Seven documents, each one written rather than assembled.

Almost nothing here is a cookie. Your preferences are kept in your browser's local storage, which never travels with a request, and your filters and search terms are kept in the address bar rather than stored at all. The page keeps the name Cookies because that is the address it is indexed under and the word people search for.

All of it is written through one storage layer rather than by each feature reaching for the browser directly, which is why this table can be complete rather than approximately complete.

There is no advertising network, no social media pixel, no remarketing tag and no cross-site identifier on these pages, and nothing on them is embedded from a third party that could set one. That is checkable rather than asserted, which is why clause 02 can be complete rather than approximately complete.

The heading says today on purpose. LabFlow expects to carry advertising, and the Android app already declares the advertising identifier permission for that reason — app permissions clause 05. So this clause describes a build instead of promising a future, and clause 04 explains why that distinction is the honest way to write it.

One part of it is not a description and does not move: no advertising or cross-site identifier is loaded on a signed-in clinical route. A page showing a patient's results is not a page that carries an advert.

Product measurement, where it is switched on, receives event names and route patterns only. It does not receive a patient identifier, an accession number, a result value, a free-text note or the contents of any record.

If a session-replay or heatmap tool is ever added, it will appear in the table in clause 02 and in the processor table in the privacy policy before it is switched on, and it will be blocked from every signed-in clinical route.

Why this is phrased as a commitment rather than as a denial. The tempting sentence here is "we do not record your session". It is easy to write, it is currently true, and it is exactly the sentence that turns into a lie the day somebody adds a heatmap tool and updates only the privacy policy. A cookies page and a privacy policy that disagree is the cheapest false statement a site can make, and it is almost always an accident of that shape. So both pages carry this paragraph, in the same words, and changing one without the other is visible.

Consent is required for storage that is not necessary for a service you asked for. Everything in clause 02 is either strictly necessary, meaning the sign-in session, or a preference you set yourself by using a control, meaning the appearance settings, or something you explicitly turned on, meaning push notifications. None of it is analytics or advertising placed without asking.

So there is nothing to consent to, and a banner would be theatre. If that ever stops being true, the banner arrives in the same change as the thing that made it necessary.

The theme control in the header resets every appearance setting in one action. Your browser's own site-data controls clear the rest, and revoking notification permission removes the push subscription.

What you lose by clearing it: the site goes back to its default appearance and you are signed out. No laboratory data is stored in your browser, so nothing you have entered into LabFlow is affected by clearing site data on any device.

Both signals are honoured. Today honouring them changes nothing you would notice, because clause 03 is what it is: nothing here follows you off this site, so there is no cross-site profile for a signal to switch off. They are named so that a reader can hold us to them when the table in clause 02 grows — and clause 03 says plainly that advertising is expected, so when is the right word there rather than if.