Loading page
Exactly what Rose Beauty Clinic stores in your browser, why, how long it lasts, and how to refuse it. There are four items in total, and none of them track you.
This document was drafted for Rose Beauty Clinic as a working starting point. No lawyer has reviewed, amended or approved it, and it is published here so it can be read and marked up — not because it is settled. It is not legal advice to you, and it is not yet a reliable statement of the clinic’s legal position.
Before anyone relies on it, the clinic’s own counsel must review it and confirm every factual claim in it against how the clinic actually operates — its vendors, its retention schedule, its fees and its insurance. The cookie names, lifetimes and third-party list in particular should be re-verified against the live site before this page is treated as complete.
A cookie is a small file a website asks your browser to keep and hand back on your next request. Websites also use two related mechanisms — local storage and session storage — which keep data in your browser but are never sent to a server at all. This notice covers all three, because the difference matters to us and should not have to matter to you.
This notice sits under our privacy policy, which covers everything else we collect. Cookies are a small part of that picture.
Cookie notices usually list four categories. We use two of them, and it is worth being clear which two.
This is the complete list of what this site sets. If you find something in your browser from this site that is not on it, tell us — that is a defect and we want to know.
| Name | What it does | Kind | How long it lasts |
|---|---|---|---|
| __convexAuthJWT | Proves you are signed in, so the portal or the staff admin can show you your own records. | First-party cookie, not readable by scripts | About an hour, renewed silently while you keep using the site |
| __convexAuthRefreshToken | Keeps you signed in between visits so you do not have to enter your password every time. | First-party cookie, not readable by scripts | Up to 30 days, or until you sign out |
| __convexAuthOAuthVerifier | Protects a sign-in exchange from being intercepted or replayed. | First-party cookie, not readable by scripts | Minutes — deleted as soon as the sign-in completes |
| roose:announce:… | Remembers that you closed the notice strip at the top of the page, so it does not come back on every page. | Local storage — never sent to any server | Until you clear this site's data in your browser |
The three sign-in cookies are only set once you actually sign in. Reading the public pages of this site — the treatments, the Journal, this page — sets no cookie at all.
Paying for a deposit or an invoice takes you to a page hosted by our payment processor, Stripe. That page is theirs, not ours, and it sets its own cookies — principally to detect fraud and to keep the payment session together. We do not control them and we cannot switch them off; their own cookie notice governs them.
Where a page on this site embeds something from another company — a map, for instance — that company may set its own cookies when the embed loads. We keep such embeds to a minimum for exactly this reason.
We do not embed social media tracking pixels, advertising tags, or “like” buttons that report your visit back to a social network.
You have probably noticed there is no pop-up asking you to accept cookies. That is deliberate, and here is the reasoning rather than the assertion.
You are in control of all of it, from your browser, without asking us.
You can also ask us to delete information we hold about you outside your browser — see your right of access and correction.
Some browsers send a Do Not Track header or a Global Privacy Control signal. There is no agreed standard for how a website must respond to either, and many sites ignore them while saying nothing.
Our position is simple: this site does not track you across other sites whether or not you send one of those signals, so there is nothing for us to turn off. If we ever introduce anything that a Global Privacy Control signal would properly apply to, we will honour it and say so here.
Rose Beauty Clinicreviews this notice whenever the site’s technology changes, and at least once a year. The date at the top of this page is the date of the current version.
A change that adds a new category of cookie — analytics, advertising, anything that follows you off this site — will be announced before it takes effect, not documented after it.
Ask the Privacy Officer about anything on this page — including if you find something stored by this site that is not listed in § 3.