Legal

Cookies

Weft sets cookies only to sign people in and keep them signed in. Every cookie below is strictly necessary to that, so there is no cookie banner and nothing to accept or refuse.

Nothing on the public pages or the help centre writes a cookie. The cookies below are set when somebody signs in to the practice application, the client portal, a video visit or the administration console.

What is set

`weft_session`

Set by: Practice application
Purpose: Keeps a signed-in team member signed in.
Lasts: Until the browser is closed. The session also ends after 15 minutes without activity or 8 hours in all.
Strictly necessary: Yes

`weft_challenge`

Set by: Practice application
Purpose: Carries a sign-in between the password and the second step, so the second step can only be answered by whoever entered the password.
Lasts: 10 minutes.
Strictly necessary: Yes

`weft_device`

Set by: Practice application
Purpose: Recognises a browser a team member chose to trust at the second step, so the second step is not asked every time. Not set unless they choose it.
Lasts: 30 days.
Strictly necessary: Yes

`weft_client_portal_session`

Set by: Client portal
Purpose: Keeps a signed-in client signed in.
Lasts: Until the browser is closed. The session also ends after 15 minutes without activity, or at the limit on a session's length, which is 12 hours unless the service has set another.
Strictly necessary: Yes

`weft_client_portal_challenge`

Set by: Client portal
Purpose: Carries a sign-in between the first step and the second step.
Lasts: 10 minutes.
Strictly necessary: Yes

`weft_visit_session`

Set by: Video visit
Purpose: Lets a client who joined a visit by its link stay in that visit's waiting room.
Lasts: Until the browser is closed. The visit ends it on the appointment's own clock.
Strictly necessary: Yes

`weft_admin_session`

Set by: Administration console
Purpose: Keeps a signed-in Weft administrator signed in. Practices and clients never receive it.
Lasts: Until the browser is closed. The session also ends after 10 minutes without activity or 8 hours in all.
Strictly necessary: Yes

`weft_admin_challenge`

Set by: Administration console
Purpose: Carries an administrator's sign-in between the password and the second step.
Lasts: 10 minutes.
Strictly necessary: Yes

Name	Set by	Purpose	Lasts	Strictly necessary
`weft_session`	Practice application	Keeps a signed-in team member signed in.	Until the browser is closed. The session also ends after 15 minutes without activity or 8 hours in all.	Yes
`weft_challenge`	Practice application	Carries a sign-in between the password and the second step, so the second step can only be answered by whoever entered the password.	10 minutes.	Yes
`weft_device`	Practice application	Recognises a browser a team member chose to trust at the second step, so the second step is not asked every time. Not set unless they choose it.	30 days.	Yes
`weft_client_portal_session`	Client portal	Keeps a signed-in client signed in.	Until the browser is closed. The session also ends after 15 minutes without activity, or at the limit on a session's length, which is 12 hours unless the service has set another.	Yes
`weft_client_portal_challenge`	Client portal	Carries a sign-in between the first step and the second step.	10 minutes.	Yes
`weft_visit_session`	Video visit	Lets a client who joined a visit by its link stay in that visit's waiting room.	Until the browser is closed. The visit ends it on the appointment's own clock.	Yes
`weft_admin_session`	Administration console	Keeps a signed-in Weft administrator signed in. Practices and clients never receive it.	Until the browser is closed. The session also ends after 10 minutes without activity or 8 hours in all.	Yes
`weft_admin_challenge`	Administration console	Carries an administrator's sign-in between the password and the second step.	10 minutes.	Yes

How they are held

Each cookie holds a random value and nothing else. It is marked HttpOnly, so a page cannot read it, and Secure, so it travels only over an encrypted connection. It has no domain, so the browser sends it back to the one host that set it.

Settings kept in your browser

The applications also keep some things in your browser's storage on your own device. These are not cookies.

Kept until you clear them: display preferences, such as the colour scheme, the text size, the time format and whether the sidebar is folded; in the practice portal, when you were last reminded to turn on two-step sign-in and whether it has been offered; and a short signal that lets your other open tabs of the same portal know you signed out, a session ended or you were active. The signal carries no name, record or session identifier.

Kept until the tab closes: the page to return to after you sign in, your scroll position on a page, the steps of signing in through a provider while they are in progress, which application's session has just ended, and, in the client portal, whether the pass for a visit has been used in that tab.