Privacy Hub
What we collect, where it lives, and who can reach it
Consential sells a paper trail. A company that sells a paper trail should publish its own. This page is the whole picture: every field a consent record holds, every field it deliberately does not, the infrastructure underneath it, the third parties involved, and the documents that govern all of it.
-
Data residency
United
States A single region. No cross-region replication and no offshore processing. - Encryption TLS 1.2+ Every connection reaching us from the outside world is encrypted in transit.
- Ledger permissions 0 UPDATE and DELETE grants on the consent ledger. Enforced by Postgres, not by policy.
- Audit retention 6 years Matched to the accounting-of-disclosures window at 45 C.F.R. § 164.528(a)(1). Not tied to billing.
01 / The record
A consent record is ten fields long
This is the entire contents of a row in consent_events, the table that holds a patient's decision. Nothing else is written when a visitor makes a choice.
| Field | What it holds |
|---|---|
practice_id | Which practice's website the visitor was on. |
visitor_id | A random identifier — the string vis_ followed by 32 hexadecimal characters drawn from the browser's cryptographic random number generator, kept in a first-party cookie. Nothing about the device is measured to produce it. |
ip_hash | A SHA-256 hash of the IP address the request arrived from. The raw address is never written to disk. |
ip_geo_region | A US state code, derived on our server from the address we already received, so the right state notice can be shown. A region supplied by the browser is discarded. |
user_agent | The browser identification string sent with the request. |
policy_version | A SHA-256 hash of the policy text that was in force at that moment — so the record shows what was actually agreed to, not what the policy says today. |
consent_action | One of granted, denied, revoked, updated. |
categories | The four category switches and their state. |
source | Where the decision came from: the consent box, the preference centre, the API, or a Global Privacy Control signal. |
created_at | The timestamp, to the microsecond, with time zone. |
Two absences are worth dwelling on. The visitor identifier is a random number rather than a fingerprint, so it cannot follow a person to a different practice's website — it is meaningless outside the site that issued it. And the page URL is missing on purpose: on a medical website the URL is frequently the most sensitive thing on the page. A path like /hair-transplant-consultation is a health inference about the person reading it. We do not want it, so we do not take it.
What a consent record never contains
These are not fields we omit today and might add later. Several of them are the reason the product exists.
×Name, email address, or phone number×The raw IP address×A device or browser fingerprint×The page URL, title, or referrer×Any treatment, condition, or symptom context×Anything a practice would recognise as PHI
02 / Data flow
Where a visitor's data goes, in order
Four steps, one of which is a wall. Everything below the dashed line is held until a patient decides otherwise.
- STEP 1 Page loads The consent script runs before any marketing or analytics tag. Non-essential tags are rewritten so the browser will not execute them yet. state: denied by default
- STEP 2 A choice is made The patient accepts, declines, or sets categories individually. A Global Privacy Control signal from the browser is honoured without showing a box at all. source: widget · preference_center · api · gpc
- STEP 3 The record is written The ten fields above travel over TLS to our API. The IP is hashed on arrival; the region is derived server-side. If the write fails, the event is queued and retried rather than dropped. transport: TLS 1.2+
- STEP 4 Tags are released Only the categories that were granted are allowed to run, and the consent state is sent to Google's Consent Mode before the tag library is allowed to fire. order: default → update → release
- Analytics tags
- Advertising pixels
- Tag managers
- Session recording
- Chat and call widgets
- Remarketing tags
The consent script talks to exactly two hosts: the file it loads from, and the endpoint it posts the record to. Both are ours. It does not call an analytics provider, an advertising network, or an IP-geolocation service. That holds on our own website too: open the network tab here and you will see no third-party request until you have consented to one. We run analytics on this marketing site, gated behind our own consent box like anyone else's — which is the only honest way to sell this.
03 / Immutability
The record cannot be edited, including by us
A consent log that can be quietly rewritten after a complaint arrives is not evidence of anything. So the account our application runs as is granted the right to read and to append, and is explicitly stripped of the right to change or remove a row.
-- the application account GRANT SELECT, INSERT ON consent_events TO app_user; -- and what it is refused REVOKE UPDATE, DELETE ON consent_events FROM app_user; REVOKE UPDATE, DELETE ON consent_events FROM audit_reader;
This is a database permission, not a convention in the application code — an ordinary bug, or someone with the application's own credentials, cannot get around it, because the refusal happens inside Postgres. A test in our build suite connects as that account, attempts a real UPDATE against the table, and fails the build if the database allows it to succeed. Corrections are made the way a ledger makes them: by appending a new event that supersedes the last one, leaving both visible.
How long it is kept, and what happens if you leave
Consent records are retained for six years from the date of the event. The number is matched to HIPAA's accounting-of-disclosures right, which entitles an individual to “an accounting of disclosures of protected health information made by a covered entity in the six years prior to the date on which the accounting is requested” (45 C.F.R. § 164.528(a)(1)). Under OCR's tracking-technology guidance, a tag firing on a health-intent page can itself be a disclosure to a third party — so six years is the window in which a practice may still be asked what fired and whether anyone agreed to it. That reading is with counsel and is not settled.
Retention is not tied to billing. Ending a subscription stops collection, the dashboard and the reports. It does not delete the record — the evidence is worth most after the relationship ends, because demand letters and regulator questions arrive late. On cancellation the practice is given a complete export of its own records, so custody transfers rather than the evidence being destroyed. A paper trail that disappears when the invoice stops is not a paper trail.
04 / Infrastructure
Where the data physically lives
Consential runs in a single United States region, inside professionally operated commercial data centres. The facility operator is responsible for the building; we are responsible for everything running inside it.
- RegionUnited States — one region. No replication to another region and no processing outside the United States.
- NetworkThe database publishes no public port. It sits on a private network and is reachable only from the application itself — there is no route to it from the internet.
- In transitTLS 1.2 or higher for every connection reaching us from the outside world.
- AccessSeparate database roles for the application and for read-only audit export. The superuser role that could alter the ledger is held out of the application entirely.
- AWS BAAExecuted and active, effective 13 July 2026, covering the AWS services we build on.
- BackupsDumped nightly, then restored and verified before the copy is kept — a backup nobody has restored is a hope, not a backup. Fourteen days rolling, plus the first of every month retained.
The free scanning tool at analyze.consential.io runs on separate infrastructure from the consent platform. It reads publicly available web pages and stores the domain scanned and its result. It never receives patient data, consent records, or anything from a practice's own systems, and it is deliberately outside the scope of the BAA above.
05 / Subprocessors
The third parties in the path
The outside services that touch, transmit, or store any part of the system. It is short on purpose. The final list is being fixed with counsel before launch and will be published here in full.
| Provider | What it does | Location | Sees consent data |
|---|---|---|---|
| Amazon Web Services | Object storage and content delivery for this website and for the consent widget itself. Covered by an executed Business Associate Addendum. | United States | No — it serves the widget, it does not receive decisions |
| Cloudflare | Authoritative DNS for the consential.io domain. Traffic is not proxied through Cloudflare; it resolves names and nothing more. | Global anycast DNS | No |
| Tag Manager and Analytics on this marketing website only — so we can see which pages get read. It is gated by our own consent box exactly like a practice's would be, and it is absent from the consent platform and from any practice's site. | United States | No — and only after you opt in | |
| Amazon / Let's Encrypt | TLS certificate issuance for the public endpoints. | United States | No |
If this list changes, it changes here first. We will not add a subprocessor that handles consent records without a signed agreement covering it, and a practice that wants notice of changes in writing should say so in its own agreement with us.
06 / The legal floor
The rules this is all measured against
Two layers sit underneath every medical practice website in the United States: the federal one, which is the same everywhere, and the state one, which is not. The figures below are statutory maximums and pleading floors as written — not predictions, and not an assessment of any particular practice.
HIPAA civil money penalties escalate by what the covered entity knew and whether it fixed the problem. Amounts as adjusted for inflation effective 28 January 2026, under 45 C.F.R. § 160.404.
View as table, with per-violation ranges
| Tier | Culpability | Per violation | Annual cap |
|---|---|---|---|
| 1 | Did not know | $145 – $73,011 | $36,505 |
| 2 | Reasonable cause | $1,461 – $73,011 | $146,053 |
| 3 | Willful neglect, corrected | $14,602 – $73,011 | $365,052 |
| 4 | Willful neglect, not corrected | $73,011 – $2,190,294 | $2,190,294 |
Twenty US states have a comprehensive consumer privacy law in effect. Most practices assume HIPAA lifts them out of all twenty. In seven of them, it does not.
- 13 states — exempt at the entity level. The whole statute steps aside for a HIPAA covered entity.
- 7 states — exempt the data, not the business. California, Colorado, Delaware, Maryland, Minnesota, New Jersey and Oregon carve out PHI only, so the practice's website and marketing data stay in scope.
There is a prior question almost no practice has answered in writing: are you actually a covered entity? A cash-pay aesthetic or wellness practice that never transmits a HIPAA standard transaction electronically may not be — in which case no state exempts it at all.
View as table
| Treatment of a HIPAA covered entity | States |
|---|---|
| Entity-level exemption — statute does not apply | 13 |
| PHI-only exemption — statute still applies to other data | 7 |
| Total states with a comprehensive law in effect | 20 |
Every figure on this page is drawn from the statute, the regulation, or the enforcing agency's own material, and each one is a maximum or a pleading floor rather than a forecast of what any case would produce. Applying a mid-century eavesdropping statute to a marketing pixel is a contested theory and courts have split on it. This is information, not legal advice, and it is pending review by healthcare counsel. Read your own state's page at State Privacy.
If you are a patient, this is your part
Everything above describes how the system works for the practice. This is what it means for you as the person whose choice was recorded.
If a practice using Consential sent you a personalised link — in a confirmation email, or from a footer on their website — that link opens your own consent record. You can see what you agreed to and when, change any category, or withdraw everything. A withdrawal takes effect on your next page load and is recorded as its own event.
There is no general public login, because your record is tied to a private per-visitor link rather than to an account. That is a deliberate design decision and not a missing feature: an account would require us to hold your name and email address, which is exactly what the record above goes out of its way not to contain.
- Change your choicesOpen the personalised link from the practice, adjust any category, and save. The change is recorded immediately.
- Withdraw consent entirelyChoose to decline everything. Non-essential tags stop running on your next page load.
- Use Global Privacy ControlIf your browser transmits a GPC signal, we honour it automatically and record that we did. You do not have to click anything.
- Can't find your link?Contact the practice directly — they hold the relationship and your records. You can also reach out to us and we will help track it down.
- Requests about your health recordsThose go to the practice, not to us. They are the covered entity; we handle only the consent event described above, on their behalf.
08 / Documents
Everything in writing
Several of these are published as topic outlines rather than binding text while they are with healthcare counsel. We would rather show you an honest outline than fabricated legal language that reads convincingly and protects nobody.
Questions
The ones we actually get asked
Does Consential ever see protected health information?
No. A consent record holds no name, contact detail, page URL, or clinical context — the ten fields listed above are the whole of it. A Business Associate Agreement is still the right instrument, because a practice's regulator cares about the arrangement rather than our assurance about it, and because the hashed IP and visitor identifier are the kind of data a regulator would want covered. Holding a BAA and holding no PHI are not in tension; the first is what makes the second verifiable.
Can a practice delete a consent record it does not like?
No, and neither can we through the application. The database account the platform runs as has no UPDATE or DELETE permission on the consent ledger, so the refusal happens in Postgres rather than in code that could be changed or bypassed. A correction is made by appending a new event that supersedes the old one, and both remain visible. That is the whole point of the product.
Is the visitor identifier a fingerprint?
No. It is a random value generated by the browser's cryptographic random number generator and stored in a first-party cookie. Nothing about the device — screen size, fonts, hardware, canvas rendering — is measured to produce it. Because it is random rather than derived, the same person visiting a different practice's website receives an entirely unrelated identifier, and the two cannot be linked.
Where is the data stored, and does it leave the United States?
It is held in a single United States region and is not replicated to another region. There is no processing outside the United States. AWS's Business Associate Addendum covering the AWS services we build on has been executed and is active, effective 13 July 2026.
Does using Consential make a practice compliant?
No, and any vendor who tells you otherwise is selling you something. Consential is consent and accessibility infrastructure. It gates tracking until a patient decides, and it records what was decided in a form that cannot be quietly rewritten later — which strengthens a practice's position and gives it a defensible, timestamped history. Whether a given practice meets its obligations depends on facts well outside a piece of software, and that assessment belongs to its own counsel.
What happens to our records if we cancel?
They are not deleted, and that is deliberate. Ending a subscription stops collection, dashboard access and the monthly reports; the archive stays for the balance of its six-year retention period. On cancellation the practice is given a complete export of its own consent records, so custody transfers rather than the evidence being destroyed — which is the correct shape anyway — the practice is the covered entity and it is their evidence. Deleting on cancellation would destroy the one artifact that answers a demand letter arriving eight months later, and routine destruction after a duty to preserve has attached is its own problem.
How do I make a data request about myself?
Start with the practice whose website you visited. They hold the relationship, and under both HIPAA and the state privacy laws they are the party your rights run against; we act on their instructions. If you need help identifying the right contact, or your request concerns the consent record specifically, write to us and we will route it.
See what your own site is doing right now
The scan reads a practice's public pages and reports which trackers fire before anyone has consented to anything. It takes about thirty seconds and does not require an account.
Imagery: the two data centre visuals on this page are AI-generated illustrations, tinted to brand. They depict the kind of facility described here and are not photographs of any real site, including the region Consential runs in.