Privacy and cookie information

Scope

This notice describes this public information website. The verified clinic sign-in opens a separate application at orthoticenergylab.com; that application controls clinic credentials, prescriptions, orders, files, checkout, pickup data and a separately public repair-upload form. It must provide the notices applicable to those workflows.

Information the public site may process

Web servers and security services may process an IP address, request time, requested URL, browser/device information, referrer, response status, and diagnostic or security signals. Email includes the information you choose to send and normal message metadata. This build has no contact form, account form, patient upload, checkout, or advertising identifier.

Catalogue lookups

If you submit the optional Footwear or Hosiery catalogue filter, this server sends only the product text and allow-listed category, width or displayed pressure filter to Orthotic Energy’s public catalogue API. Your browser does not contact that API directly, and this rebuild discards upstream prices and image identifiers. Do not enter a person’s name, patient detail, prescription or other confidential information in a catalogue search.

Purposes and data minimization

Information may be used to deliver and secure the site, diagnose errors, prevent abuse, answer enquiries, and investigate correction or rights reports. General email must not include patient records, prescriptions, scans, medical images, dates of birth, health card numbers, passwords, or payment details.

Retention, access, and disclosure

Provider: ZQ managed NGINX/PHP host behind Cloudflare. Logged fields: IP address; request time; requested URL; referrer; user agent; response status; language; local time; time zone. Retention: 7 days. Access owner: ZQ production administrators. Analytics retention: 180 days. Consent mechanism: Notice-based cookie-free audience measurement; no advertising identifier and no site-created analytics cookie or browser storage. Categories: Essential delivery/security logs; first-party audience measurement; Cloudflare performance/traffic measurement. Withdrawal: Email the privacy contact with a non-sensitive opt-out or deletion request; collection can also be blocked through browser request controls.

Cookies, browser storage, and analytics

Analytics: First-party /collect/ aggregate audience measurement and Cloudflare Web Analytics/edge analytics; no Google Analytics or advertising analytics. /collect/ enabled: yes. Endpoint owner: ZQ shared first-party collector. Payload: First-party collector: server-derived IP and page URL plus language; local time; IANA time zone and referrer. Cloudflare: page-view and performance metrics under its Web Analytics configuration. Purpose: Aggregate page views and approximate unique visits; diagnose traffic sources; performance and site operation. Current page-load collection state: active.

External clinic application

The separate application was observed using Azure affinity cookies and browser storage for authenticated account state. Public code exposes clinic account, patient/order, file, checkout and pickup workflows; a repair form requesting contact/order details and four device photos rendered without authentication. These observations do not establish server-log retention, deletion, subprocessors, consent or upload safeguards. This rebuild does not link directly to that repair form while those facts remain unverified.

Advertising and third parties

No advertising or affiliate code is active. Cloudflare provides the proxy, edge traffic analytics and the automatically injected Web Analytics performance beacon; the first-party collector is hosted on the same managed origin. Google Analytics, advertising analytics and cross-site advertising identifiers are not active.

Your choices and privacy requests

For a privacy request, use the approved contact: [email protected] (Verified general privacy contact; no separate privacy-officer designation asserted). Do not include sensitive clinical information in an initial email.

Security and sensitive information

No email, network, or storage system is risk-free. Do not use ordinary email for confidential clinical or payment information. The public site is intended for clinic and practitioner information and does not ask children or patients to create accounts or submit health information.

Effective: 2026-09-20. Production data governance has an approved record; runtime collection remains subject to its explicit switch.