What this notice covers
This notice explains the cookies and browser storage that Orvie uses, what each one does, how long it lasts and how to remove it. It should be read with our Privacy Notice, which explains how we handle personal data generally.
A cookie is a small file a website asks your browser to store. Local storage is a similar store that stays in your browser and is never sent to our servers. We use both, first-party only. We do not set third-party cookies, and we do not embed third-party scripts that would.
We show a small cookie banner on your first visit. It appears once: you can choose Accept all or Essential only. Either choice leaves the site fully usable, because we set only strictly necessary cookies and the preference cookies you choose (language, theme and senior mode); we set no advertising or analytics cookies either way. Your answer is stored for one year in the dv_cookie_consent cookie. Clearing your site cookies resets the choice, and the banner appears again on your next visit.
Strictly necessary cookies
These cookies are required to sign in, to protect the sign-in form and to remember your cookie choice. The authentication cookies are set by Auth.js, the authentication library the workspace uses. The consent cookie is set by our own banner. Without the authentication cookies you cannot stay signed in, so blocking them will break sign-in.
| Name | Purpose | Type | Duration | Attributes |
|---|---|---|---|---|
authjs.session-token | Keeps you signed in. It holds a signed session token with your account identifier, role, account status and language preference. The server checks the account against the database on every request, so a suspension takes effect immediately. | Strictly necessary; first-party | Browser session; the signed-in session expires after 8 hours regardless | HttpOnly; SameSite=Lax; Secure over HTTPS; Path=/ |
authjs.csrf-token | Protects sign-in and other authentication forms against cross-site request forgery. It is matched against a token embedded in the form. | Strictly necessary; first-party | Browser session | HttpOnly; SameSite=Lax; Secure over HTTPS; Path=/ |
authjs.callback-url | Remembers the page to return to after you sign in. | Strictly necessary; first-party | Browser session | HttpOnly; SameSite=Lax; Secure over HTTPS; Path=/ |
dv_cookie_consent | Remembers your cookie choice. The value is 1:all or 1:essential. The banner reads it so the prompt appears only once, and any future non-essential script must refuse to load unless the value is 1:all. | Strictly necessary; first-party | 1 year | SameSite=Lax; Secure over HTTPS; Path=/; not HttpOnly (set and read by our own JavaScript) |
authjs.state, authjs.pkce.code_verifier, authjs.nonce | Complete the OAuth handshake when you choose Google sign-in. They are not set if you sign in with email and password. | Strictly necessary; first-party | 15 minutes | HttpOnly; Secure over HTTPS; short-lived |
When the site is served over HTTPS, Auth.js adds a security prefix to these names: __Secure-authjs.session-token, __Secure-authjs.callback-url and __Host-authjs.csrf-token. A large session token may be split into numbered chunks, such as authjs.session-token.0. The names differ; the purpose does not.
Preference cookies and local storage
These entries remember how you asked the interface to look. They contain no clinical data and are not used to identify you across other sites. We set them only after you use the relevant control.
| Name | Purpose | Duration | Storage |
|---|---|---|---|
dv_locale | Remembers your language choice (English, Bahasa Indonesia or Mandarin) so the next page renders in the same language. | 1 year | Cookie; SameSite=Lax; Path=/; not HttpOnly |
dv_senior | Remembers whether senior mode is on: larger type, stronger contrast and 44 px targets. | 1 year | Cookie; SameSite=Lax; Path=/; not HttpOnly |
dv_theme | Remembers whether you chose the light, dark or system theme. This entry is written by the theme switcher and is never sent to our servers. | Until you clear site data | Browser local storage; not a cookie |
Why dv_theme is not a cookie. The theme is applied by the browser before the page is displayed, so the theme switcher stores it in local storage rather than sending it with every request. It is still your preference, and you can remove it the same way as a cookie.
The language and senior-mode cookies are readable by JavaScript because the interface updates them without a full page reload. They contain a two-letter language code or “1”/“0”, nothing else.
No advertising or analytics
We do not use advertising or analytics tracking. The product contains no Google Analytics, Meta pixel, Hotjar, Segment, advertising identifier, cross-site tracker or fingerprinting script. Fonts, icons and images are served from our own domain; no third-party font or content delivery network receives your request.
Our servers keep access and audit logs that include an IP address and browser user agent. Those logs exist for security, accountability, and the audit requirements described in the Privacy Notice. They are not used to build an advertising profile or to follow you across websites.
Because there is no cross-site tracking, there is nothing for a “Do Not Track” or Global Privacy Control signal to switch off. We honour those signals by not tracking in the first place.
Video consultations
When you join a video consultation, the workspace opens a room on Jitsi Meet at meet.jit.si, a service operated by 8x8, Inc. That is a different domain. Jitsi may set its own cookies or local storage for the call, and its own privacy notice applies. We do not control those entries and cannot list them here.
The same applies when you choose Google sign-in: the Google account pages are on Google’s domain and use Google’s cookies. We receive only the account details described in the Privacy Notice. We do not record consultations in the product, and we do not add tracking to the Jitsi room.
If you do not want Jitsi to set anything, do not open a consultation room. A clinician can arrange another channel or an in-person visit.
Managing and clearing cookies
You can view, block and delete cookies in your browser settings. The path differs by browser, but it is usually under Settings → Privacy and security → Cookies and site data (Chrome and Edge), Settings → Privacy & Security → Cookies and Site Data (Firefox), or Settings → Privacy → Manage Website Data (Safari). You can also clear site data for this domain only. Deleting dv_theme is part of the same “clear site data” action.
What happens when you clear them:
- deleting the authentication cookies signs you out of this browser; you will need to sign in again;
- deleting the preference cookies resets the language, theme and senior mode to their defaults;
- blocking all cookies prevents sign-in and is not a supported configuration;
- private or incognito windows usually discard these entries when you close the window.
Clearing a cookie removes it from this browser. If you believe someone copied a session token, deleting it is not enough: contact security@deepvertex.tech so we can suspend the account and investigate.
Changes and contact
This notice is version 1.0 and was last updated on 22 October 2026. We will update it before adding a new cookie or storage entry, and we will tell you about a material change by email or in the workspace. Earlier versions are available on request.
Questions about cookies or this notice: privacy@deepvertex.tech. Security concerns: security@deepvertex.tech. Postal address: DeepVertex Healthcare Technology, Jakarta, Indonesia.