Cookie policy

The cookies the platform sets

There is no separate anti-forgery cookie: requests that change data are protected by the session cookie's SameSite setting together with an origin check on the API, so no additional token cookie is needed.

• kb.patient.session — how the patient portal keeps you signed in. It carries an opaque session identifier, not your name or your health information. Type: strictly necessary. Lifetime: up to 30 days of inactivity; it is renewed while you use the portal, and it is deleted when you sign out.
• kb.staff.session — the same mechanism for Klinikbook staff accounts while they work in the platform, with a shorter lifetime of 12 hours. Type: strictly necessary; it is set only while a staff member is signed in.
• kb-locale — remembers the interface language you chose (a value such as tr or en), so the interface opens in that language next time. Type: preference; it contains only a language code and is not used to identify or track you. Lifetime: 12 months.
• kb_consent — records your choice in the cookie banner (accepted or rejected), so the banner is not shown again. Type: strictly necessary; it holds only the choice. Lifetime: 6 months, after which you are asked again.
• kb_attribution — optional, set only after you accept it: the campaign parameters (such as utm_source), the referring site and the page you first landed on, so the operator can see which campaigns bring visitors when you register. Type: marketing measurement; it holds no name, health information or tracking identifier and is not shared with advertising networks. Lifetime: 90 days.

The public website

The public website keeps your language in the address rather than in a cookie — /en/... or /tr/.... It sets only the record of your cookie choice and, if you accept it, the campaign-source cookie. Every page of the public site can be read with cookies blocked.

What we do not use

No analytics cookies. No advertising cookies. No social-media pixels, no cross-site tracking, and no third-party consent-management platform — nothing on the platform observes your browsing. The only optional cookie is the campaign source; it is set only after you accept it in the cookie banner, and you can change your choice at any time with “Cookie preferences” at the bottom of every page.

If that ever changes

If a cookie that observes visitors is ever introduced — an analytics service, an embedded player that sets its own cookies, an advertising pixel — its purpose and lifetime will be named before it is set, and it will run only after you have agreed to it. We ask before, not after.

How to remove or block cookies

You can see, block and delete cookies and site data in your browser's settings. Blocking the session cookie signs you out of the portal and stops the language preference from being remembered; nothing else depends on cookies. Questions about this policy, or about the personal data described in the privacy notice, go to the privacy address on that page.