Cookie Policy

A practical overview of the cookies and similar technologies that support Mediqa's website, booking flows, and reserved SaaS area.

Last updated: 5 May 2026. This version reflects a source-code review for cookies, local storage, analytics tags, and tracking scripts.

What this policy covers

This policy explains the cookies and equivalent browser technologies used by Mediqa on the public website, booking pages, authentication flows, and reserved SaaS area.

Technical cookies

The current codebase uses first-party technical cookies and equivalent technologies for login, session refresh, language preference, workspace and location scope, security, fraud prevention, demo/booking handoff, and reserved-area usability.

These tools are necessary or preference-based and do not require prior consent under the Italian cookie rules.
They are described here to satisfy the information requirement.

Analytics or marketing cookies

Mediqa can load Google Analytics 4, Google Tag Manager, and Meta Pixel only when the related public environment ID is configured and the visitor has given granular consent. Optional tags are blocked by default and are limited to public marketing pages.

Analytics and marketing choices are separate, initially disabled, and can be changed from the floating cookie preferences control.
Rejecting or closing the banner keeps all optional trackers disabled.
Google Tag Manager loads only when both analytics and marketing consent are accepted, unless the container is redesigned and documented for a narrower purpose.
Optional tags are not loaded on booking pages, authentication flows, the reserved workspace, admin pages, billing, contacts, leads, statistics, support, settings, or voice-operations areas.

Consent choices

When no optional tracking ID is configured, Mediqa uses only technical cookies and no optional-cookie banner is shown. When an optional analytics or marketing tool is configured, the banner appears before any optional script runs.

Scrolling, inactivity, preselected choices, or forced cookie walls must not be used as consent.
A consent banner must not be shown again at every visit unless processing changes, the prior choice cannot be read, or at least six months have passed.

Retention

Cookie duration depends on purpose: session cookies expire when the session ends, while persistent cookies remain only for the time needed to provide the related function or preference.

Third-party providers

Authentication, hosting, database, payment, telephony, email, voice AI, calendar, and security providers may process technical identifiers when their function is enabled. Supabase may set auth-session cookies; Stripe, Twilio, ElevenLabs, Google Calendar/Workspace, SMTP email, and rate-limit providers are used server-side or through explicit integration flows. Google Analytics, Google Tag Manager, and Meta Pixel are optional public-page tools and load only after the required consent.

Contacts

For questions about cookie handling, write to info@mediqa.it.

Technical cookie register

Name	Provider	Purpose	Duration
mediqa_locale	Mediqa	Stores the language preference and helps serve the correct localized interface.	12 months
mediqa_cookie_consent	Mediqa	Stores the visitor's analytics and marketing cookie choices and prevents the banner from being repeated on every visit.	180 days
inbound_ai_session or configured session cookie	Mediqa	Keeps authenticated users signed in to the reserved area. HttpOnly where set by the server.	30 days
inbound_ai_session_admin_workspace	Mediqa	Stores the selected workspace for platform-admin views.	30 days
inbound_ai_session_location_scope	Mediqa	Stores the selected location scope inside a customer workspace.	30 days
sb--auth-token / sb--refresh-token	Supabase	Manages authentication sessions when Supabase mode is active.	Managed by Supabase session settings

Optional analytics and marketing register

These tools are dormant unless their environment IDs are configured and the visitor gives the relevant consent.

Name	Provider	Purpose	Duration
_ga	Google Analytics	Distinguishes visitors on public marketing pages after analytics consent.	Default 2 years
_ga_<measurement-id>	Google Analytics	Persists analytics session state on public marketing pages after analytics consent.	Default 2 years
_fbp	Meta Pixel	Supports Meta advertising measurement and remarketing on public marketing pages after marketing consent.	Typically up to 90 days; verify after production scan
_fbc	Meta Pixel	Stores the Meta click identifier when a visitor arrives with a Meta ad click parameter and marketing consent is active.	Typically up to 90 days; verify after production scan
Tags inside GTM container	Google Tag Manager / configured tag vendors	Google Tag Manager is a container. Any cookie depends on the tags configured inside it and must remain consent-gated and documented before activation.	Depends on the contained tag

Equivalent storage register

Name	Storage	Purpose	Duration
mediqa.demo-request.last-id	Mediqa sessionStorage	Keeps the last demo request reference visible during the current browser session.	Browser session
mediqa.demo.scenario.v1	Mediqa sessionStorage	Transfers the lost-calls calculator scenario to the demo request flow.	Browser session or until the demo form clears it
mediqa.command-center.recents.v1	Mediqa localStorage	Stores recent reserved-area commands for faster navigation.	Until deleted by the user/browser

Book a demo