session expiry, normally up to 8 hours. Sign-in, MFA and linking challenges are short-lived, up to 10 minutes. Linked-session cookies retain independent authentication only until its actual expiry; they do not extend login. Devices use a random identifier with a bounded lifetime, normally up to 180 days.

Production security cookies are Secure, HttpOnly and host-scoped. Linking uses SameSite Strict. Recipient-access proofs last up to 12 hours and protected upload recovery up to 24 hours; server permissions may expire or be revoked sooner. Logout clears these proofs and pending connections. An invitation or individual offer may use a separate cookie for up to 90 days or until consumed.

Production names: __Host-medisend_session; __Host-medisend_device; __Host-medisend_mfa_challenge; __Host-medisend_login_challenge; __Host-medisend_assisted_signup; __Host-medisend_linked_challenge; __Host-medisend_linked_sessions; __Host-medisend_transfer_claim; and scope-specific __Host-medisend_transfer_upload_ cookies. These are technology identifiers, not values or secrets.

3. Local preferences

Local preferences may include language, pinned-handover identifiers, filters and sort order, last-read updates and limited aggregate article feedback. Upload recovery stores an opaque identifier, scope and expiry without the upload secret. Account or workspace changes are broadcast between tabs using a random signal without medical data.

These records contain no medical files, patient names, passwords or PINs. Preferences remain until cleared; temporary workflow records have expiry. Remove them using the browser’s site-data controls. Use an individual protected device profile on shared equipment.

4. External security and payment services

Turnstile is used where needed against automated abuse. Stripe opens for a selected payment or portal action. Sentry is limited technical diagnostics when enabled; this policy does not authorize session or content recording. Suppliers may process their technical signals; relevant roles and locations are confirmed in the register.

5. Controls

Cookies can be blocked or removed in your browser, but sign-in, linking, MFA and authorized public access may stop working. Contact [email protected] with questions. Verification of technologies actually loaded and their transfers is required before final approval of this draft.