Cookie and tracking notice.

This Cookie and Tracking Notice explains how HandshakeMD, operated by shrinkMD Publishing LLC, a Florida limited liability company, uses cookies and similar technologies on handshakemd.com and in related Platform services.

It should be read with our Privacy Policy and our Consumer Health Data Privacy Policy. Where they overlap, the more protective treatment applies.

One thing sets this document apart from the others, and it is worth saying at the start. Every other legal page here describes how people will behave. This one describes what a machine does, which means you can check it, and being wrong about it would be obvious to anybody who opened developer tools. So it is written in the present tense about a deployment that has been scanned, rather than in the language of what a platform may one day do.

1What cookies are

Cookies are small text files a website can ask your browser to store on your device, and then read back on a later request. They can keep you signed in, remember a preference, protect an account, detect fraud, measure how a site performs, or follow you between sites for advertising.

Several other technologies do the same job by different means, and this Notice treats them all together:

• local storage and session storage, which keep values in the browser rather than sending them with every request;
• pixels, tags, and beacons, which are usually a tiny image or a script request whose real purpose is the request itself;
• scripts and software development kits loaded from another company;
• device and browser identifiers, including values assembled from your browser's characteristics rather than stored on it; and
• similar browser or device technologies that arrive after this Notice was written.

Where this Notice says Cookies with a capital C, it means all of that, not only the text files. The distinction matters because most of the privacy problems in this area now come from the technologies that are not literally cookies.

2What this site actually does

HandshakeMD sets no cookies. Not analytics cookies, not advertising cookies, not strictly necessary cookies. It also uses no local storage, no session storage, and no other device storage, and it makes no request to any third party while you use it.

That is a statement of fact about a deployment rather than an aspiration, so it is worth saying how it is checked. A scan runs against the live site and against every build, loads each page, searches for a health phrase, fills in the estimate tool, and then reports every cookie, every stored value, and every request that left the origin. The most recent scan was on 2026-08-31 and found none of any of those. Section 21 is that scan's output rather than a table written by hand, and section 22 tells you how to check it yourself in about ten seconds.

Because the Platform is used to search for clinicians, which is health related activity whatever it is called, some things are commitments rather than current facts. We do not, and will not without changing this Notice first:

• build a profile of your health interests, inferred conditions, or symptoms;
• infer a diagnosis for advertising, ranking, or any other purpose;
• sell, rent, or share health related browsing activity;
• track you across unrelated websites for behavioural advertising; or
• disclose identifiable health related search activity to an advertising network.

Three of those are enforced by a test that fails the build rather than by anybody remembering. That is described in section 8 and in the Consumer Health Data Privacy Policy.

3The four categories, and where each one stands

Cookie notices normally sort technologies into four categories, and normally describe what each category is used for. All four are listed here with what is true of this Platform today, because a section describing login cookies on a site with no login is the part of a cookie notice that goes stale first and misleads most.

Strictly necessary. Cookies without which a site cannot do what somebody asked it to do. Session management, authentication, load balancing, fraud prevention, remembering a consent choice.

None in use. This is a static site with no accounts, no login, and no server side session, so there is no state to keep between requests and nothing for a necessary cookie to carry.

Functional. Cookies that remember a choice you made. A display preference, a saved filter, a language, a preferred area.

None in use. The search page keeps your filters in the address bar instead, which is why a search is shareable without anything being stored, and why closing the tab is enough to end it.

Analytics. Technologies that count visits and describe how people move through a site.

Current analytics provider: none. There is no analytics on this site at all, first party or third party, so there is no traffic data about you for us to hold, configure badly, or be asked to hand over.

Advertising and marketing. Technologies that build a profile for targeting, or that let another company recognise you somewhere else.

None in use, and this is the category we have committed against rather than merely not got round to. Section 8 is the specific commitment and the check that enforces it.

4Why there is no strictly necessary cookie either

Most sites that claim to use only necessary cookies still set two or three, because a login session, a form token, or a consent record has to live somewhere. This one does not, and the reason is structural rather than virtuous.

The Platform is a set of static files. Which means:

• there are no accounts and no passwords, so there is no session to keep;
• the search runs in your browser against a file it downloaded, so the server is never told what you searched for;
• the estimate tool runs entirely in your browser, so there is nothing to hold between steps; and
• there is no consent choice to remember, because there is nothing optional to consent to.

If accounts are ever added so that clinicians can claim and edit their own listings, that will need a session cookie, and it will be a strictly necessary one. This Notice and the inventory in section 21 get updated before that ships, not after.

5Health related search activity

People search this Platform by things that describe a health situation:

• specialty and sub specialty;
• condition or presenting problem;
• treatment type;
• insurance or cash pay;
• location;
• availability;
• population served;
• language; and
• other clinical criteria.

Depending on how it is collected and what it can be linked to, that activity can qualify as consumer health data under state law. Washington's My Health My Data Act, for example, reaches information that identifies or is reasonably linkable to a consumer and that relates to their physical or mental health status, and it treats seeking health care services as within that definition. Searching for a psychiatrist who treats a particular condition is squarely the kind of activity those laws were written about.

So the architecture treats a search as sensitive by default rather than treating it as sensitive once somebody complains. A raw search is never linked to a persistent identifier, because there is no persistent identifier to link it to.

6Search terms and the address bar

A search term in a URL is the quiet way health information escapes. The address bar is not private: a query string is sent to the server on every request, written into your browser history, passed to the next site in the referrer header, handed to any script on the page, and written into whatever logs sit in between.

This Platform keeps search state in the fragment, the part of a URL after the hash. A fragment is never transmitted in an HTTP request and is stripped from the referrer, so it stays in your browser. The practical result is that a search link is still shareable, still bookmarkable, and still gets you back to the same results, while the terms themselves never reach a server, ours included.

A test runs a real search for a distinctive phrase on every build, records every request that arrives at the server, and fails if the phrase appears in any of them. That check exists specifically so that a future change moving the search back into a query string breaks the build instead of shipping quietly.

One edge worth naming, because we would rather say it than have somebody find it. If you arrive here through an older link that carries search terms in a query string rather than after the hash, the request that loaded the page had already sent those terms before any of our code ran, and dropping them afterwards does not unsend them. The page does drop them immediately, so a reload, a bookmark, or an onward click cannot carry them further. Nothing this Platform builds puts search terms in a query string, and this is only about a link that arrived with them.

7Analytics

Current analytics provider: none. There is no analytics on this site at all, first party or third party, so there is no traffic data about you for us to hold, configure badly, or be asked to hand over.

If analytics is ever added, this Notice will name the provider before it is switched on, and the provider has to be configurable to:

• work without a cookie or a persistent identifier;
• truncate or discard IP addresses rather than store them;
• exclude query strings and fragments, so no search text is ever sent;
• keep no user level records and offer no cross site identity feature;
• retain aggregates for a stated period and no raw event log beyond it; and
• contractually forbid the vendor using any of it for its own advertising purposes.

A provider that cannot do those things is the wrong provider. It is not a reason to soften this section, and a vendor calling its product anonymous does not make it anonymous: if a value can reasonably be linked back to a person or a device, this Notice treats it as identifying regardless of what the sales page says.

8Advertising technologies, and the check that keeps them out

The Platform does not use, on any page:

• the Meta Pixel or any Meta conversion or advertising tag;
• Google Ads remarketing or conversion tags, or Google Tag Manager;
• Google Analytics;
• the TikTok Pixel;
• the LinkedIn Insight Tag;
• X or Twitter conversion tracking;
• session replay or heat mapping tools;
• cross site retargeting pixels of any kind; or
• an advertising or data broker software development kit.

This is not a statement of intent. Every one of those is a pattern in a test that greps the built site on every build and fails on a match, so a snippet somebody pastes in next year gets caught by the build rather than by a journalist. The list includes Google Fonts, Google Maps, and YouTube embeds, because those are third party requests too and a directory is exactly the kind of site that reaches for them.

There is no advertising on this Platform at all, and no paid placement in the directory. Nobody pays to appear, to rank higher, or to be shown first, which removes the commercial reason most directories end up with advertising technology in the first place.

9Device storage

The Platform uses no local storage, no session storage, and no other browser database. That is unusual enough to be worth stating plainly, because local storage is the normal way a site avoids a cookie banner while still keeping a value on your device, and the storing is the thing privacy law cares about rather than the file format.

Where a value has to survive from one page to the next, it lives in the address bar as a fragment, which means it lives in the page you are looking at and disappears when you close it.

10Tools that run in your browser

Some tools on this Platform run entirely in your browser. The good faith estimate generator is the one that matters, because it is the only place on the site where anybody types information about a patient.

It is local in the strict sense. The page does the arithmetic in your browser, the values are never sent anywhere, and nothing is written to storage, so closing the tab is the whole of the deletion process. There is no draft to recover, no autosave, and no copy on our side, which is deliberate: the point of a local tool is that we never hold the information at all.

Two consequences worth being straight about. If you print or save the estimate, the copy is yours to look after. And a tool that runs on your device runs in your device's environment, so your browser, your extensions, and anyone with access to your computer are outside our control. The Good Faith Estimate Tool Terms cover this in more detail.

11Authentication

There is no authentication, because there are no accounts. Nobody has a password on this Platform, which is why no page asks for one and why no page can ask for one. A page that appears to and asks you to log in is not ours.

Listing confirmations work through a single use link sent to the address on the listing, which means a clinician confirms availability without an account and without a cookie. If accounts arrive later, the session cookie they need will be a strictly necessary one, disclosed here before it ships.

12Security and infrastructure

The Platform is served through Cloudflare, which sits between your browser and the files. Delivering a page over the internet means the infrastructure sees the technical information any web request contains: your IP address, the time, the page requested, and your browser's user agent and language headers.

That processing is necessary to serve the site and to keep it up, and it happens at the network layer rather than through anything stored on your device. No cookie is set for it today. Cloudflare's bot management does set a cookie when it is enabled, so if that is ever turned on it belongs in the table in section 21, and the scan is what would catch it.

One detail most notices leave out. The responses carry Network Error Logging headers, which ask your browser to report failed requests to a Cloudflare endpoint. It is configured to report failures only and not successful page views, but it is still a browser initiated request to a third party, and a Notice that claimed no third party contact of any kind while that header is present would be wrong. Section 19 covers what else the platform adds.

13Why there is no cookie banner

There is no consent banner on this Platform, and that is a decision rather than an omission. It was made from the deployment rather than from what other sites do.

Consent requirements in this area attach to storing information on your device, or accessing information already stored there, beyond what is strictly necessary to provide what you asked for. This site stores nothing on your device at all. There is no optional technology here, so there is no category of thing left for you to accept or reject, and a banner asking you to choose would be asking about something that does not exist.

It would also make the privacy position worse rather than better. A consent tool has to remember your answer, which means the first cookie this site ever set would be the one recording your opinion about cookies, and most consent platforms are themselves third party scripts that load before you have agreed to anything.

What would change this: adding analytics, an advertising technology, an embedded third party service, or any storage that is not strictly necessary. Any of those means a consent mechanism appropriate to the jurisdictions involved goes in first, with this Notice updated before deployment rather than after.

14Your browser controls

Every mainstream browser lets you:

• see which cookies a site has set;
• delete them, for one site or all of them;
• block them, or block only third party cookies;
• clear local and session storage;
• ask to be warned before anything is stored; and
• browse in a private window that discards everything when it closes.

Any of those can be used here and none of them will break anything, which is the useful part of having no cookies: blocking cookies on this site changes nothing, because there is nothing to block. Browsers move their menus around, so their own help pages are the accurate instructions rather than a list here that would go out of date.

Turning JavaScript off is also fine. Every page's content, every legal document, every listing, and every published contact address is in the HTML and readable without it. Search and the estimate tool need JavaScript, because they run on your device, which is the same reason they never send anything to us.

15Global Privacy Control

Global Privacy Control is a signal a browser or extension can send saying that you do not want your personal information sold or shared. Several state privacy laws require a business to honour it as a valid opt out, and it is the mechanism actually recognised in law, as opposed to the older Do Not Track header.

This Platform does not sell personal information and does not share it for cross context behavioural advertising, which means there is nothing here for the signal to switch off. So the honest statement is not that we have built support for it, and not that we ignore it, but that the practice it exists to stop is not one we engage in.

That would change the moment any advertising or data sharing technology is introduced. If that ever happens, honouring recognised opt out preference signals gets built and tested before deployment, and this section will say so specifically rather than in the abstract. A page describing an opt out you cannot actually exercise is worse than no page.

16Do Not Track

Some browsers still send a Do Not Track header. There has never been a single agreed technical or legal standard for what a site must do in response, which is why the industry effort around it stalled and why newer laws point at Global Privacy Control instead.

This Platform does not respond to Do Not Track, and there is nothing for it to respond to, since no tracking happens either way. That is separate from the legally recognised opt out mechanisms in section 15.

17Embedded third party content

Directory sites usually embed other companies' services, and each one is a request that tells that company you are here. This Platform embeds none of the following:

• a map or geocoding widget;
• video from a third party player;
• a scheduling or booking widget;
• a captcha;
• a chat, support, or feedback widget;
• an embedded document viewer;
• social sharing buttons;
• a review or ratings widget; or
• a font, script, or stylesheet from another company.

Some of those are genuinely useful and their absence costs the Platform something. A map would be nicer than a list of addresses. The trade is deliberate: on a page where somebody is looking for a psychiatrist, an embedded widget means a third party learns which clinician's page was open, and no map is worth that.

Links to other sites are a different thing. This Platform links out to the other Shrink Network sites, to clinicians' own websites, and to sources such as licensing boards and the National Provider Identifier registry. A link is not a request: nothing is sent to those sites until you click, and once you do, their own policies apply rather than this one.

18Fonts

The four typefaces this site uses are served from handshakemd.com as local font files. None of them comes from a font hosting service, so loading a page on this Platform tells no font provider that you are reading it.

This is a small thing that is worth doing anyway. A hosted font is a request to another company on every page load, which makes it both a privacy disclosure and one more sentence a policy has to carry. Self hosting removes the request and the sentence at once.

19What the hosting platform adds, and what we turned off

A static site is not entirely in the hands of the people who wrote it. A hosting platform can add things to a page after the build, and a cookie notice that only describes the repository would miss them. So the scan looks at what the live site actually serves and compares it against what this project built.

It found one thing. Cloudflare enables a feature called Email Address Obfuscation on new sites by itself, and it was rewriting every published contact address on the legal pages into the words [email protected], with a small script added to the page to put the real address back once JavaScript ran.

The intent is anti spam and the effect here was not acceptable. The addresses it rewrote are the ones a copyright notice, a privacy request, a correction, and a service of process enquiry are supposed to go to. A reader with JavaScript turned off, or whose script simply failed, was being shown a legal contact route they could not use, which makes a published process defective rather than merely inconvenient. It also put a script on the legal pages that this project had not written.

So the build now marks every published address as one that must not be rewritten, using the documented mechanism for it, and the check runs on every page rather than the ones somebody remembered. The addresses ship as real text, readable with no script running at all. We would rather filter spam than publish a contact route that needs JavaScript to read.

That fix is a reason to keep scanning rather than a reason to stop. Any platform level feature can be switched on from a dashboard by somebody who is not thinking about this document, which is why the scan is a command in this repo and not a thing that happened once.

20Retention

There is nothing on your device for us to retain, so the usual table of cookie lifetimes has nothing to describe. Session cookies would expire when a browser closes and persistent ones would last for a stated period, and neither exists here.

The Platform does hold information you deliberately send it, such as a listing request or a listing confirmation, and the Privacy Policy is where retention for that is described. Nothing in it comes from tracking you.

21The current inventory

This is the output of the most recent scan rather than a table written from memory. It was produced by a command in this project's repository that loads every significant page against the live site and against a local build, searches for a health phrase, fills in the estimate tool, and then lists every cookie in the jar, every value in browser storage, and every request that left the origin.

Every cookie and storage technology found on handshakemd.com by the scan of 2026-08-31

Cookie or technology	Set by	Purpose	Category	Duration
None	Nobody	There is nothing to describe, because the scan found no cookie and no stored value	Not applicable	Not applicable

Scan date: 2026-08-31. If this table and your browser ever disagree, your browser is right and we want to know: write to privacy@handshakemd.com and we will treat it as a defect in the Platform rather than an argument about wording.

22How to check any of this yourself

Almost nothing in a privacy policy can be verified by the person reading it. This document is the exception, so here is how, in about ten seconds and with no special tools.

In any desktop browser, press F12 to open developer tools, then:

• open the Application or Storage tab and look at Cookies, Local Storage, and Session Storage. All three should be empty for this site;
• open the Network tab, reload the page, and sort by domain. Every request should be to handshakemd.com, except the browser's own error reporting described in section 12;
• go to the search page, run a search, and watch the Network tab. No request should appear carrying what you typed; and
• look at the address bar after searching. Your terms are after the hash, which is the part that never leaves your browser.

If any of that does not match what this page says, the page is wrong and we would rather hear it from you than not hear it. The same address in section 21 reaches us.

23Consumer health data

Where information collected through Cookies or similar technologies qualifies as consumer health data under applicable law, our Consumer Health Data Privacy Policy applies to it as well as this Notice, and the more protective treatment governs.

Washington's My Health My Data Act requires a covered business to disclose what consumer health data it collects, where it comes from, why, and who it goes to, and generally requires consent for collecting or sharing it beyond what is necessary to provide something the consumer asked for. Several other states have taken similar approaches. The simplest way to comply with all of them is not to collect the data, which is the position this Platform is in.

24Sale and sharing

We do not sell personal information, and we do not share it for cross context behavioural advertising. That covers health related browsing activity and search activity, and it covers the ordinary technical information too.

Those words carry specific statutory meanings that are wider than their ordinary ones. Under several state laws a sale can include a disclosure for something other than money, and a share can include letting another company use data for advertising even where nothing is paid. This Notice uses them in the wider statutory sense rather than the narrow everyday one, which is the reading that favours you.

There is nothing to opt out of here, because the practice does not happen. Requests about privacy rights go to privacy@handshakemd.com, and our State privacy rights and do not sell or share notice sets out the rights available, how a request is handled, and what would have to change before that answer moved.

25Tracking as part of the security picture

A tracking technology is part of a site's data architecture, not a marketing detail bolted onto the side. A pixel, a tag, or a vendor script can disclose identifiable information to a third party automatically, without anybody deciding to send it, and the disclosure is just as real for happening by default.

This matters here specifically because this Platform is not a HIPAA covered entity, and people sometimes read that as meaning health privacy rules do not apply. The Federal Trade Commission has been explicit that they do: its Health Breach Notification Rule reaches vendors of personal health records and related entities outside HIPAA, and its 2024 amendments confirmed the Rule's application to health apps and similar technologies. Several enforcement actions in this area have been about exactly this pattern, an advertising tag on a health related page.

That is the reasoning behind the architecture rather than a footnote to it. The safest way to avoid disclosing health data through a script is to have no scripts that could.

26Changes to this Notice

This Notice gets updated when what the Platform does changes, which includes:

• a new cookie or storage technology of any kind;
• an analytics provider being added, changed, or removed;
• a third party embed or vendor script;
• a hosting or infrastructure change that alters what is set or sent;
• a new feature such as accounts that needs a session; or
• a change in what applicable law requires.

The last updated date at the top identifies the current version, and the inventory in section 21 carries the date of the scan behind it, which is the more useful of the two dates. The commitment is that the disclosure comes before the deployment rather than after it.

27Contact

Questions about cookies or tracking technologies, and reports that something on this page does not match what your browser shows, go to privacy@handshakemd.com.

shrinkMD Publishing LLC, a Florida limited liability company
Operator of HandshakeMD
General correspondence: by email. We do not publish a general mailing address, because the address below is our registered agent rather than an office, and post sent to it for anything other than formal legal notice may not reach us.
Registered agent for service of process in Florida: Northwest Registered Agent LLC, 7901 4th St N Ste 300, St. Petersburg, FL 33702
Every contact route in one place: Legal notices and contact information

None of these is a HIPAA compliant channel and none is monitored around the clock, so please do not send clinical information about a patient. If you or somebody else is in immediate danger, call 911. If you are in crisis, call or text 988 to reach the Suicide and Crisis Lifeline.