Cookie policy
Last updated 22 October 2026
Keystone uses a small number of cookies and browser storage items. We don't use advertising cookies. Google Analytics only runs if you click Accept.
What cookies are
Cookies are small files a website saves on your device. Browser storage works in a similar way. In this policy we call both "cookies".
What we use
| Name | Set by | What it's for | How long | Type |
|---|---|---|---|---|
| ks_consent | Keystone | Remembers your cookie choices | Until you clear your browser storage | Strictly necessary |
| ks_session_id | Keystone | A random ID for this visit, so our statistics can tell one visit from another. It can't identify you | Until you close the tab | Site statistics |
| ks_first_touch | Keystone | The site or campaign that first brought you to Keystone | 13 months, or until you switch statistics off | Site statistics |
| ksInternal | Keystone | Marks Keystone staff browsers so our own visits are left out of statistics | Staff browsers only | Strictly necessary |
| __Secure-ks_microsite_review | Keystone | Keeps your booking details while you review them on a clinic booking page | 20 minutes | Strictly necessary |
| __cf_bm, cf_clearance | Cloudflare | Set only if Cloudflare needs to check that you're a person and not a bot, to protect the site | 30 minutes by default | Strictly necessary |
| Vercel Web Analytics | Vercel | Counts page views without cookies or stored IDs | Not stored on your device | Site statistics |
| _ga, _ga_28HK89ML6P | Tells Google Analytics visitors apart | Up to 2 years | Google Analytics, only if you accept |
Keystone staff signing in to our admin pages also get sign-in cookies from Supabase and a saved-views setting. Patients never do.
How we ask for your consent
The law (the Privacy and Electronic Communications Regulations, or PECR) lets us use strictly necessary cookies without asking. Our own site statistics use the statistics exemption added by the Data (Use and Access) Act 2025, so they are on by default and you can switch them off at any time.
Google Analytics only runs if you click Accept. Refusing is as easy as accepting, and refusing doesn't stop you using Keystone.
Site statistics
Our own statistics and Vercel's tell us which pages and services people use, so we can improve Keystone. They don't identify you and aren't used for advertising.
Google Analytics
If you don't click Accept, Google Analytics doesn't load and sets no cookies. We have turned off Google's advertising features and Google signals, so the data isn't used for advertising.
Changing your choices
Open cookie settings to switch site statistics or Google Analytics on or off.
Switching Google Analytics off deletes its cookies from this site. You can also block or clear cookies and site data in your browser settings, though blocking strictly necessary ones may stop parts of the site working. See our privacy policy for how we use data.