This document is written in plain English. If anything is unclear, contact [email protected].
In short: The VipLIMS website sets no cookies and loads no analytics, adverts or third-party scripts. After you sign in, the app sets one strictly necessary cookie to keep you signed in, and a second cookie only if you tick "remember this device". The app also keeps a few technical entries in your browser's storage. None of this is used for tracking, so the law does not require a consent banner and we do not show one.
Version 1.0. Effective date: 13 October 2026.
1. What cookies and browser storage are
A cookie is a small text file that a website asks your browser to store and send back on later visits. Browsers also offer other storage: sessionStorage, which is cleared when you close the tab, and localStorage, which is kept until you or the site clears it. The same legal rules apply to cookies and to these other kinds of storage.
2. The public website
The public website at viplims.com, including the features, pricing, donation, help and legal pages:
- sets no cookies;
- uses no browser storage;
- uses no analytics or visitor tracking;
- shows no adverts;
- loads no third-party scripts that could set their own cookies.
The donation buttons take you to Stripe or PayPal. Their pages are governed by their own cookie policies. Our network provider, Cloudflare, delivers the site and protects it against attacks; see our Privacy policy for how request data such as IP addresses is handled.
3. The VipLIMS app
The app at viplims.com/app uses the following, and only after you start to sign in.
| Name | Type | Purpose | How long it lasts |
|---|---|---|---|
__Host-lims_sid | Cookie (HttpOnly, Secure, SameSite=Strict) | Keeps you signed in after you sign in, and links your requests to your session on our server | Ends when you sign out, after 30 minutes without activity (your laboratory may set a shorter time) or 12 hours after sign-in, whichever comes first |
__Host-lims_dev | Cookie (HttpOnly, Secure, SameSite=Strict) | Set only if you tick "remember this device". Lets you skip the two-step code on this browser; your password is still required | Up to the number of days your laboratory allows (at most 90). Removed when you change or reset your password, reset two-step verification, change your sign-in email or choose "Forget remembered devices" |
| Sign-in progress | sessionStorage | Remembers which step of sign-in you are on, including the email address you entered, so that reloading the page does not lose your place | Cleared when you close the browser tab |
| Announcement dismissed | sessionStorage | Remembers that you closed a service announcement | Cleared when you close the browser tab |
| Update reload marker | sessionStorage | Prevents a loop of page reloads after we release a new version | Cleared when you close the browser tab |
| Table preferences | localStorage | Remembers which columns you chose to show in lists on this device | Until you clear your browser storage |
Both cookies contain only a random token, which our server stores only in hashed form. They hold no personal or clinical data. Their settings mean that scripts cannot read them, they are sent only over encrypted connections, and they are not sent with requests that start on other websites.
4. Why there is no consent banner
4.1 The Privacy and Electronic Communications Regulations 2003 (PECR, regulation 6) in the UK, and Article 5(3) of the ePrivacy Directive in the EU, require consent before storing or reading information on your device, except where it is strictly necessary to provide a service you have asked for.
4.2 Everything in section 3 meets that exception:
- the session cookie and sign-in progress entry are needed to sign you in securely and keep you signed in;
- the device cookie is set only when you ask for it by ticking "remember this device", and does only that;
- the remaining entries only remember choices you made in the interface or keep the app working after an update.
4.3 Because nothing else is used, there is nothing to ask consent for.
5. Managing cookies
You can block or delete cookies and browser storage in your browser settings. If you block the session cookie, you will not be able to sign in to the app. If you delete the device cookie, you will be asked for a two-step code at your next sign-in. Blocking cookies has no effect on the public website, because it sets none.
6. If this changes
If we ever add analytics or any other non-essential cookies or storage, they will be opt-in: off until you choose to turn them on, with refusing as easy as accepting. We will update this page and announce the change in the changelog before it takes effect.
7. Contact
Questions about this policy: [email protected].