1. Current register
| Name | Type and provider | Purpose | Duration | Consent or activation |
|---|---|---|---|---|
np_csrf | First-party cookie; NovaPharm | Prevents forged form and portal requests | 1 hour | Strictly necessary |
np_session | First-party cookie; NovaPharm | Maintains an authenticated, role-scoped secure session | 30 minutes of inactivity or 8 hours absolute, with earlier logout/revocation | Strictly necessary for the requested portal |
np_cookie_consent | First-party local storage; NovaPharm | Remembers consent version, selected categories, timestamp and a random preference-record identifier | 180 days | Necessary to remember the visitor's choice |
novapharm-public-ai | First-party IndexedDB; NovaPharm | Optionally caches the approved local semantic retrieval asset and public-content embeddings so a visitor can reuse private on-device search | Until the visitor uses Clear optional cache, the browser removes it or site data are cleared | Created only after the visitor explicitly enables private semantic retrieval; no query or answer is stored |
2. Categories
Strictly necessary technologies support security, forms and an authenticated portal. Preference storage remembers the choices a visitor asks the site to retain. Analytics and marketing are separate optional categories. The current production candidate contains no enabled analytics, advertising, social pixel or marketing tag, and no such tool may be added without updating this register, completing a transfer and privacy review, and honouring the saved category choice.
3. Your choices
The first layer offers equally accessible controls to accept all, reject non-essential technologies or manage categories. Optional boxes are off by default. Use at any time to change or withdraw a choice. Rejecting optional categories does not block ordinary public content.
4. Evidence and transfers
The preference record stays in the browser and is not used for unrelated tracking. It contains no name, email or portal data. Current first-party cookies do not themselves initiate an international transfer. Any future third-party analytics or marketing provider requires a documented recipient, purpose, duration and transfer assessment before activation.
5. Audit method
The release audit checks application source and generated response headers, and automated tests assert that optional categories default to off and remain off after rejection. Browser inspection of cookies, local storage and network requests remains a required preview and production acceptance step. The approach follows the ICO's final April 2026 guidance on storage and access technologies. NovaPharm does not rely on a statistical-purpose exception in this release; optional analytics remains absent and off.