Legal
Cookie Policy
- Operator
- Eco Science Limited, registered in the Cayman Islands, trading as Normal
- Contact
- hello@whatsnormal.com
- Data Protection Officer
- dpo@mishcon.com
- Effective
- Last updated
- Version
- 1.1
What a cookie is
A cookie is a small file a website asks your browser to keep. Some let the site work at all. Others count how the site is used, or tell an advertising platform that someone who saw an ad went on to do something. The same rules cover anything that works like a cookie, including local storage and tracking pixels, so everything below means those too.
Regulation 6 of the Privacy and Electronic Communications Regulations 2003 lets us set only the ones that are strictly necessary without asking you. Everything else waits for your choice.
Your choice, and how to change it
The first time you visit, the banner offers Accept all and Reject all with the same weight. Nothing in the analytics or marketing groups is set until you accept. If you reject, or close the banner without choosing, only the strictly necessary group runs.
You can change your mind at any time through the Cookie choices link in the footer, and your choice is remembered on this device for 6 months. You can also clear cookies in your browser, which resets everything including your choice.
Strictly necessary
These run on every visit, because without them the site cannot be delivered or kept secure.
| Name | Set by | What it does | How long |
|---|---|---|---|
| __cf_bm | Cloudflare | Tells a person from a bot, so the site stays available | 30 minutes |
| cf_clearance | Cloudflare | Remembers that a challenge was already passed | Up to 1 year |
| normal_consent | Normal | Remembers the choice you made on the banner, so you are not asked again | 6 months |
Analytics, only if you accept
These tell us which pages are read and where people give up. They are not used to advertise to you and they are never joined to anything you tell a clinician.
| Name | Set by | What it does | How long |
|---|---|---|---|
| _ga | Google Analytics 4 | Tells one browser from another so visits can be counted | 400 days |
| _ga_<id> | Google Analytics 4 | Keeps the state of a single visit | 400 days |
| ph_<id>_posthog | PostHog | Counts page views and which steps are reached. Servers in the EU | 1 year |
Marketing, only if you accept
These tell an advertising platform that someone who saw an ad went on to take a step here. They carry the fact that a step happened. They never carry your answers, your health information or what you are treated for.
| Name | Set by | What it does | How long |
|---|---|---|---|
| _fbp | Meta | Measures whether an ad led to a visit or a sign up | 90 days |
| _rdt_uuid | The same, for ads on Reddit | 90 days |
Meta decides for itself what it does with what it receives, as an independent controller under its own privacy notice, so we cannot answer for that part. The Privacy Policy explains what we do and do not send.
How these are loaded
Google Tag Manager holds the analytics and marketing tags and releases them only once your choice allows it. Analytics measurement is sent through our own subdomains, sst.whatsnormal.com and m.whatsnormal.com, so that an ad blocker does not silently break the counts. This changes where the request goes, not what is collected or who decides it.
Browser signals
There is no agreed standard that websites must honour for Do Not Track or Global Privacy Control, so we do not claim to act on them. The banner is the control that works.
Changes to this policy
We update this policy when the cookies change, and the version and date at the top always say which one you are reading.
Contact
Questions about cookies: hello@whatsnormal.com. Our Data Protection Officer is Mishcon de Reya LLP, dpo@mishcon.com, and you can contact them directly and in confidence. You can also complain to the Information Commissioner's Office at ico.org.uk.