Seven documents, each one written rather than assembled.

Almost nothing here is a cookie. Your preferences are kept in your browser's local storage, which never travels with a request, and your filters and search terms are kept in the address bar rather than stored at all. The page keeps the name Cookies because that is the address it is indexed under and the word people search for.

All of it is written through one storage layer rather than by each feature reaching for the browser directly, which is why this table can be complete rather than approximately complete.

There is no advertising network, no social media pixel and no remarketing tag on these pages. The one identifier that can reach beyond this site is MUID, which Microsoft Clarity sets on Microsoft's own domain and Microsoft also reads on its other sites. It is set on the public pages only, never on a signed-in page. That is checkable rather than asserted, which is why clause 02 can be complete rather than approximately complete.

The heading says today on purpose. LabFlow expects to carry advertising, and the Android app already declares the advertising identifier permission for that reason — app permissions clause 05. So this clause describes a build instead of promising a future, and clause 04 explains why that distinction is the honest way to write it.

One part of it is not a description and does not move: no advertising or cross-site identifier is loaded on a signed-in clinical route. A page showing a patient's results is not a page that carries an advert.

Product measurement, where it is switched on, receives event names and route patterns only. It does not receive a patient identifier, an accession number, a result value, a free-text note or the contents of any record.

If a session-replay or heatmap tool is ever added, it will appear in the table in clause 02 and in the processor table in the privacy policy before it is switched on, and it will be blocked from every signed-in clinical route.

One such tool is now in use. Microsoft Clarity records how the public pages are scrolled and clicked. It is in both tables, it is not loaded on any signed-in page, and anything that could show a record is masked before it is recorded.

Why this is phrased as a commitment rather than as a denial. The tempting sentence here is "we do not record your session". It is easy to write, it is currently true, and it is exactly the sentence that turns into a lie the day somebody adds a heatmap tool and updates only the privacy policy. A cookies page and a privacy policy that disagree is the cheapest false statement a site can make, and it is almost always an accident of that shape. So both pages carry this paragraph, in the same words, and changing one without the other is visible.

Most of clause 02 needs no consent. The sign-in session is strictly necessary, the appearance settings are choices you made with a control, and a push subscription exists only if you turned push on.

Google Analytics, Amplitude and Microsoft Clarity measure how LabFlow is used, so it can be made better. They are on for everyone, and the first-visit notice says so once. Sentry reports an error when something breaks, which is part of keeping the service working.

There is still no banner and no window that opens by itself. A first visit shows one quiet note at the foot of the page naming the Privacy Policy and the Terms of Service and saying that LabFlow counts how it is used, and it leaves by itself after ten seconds. A banner asking the same question on every visit would be louder than the thing it asks about.

The theme control in the header resets every appearance setting in one action. Your browser's own site-data controls clear the rest, and revoking notification permission removes the push subscription.

What you lose by clearing it: the site goes back to its default appearance and you are signed out. No laboratory data is stored in your browser, so nothing you have entered into LabFlow is affected by clearing site data on any device.

Neither signal switches LabFlow's measurement off. What is measured is how the product is used, never what is in a record, and it is how LabFlow is made better; the notice on your first visit says so. Microsoft Clarity is still never loaded on a signed-in page.