Cookie Policy

Version: v1.1-temp · Last updated: 22 July 2026 · Effective: from the date this version is published at cbtflow.com/legal/cookies

This notice explains how Digita1 OÜ, trading as CBT Flow, uses cookies, local storage, tags and similar technologies on the public CBT Flow marketing website (cbtflow.com).

It does not cover the authenticated therapist workspace or the Client app: we do not run advertising or marketing-analytics tools on those surfaces, and the strictly necessary technologies they use (such as sign-in session storage) exist only to provide the service you asked for.

Questions: privacy@cbtflow.com.

1. What these technologies do

Cookies and similar technologies can store or access information on your browser or device. Tags and pixels can send events to a provider. We group them by purpose, because one tool can support several purposes.

2. Our consent approach

Non-essential technologies run only after you choose to allow them:

• Strictly necessary technologies operate without consent, because the site cannot honour your choices or basic functions without them.
• Analytics runs only after you consent through the cookie bar.
• Advertising/social tools are not currently used on the site. If we introduce them, they will appear as a separate category in the cookie bar and will run only after a separate advertising consent.

The cookie bar offers equally prominent Accept all, Reject non-essential and Customise choices, and does not block you from using the site while you decide. Refusing non-essential cookies does not restrict your access to the public site.

Your choice is stored and re-asked after 6 months, or sooner if the purposes or providers materially change. You can change or withdraw your choice at any time through the persistent Cookie settings link in the site footer; withdrawal applies from that point forward.

Where Google consent signals are used, they communicate your choice to Google; they do not replace it.

3. The technologies we use

Advertising/social tools (such as Google Ads conversion tracking or Meta Pixel) are not active. Before any are introduced, this notice and the cookie bar will be updated and a separate advertising consent will be required.

The exact cookie names and lifetimes set by these tools depend on their current configuration; we review them when the configuration changes and keep this notice aligned. Analytics events are configured to exclude names, email addresses, client or practice identifiers, health information and any URL content that could reveal them.

4. Managing your choices

• Use the Cookie settings link in the site footer to review, change or withdraw your choices at any time.
• You can also block or delete cookies in your browser or device settings. Browser blocking is a blunt tool: it does not replace our consent controls, and blocking strictly necessary storage may stop parts of the site working (for example, your cookie choice itself cannot be remembered).

5. Providers and transfers

After you consent to analytics, Google receives online identifiers and site-usage events. Google's processing, retention and any onward transfers are governed by our configuration and Google's applicable terms. Where a transfer outside the UK/EEA occurs, a lawful transfer route applies, as described in our Privacy Policy (cbtflow.com/legal/privacy, section 9).

Analytics and advertising providers are recipients for public-site measurement only; they are not sub-processors of clinical data and never receive it. Our clinical-data suppliers are listed at cbtflow.com/legal/subprocessors.

6. Changes

This page shows the current version and effective date. If we add a non-essential purpose or provider, we will update this notice and the cookie bar, and ask for the required consent, before the new technology runs.