Draft — to be reviewed by a solicitor before launch
Cookie Policy
Last updated:
The short version
There are no analytics or advertising cookies on our marketing site. The app uses a necessary sign-in cookie. A practice’s chat widget stores a browser identifier so an unfinished chat can resume for 24 hours. Our marketing demo also remembers a dismissed prompt during your tab session. Our fonts are served from our own website, not Google’s.
1. Who we are
This policy is provided by [Company legal name], trading as OpenDent (company number [Company number]), of [Registered address]. Contact us at hello@opendent.co.uk. It covers our marketing site, the opendent bot app and the browser storage used by our widget on practice websites. Our Privacy Policy explains personal data use and your rights.
2. Cookies and similar storage
A cookie is a small piece of information a website places in your browser. Local storage can retain information between visits; session storage generally lasts for the current browser tab session. PECR’s storage and access rules can apply to all of these, even if they do not hold your name.
We use the necessary app cookie to recognise an authenticated staff session. The widget identifier links a visitor to their unfinished chat. These identifiers are not themselves the visitor’s answers, although they can link to records on the service.
3. What is stored
| Where and technology | Purpose | Lifetime |
|---|---|---|
App: ob_session cookie | Strictly necessary authentication: recognises a signed-in staff user and protects access to the practice inbox. This is a login-session cookie, not an analytics cookie. | Configured maximum of 14 days; cleared on sign-out. It can persist after closing the browser. |
| Practice website: widget session identifier in browser storage | Allows a visitor to resume the chat they started when reloading or moving between pages. This is functional storage, not permission to track people for advertising. | Allows resumption for 24 hours; unfinished server-side sessions then expire. The deployed storage key and client-side removal behaviour must be confirmed before launch. |
Marketing demo: ob-teaser in session storage | Remembers that a demo prompt has been dismissed or the demo opened, so the prompt is not repeated during that tab session. It is not used for analytics or advertising. | The browser tab session, normally until the tab is closed. Browser session restoration can affect this. |
Draft implementation check: ob_session and its 14-day maximum, and ob-teaser, reflect the repository at drafting. Confirm the production cookie settings, the widget’s exact storage keys and expiry/removal behaviour, and whether any provider sets additional cookies. A server-side session expiring does not necessarily remove a browser storage entry.
4. Consent and practice website notices
Under PECR, storage or access that is strictly necessary to provide a service a person requests can be exempt from consent. Our app sign-in cookie serves that purpose. A practice must assess whether its widget storage is strictly necessary for the chat the visitor requests, taking account of when storage begins, why it is used and how long it lasts. Loading a widget by itself does not make every use of storage necessary.
Practices should name and explain the widget storage, its purpose and lifetime in their own cookie notice, alongside their privacy notice. They must obtain prior consent for storage or access that is not exempt, including any additional analytics, advertising or attribution technology. The marketing demo preference should also be assessed for an applicable exemption and consent obtained if required. These policies do not implement consent controls.
Page URLs, referrers, UTM tags, ad click identifiers, device information and coarse city/region may be included in practice enquiry records. That does not itself mean an advertising cookie is set. Practices still need transparency and a lawful basis, and consent where PECR requires it for the particular collection or use.
See the ICO’s guidance on storage and access technologies for how these rules apply.
5. Fonts and external services
Our website, the app and the chat widget use Geist fonts served from our own servers. Loading them doesn’t send your information to a font provider. Stripe checkout and practice-connected services may use their own cookies on their pages; consult their notices when you use them.
6. Managing browser storage
You can use your browser’s privacy settings to inspect, block or delete cookies and site storage. Clearing or blocking the app cookie may sign you out or prevent access. Clearing or blocking widget storage may stop a chat from resuming.
For a widget on a practice website, contact that practice about its storage and consent choices. Contact hello@opendent.co.uk about our site or app. We will update this policy when the technologies change and show the revision date above.