Cookie and Tracking Policy
Effective Date: June 1, 2026 · Last Updated: June 1, 2026 · Version 1.0
What this policy covers: This Cookie and Tracking Policy explains what cookies and similar tracking technologies Health Matters Clinic uses across our platforms, why we use them, and how you can control or opt out of them. We use cookies to keep our platforms functioning, understand how they are used, and improve the experience for community members, volunteers, and partners. We do not use cookies for advertising or behavioral profiling.
1. What Are Cookies
Cookies are small text files placed on your device (computer, phone, or tablet) when you visit a website. They are widely used to make websites function correctly, remember your preferences, and provide analytical information to website operators.
In addition to cookies, websites use similar technologies for tracking and analytics, including:
- Local storage and session storage: Browser-side data storage that persists beyond a page load or is cleared when you close the tab
- Pixels and web beacons: Tiny invisible images or scripts embedded in pages or emails that signal when content has been loaded
- Fingerprinting-adjacent data: Technical attributes like browser type, screen resolution, and IP address used to identify and distinguish sessions
- SDK-based tracking: In-app analytics frameworks embedded in web applications
This policy covers all of these technologies, not just traditional browser cookies.
1.1 Session Cookies vs. Persistent Cookies
Session cookies are temporary and are deleted automatically when you close your browser. They are used to maintain your experience during a single visit, such as keeping you logged in while navigating between pages.
Persistent cookies remain on your device for a defined period (or until manually deleted) and are used to remember preferences and collect analytics across multiple visits.
1.2 First-Party vs. Third-Party Cookies
First-party cookies are set by HMC directly for the domain you are visiting. Third-party cookies are set by external services (such as Google Analytics or reCAPTCHA) when their code is loaded on our pages. HMC does not allow advertising networks to place third-party cookies on our platforms.
2. Platforms Where Cookies Are Used
Cookies and tracking technologies are used on the following HMC platforms:
| Platform | URL | Cookies Used |
|---|
| Main Website | healthmatters.clinic | Analytics, functional, reCAPTCHA, session |
| Event Finder | eventfinder.healthmatters.clinic | Session, reCAPTCHA, minimal analytics |
| Volunteer Portal | volunteer.healthmatters.clinic | Authentication (Firebase), session, reCAPTCHA |
| Partner Portal | partner.healthmatters.clinic | Authentication (Firebase), session, reCAPTCHA |
| CalmKit | calmkit.healthmatters.clinic | Session only (no persistent or analytics cookies) |
| Resource Directory | healthmatters.clinic/resources | Analytics, session (via Webflow) |
HMC's Gumroad product listing uses cookies set by Gumroad, Inc. Those cookies are governed by Gumroad's own Cookie and Privacy Policy.
3. Categories of Cookies We Use
Strictly NecessaryCannot Be Disabled
These cookies are essential for HMC's platforms to function. Without them, services like logging into the Volunteer Portal, submitting RSVP forms, or completing training modules would not work. These cookies do not track browsing behavior across other websites and do not require consent under applicable law.
Examples: Authentication tokens (Firebase), session identifiers, CSRF protection tokens, form submission state
Data stored: Encrypted session identifiers, authentication state. No personal content is stored in these cookies.
Retention: Session cookies expire when you close your browser. Authentication cookies expire based on your login session, typically 30 days unless you log out sooner.
AnalyticsOptional / Can Be Opted Out
Analytics cookies help HMC understand how our platforms are used so we can improve them. We use Google Analytics with IP anonymization enabled, which means your IP address is truncated before it is processed by Google. Analytics data is aggregated and is not linked to your name or account unless you are logged in and we have explicitly configured user-ID tracking (which we do not do for our public-facing platforms).
Examples: Google Analytics cookies (_ga, _ga_*, _gid)
What we measure: Pages visited, time on page, referral source, device type, browser type, general geographic region (city or state level), and interaction with key features
What we do NOT do with analytics data: Cross-site tracking, behavioral advertising, individual-level profiling, data resale
Retention: _ga cookies persist for 24 months. _gid cookies persist for 24 hours.
How to opt out: See Section 6 for browser-level and Google-level opt-out options.
FunctionalEnhance Your Experience
Functional cookies remember choices you make on HMC platforms to provide a more personalized and convenient experience. These are not advertising cookies and do not track you across unrelated websites.
Examples: Language or accessibility preferences, notification preferences, previously viewed resources (stored locally in your browser)
Retention: Varies by cookie; typically 90 days to 12 months.
Disabling functional cookies may affect convenience features (such as remembering your preferred event filters) but will not prevent you from using core services.
4. Specific Cookies and Tracking Technologies
4.1 Google Analytics
HMC uses Google Analytics (provided by Google LLC) to collect aggregated usage data about how visitors interact with our platforms. Google Analytics uses first-party cookies stored in your browser to track sessions and page views.
| Cookie Name | Purpose | Duration | Type |
|---|
| _ga | Distinguishes users for analytics reporting | 24 months | Persistent, first-party |
| _ga_[ID] | Maintains session state for Google Analytics 4 | 24 months | Persistent, first-party |
| _gid | Distinguishes users across a 24-hour window | 24 hours | Persistent, first-party |
HMC has enabled IP anonymization in Google Analytics, which means the last octet of your IP address is removed before analytics data is stored. HMC does not use Google Analytics Advertising features, Remarketing, or User ID linking on public-facing platforms.
Google's use of analytics data is governed by the Google Privacy Policy. You can opt out of Google Analytics across all websites using the Google Analytics Opt-out Browser Add-on.
4.2 Google Firebase and Authentication Cookies
The Volunteer Portal and Partner Portal use Google Firebase for backend services, database access, and authentication. Firebase sets cookies and uses local storage to manage authentication sessions and security.
| Technology | Purpose | Duration | Type |
|---|
| Firebase Auth Token | Maintains your authenticated session in the Volunteer or Partner Portal | Session or 30 days (if "stay signed in" is selected) | Browser local storage, strictly necessary |
| Firebase Session Cookie | Security token for API requests between browser and HMC's Cloud Run backend | Session | Session cookie, strictly necessary |
These cookies are strictly necessary for authenticated platforms to function. Disabling them will prevent login to the Volunteer Portal and Partner Portal.
4.3 Google reCAPTCHA
HMC uses Google reCAPTCHA (v2 and/or v3) on forms across our platforms to distinguish human users from automated bots and prevent spam submissions. reCAPTCHA analyzes behavioral signals from your browser session, including mouse movements, typing patterns, and browser characteristics, to generate a risk score.
| Technology | Purpose | Duration | Type |
|---|
| reCAPTCHA cookies | Bot detection and form spam prevention on RSVP and contact forms | 6 months (Google-set) | Third-party (google.com domain) |
reCAPTCHA data is processed by Google LLC under its own privacy policy. HMC receives only a pass/fail assessment, not the underlying behavioral data. By using forms on HMC's platforms, you acknowledge that reCAPTCHA will analyze your browser session.
More information is available in the Google Privacy Policy and the reCAPTCHA documentation.
4.4 Webflow Platform Cookies
HMC's main website (healthmatters.clinic) is hosted on Webflow. Webflow may set its own operational cookies for site functionality and performance monitoring.
| Cookie Name | Purpose | Duration | Type |
|---|
| Webflow session cookies | Site functionality, form state, and CMS rendering | Session | Session, functional |
Webflow's data practices are governed by the Webflow Privacy Policy.
4.5 Session Storage (Non-Cookie Browser Storage)
Some HMC platforms use browser sessionStorage or localStorage to temporarily hold data like form progress, selected filters in the Event Finder, or accessibility preferences. This data is stored in your browser only and is never transmitted to HMC's servers unless you explicitly submit a form. SessionStorage is cleared when you close the tab. LocalStorage persists until cleared by you or by the application.
5. CalmKit: No Persistent Tracking
CalmKit Is a Tracking-Free Zone
By design, CalmKit (calmkit.healthmatters.clinic) does not use persistent cookies, does not run Google Analytics, does not store any user-entered content, and does not transmit any identifiable information to HMC's servers.
The only browser storage used by CalmKit is sessionStorage for maintaining the state of your current coaching session (for example, which stage of a breathing exercise you are in). This data is automatically cleared when you close the tab.
This design reflects our belief that mental wellness tools should be safe to use without fear that your inputs will be recorded, analyzed, or shared. CalmKit is anonymous by architecture, not merely by policy.
6. How to Control and Opt Out of Cookies
6.1 Browser-Level Cookie Controls
All modern browsers allow you to view, block, and delete cookies through their settings. The instructions vary by browser. Use the links below to find guidance for your browser:
Important: Blocking all cookies will prevent you from logging into authenticated HMC platforms such as the Volunteer Portal and Partner Portal. Strictly necessary cookies cannot be disabled without disabling the core service they support.
Opt-Out Options by Tracking Type
Google Analytics: Install the Google Analytics Opt-out Browser Add-on. This add-on prevents Google Analytics from collecting data about your visits on any website that uses it, not just HMC's.
Google services broadly: Manage your Google privacy settings and ad personalization at myaccount.google.com/data-and-privacy.
reCAPTCHA: reCAPTCHA is a strictly necessary security technology on HMC forms. There is no opt-out for reCAPTCHA that preserves form functionality, as it is required to distinguish human users from bots. You may use browser privacy extensions that block reCAPTCHA, but this may prevent form submission.
Webflow platform cookies: These are operational cookies managed by Webflow. Blocking them via browser settings may affect website rendering. There is no Webflow-specific opt-out tool.
All analytics cookies (global opt-out): You can use browser extensions such as Privacy Badger, uBlock Origin, or similar tools to block third-party tracking scripts on all websites including HMC's. These tools block analytics and functional cookies while generally allowing strictly necessary first-party cookies.
6.2 Mobile Device Controls
On mobile devices, you can control cookies and tracking through your browser settings. iOS and Android also provide system-level privacy controls:
- iOS: Settings > Privacy and Security > Tracking allows you to limit cross-app tracking (not directly applicable to web cookies, but relevant for Safari)
- Android: Your browser app's settings control cookie behavior; the specific path varies by device and browser
6.3 Effect of Opting Out
Opting out of analytics cookies will not affect your ability to use HMC's public resources, browse the Resource Directory, RSVP for events, or access CalmKit. It will prevent HMC from counting your visit in our analytics reports. Opting out of authentication cookies will prevent you from logging into authenticated portals.
7. California Privacy Rights and CCPA Disclosure
California Residents: Your Cookie-Related Rights
Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), California residents have specific rights regarding personal information collected through cookies and tracking technologies.
7.1 CCPA Category Disclosure for Cookie Data
Cookie and tracking data collected on HMC platforms may fall into the following CCPA personal information categories:
- Identifiers: IP address (anonymized in Google Analytics), device identifiers, session identifiers
- Internet or network activity information: Pages visited, time on page, interaction with platform features, referral sources
- Geolocation data: General location data derived from IP address (city or state level only; no precise geolocation tracking)
7.2 No Sale of Cookie Data
HMC does not sell personal information collected through cookies or tracking technologies. We do not share cookie data with advertising networks, data brokers, or third parties for cross-context behavioral advertising. The analytics data collected through Google Analytics is used solely for HMC's internal platform improvement purposes.
7.3 Your CCPA Rights Regarding Cookie Data
California residents may exercise the following rights regarding cookie-collected data:
- Right to Know: Request disclosure of the categories of personal information we collect through cookies and how it is used
- Right to Delete: Request deletion of personal information collected through cookies (note: some technical data may be outside HMC's direct control once processed by third-party analytics providers)
- Right to Opt Out of Sale or Sharing: Not applicable because HMC does not sell or share cookie data for advertising purposes
- Right to Non-Discrimination: Exercising cookie opt-out rights will not result in any discrimination in access to HMC's free services
To exercise these rights, contact privacy@healthmatters.clinic. For more information about your full CCPA rights, see our Privacy Policy.
7.4 Global Privacy Control (GPC)
The Global Privacy Control (GPC) is a browser-level signal that communicates your privacy preferences to websites. HMC is aware of the GPC specification and the California Attorney General's guidance that GPC signals may constitute a valid opt-out request under the CCPA. HMC will treat GPC signals as opt-out requests to the extent technically feasible and legally required. We are actively working to ensure technical compliance with GPC signals on our platforms.
8. Third-Party Tracking Tools
8.1 What We Do Not Use
HMC explicitly does not use any of the following on its platforms:
- Facebook Pixel or any Meta advertising tracking
- Twitter/X advertising pixels
- LinkedIn Insight Tag or advertising pixels
- Google Ads remarketing or conversion tracking
- Any third-party advertising networks or demand-side platforms
- Data broker integrations or audience enrichment services
- Hotjar, FullStory, or session recording tools (which record individual user interactions)
- Fingerprinting services designed to re-identify users without cookies
8.2 What We Do Use
Third-party tools currently active on HMC platforms are limited to those described in this policy: Google Analytics (analytics), Google Firebase (infrastructure and authentication), Google reCAPTCHA (security), and Webflow (hosting). These are operational, not advertising, tools.
8.3 Embedded Content
HMC may embed content from YouTube on blog posts or event pages for educational purposes. When you view embedded YouTube content, YouTube may set its own cookies under Google's privacy policy. HMC uses YouTube's privacy-enhanced embed mode where possible to minimize cookie placement before you interact with embedded video.
9. Changes to This Policy
HMC may update this Cookie and Tracking Policy when we add new platforms, change tracking tools, or when applicable law changes. Material changes will be reflected in an updated "Last Updated" date at the top of this page.
We recommend reviewing this policy periodically. If we introduce new analytics or functional tracking technologies beyond what is described here, we will update this page before deploying those technologies.
Continued use of HMC's platforms after a policy update constitutes acceptance of the revised policy. If you have concerns about any changes, contact us at privacy@healthmatters.clinic.
10. Contact Us
