NewMissing Records Detection: flags every visit, provider, and date missing from the file. See how →
Home›Legal Center›Cookie Policy
Legal · Document 06

Cookie Policy

Every cookie and browser-storage key we set on medrecords.ai and workspace.medrecords.ai, named and explained. The list is short: sign-in, security, your preferences, analytics, and marketing, and none of it on the platform. Analytics and marketing cookies run on the marketing site only, on every visit.

Effective: September 23, 2026 Version 1.2

What cookies are, and how we approach them

Cookies are small files a website places on your device; "first-party" cookies are set by us, "third-party" cookies by services we use. Browsers also offer localStorage and sessionStorage (persistent and tab-scoped storage we use for interface preferences). This policy, issued by AI Health Studio LLC d/b/a Medrecords AI, covers all of them on medrecords.ai (the marketing site) and workspace.medrecords.ai (the platform).

2 rules govern everything below: marketing and analytics cookies run only on this public website, never on workspace.medrecords.ai, and no PHI or record content is ever placed in a cookie or browser storage, full stop. Both categories run on every visit to this public site; there is no on-site toggle. Use your browser’s own cookie controls to block or delete them.

Essential cookies — always on; the Services can't work without them

Name
Provider
Purpose
Expires
mr_session
Medrecords AI
Authenticates your platform session. HTTP-only, Secure, SameSite: holds a session identifier only, never PHI.
8h inactivity
mr_csrf
Medrecords AI
Protects forms and API calls against cross-site request forgery.
Session
mr_consent
Medrecords AI
Remembers your cookie choices so the banner doesn't re-ask.
12 months

Analytics cookies — every visit; marketing site only

Name
Provider
Purpose
Expires
_ga
Google Analytics 4
Distinguishes unique visitors to medrecords.ai. IP anonymization enabled; ad personalization signals disabled.
2 years
_ga_*
Google Analytics 4
Maintains session state for each measurement property receiving this site's pageviews.
2 years
ph_phc_*_posthog
PostHog
Anonymous visitor id for page analytics and session replays of this public site, with everything you type masked before it is stored. Mirrored in localStorage under the same name. US cloud; never used on the platform.
12 months

PostHog and Google Analytics 4 both run today. Cloudflare Web Analytics also counts page visits, and it sets no cookie.

Decline analytics and the site works identically. The platform at workspace.medrecords.ai carries no third-party analytics at all: usage metering there is first-party Service Data, described in the DPA.

Marketing cookies — every visit; never the platform

6 tools run today: the Meta Pixel, the LinkedIn Insight Tag, the TikTok Pixel, Google Ads, the Reddit Pixel and Snitcher, which tell us which ads and companies bring visitors to this site. Their cookies are named below with their provider, purpose, and lifetime. Anything we add later will be listed here before it goes live. Marketing runs on every visit, site-wide, rather than waiting for an opt-in.

Name
Provider
Purpose
Expires
_fbp
Meta (Facebook)
Anonymous browser id Meta uses to measure which ads bring visitors to this site. Set only on medrecords.ai, never on workspace.medrecords.ai, and never based on anything in a medical record.
3 months
_fbc
Meta (Facebook)
Stores the click id from a Meta ad so a later demo booking can be attributed to that ad. Written only when you arrive from a Meta ad link.
3 months
li_sugr
LinkedIn
Anonymous browser id LinkedIn uses to measure which ads bring visitors to this site.
3 months
bcookie / lidc
LinkedIn
Browser and routing ids the LinkedIn Insight Tag sets to attribute a demo booking to a LinkedIn ad.
1 year / 1 day
UserMatchHistory
LinkedIn
Syncs the anonymous browser id with LinkedIn so ad measurement works across sessions.
30 days
_rdt_uuid
Reddit
Anonymous browser id the Reddit Pixel sets to attribute a demo booking to a Reddit ad.
90 days
rdt_cid
Reddit
Click id carried over from a Reddit ad so the visit can be matched back to the ad that sent it.
90 days
_gcl_au
Google Ads
Attributes a demo booking to the Google ad that brought you here. Set by the Conversion Linker.
90 days
_ttp
TikTok
Measures whether a TikTok ad led to a visit or a booking.
13 months
Snitcher tracker
Snitcher
Identifies the company behind a visit from its IP address, for sales follow-up. Snitcher does not publish the specific cookie name(s) or lifetime it sets.
Not published

It runs across this public site, medrecords.ai, with no page excluded. It never runs on workspace.medrecords.ai, and it is never based on anything inside a medical record: no diagnosis, no document content, and nothing from a file you upload is ever sent to an advertising platform. We do not sell or share personal information, and nothing in a cookie identifies you by name.

Browser storage — site preferences and booking attribution

Key
Type
Purpose
Cleared
mr_src
localStorage
Stores a validated source-page label so a demo booking can be attributed. Only that label is forwarded to Cal.com; free-form query values are discarded.
30 days
mr_visitor
Cookie + localStorage
A random anonymous visitor id plus the first page, referrer, and campaign labels (utm_*, click ids) that brought you here, so a later demo booking or file test can be attributed to its channel. Readable by workspace.medrecords.ai so a signup can be tied to its source. Never contains PHI, a name, or contact details.
13 months
mr_visitor_id
Cookie
A compact copy of just the visitor id, for the same attribution purpose.
13 months
mr_ui_layout
localStorage
Remembers your 3-pane workspace layout (pane sizes and collapse states) so the workspace opens the way you left it.
When you clear it
mr_roi_inputs
localStorage
Keeps your ROI-calculator sliders (pages/month, rates) so estimates survive a reload. Never sent to us.
When you clear it
viewer state
sessionStorage
Tab-scoped document-viewer position and zoom during a review session.
Tab close

No record text, patient data, or PHI is ever written to cookies, localStorage, or sessionStorage. Record content renders from the encrypted platform session only.

Controlling cookies

  • Cookie notice: a short disclosure on your first visit. It tells you what runs; it does not gate anything, and there is no on-site toggle.
  • Ad platform controls: opt out of ad personalization directly with each provider: Meta, LinkedIn, Google, Reddit, and TikTok.
  • Browser controls: view, block, or delete cookies in Chrome, Firefox, Safari, or Edge. Blocking essential cookies will break sign-in.
  • Google Analytics opt-out: the GA opt-out browser add-on works across all sites using GA.

Updates & contact

If our cookie use changes, this page changes first, with a new effective date. Questions or deletion requests for cookie-collected data: [email protected]. This policy is part of the Privacy Notice.