Cookie and Tracker Notice

Essential cookies

Essential cookies are required for the site to function. These include: the session cookie that keeps you logged in, the language cookie (zanason_lang) that remembers whether you prefer Spanish or English, and security cookies that prevent request-forgery attacks. You cannot disable these cookies; the site will not function without them.

Analytics cookies

We use analytics cookies to understand how visitors use the site — which pages they visit, how long they stay, where they came from. This helps us improve the experience. We never send protected health information (PHI) to analytics tools. The ID we send is a random UUID that does not personally identify you. These cookies are on by default. You can turn them off at any time with the 'Analytics' toggle under 'Cookie preferences' (the link in the footer), and we turn them off automatically when your browser sends the Global Privacy Control (GPC) or 'Do Not Track' signal.

The analytics tools we run today: Google Analytics 4 (product events, anonymous client identifier), AWS RUM (web performance — Core Web Vitals, JS errors), and Core Web Vitals reported to Google Analytics.

Error reporting (strictly necessary)

We use Sentry for error reporting. Sentry is treated as 'strictly necessary' under CCPA and GDPR because it's operational security — catching crashes and bugs that affect every visitor regardless of consent posture. Before sending to Sentry, we run a scrubber that strips sensitive fields (email, phone, weight, BMI, etc.). Sentry does NOT turn off when you decline analytics cookies; the same PHI scrubber applies to every event.

Advertising cookies

Advertising cookies help us measure which ads bring visitors to our site and show relevant ads on other platforms. They are off by default and are used only if you turn on Advertising in the cookie banner or under Cookie Preferences.

If you opt in, our advertising partners — Meta (Facebook and Instagram) and TikTok — will receive limited activity from our public marketing pages only: things like which page you visited or which button you clicked, tied to an advertising cookie. This never includes your name, email, phone number, or any health information — and it never comes from the patient portal, medical forms, or any part of the care experience. Never.

You can change your mind at any time: the "Cookie Preferences" link in the footer of every page reopens your settings, and turning Advertising off takes effect immediately. If your browser sends the Global Privacy Control (GPC) or Do Not Track signal, we treat it as a no — advertising cookies stay off and we don't ask.

How to control cookies

Most browsers let you: see which cookies are stored on your device; block cookies from certain sites; delete all cookies on browser close. See your browser's help (Chrome, Safari, Firefox, Edge) for specific instructions. Blocking essential cookies will break the site.

Do Not Track and GPC signals

We honor the Global Privacy Control (GPC) signal when your browser sends it. If we detect GPC, we automatically turn off analytics and marketing cookies — you don't have to click anything. We also honor the classic 'Do Not Track' (DNT) browser signal the same way: we treat it as a global opt-out. GPC is the standard recognized by California's CCPA (§1798.135); we accept DNT out of respect for users who turned it on before GPC existed.

When we detect either signal, we don't show the cookie prompt at all — you already decided at the browser level and we don't ask again. Strictly-necessary cookies (auth, security, error reporting with patient data scrubbed) stay on because the site needs them to work.

Changes to this notice

We may update this notice when we add or remove tools. The last-reviewed date appears at the top of this page.

Contact

Questions about cookies: hola@zanason.com.