Cookie Policy

This Cookie Policy explains the cookies and similar technologies used on our public website (vitrae.health) and within the Vitrae HMS application. It sits alongside our Privacy Policy, which explains how we handle personal data more generally.

We treat browser storage — cookies, localStorage and equivalents — the same way throughout this policy. What matters is that information is stored on or read from your device, not the particular mechanism used.

A small number of items are strictly necessary: without them the Service cannot do what you have asked it to do. These are set without consent because there is no version of a working sign-in that does not use them, and they are never used for analytics or advertising.

• vitrae_refresh — an HttpOnly session cookie that keeps you signed in to Vitrae HMS and allows your session to be renewed without re-entering your password. Deleted when you sign out.
• vitrae_consent — a localStorage entry recording which cookie choice you made and the version of this notice you were shown. It exists so we do not ask you the same question on every page, and so we can prove what you were told when you answered.
• Theme preference — remembers light or dark mode on the public website.

The following applies only if you chose "Accept all cookies". If you chose "Accept necessary cookies only", nothing described in this section happens and no record of your visit is created.

When you accept, we record each page you open on our public marketing website — the landing page, blog, careers, help, documentation and legal pages. We do not record your activity inside the authenticated hospital application: your work in Vitrae HMS is clinical activity governed by our Privacy Policy and our agreement with your hospital, and it is never treated as website analytics.

• vitrae_visitor_key — a random identifier stored in your browser, created only at the moment you accept, which lets us group your page views into a visit. It is not linked to your name, email address or any account, and it means nothing outside our visitor records.
• Page address, the page that referred you, your browser language and time zone, and a broad device category (desktop, mobile or tablet).
• Your approximate location, and — only if you separately allow it — your precise location. Section 4 explains both.

We use location data to understand which countries and cities our visitors come from, so we know where hospitals are looking for us. We do not use it to identify you individually, and we do not use it for advertising.

There are two separate steps, and you control each one independently.

• Approximate location from your IP address. If you accept optional cookies, our server sends your IP address to ipwho.is, a third-party geolocation provider, which returns the country, region and city associated with that address. This is accurate to a city at best and cannot identify a person or an address.
• Precise location from your device. Your browser will ask you separately for permission to share your exact coordinates. This is a distinct prompt from the cookie banner, and declining it is a complete answer: we simply record the visit with the approximate location instead. Nothing about the site changes if you refuse.

We do not store your full IP address against a visit. Before the record is saved, the address is truncated — the final block of an IPv4 address, or the final 80 bits of an IPv6 address, is set to zero. This is enough to distinguish one network from another if we need to investigate abuse, and not enough to identify the connection behind it.

The untruncated address is used only in the moment of the lookup described in section 4, and is not retained by us afterwards. ipwho.is processes it under its own privacy terms.

Visit records are deleted automatically 400 days after the visit. The period allows us to compare one year against the previous one; nothing is kept beyond it, and the deletion runs on a schedule rather than on request.

Your recorded cookie choice stays in your browser until you change it or clear your browser storage.

You can change your choice at any time using the "Cookie preferences" link at the foot of any page on our public website. Choosing necessary cookies only will immediately delete the visitor identifier from your browser, and no further visits will be recorded.

Changing your choice does not delete visits already recorded. If you want those removed, contact us using the details in our Privacy Policy and we will handle it as a data subject request.

You can also control or delete cookies through your browser settings. Blocking strictly necessary cookies will prevent you from signing in to Vitrae HMS; blocking the optional ones has no effect on how the site works.

We rely on your consent for everything described in sections 3 and 4, in line with the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive 2025. Strictly necessary cookies are set on the basis of our legitimate interest in providing a service you have asked for.

Consent is recorded against a version of this notice. If we materially change what we collect, the version changes and you will be asked again rather than carried over on an answer you gave to different wording.

We may update this Cookie Policy from time to time. The revised version will be posted on this page with an updated date, and where the change affects what we collect you will be asked for your choice again.