HexylCookie policy
Last updated: 26 September 2026
1. Introduction
This cookie policy explains how HEXYL LTD, a company registered in Scotland (company number SC875134), registered office 18 Woodside Place, 2nd Floor, Glasgow, G3 7QL, uses cookies and similar technologies on the Hexyl website and platform (the ‘Platform’).
This policy should be read alongside our privacy policy, which explains more broadly how we collect and use your personal data, and Your information at Hexyl, a short summary of what the website collects. It is provided under the UK Privacy and Electronic Communications Regulations 2003 (PECR) and the UK General Data Protection Regulation (UK GDPR).
This policy does not cover websites that clinics publish using the Hexyl platform. For those sites, please see the cookie notice on the clinic’s own site. It does cover the patient portal that clinics offer through the Platform.
2. What are cookies
Cookies are small text files that are placed on your device (computer, tablet or mobile) when you visit a website. They are widely used to make websites work, to make them work more efficiently and to remember choices you make.
There are two main types of cookies:
- Session cookies: temporary cookies that are deleted when you close your browser. They remember your actions during a single browsing session.
- Persistent cookies: cookies that stay on your device for a set period or until you delete them. They remember your choices across visits.
A cookie’s name does not always tell you which type it is. The tables in section 4 give the actual lifetime of each one.
A website can also keep information in your browser’s local storage or session storage. These work much like cookies, but your browser does not send them to the website with every request. This policy covers browser storage as well as cookies.
3. How we use cookies
We use cookies and browser storage on the Platform for the following purposes:
- Strictly necessary cookies: required for the Platform to work. They keep your session secure, protect forms against cross-site request forgery (CSRF), keep you signed in, support the demos you start and, once we ask for cookie consent on our website, record your choice. They cannot be switched off on the Platform.
- Preferences and saved choices: remember how the Platform is displayed for you and what you choose to save, for example the theme you pick in the clinic workspace, the display of the clinic admin panel, a package you save on your device, or the figures you enter in the savings calculator on some older sector pages.
- Payment and account-connection services: our sign-up, set-up, channel-connection, set-up-complete and account-paused pages load software from Stripe, which processes payments, and our classic sign-up, channel-connection, set-up-complete and account-paused pages load software from Meta, which lets you connect a WhatsApp Business account on the connection pages. Stripe sets its own cookies to prevent fraud, and Meta may set its own cookies. This happens only on the pages that load their software, and the software loads when the page opens.
- Analytics and advertising cookies: we do not set any (see section 4.4).
4. Cookie details
The tables below list the cookies and browser storage used on the Platform. The lifetime shows how long each one stays on your device unless you delete it sooner.
4.1 Strictly necessary cookies
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
| hexyl_session | Hexyl | Identifies your session so that the Platform works securely from page to page and, when you sign in, keeps you signed in. The cookie holds an encrypted session identifier; the session data is kept on our servers. Set on every page. Despite its name, it does not end when you close your browser. | 8 hours from your last page view |
| XSRF-TOKEN | Hexyl | Security token that protects forms against cross-site request forgery, so that no one else can submit actions on your behalf. Set on every page. | 8 hours from your last page view |
| remember_web_… and remember_customer_… | Hexyl | Keeps you signed in between visits, to the clinic admin panel (remember_web_…) or to a clinic’s patient portal (remember_customer_…). Set only if you tick ‘Remember me’ when you sign in, and removed when you sign out. | 400 days |
| hexyl_preview | Hexyl | Unlocks the pre-launch preview of the website for people who hold a preview link. It is not set for other visitors. | 30 days |
| wa_sim_pin | Hexyl | Keeps your demo chat linked to your browser. It holds, in encrypted form, a random identifier for your browser and the phone number the demo uses: your own mobile number if you started the demo from our website, or a demo number we assigned. | Until 24 hours after you started the demo on our website; for demo numbers we assign, 25 hours, renewed each time you open the demo |
| hexyl_demo_ownership | Hexyl | A random identifier that links your browser to the check that you own the mobile number you entered for the browser demo. Set only when that check is in use. | 24 hours |
| hexyl_consent | Hexyl | Records the cookie choices you make on our website. Set only once we ask for consent, which we will do only if we introduce analytics or advertising cookies (see section 6.1). It is not set today. | 180 days |
4.2 Preferences and saved choices
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
| ws_theme | Hexyl (cookie) | Remembers the light or dark theme you choose in the clinic workspace. Set only when you choose light or dark, and removed if you switch back to your device’s setting. | 400 days |
| theme, isOpen, collapsedGroups | Hexyl (local storage in your browser) | Remember how the clinic admin panel is displayed: whether the sidebar is open, which menu groups are collapsed, and light or dark mode if you choose one. The admin panel writes the sidebar and menu settings whenever you use it, whether or not you change them. | Until you clear your browser’s storage |
| hexyl-package-v1 | Hexyl (local storage in your browser) | Keeps the package you build on the website, such as the products, sector and goals you chose, when you click ‘Save on this device’. It holds no contact details. | Until you click ‘Delete saved package’ or clear your browser’s storage |
| hexyl_roi_inputs | Hexyl (local storage in your browser) | Remembers the figures you enter in the savings calculator on some of our older sector pages, such as team size, salaries, enquiries and the plan you pick, so they are there when you return. It is updated each time you change a figure. It holds no contact details. | Until you clear your browser’s storage |
| sim_dark | Hexyl (local storage in your browser) | Remembers whether you turned on dark mode in the browser demo chat. | Until you clear your browser’s storage |
| sim_opener_… | Hexyl (session storage in your browser) | Used only in our team’s internal demo tool, not in the public demo. It holds the first message of a sample conversation until the page reloads. Its name includes the demo number used. | Deleted once used, or when you close the tab |
The clinic workspace may also keep short-lived technical entries in session storage while you move between pages; they are deleted when you close the tab.
4.3 Payment and account-connection services
These cookies are set by third parties, and only on the pages that load their software. Our sign-up, set-up, channel-connection, set-up-complete and account-paused pages load Stripe’s payment software (Stripe.js) when the page opens, so that you can pay securely, and Stripe uses the cookies below to detect and prevent fraud. Because the software loads with the page, these cookies can be set before you reach a payment step, and on pages where you do not make a payment.
Our classic sign-up, channel-connection, set-up-complete and account-paused pages load Meta’s JavaScript SDK when the page opens, including pages where you cannot connect WhatsApp. It is there so that the connection pages can open Meta’s sign-up window, and it loads whether or not you choose to connect. Meta may set its own cookies. When you click to connect, the SDK is started with Meta’s automatic event logging switched on, which sends Meta information about the connection flow.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
| __stripe_mid | Stripe (on our website) | Fraud prevention for payments | 1 year |
| __stripe_sid | Stripe (on our website) | Fraud prevention for your current visit | 30 minutes |
| m | Stripe (on stripe.com) | Fraud prevention for payments | 400 days |
| Cookies set by Meta’s JavaScript SDK | Meta Platforms | Lets the connection pages open Meta’s sign-up window so that you can connect your WhatsApp Business account to Hexyl (WhatsApp Embedded Signup); the SDK also loads on the other pages listed above | Set and controlled by Meta; see Meta’s privacy policy (linked in section 7) |
4.4 Analytics and advertising cookies
We do not set analytics or advertising cookies on the Platform. Our pages do not load Google Analytics, Google Tag Manager, the Meta Pixel or Microsoft Clarity. Once you start the WhatsApp connection, Meta’s SDK logs events automatically, as described in section 4.3.
To understand how the website is used, our server counts how many visits reach certain steps of the website and which sector was chosen. Each count records only the step, the sector and the time. Counting sets no cookie of its own and stores no identifier; like any request, it appears in our server logs with your IP address.
5. Legal basis (UK PECR)
Under PECR, a website needs your consent to store information on your device, or to read it, unless an exemption applies. The main exemption covers storage that is strictly necessary to provide a service you have asked for.
- Strictly necessary cookies (section 4.1) are exempt from the consent requirement under regulation 6 of PECR. We treat the cookies in section 4.1 as strictly necessary: they keep the Platform secure, keep you signed in, run a demo you have started, give preview access to people who hold a preview link, and record your cookie choice once we ask for one.
- Preferences and saved choices (section 4.2) only remember how the Platform looks and what you have chosen to save on your device. Some are set only when you make a choice, such as a workspace theme, dark mode in the browser demo or a saved package. Others are written by our software as you use it, such as whether the clinic admin panel’s sidebar is open, or the figures in the savings calculator on some older sector pages. None of them is used for analytics or advertising, and none is shared with third parties. None of them holds contact details, except that the name of the sim_opener_… entry, used only in our team’s internal demo tool, includes the demo number used.
- Payment and account-connection services (section 4.3) are set by Stripe and Meta through their own software, which loads when the relevant page opens. Stripe uses its cookies to detect and prevent fraud, and they can be set before you reach a payment step. Meta’s SDK loads before you choose to connect WhatsApp, including on pages where no connection is offered, and Meta decides which cookies it sets.
- Analytics and advertising cookies require your informed consent before being placed on your device, as they are not strictly necessary for the service. We do not use any today (see section 4.4). If we introduce them on our website, we will ask for your consent first (see section 6.1).
6. Your choices and managing cookies
6.1 Your choices
Our website sets no analytics or advertising cookies today. If we introduce them, we will ask for your consent first through a cookie banner, and we will not set them unless you agree. You will then be able to change your choice at any time through ‘Cookie settings’ in the site footer; that link appears once such cookies are in use. The banner stores your choice in the hexyl_consent cookie (section 4.1).
6.2 Managing cookies in your browser
You can control and manage cookies through your browser settings. Please note that removing or blocking cookies may affect how the Platform works; for example, you may not be able to sign in or submit forms. The exact steps differ between browser versions, and each browser’s help pages give the current ones. In recent versions they are:
- Google Chrome: Settings > Privacy and security > Third-party cookies > See all site data and permissions (Chrome help)
- Mozilla Firefox: Settings > Privacy & Security > Cookies and Site Data (Firefox help)
- Safari on Mac: Safari > Settings > Privacy > Manage Website Data (Safari help)
- Microsoft Edge: Settings > Privacy, search, and services > Cookies > See all cookies and site data (Edge help)
Clearing your browser’s site data also removes the browser storage listed in section 4.2.
7. Third-party cookies and content
Some cookies on the Platform are set by third-party services (see section 4.3). We do not control these cookies.
Some of our pages also fetch fonts, scripts or images from other providers’ servers. Each request gives that provider your IP address and basic information about your browser. For example, the website, our sign-up pages and some account pages load fonts from Google Fonts, the clinic admin panel loads its font from Bunny Fonts, patient survey pages load scripts and icons from Cloudflare (cdnjs) and jsDelivr, and one older product page loads images from Unsplash and Clearbit. We have not observed Google setting cookies through these font requests.
The relevant third-party privacy policies include:
- Stripe: Stripe Privacy Policy
- Meta: Meta Privacy Policy
- Google (Google Fonts): Google Privacy Policy
- Bunny (Bunny Fonts): bunny.net Privacy & Data Policy
- Cloudflare (cdnjs): Cloudflare Privacy Policy
- Unsplash: Unsplash Privacy Policy
- Clearbit: Clearbit Privacy Policy
8. Changes to this policy
We may update this cookie policy from time to time to reflect changes in technology, legislation or our data practices. We will post the updated policy on this page and update the ‘Last updated’ date. We encourage you to review this page periodically.
9. Contact us
If you have any questions about our use of cookies, please contact us:
HEXYL LTD
18 Woodside Place, 2nd Floor, Glasgow, G3 7QL
Email: hello@hexyl.ai