Consent
01Nothing optional before you choose
Only strictly necessary cookies are set on first visit. Analytics, advertising and embedded video wait for an explicit choice in the banner.
Legal
Which cookies, pixels and storage cortexanote.com and the CortexaNote app use, who provides them, why, how long they last, and how to change or withdraw consent.
At a glance
A legal page should pair a plain document with a sticky table of contents and a practical review path. CortexaNote writes for Recorder, AI scribe, and EHR workflow ownership.
Consent
01Only strictly necessary cookies are set on first visit. Analytics, advertising and embedded video wait for an explicit choice in the banner.
Control
02Cookie settings stays in the footer of every page and in the app settings. Turning a category off deletes its cookies and stops the related tags.
Inventory
03The same categories, vendors and consent record cover cortexanote.com and app.cortexanote.com, so the policy cannot drift from the dialog.
Policy packet
Strong legal pages make the policy easy to scan and the review path easy to find. CortexaNote keeps that pattern, but only exposes materials that are public or requestable today.
Policy
Read policyRead how account, workspace, recording, transcript, note, support and website data are handled alongside this cookie inventory.
Compliance
Read policySee how consent, transparency and data subject rights are handled for EU users, including the DPA request path.
External
Open externalOpen the external trust center for subprocessor lists, security policies and review evidence that changes outside the policy text.
At a glance
Last updated 2026-09-11 / CortexaNote Legal / Clinical documentation workflow
Which cookies, pixels and storage cortexanote.com and the CortexaNote app use, who provides them, why, how long they last, and how to change or withdraw consent.
Scope
This Cookie Policy explains how Cortexa AI, Inc. (CortexaNote) uses cookies, local storage and similar technologies on cortexanote.com and in the CortexaNote web app at app.cortexanote.com. It works together with the Privacy Policy, which describes how personal data is processed, and with the Cookie settings dialog, where you make and change your choices. The inventory further down this page lists every technology in use, its provider, purpose and lifetime.
What cookies are
A cookie is a small text file that a website stores on your device so it can recognise your browser later. Local storage and session storage are similar browser storage areas without an expiry date or that last for one tab session. Pixels, tags and software development kits are scripts that send information from your browser to a provider. This policy calls all of these cookies unless a distinction matters.
How consent works
When you first visit, only strictly necessary cookies are set. The banner offers Accept all, Reject all and Customize with equal prominence. Nothing in the Functional, Analytics or Advertising categories is stored, read or loaded until you actively choose it; continuing to browse, scrolling or closing the banner is not consent. Your choice is stored in the ctx_consent cookie for twelve months and applies to both cortexanote.com and app.cortexanote.com because they share one privacy programme and one cookie inventory.
Strictly necessary
Strictly necessary cookies keep the service working and are used on the basis of providing the service you request. They include the sign-in session for the web app, the token that lets the CortexaNote browser extension authenticate, bot protection on the Recorder checkout, your language and layout preferences, and the ctx_consent cookie that remembers your choice. They cannot be switched off in the dialog because the site and app would not function without them; you can still delete them in your browser.
Functional
Functional cookies load optional features from other companies, currently video players hosted by YouTube (Google LLC). When Functional is off, a placeholder appears instead of the video and nothing is sent to Google. You can load a single video by choosing Load video, which counts as consent for that video only, or allow the category for all videos.
Analytics and performance
Analytics and performance cookies help us understand how the website and the app are used and whether they perform well. On cortexanote.com we use Google Analytics 4 through Google Tag Manager, plus a first-party ctx_ga cookie that keeps the Google Analytics client ID so a later sign-up can be attributed to the same visit. We use PostHog for analytics and Datadog for performance and error monitoring on both the website and the web app. On the website, PostHog also records session replays with form inputs, text, images and payment frames hidden. Datadog Session Replay is disabled on the website. Page URLs are stripped of sensitive parameters before they are sent, and patient data, transcripts and notes are never included. These providers process data in the United States under data processing agreements.
Advertising
Advertising cookies measure whether our advertising on Google and Meta leads to demo requests, checkout starts, Recorder orders or sign-ups. When you allow this category, the Meta Pixel and Google Ads tags may set identifiers, and a first-party ctx_attr cookie remembers the campaign and ad click identifiers that brought you to Cortexa. Completed sign-ups and orders are reported to Google and Meta from our servers only when this category was allowed at the time. We never share Protected Health Information, patient identifiers or clinical content with advertising platforms, and the authenticated app does not load advertising pixels.
Changing or withdrawing consent
You can change or withdraw your consent at any time, as easily as you gave it, by opening Cookie settings from the footer of any page or from the Privacy and cookies section of the app settings. Withdrawing a category stops the related cookies and processing immediately: existing cookies for that category are deleted, the page reloads without the corresponding tags and new collection stops. Data collected before withdrawal, including requests already queued or in transit, may finish sending. Withdrawal does not affect the lawfulness of processing that took place before it.
Consent records
So that we can demonstrate consent, each choice is stored locally in the ctx_consent cookie and recorded in a consent log that contains a random consent identifier, the time, the action taken, the categories allowed, the version of this policy and of the banner, the surface on which the choice was made and the page path. The log does not contain your name, email, account, IP address or device fingerprint, and it is kept only as long as needed to evidence consent and meet legal obligations. The consent identifier is not used for any other purpose.
Japan disclosures
For people in Japan, the external transmission table on this page is presented in the format of the external transmission rules under the Telecommunications Business Act only: as a voluntary measure, it follows the disclosure format published by the Ministry of Internal Affairs and Communications and names, for each technology, the company that receives information from your device, the information sent, why Cortexa uses it, how the recipient uses it and how you can stop it. Disclosures under the Act on the Protection of Personal Information are made in the Privacy Policy, which is linked from this page. Cortexa does not provide personal data to these companies for their own marketing databases, and the authenticated app does not send patient or clinical information to analytics or advertising providers.
Browser controls
You can also control cookies in your browser: most browsers let you block all cookies, block third-party cookies, delete cookies when you close the browser or delete them one at a time. Blocking strictly necessary cookies will prevent you from signing in to the app or completing a Recorder order. Browser controls are independent of the Cookie settings dialog, so the cleanest way to change a category is through the dialog.
Changes and contact
We review this policy whenever a tag, pixel, SDK or storage key is added or removed, and at least annually. When the categories, vendors or purposes change materially, the policy version stored with your choice will no longer match and you will be asked to choose again. Questions about cookies, requests to see the consent log entry for your consent identifier and privacy complaints can be sent to support@cortexanote.com.
“Which cookies, pixels and storage cortexanote.com and the CortexaNote app use, who provides them, why, how long they last, and how to change or withdraw consent.”
Inventory
This inventory covers cortexanote.com and app.cortexanote.com. Categories match the choices offered in Cookie settings. Durations are maximum lifetimes; a cookie is removed earlier when you withdraw consent for its category or clear your browser data.
Required for the website and the CortexaNote app to work: sign-in sessions, security and bot protection, language and layout preferences, and remembering the cookie choice you make here. These cannot be switched off because the service cannot be delivered without them.
| Name | Provider | Domain | Purpose | Duration | Type | Consent | Where |
|---|---|---|---|---|---|---|---|
| ctx_consent | Cortexa AI, Inc. | .cortexanote.com | Stores the cookie choice you made: the categories you allowed, when you decided, the policy version you saw and a random consent ID so we can prove the choice later. | 12 months | First party | Not required (stores your consent choice) | Both |
| wos-session | WorkOS, Inc. on behalf of Cortexa AI, Inc. | app.cortexanote.com | Encrypted sign-in session for the CortexaNote web app. | Session, refreshed while you stay signed in | First party | Not required (authentication) | app.cortexanote.com |
| cortexa.ai.gcip_session | Cortexa AI, Inc. | .cortexanote.com | Lets the CortexaNote browser extension authenticate with the account you are signed in to. | 1 day | First party | Not required (authentication) | app.cortexanote.com |
| NEXT_LOCALE, sidebar_state, theme, workbench-pref:* (local storage), cortexa-app-download-splash-dismissed (session storage) | Cortexa AI, Inc. | app.cortexanote.com | Remembers display language, light or dark appearance, sidebar and panel layout, and whether the mobile app prompt was dismissed. | Language 12 months; sidebar 7 days; other values until you clear browser storage or the session ends | First party | Not required (user-selected preferences) | app.cortexanote.com |
| Cloudflare Turnstile challenge | Cloudflare, Inc. | challenges.cloudflare.com | Bot and abuse protection on the Recorder checkout form. | Session | Third party | Not required (security) | cortexanote.com |
Loads optional third-party features, currently embedded YouTube videos. When this is off, videos show a placeholder and only load if you click to play them.
| Name | Provider | Domain | Purpose | Duration | Type | Consent | Where |
|---|---|---|---|---|---|---|---|
| YouTube embedded player (VISITOR_INFO1_LIVE, YSC, PREF and related cookies set by YouTube) | Google LLC (Google Ireland Limited for users in the EEA, UK and Switzerland) | youtube.com, youtube-nocookie.com | Plays demo videos hosted on YouTube when you load them. | Session to 6 months, set by YouTube | Third party | Required | cortexanote.com |
Helps us understand how the website and app are used and how they perform: Google Analytics on cortexanote.com, and PostHog analytics and Datadog performance monitoring on the website and in the app. On the website, PostHog also records masked session replays; Datadog does not record replays. Off until you turn it on.
| Name | Provider | Domain | Purpose | Duration | Type | Consent | Where |
|---|---|---|---|---|---|---|---|
| _ga, _ga_<container id> | Google LLC (Google Ireland Limited for users in the EEA, UK and Switzerland) | .cortexanote.com | Google Analytics 4 visitor and session identifiers used to count visits, pages viewed and conversion events such as demo requests or checkout starts. | 2 years | First party cookie set by a Google script | Required | cortexanote.com |
| ctx_ga | Cortexa AI, Inc. | .cortexanote.com | Stores the Google Analytics client ID so a later sign-up on app.cortexanote.com can be attributed to the same website visit. | 180 days | First party | Required | cortexanote.com |
| ph_<project key>_posthog and ph_* (cookie, local and session storage) | PostHog, Inc. | cortexanote.com; app.cortexanote.com | Website events, checkout funnels and masked session replays. Product analytics in the CortexaNote app, linked to your account when signed in. | 12 months | First party cookie set by the PostHog SDK | Required | Both |
| _dd_s, _dd_s_v2 | Datadog, Inc. | cortexanote.com; app.cortexanote.com | Performance monitoring and error diagnostics for the website and CortexaNote app. Website Session Replay is disabled. | 15 minutes of inactivity, at most 4 hours | First party cookie set by the Datadog SDK | Required | Both |
Measures whether our advertising on Google and Meta leads to sign-ups or Recorder orders, and remembers which campaign brought you here. Off until you turn it on. Patient and clinical data are never shared with advertising platforms.
| Name | Provider | Domain | Purpose | Duration | Type | Consent | Where |
|---|---|---|---|---|---|---|---|
| _fbp, _fbc | Meta Platforms, Inc. (Meta Platforms Ireland Limited for users in the EEA, UK and Switzerland) | .cortexanote.com | Meta Pixel browser identifier and Meta ad click identifier used to measure whether Meta ads lead to demo requests, checkout starts or Recorder orders. | 90 days | First party cookie set by a Meta script | Required | cortexanote.com |
| ctx_attr (cookie), __ctx_attribution (session storage), ctx_ads_attribution_v1 (local storage in the app) | Cortexa AI, Inc. | .cortexanote.com | Remembers the campaign and ad click identifiers (UTM parameters, gclid, fbclid) that brought you to Cortexa so a later sign-up or order can be attributed to that campaign. | 90 days | First party | Required | Both |
| _gcl_au, _gcl_aw, _gcl_gb | Google LLC (Google Ireland Limited for users in the EEA, UK and Switzerland) | .cortexanote.com | Google Ads conversion linker cookies that store the Google ad click identifier so conversions can be attributed to the ad. | 90 days | First party cookie set by a Google script | Required | cortexanote.com |
External transmission
When a cookie or script below is active, your browser sends information to the named company. This table lists the legal entity that receives it, the information sent, why Cortexa uses the service, how the recipient uses the information, and how to stop it. It is also the disclosure required by the external transmission rules under Japan's Telecommunications Business Act.
| Technology | Recipient | Information sent | Cortexa's purpose | Recipient's purpose | How to stop it |
|---|---|---|---|---|---|
| wos-session | WorkOS, Inc. on behalf of Cortexa AI, Inc.Privacy policy | Encrypted session token exchanged with WorkOS to verify your sign-in. | Encrypted sign-in session for the CortexaNote web app. | Authentication service provided to Cortexa under a data processing agreement. | Sign out of the app. The session cookie is removed when you sign out. |
| Cloudflare Turnstile challenge | Cloudflare, Inc.Privacy policy | IP address, browser characteristics and the challenge result, processed by Cloudflare as our security provider. | Bot and abuse protection on the Recorder checkout form. | Distinguishing people from automated abuse on our behalf. | Turnstile only runs on the checkout page. You can order by contacting sales instead. |
| YouTube embedded player (VISITOR_INFO1_LIVE, YSC, PREF and related cookies set by YouTube) | Google LLC (Google Ireland Limited for users in the EEA, UK and Switzerland)Privacy policy | IP address, browser and device information, the page you are viewing and your interactions with the player. | Plays demo videos hosted on YouTube when you load them. | Video delivery, playback preferences, spam and abuse prevention, and Google's own analytics and, on youtube.com, personalisation as described in Google's privacy policy. | Keep Functional off and the video will not load unless you click Load video. Cookie settings in the footer, or the Privacy and cookies section in the app settings. |
| _ga, _ga_<container id> | Google LLC (Google Ireland Limited for users in the EEA, UK and Switzerland)Privacy policy | Pseudonymous client ID, page URL and title, referrer, device and browser type, approximate location derived from IP address, event names and marketing campaign parameters. | Google Analytics 4 visitor and session identifiers used to count visits, pages viewed and conversion events such as demo requests or checkout starts. | Providing analytics reports to Cortexa; Google may also use the data for its own purposes as described in Google's privacy policy. | Cookie settings in the footer, or the Privacy and cookies section in the app settings.Opt out |
| ctx_ga | Cortexa AI, Inc. | The client ID is sent by Cortexa's servers to Google Analytics when a sign-up completes. | Stores the Google Analytics client ID so a later sign-up on app.cortexanote.com can be attributed to the same website visit. | Google Analytics conversion reporting. | Cookie settings in the footer, or the Privacy and cookies section in the app settings. |
| ph_<project key>_posthog and ph_* (cookie, local and session storage) | PostHog, Inc.Privacy policy | Website: random browser/session IDs, checkout reference, events, amounts, device/browser type and page paths without query strings; masked clicks, scrolling and layout in replay, with form inputs, text, images and payment frames hidden. Campaign parameters only with Advertising consent. The app also sends account/workspace IDs and feature events. No patient data, transcripts or notes. | Website events, checkout funnels and masked session replays. Product analytics in the CortexaNote app, linked to your account when signed in. | Hosting the analytics service for Cortexa under a data processing agreement. | Cookie settings in the footer, or the Privacy and cookies section in the app settings. |
| _dd_s, _dd_s_v2 | Datadog, Inc.Privacy policy | Page and API timing, request failures, error types and redacted source locations, browser/device type and structured diagnostic events. Website events include checkout and PostHog session references for correlation; raw error messages and URL query strings are removed. No payment fields or replay recordings. | Performance monitoring and error diagnostics for the website and CortexaNote app. Website Session Replay is disabled. | Hosting the monitoring service for Cortexa under a data processing agreement. | Cookie settings in the footer, or the Privacy and cookies section in the app settings. |
| _fbp, _fbc | Meta Platforms, Inc. (Meta Platforms Ireland Limited for users in the EEA, UK and Switzerland)Privacy policy | Pixel ID, browser identifier, page URL, event names (page view, content view, lead, checkout started, purchase), order value and currency, IP address and browser information. | Meta Pixel browser identifier and Meta ad click identifier used to measure whether Meta ads lead to demo requests, checkout starts or Recorder orders. | Ad measurement and attribution for Cortexa; Meta may also use the data for its own purposes as described in Meta's privacy policy. | Cookie settings in the footer, or the Privacy and cookies section in the app settings.Opt out |
| ctx_attr (cookie), __ctx_attribution (session storage), ctx_ads_attribution_v1 (local storage in the app) | Cortexa AI, Inc. | Campaign identifiers are sent by Cortexa's servers to Google Ads and Meta when a sign-up or order completes. | Remembers the campaign and ad click identifiers (UTM parameters, gclid, fbclid) that brought you to Cortexa so a later sign-up or order can be attributed to that campaign. | Conversion attribution for advertising campaigns. | Cookie settings in the footer, or the Privacy and cookies section in the app settings. |
| _gcl_au, _gcl_aw, _gcl_gb | Google LLC (Google Ireland Limited for users in the EEA, UK and Switzerland)Privacy policy | Ad click identifier, page URL, conversion event names and values. | Google Ads conversion linker cookies that store the Google ad click identifier so conversions can be attributed to the ad. | Ad conversion measurement for Cortexa; Google may also use the data for its own purposes. | Cookie settings in the footer, or the Privacy and cookies section in the app settings.Opt out |
The right review connects clinical capture, AI draft responsibility, workspace governance, and EHR export before rollout.
Talk to sales