Health Journal uses only the cookies needed to run the app securely and to process payments safely. We never use cookies for advertising, analytics, marketing, or cross-site profiling.
We keep things simple. The Health Journal App uses two kinds of cookies only: essential cookies that make the app work, and payment-security cookies set by our payment provider when you view a billing or sign-up page. We do not use advertising cookies, analytics cookies, marketing cookies, or any cookies for cross-site profiling.
1. What Are Cookies?
Cookies are small text files that a website or web application places on your device when you visit or use it. They are widely used to make sites and apps work, or to make them work more efficiently. Similar technologies, such as your browser's local storage and session storage, can also store small amounts of information on your device; where we use these we describe them in Section 5.
Cookies can be:
- Session cookies — temporary files that are deleted automatically when you close your browser.
- Persistent cookies — files that remain on your device for a set period of time, or until you delete them.
Cookies can also be:
- First-party cookies — set by Health Journal itself.
- Third-party cookies — set by another company whose service we use. The only third-party cookies you may receive through the app are payment-security cookies, described in Section 4.
2. How We Use Cookies
We use cookies for two purposes only:
- To enable the Health Journal App to function correctly and securely (for example, to keep you signed in and to protect against cross-site request forgery). These are strictly necessary cookies set by us.
- To process payments securely and prevent fraud, through our payment provider, Stripe. These load only on billing and sign-up pages. They are described in Section 4.
We do not use cookies for any of the following purposes:
- Tracking your behaviour across websites or apps for advertising or profiling.
- Targeted or behavioural advertising.
- Analytics or performance measurement, by us or by any third party.
- Social media integration or sharing.
- Any form of cross-site profiling.
3. Essential Cookies We Set
The table below lists the first-party cookies the Health Journal App sets to keep you signed in and to protect your account. These are set on the app domain and are marked Secure and HttpOnly.
| Cookie name | Purpose | Duration | Type |
|---|---|---|---|
refresh_token | Keeps you signed in and lets the app securely renew your session without asking you to log in again. It is rotated each time it is used and is cleared when you log out. | Up to 7 days | Strictly necessary |
csrf_token | Protects against cross-site request forgery attacks by confirming that requests to your account originate from the app. | Session (expires on browser close) | Strictly necessary |
We do not store your login (access) token in a cookie. It is held only in your browser's memory for the duration of your visit and is discarded when you close the tab.
4. Payment-Security Cookies (Stripe)
We use Stripe to process payments and to verify that new accounts are created by real people. Stripe is an independent payment provider and a third party. When you open a page that handles payment or card details — for example the sign-up card step or a billing page — Stripe's payment library loads and sets a small number of cookies to detect and prevent fraud. As part of this fraud check, Stripe may also load a bot-protection service (hCaptcha), which sets its own cookie.
These cookies are used only to take payments securely, verify that accounts are being created by real people, and help prevent fraud. They load only on payment and sign-up pages, not while you browse the rest of the app. We do not control the contents of these cookies, and they are not used for advertising, analytics, marketing, or profiling.
| Cookie name | Set by | Purpose | Duration |
|---|---|---|---|
__stripe_mid | Stripe (on the app domain) | Fraud prevention — identifies the device across sessions to detect suspicious payment activity. | Up to 1 year |
__stripe_sid | Stripe (on the app domain) | Fraud prevention — identifies the current session while a payment is in progress. | About 30 minutes |
m | Stripe (stripe.com) | Fraud prevention — helps Stripe distinguish humans from automated activity. | Up to 1 year |
__cf_bm | hCaptcha / Cloudflare (hcaptcha.com) | Bot protection used within Stripe's fraud-prevention check. | About 30 minutes |
For more information on how Stripe uses cookies and data, see Stripe's privacy policy at stripe.com/privacy and cookie information at stripe.com/legal/cookies-policy.
5. Local and Session Storage
In addition to cookies, the app stores a small amount of information in your browser's local storage and session storage. This information stays on your device, is not automatically sent to our servers, and is used only to make the app work and to remember your preferences.
| Item | Storage | Purpose | Duration |
|---|---|---|---|
| Language preference | Local storage | Remembers the language you have chosen. | Until you clear it |
| Display / theme preference | Local storage | Remembers whether you use light or dark mode. | Until you clear it |
| Reference-data cache | Local storage | Briefly caches the app's medical reference lists so pages load faster. | Refreshed every few minutes |
| Record summary cache | Session storage | Temporarily caches a summary of your own health record so the app is responsive while you navigate. Held only in this browser tab and cleared when you close it. | Up to 1 hour, or until the tab closes |
Clearing your browser's site data will remove these items, log you out, and reset your saved preferences.
6. What We Do Not Use
Beyond the essential and payment-security items described above, the Health Journal App does not load third-party content that sets cookies. In particular, we use:
- No advertising networks.
- No social media plugins or widgets.
- No third-party analytics platforms (such as Google Analytics).
- No embedded maps, videos, or other third-party embeds that carry cookies.
7. Legal Basis for Using Cookies
Under the UK Privacy and Electronic Communications Regulations (PECR) and the UK General Data Protection Regulation (UK GDPR), strictly necessary cookies are exempt from the requirement to obtain prior consent. This is because they are essential to deliver a service you have explicitly requested.
The essential cookies in Section 3 are required for the app to function. The payment-security cookies in Section 4 are required to take payments and prevent fraud when you choose to subscribe or verify your account. We therefore do not ask for consent to set them. We do not set any cookies for advertising, analytics, marketing, or profiling; if we ever introduce non-essential cookies, we will update this policy and put an appropriate consent mechanism in place first.
8. Managing and Deleting Cookies
Because the cookies we set are strictly necessary, disabling them through your browser may prevent the Health Journal App from functioning correctly, or from processing payments, or at all.
You can manage cookies through your browser settings. The following links provide guidance for the most commonly used browsers:
- Google Chrome — Settings > Privacy and security > Cookies and other site data
- Mozilla Firefox — Settings > Privacy & Security > Cookies and Site Data
- Apple Safari — Preferences > Privacy > Manage Website Data
- Microsoft Edge — Settings > Cookies and site permissions
Please note that clearing your cookies and site data will log you out of the Health Journal App and remove any stored preferences.
9. Changes to This Policy
We may update this Cookie Policy from time to time to reflect changes to the cookies and similar technologies we use, or for other operational, legal, or regulatory reasons. Any updates will be posted on our website with a revised effective date. We encourage you to review this policy periodically.
If we introduce any non-essential cookies in the future, we will update this policy and implement an appropriate consent mechanism before doing so.
10. Contact Us
If you have any questions about this Cookie Policy or about how we handle your personal data, please contact us at:
| Company name | I Own My Health Ltd |
| Address | its registered office address as recorded at Companies House |
| support@healthjournal.app | |
| Website | healthjournal.app |