Legal · Cookies
The short list of cookies we use.
We use as few cookies as possible. No analytics cookies, no advertising cookies, no cross-site tracking. This page lists every cookie that can land on your device when you use Unmist, who sets it, what it does, and how to control it.
Last updated: October 2026 · Set by Northlight Technologies Ltd (trading as Unmist) — see the controller details
Section 01
What a cookie is
A cookie is a small text file that a website asks your browser to store on your device. Each time your browser sends a request to that website, it sends the cookie back. Sites use cookies for all sorts of things — keeping you signed in, remembering your preferences, measuring how popular pages are, building advertising profiles. We use cookies for almost none of those things.
Some site features (like the embedded map) are actually loaded from other companies' servers, and those companies can set their own cookies through the embed. We list those below alongside our own cookies, because from your point of view they all land on your device through Unmist.
Section 02
Cookies we set
We set three first-party preference/access cookies, plus bounded rate-limit cookies when you use Ask Unmist or submit a public form. They are strictly necessary for services you explicitly request under paragraph 4 of Schedule A1 to the UK Privacy and Electronic Communications Regulations (PECR), so they do not require your consent.
| Name | Set by | Purpose | Lifetime | Category |
|---|---|---|---|---|
| unmist_req_rate | Unmist (first-party, HttpOnly) | Stores only recent submission timestamps to limit abuse of the “request a clinic check” form. It contains no form answers or visitor identifier. | 24 hours | Strictly necessary |
| unmist_lead_rate | Unmist (first-party, HttpOnly) | Stores only recent submission timestamps to limit abuse of the clinic waitlist and enquiry form. It contains no form answers or visitor identifier. | 24 hours | Strictly necessary |
| tl_admin | Unmist (first-party) | Holds an authenticated session for Unmist's private admin area. Set only when an authorised account signs in to internal tooling. Never set on public clinic pages. | Session (cleared when the browser is closed) or up to 30 days if "remember me" is selected. | Strictly necessary |
| tl_consent | Unmist (first-party) | Records your Maps choice (made with the Load map button or in Cookie settings) so we don't keep asking you. Stores a single value: accepted or rejected. | 12 months | Strictly necessary |
| tl_stats | Unmist (first-party) | Remembers your statistics choice as on or off; it contains no visitor identifier. Global Privacy Control is remembered as off. Turning statistics back on is a separate choice from allowing Maps. | 12 months | Strictly necessary preference |
| unmist_ask_session | Unmist (first-party, HttpOnly) | Holds a pseudonymous browser identifier and timestamps used only to limit repeated Ask Unmist requests and protect the service from abuse. It contains no question text. | 30 days | Strictly necessary — Schedule A1 paragraph 4(2)(c)/(d) |
Section 03
Cookies set by embedded third parties
On clinic pages and results pages we embed an interactive map so you can see where each clinic is. The map uses the open-source Leaflet library (loaded from the unpkg CDN) and OpenStreetMap tiles served through CARTO's CDN. Loading that content sends your IP address to those CDNs, and they may set their own cookies as part of their normal operation. These are third-party cookies and they require your prior consent under UK PECR. The tile requests carry Unmist's own CARTO service key in the URL so CARTO can count our usage; it identifies this website, not you. If the map is not available on a page, nothing is loaded from these CDNs at all.
Until you click Load map, we do not load the map at all — neither the Leaflet script nor the tiles. The page shows a static placeholder with a “Load map” button; clicking it is your consent for Maps and is remembered for a year. You can withdraw it in Cookie settings. The clinic's address is still printed on the page, and there's a link that opens Google Maps in a new tab if you want directions — but only Google's own cookie practices apply at that point, because you actively chose to click through.
| Set by | Triggered by | Purpose | Category |
|---|---|---|---|
CARTO (basemaps.cartocdn.com) and unpkg (unpkg.com) | Loading the interactive map on clinic and results pages | Render the map tiles and the Leaflet JS library. These CDNs may set operational cookies and will see your IP address as part of any standard HTTP request. See CARTO's privacy policy and unpkg's parent (Cloudflare) privacy policy. | Consent required |
Section 04
What we don't use
For complete clarity, Unmist does not use any of the following, today, on any page:
- Google Analytics, Plausible, Fathom, Matomo, Mixpanel, Vercel Speed Insights, or any session-replay product;
- Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Twitter Pixel, or any other advertising-platform tag;
- advertising cookies, retargeting cookies, or any interest-profile cookies;
- fingerprinting libraries or device-graph services;
- A/B testing or feature-flagging tools that set a tracking cookie.
Our minimum usage statistics use no analytics identifier cookie. The tl_stats cookie only remembers your preference. Cloudflare Web Analytics is not loaded in that minimum configuration. In the earlier configuration it may load when configured, but is suppressed by GPC or tl_stats=off.
Section 05
How we ask for consent
We do not show a cookie banner on arrival. Maps ask for consent in place: the map area stays empty until you click “Load map”. Our optional first-party statistics do not use an analytics identifier cookie. Where they are active, they are limited to improving Unmist under the statistical exception in Schedule A1 to PECR, with clear information and a simple, free objection. You can object at any time with “Do not count my visits” in the footer or on the privacy page. “Allow maps” and “Decline maps” in Cookie settings concern Maps only; neither choice grants consent to another purpose.
The Maps choice is stored in tl_consent and the statistics choice in tl_stats. You can change them independently using the footer controls. Clearing cookies can remove a saved preference.
Section 06
How to change your mind
You can change your decision at any time:
- Click Cookie settings in the footer of any page on Unmist to open the privacy panel.
- Or, in your browser settings, delete the
tl_consentcookie — the map placeholder will ask again next time you visit. - Most browsers also let you block all third-party cookies, refuse cookies from specific domains, or delete cookies on exit. The Information Commissioner's Office has a short consumer guide explaining how.
Section 07
Other tracking technologies
We use the browser's local storage only for your saved-clinic shortlist (unmist_saved) and the record that you accepted the Ask Unmist terms (unmist_ask_consent). Each is written only after you act, stays in your browser, is never sent to our servers, and can be cleared from your browser settings. We do not store search history or recently viewed clinics. We do not use local storage for the pre-booking check, "Weigh their answers" or the Consultation Kit: those pages keep your selections in the memory of the open tab only, and lose them when you leave.
Section 08
Server logs are not cookies
Separately from cookies, our hosting provider keeps short-lived technical server logs (request paths, IPs, timestamps, status codes) for security and abuse prevention. These are described in our Privacy Policy, not here, because they don't involve writing anything to your device.
Section 09
Changes to this policy
If our cookie use changes — for example if we add a new third-party embed or a new telemetry tool — we will update this page with the new entries and re-prompt for consent before any new cookies are set. The version you are reading is dated at the top of the page.
Section 10
Contact
For questions about this policy or about a specific cookie you see on Unmist, write to hello@unmist.co.uk. For any wider question about how we handle data, see our Privacy Policy.