- 1.1Scope. This Cookie Policy explains how Health Tourism Inc. (“HTI”) uses cookies, local and session storage, pixels, software development kits and similar technologies (together, “cookies”) on Health-Tourism.com and its apps (the “Service”). It forms part of our Privacy Policy, which explains how we treat the personal data some cookies collect.
- 1.2Legal framework. Where the ePrivacy rules[1], the GDPR or the UK GDPR apply, we store or read anything that is not strictly necessary only with your prior consent, which must be freely given, specific, informed and as easy to withdraw as to give[2][3]. Where U.S. state privacy laws apply, advertising cookies amount to “sharing” for cross-context behavioural advertising or “targeted advertising”, and your refusal — including by a Global Privacy Control signal — is honoured as an opt-out[5][6].
- 1.3What “strictly necessary” means. A cookie is strictly necessary only if the Service cannot work without it for a feature you asked for: signing in, keeping a form secure, holding your enquiry draft, remembering your cookie choice itself. Nothing in that category is used for analytics or advertising.
On this page
Version 3.0 takes effect on 8 Dec 2026. It applies immediately to anyone who starts using the service after 8 Nov 2026. ask us for a copy or a redline.
Summary
In short: Health Tourism Inc. uses strictly necessary cookies to run Health-Tourism.com, and — only with your consent — functional, analytics and advertising cookies. Nothing optional is set until you choose; “Reject all” is as easy as “Accept all”; analytics never receives enquiry contents, uploads or AI conversations; advertising cookies are off by default and switched off automatically when your browser sends Global Privacy Control. The table below lists every technology, and the preference center lets you change your choice at any time.
Key points
- Only strictly necessary cookies are set until you choose; closing the banner counts as “Reject all”.
- Four categories: necessary (always on), functional, analytics, advertising (off by default).
- Analytics is configured to exclude enquiry contents, uploads, AI conversations and payments.
- Global Privacy Control switches advertising off and is treated as a sale/share opt-out.
- Every cookie and pixel is listed with its purpose and lifetime; a tag not in the table is not loaded.
- Your consent record (version, time, choices, GPC) is kept 12 months, then we ask again.
1. What cookies and similar technologies are, and what this Policy covers
In short
Cookies are small files a website stores on your device; we also use local storage and a few pixels. This Policy lists every one we use, what it does, how long it lasts, and how to switch the optional ones on or off.
2. The four categories
In short
Strictly necessary (always on), functional, analytics and advertising. The last three stay off until you switch them on, and you can change your mind at any time from “Manage cookies” in the footer.
Always on
Strictly necessary
Sign-in, security, your enquiry draft, this consent choice. Always on; cannot be switched off because the site would not work.
Your choice
Functional
Remembers language, currency, the region you chose in legal documents, the hospitals you compared, and loads embedded videos and maps. Off until you choose.
Your choice
Analytics
Aggregated statistics about pages, searches and errors, with IP addresses truncated. No medical details, enquiry contents or AI conversations are ever sent to analytics. Off until you choose.
Your choice · off by default
Advertising and measurement
Measures our campaigns and limits repeat ads. Off by default; treated as a “sale/share” opt-out signal where that law applies, and switched off automatically when your browser sends Global Privacy Control.
- 2.1Defaults. On your first visit only strictly necessary cookies are set. The banner offers “Accept all”, “Reject all” and “Manage” with equal prominence; closing the banner without choosing is treated as “Reject all”. We do not use cookie walls, pre-ticked boxes or nudging colours.
- 2.2Health data and analytics. Our analytics configuration excludes enquiry contents, uploaded files, AI conversations, payment details and any free-text field. Page paths that reveal a health interest (for example a procedure page) are included in aggregate page statistics only; they are never joined to your identity or used to build an advertising audience.
3. The cookies we use
In short
Every cookie, storage key and pixel, with who sets it, what it does and how long it lasts. Third-party analytics and advertising tags load only after you accept their category.
| Name | Category | Set by | Purpose | Expires |
|---|---|---|---|---|
| ht_session | Strictly necessary | Health-Tourism.com | Keeps you signed in and ties the pages of one visit together; protects forms against cross-site request forgery | Session |
| ht_csrf | Strictly necessary | Health-Tourism.com | Security token checked when you submit an enquiry, booking or request | Session |
| ht_consent (localStorage ht.legal.consent) | Strictly necessary | Health-Tourism.com | Records your cookie choices, the policy version you saw, the time and whether a Global Privacy Control signal was present | 12 months |
| ht_eq_draft (sessionStorage) | Strictly necessary | Health-Tourism.com | Holds an unsent enquiry draft on your device so a page reload does not lose it; never sent to analytics | Until the tab closes |
| ht_rl | Strictly necessary | Health-Tourism.com | Rate-limiting and bot-detection token that protects enquiry and payment endpoints | 24 hours |
| ht_lang · ht_cur | Functional | Health-Tourism.com | Remembers your language and currency | 12 months |
| ht.legal.tab.* (localStorage) | Functional | Health-Tourism.com | Remembers the region you chose in a legal document and whether you dismissed a notice | 12 months |
| ht_compare | Functional | Health-Tourism.com | Remembers the hospitals you added to a comparison when you are not signed in | 30 days |
| ht_live | Functional | Health-Tourism.com | Remembers whether you switched off live-activity pop-ups | 12 months |
| ht_a (first-party analytics) | Analytics | Health-Tourism.com | Counts visits, pages, searches and errors in aggregate; IP addresses are truncated; enquiry contents, uploads and AI conversations are excluded by design | 13 months |
| _ga · _ga_* (Google Analytics 4) | Analytics | Aggregated usage statistics with IP anonymisation and Google signals and ad personalisation disabled; loaded only after you accept analytics cookies | 13 months (_ga: 2 years) | |
| ht_ab | Analytics | Health-Tourism.com | Assigns you to one variant of a page test so you see a consistent version | 90 days |
| ht_src | Advertising and measurement | Health-Tourism.com | Remembers which campaign brought you to the site so we can measure it | 30 days |
| _gcl_* (Google Ads conversion) | Advertising and measurement | Measures whether an advertising click led to an enquiry; loaded only after you accept advertising cookies | 90 days | |
| _fbp (Meta Pixel) | Advertising and measurement | Meta Platforms | Measures our campaigns on Meta services and limits repeat ads; loaded only after you accept advertising cookies; no medical details are sent | 90 days |
| YouTube (embedded videos, youtube-nocookie.com) | Functional | Plays embedded videos; the privacy-enhanced domain sets cookies only when you press play | Set by YouTube | |
| Maps (embedded) | Functional | Map provider | Shows a hospital's location on an interactive map after you accept functional cookies | Set by the provider |
Cookie inventory confirmed against a scan of the production site. This table is generated from the same configuration the consent manager enforces: a tag that is not in the table is not loaded. Last reviewed 8 Nov 2026.
4. Your choices and how to change them
In short
Open the preference center any time from the footer or the button below, switch categories on or off and save. Your choice is stored for 12 months, then we ask again. You can also block cookies in your browser, and we honour Global Privacy Control automatically.
- 4.1Preference center. The cookie preference center is available from every page via “Manage cookies” in the footer. Changes take effect immediately; cookies already set in a category you switch off are deleted or expire and are not read again.
- 4.2Your consent record. When you make a choice we store a record on your device (and, if you are signed in, in your account) with the policy version, the time, the categories chosen, how the choice was made and whether a Global Privacy Control signal was present, so that we can demonstrate consent and you can see it. The record expires after 12 months and we ask again.
- 4.3Global Privacy Control. If your browser or extension sends a Global Privacy Control signal[6], we switch advertising cookies off, treat the signal as a request to opt out of sale, sharing and targeted advertising for that browser, and show it in the preference center. The signal does not override a more protective choice you made.
- 4.4Browser settings. You can also block or delete cookies in your browser; the help pages of Chrome, Safari, Firefox and Edge explain how. Blocking strictly necessary cookies will stop sign-in, enquiries and payments from working. Browser “Do Not Track” has no agreed meaning and is not acted on; use Global Privacy Control or the preference center instead.
- 4.5Opting out with the vendors. You can also opt out of Google Analytics with Google's browser add-on and of interest-based advertising through the Digital Advertising Alliance (optout.aboutads.info), the European Interactive Digital Advertising Alliance (youronlinechoices.eu) and the Network Advertising Initiative; these affect the vendor's cookies on all sites, not only ours.
5. Third parties and embedded content
In short
Google (analytics and ads measurement), Meta (campaign measurement) and the providers of embedded videos and maps set cookies only after you accept their category. They act under their own privacy policies for anything they do with the data beyond our instructions.
- 5.1Analytics and advertising vendors. Google Analytics 4 is configured with IP anonymisation, data sharing with Google switched off and advertising features disabled; Google Ads conversion tags and the Meta Pixel are loaded only after you accept advertising cookies and are configured not to receive enquiry contents, health interests or any personal data beyond a hashed identifier where the platform requires one. Each vendor's own privacy policy governs its use of the data it collects for its own purposes.
- 5.2Embedded content. Videos use the privacy-enhanced youtube-nocookie.com domain and set cookies only when you press play; maps and social widgets load only after you accept functional cookies. Until then you see a placeholder with a link to the content.
- 5.3Messaging. The WhatsApp button opens Meta's service; Meta sets its own cookies there under its own terms.
6. Changes to this Policy, and contact
In short
When we add or change a cookie we update the table and the date at the top. If a change needs new consent, the banner asks again. Questions: our privacy request form.
- 6.1Changes. We review this Policy and the cookie inventory at least every 12 months and whenever we add or remove a technology. Material changes — a new category, a new vendor that receives personal data — are announced on the Service and, where consent is required, the preference center asks for it again before the new cookie is set.
- 6.2Contact. Health Tourism Inc., 7 Times Square, 19th Floor, New York, NY 10036, United States · our privacy request form · privacy request form.
FAQ
Cookie Policy: frequently asked questions
Short answers, each 50 words or fewer. The numbered clauses above prevail if anything here differs.
Do I have to accept cookies to use the site?
No. Only strictly necessary cookies are set until you choose, and “Reject all” is offered with the same prominence as “Accept all”. Enquiries, comparisons and payments work with necessary cookies alone; you just lose conveniences such as a remembered language.
Does analytics see my medical details?
No. Enquiry contents, uploads, AI conversations and payment details are excluded from analytics by configuration. Analytics counts pages, searches and errors in aggregate with truncated IP addresses, and only after you accept the analytics category.
How do I change my mind later?
Click “Manage cookies” in the footer of any page, switch categories on or off and save. Changes apply immediately and cookies in a switched-off category are deleted. Your choice is kept for 12 months, then we ask again.
What does Global Privacy Control do here?
If your browser sends the signal we switch advertising cookies off automatically and treat it as an opt-out of sale, sharing and targeted advertising for that browser. The preference center shows that the signal was detected.
7. Changes to this document
In short
What changed, when, and why. Material changes are announced 30 days before they take effect; the current version always carries its effective date in the header.
| Version | Date | What changed |
|---|---|---|
| v3.0 | First stand-alone Cookie Policy (previously a section of the Privacy Policy). Complete inventory table, consent record, Global Privacy Control, equal-prominence banner, operator now Health Tourism Inc.. |
We keep every published version. Ask us through our legal contact form for a copy of an earlier version or a redline between two versions.
Legal basisLaws, rules and standards referenced7 official texts linked · regulators and primary legislation first
- [1]Directive 2002/58/EC (ePrivacy Directive) — cookies and similar technologies
eur-lex.europa.eu/eli/dir/2002/58/oj - [2]ICO — Guidance on the use of storage and access technologies (cookies)
ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/ - [3]EDPB Guidelines 05/2020 on consent under Regulation 2016/679
www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en - [4]Regulation (EU) 2016/679 — General Data Protection Regulation (consolidated text)
eur-lex.europa.eu/eli/reg/2016/679/oj - [5]California Consumer Privacy Act, Civil Code §1798.100 et seq. (as amended by the CPRA)
leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5 - [6]Global Privacy Control — specification and adoption
globalprivacycontrol.org/ - [7]IAPP — U.S. State Privacy Legislation Tracker (20 comprehensive state laws in effect in 2026)
iapp.org/resources/article/us-state-privacy-legislation-tracker/
Questions about this document?
Our legal team answers questions about these terms in plain language. Privacy requests go through Your privacy choices; anything else, write to us.
Legal questions: use our legal contact form · Privacy requests are answered within 30 daysAbout this page. Health-Tourism.com is an independent platform for medical tourism — not a hospital, clinic, insurer or law firm — and does not give medical or legal advice. This page is a legal document of Health Tourism Inc.; the plain-English “In short” boxes are a guide and are not a warranty or a substitute for the numbered clauses. Translations are provided for convenience; the English version prevails. Corrections: our legal contact form.