2026-08
Cookie policy
This site uses at most five cookies, and none of them measures anything: they are all there so the application works. No analytics, no advertising, no third parties. Every one of them is listed below, including those that only appear in specific situations.
The cookie we use
`hemora_sesion`: holds your session identifier so you do not have to type your password on every page. It is technical and necessary, lasts thirty days and is deleted when you sign out. It is httpOnly and, in production, secure.
`hemora_padrino`: only if you arrive through someone's invitation link. It holds their code (six letters and digits, nothing else) so you can look around the site before signing up without losing the code. It lasts thirty days, is deleted as soon as you create the account, and carries no identifier of yours and measures nothing.
`hemora_expediente`: only on the Family plan, when you are looking at the record of a minor in your care instead of your own. It holds whose record is open, so it does not switch back to yours when you change screen. It is deleted when you return to your own record.
`hemora_reto`: only during the two minutes in which a passkey is registered or used (Face ID, fingerprint, physical key). It holds the cryptographic challenge of that one operation, and expires on its own.
`hemora_preprod`: only in the test environment, never on the site you use. It keeps trial data apart from real data.
On top of that, the application keeps two things in your own browser, which are not cookies and are sent to no server: which devices you have turned biometric unlock on for, so it is only offered where it works, and whether you have already closed the window that presents Health+, so it is not shown again in the same visit. They are cleared by clearing the site data in your browser.
Being strictly necessary for a service you requested, it needs no prior consent (Article 22(2) of the Spanish LSSI). That is why you will see no cookie banner: there would be nothing to consent to.
What we do not use
No Google Analytics or any other third-party measurement. No social pixels. No advertising cookies. No fonts loaded from someone else's servers.
The only thing we measure is audience, and we do it ourselves, with no cookie at all: an aggregate counter per day and screen in our own database, with no IP address and no identifier. It cannot tell who visited what, which is why it needs no consent and is not in the cookie table: it places nothing in your browser.