NeuraVate Cookie Policy
- Essential-only by default
- Change your mind any time
- Every cookie listed
1. 1. What this policy covers
This Cookie Policy explains what cookies and similar technologies NeuraVate uses, why we use
them, and what choices you have. It applies to every NeuraVate web surface we run today: the
public NeuraVate website (www., including the legal pages you may be reading this on), the
patient web app (patient.), our sign-in service (auth.), and the public emergency
page your card or link opens (passport., /e/:token). It also covers the NeuraVate.ai app
for iPhone and Android, which sets no cookies but keeps a few items on your phone (Section 2).
If we open any other NeuraVate site or app, it is added here first.
Cookies are small text files a website stores on your device so it can recognise your
browser between requests. Similar technologies include browser storage (such as
sessionStorage and localStorage, and the Cache Storage a service worker uses). We list both.
This policy should be read together with the NeuraVate Privacy Policy (slug: privacy-policy),
which explains how we handle personal data generally.
2. 2. The complete inventory
The table below lists the cookies and similar storage NeuraVate uses today, verified against our own code. If we discover an item this table misses, we correct the table — we do not add trackers.
| Name / key | Set by | Type | Purpose | Duration |
|---|---|---|---|---|
AUTH_SESSION_ID |
Our sign-in service (Keycloak), on our authentication domain | Cookie — strictly necessary | Identifies your active sign-in session so authentication can complete and persist | Session (your sign-in session lifetime) |
KEYCLOAK_SESSION |
Our sign-in service (Keycloak), on our authentication domain | Cookie — strictly necessary | Tracks your single-sign-on session across NeuraVate surfaces | Session (your sign-in session lifetime) |
KEYCLOAK_IDENTITY |
Our sign-in service (Keycloak), on our authentication domain | Cookie — strictly necessary | Keeps you signed in between page loads without re-entering your password | Session (your sign-in session lifetime) |
KEYCLOAK_REMEMBER_ME |
Our sign-in service (Keycloak), on our authentication domain | Cookie — strictly necessary / functional | If you tick "remember me" at sign-in, remembers your username for the login form | Persistent until cleared or the option is unticked |
| Other Keycloak login-flow cookies | Our sign-in service (Keycloak), on our authentication domain | Cookie — strictly necessary | Short-lived cookies Keycloak sets transiently during the login flow, such as KC_RESTART (including legacy _LEGACY variants for older browsers) |
Login flow / session |
kc-callback-<random> |
Patient web app (our sign-in library, keycloak-js) | localStorage — strictly necessary, first-party (a cookie of the same name only if your browser blocks localStorage) |
Holds the one-time values that tie the sign-in page's answer to the request the app made (state, nonce and the PKCE code verifier), so nobody can complete a sign-in in your browser that you did not start. No health information | Removed when the sign-in completes; any left behind expire after one hour |
| Application access tokens | Patient web app | Browser memory only — not a cookie, not localStorage |
After sign-in, the tokens that authorise your requests are held in the running page's memory | Discarded when the tab or window is closed |
nv.passportDraft.<account id> |
Patient web app | sessionStorage — functional, first-party |
Keeps the passport edits you have not saved yet, on your own device, so they survive being sent through sign-in again in the middle of an edit. It can contain the health information you were typing; it is never sent anywhere until you press Save | Cleared when you save, when you sign out, and when the tab is closed |
nv-cookie-consent |
Public NeuraVate website | localStorage — strictly necessary / functional, first-party |
Records the choice you make in the cookie banner or on the Cookie Policy page, so we do not ask you again. It stores only your own four category switches; it is never sent to us and never used to identify or profile you | Until you clear your browser storage |
i18nextLng |
Public emergency page | localStorage — functional, first-party |
Remembers the language the emergency page was shown in, as a two-letter code, on the device that opened it. Nothing else | Until the browser storage is cleared |
/sw.js service worker and its nv-emergency-shell-<build> cache |
Public emergency page | Service worker and Cache Storage — functional, first-party | When the emergency page is opened in a browser that supports it, the page installs a small program (a service worker) that saves a copy of the page's own files — its HTML, script, styles, icons and app manifest — so the page opens quickly, can show its frame on a poor connection, and can be added to a home screen. The copy is the same for every visitor and holds no health information and nothing about you or about the person whose card was scanned: the emergency information is fetched from our servers each time the page opens, marked not to be stored, and is never written to this cache. Nothing in it is sent to us | Until a newer version of the page replaces it, or until the site data is cleared in the browser |
__cf_bm, cf_clearance, _cfuvid (and other __cf/cf_ security cookies) |
Cloudflare, acting as our service provider, on NeuraVate domains | Cookie — strictly necessary | Set only when Cloudflare is protecting our sites: screening for automated attacks or a security challenge (__cf_bm, cf_clearance) and applying rate limits fairly to visitors who share a network address (_cfuvid). Contains no health information and is not used to track you across sites |
__cf_bm 30 minutes; cf_clearance for the challenge-passage period in our Cloudflare settings (30 minutes by default); _cfuvid the browser session |
NeuraVate sets no cookies on the public emergency page (/e/:token). The page's requests to
our servers are made without credentials of any kind. The page keeps two things on the device that
opened it, both listed above: the language it was shown in (i18nextLng) and its service worker's
copy of the page's own files (nv-emergency-shell-). Neither holds health information, neither
identifies anyone, and neither is sent to us. A Cloudflare security cookie from the row above can appear there when Cloudflare is
protecting the site. A first responder scanning a card is never tracked by us.
Every item above is functional storage on a NeuraVate domain — it exists so a feature you use works or to keep the Service secure, not to track you. The Keycloak cookies are set by our own self-hosted sign-in service on our own domain, and sign-in cannot work without the session cookies. Apart from the Cloudflare security cookies, which Cloudflare sets for us as our service provider, no one but us sets or reads any of them.
In the NeuraVate.ai app. The app sets no cookies. It keeps the items below on your phone: the first four in your phone's secure storage (the iOS Keychain; on Android, storage encrypted with a key held in the Android Keystore), which other apps on your phone cannot read; on an iPhone, the first-open marker in the app's own storage on the phone, which deleting the app deletes; and, only while you save or share a picture of your QR code, the temporary file in the last row.
| Name / key | Type | Purpose | Duration |
|---|---|---|---|
auth_token, refresh_token, id_token |
Secure storage — strictly necessary; never carried over to another phone, and on an iPhone readable only while the phone is unlocked | The tokens that keep you signed in and authorise the app's requests to our servers | Until you sign out, until the app finds that your sign-in has ended, or until you delete the app (on an iPhone, until the app is next installed there and opens, when it deletes them before it uses any of them to sign anyone in or to show anything) |
user_data |
Secure storage — strictly necessary; as above | A summary of your account (your account ID, email address, name and account roles), so the app knows who is signed in | As above |
nv_offline_passport.meta and nv_offline_passport.c0, .c1 … |
Secure storage — functional; as above | A copy of your passport (your emergency profile, implants, emergency link and QR code, whether sharing is on, and when it was fetched), so that you can open it without a connection. It can contain your health information, and it never leaves your phone | Replaced each time your passport loads; deleted when you sign out, or when the app finds that your sign-in has ended; after you delete the app, as for the tokens |
nv_app_lock (in a version of the app that offers the app lock) |
Secure storage — functional; as above | Records only that you turned on the app lock, so that the app asks your phone to check that it is you before it shows its screens. It holds nothing else, and nothing biometric: your phone checks your face or fingerprint itself and tells the app only whether the check passed. It is never sent to us | Until you turn the lock off or sign out, or until the app finds that your sign-in has ended; after you delete the app, as for the tokens |
First-open marker nv_install_opened (iPhone only) |
Outside secure storage, in the app's own storage on an iPhone — strictly necessary | Records only that this installation of the app has been opened before, so that the first time it opens it deletes the items above that an earlier installation left in the iPhone Keychain, before it uses any of them to sign anyone in or to show anything. It holds nothing about you or your account, and it is never sent to us. The app keeps no such marker on Android, where deleting the app deletes what it kept | Until you delete the app, which deletes it; kept when you sign out |
neuravate-emergency-qr.png (in a version of the app that offers it) |
Temporary file — functional, in the app's cache on your phone, outside secure storage | A picture of your QR code (your emergency link and nothing else), made when you choose to save or share it, so that your phone's share sheet can take it. Nothing in it is sent to us | Deleted as soon as the share sheet closes; if the app is stopped while the share sheet is open, deleted the next time you save or share the picture or when you delete the app, and your phone may clear the app's cache before then |
Signing in from the app. The app opens our sign-in page in the sign-in window your phone provides, so the Keycloak cookies listed above are set there, not in the app. On an iPhone the app asks for a private window, which keeps no cookies once you finish. On Android the window is your browser (a Custom Tab), which keeps them as it would for any sign-in in that browser, for the durations listed above. The app asks our sign-in page to show its password form at every sign-in, so a sign-in cookie kept in that browser never signs anyone in to the app without the password.
3. 3. What we do not have
We state the following plainly because it is verified against our codebase, not aspirational:
- No analytics cookies. We use no product-analytics, measurement, or telemetry cookies.
- No advertising or tracking cookies. We do not advertise, retarget, or profile visitors, and we do not "sell" or "share" data for advertising in any sense.
- No third-party tracking cookies. Every cookie is set on a NeuraVate domain. The only cookies not set by us are Cloudflare's security cookies (Section 2), set for us as our service provider.
- No external fonts, pixels, or tag managers. Our web pages load no third-party fonts, tracking pixels or tag managers. Our sites are delivered through Cloudflare, so every request from your browser passes through Cloudflare's network on its way to us (see the Privacy Policy, section 8.3); an earlier version of this policy said no CDN was used and our pages made zero requests to third parties, which is no longer true and is withdrawn.
- No tracking in the app. The NeuraVate.ai app contains no analytics, advertising or tracking software, and it does not read your phone's advertising identifier.
Because every cookie we set is strictly necessary for a service you have expressly requested (signing in), the ePrivacy rules' consent requirement does not apply — strictly-necessary cookies are exempt. You are therefore not legally required to consent to anything on NeuraVate, and nothing you do or decline to do changes what we store.
About the banner on the public website. A first-visit cookie banner is shown on the public
NeuraVate website, and this section previously said the opposite ("that is why you do not see a
cookie banner"). Corrected 2026-08-31. The banner is not there because consent is required — by
the paragraph above it is not. It is there because we made a binding commitment (Section 4) that
no non-essential cookie will ever be set without prior opt-in, and the honest way to keep that
commitment is to have the control already built, already defaulting to essential-only, and
already recording a refusal, rather than to build it in the same release that first needs it. The
banner offers "Accept all", "Reject non-essential" and "Manage preferences" with equal prominence,
and the Analytics and Marketing categories it presents are empty — we set no cookie in either,
so both switches are inert today and are labelled as such. The only thing your choice actually
writes is the nv-cookie-consent record in Section 2. The patient web app and the emergency page
show no banner at all. If our use of cookies ever changes, Section 4 governs.
4. 4. Our binding commitment on future changes
If we ever propose to introduce a non-essential cookie or tracker — for example, optional product analytics such as PostHog, currently only a candidate under evaluation (no product analytics is adopted at GA; PostHog remains a candidate only, not integrated) — we commit that, before any such change ships:
- This policy will be updated first, with the new technology added to the inventory in Section 2, its purpose, provider, and duration stated.
- A prior-consent banner will be deployed, meeting the ePrivacy/GDPR standard: no non-essential cookie or tracker is set until you opt in, and rejecting is exactly as easy as accepting (equal-prominence buttons, no dark patterns, no consent walls).
- The public emergency scan page stays tracker-free permanently. Whatever we adopt
elsewhere,
/e/:tokenwill never carry analytics, advertising, or tracking, and will load nothing from any third-party domain. Like every NeuraVate page it is delivered through Cloudflare (Section 3). Emergency access is not a marketing surface.
6. 6. Changes to this policy
We will update this policy whenever our actual use of cookies or similar storage changes, and never later than the change itself (see the binding commitment in Section 4). The version identifier in the header changes with every revision. Material changes will be announced through the service.
7. 7. Contact
Questions about this policy or our use of cookies:
- Email: [email protected]
- Postal address: PairOx Pty Ltd, 4 Lorikeet Street, Glenwood NSW 2768, Australia
- Telephone: +61 402 614 311
- Operator: PairOx Pty Ltd (ABN 82 154 477 728, ACN 154 477 728), which operates the NeuraVate service
For how we handle personal data generally, including your data-protection rights, see the
NeuraVate Privacy Policy (slug: privacy-policy).
Questions about cookies or your privacy choices?