Skip to content

Cookie Policy

Last updated: 21 September 2026

This page explains how RehabPilot (Rosenheinrich Software Solutions) uses cookies and similar technologies on rehabpilot.org. It complements our Privacy Policy.

Controller

Rosenheinrich Software Solutions (Phillip Rosenheinrich), Destouchesstr. 3, 80803 Munich, Germany. Contact: see Legal Notice.

Cookie preferences (CMP)

On our marketing site we show a first-party consent banner (bottom bar) with Reject and Accept All, plus Preferences. You can reopen preferences via Cookie settings in the footer. Choices are stored in browser localStorage under rp_consent_v2 (policy version 2026-09-21). A policy-version bump asks again.

We honour Global Privacy Control (GPC) by denying Statistics and Marketing cookies when the signal is present.

Categories we use

  • Essential — always on. Security, login session (rp_web_auth), language (rp_locale), consent storage, and disclosure of Cloudflare (CDN/security) and Stripe (checkout) cookies. Consent Mode: security_storage (granted).
  • Statistics — optional. Google Analytics (GA4) via Google Tag Manager. Consent Mode: analytics_storage. No analytics cookies until you allow this.
  • Marketing — optional. Google Ads conversion measurement and Google Tag Manager marketing tags. Consent Mode: ad_storage, ad_user_data, ad_personalization. No ads cookies until you allow this.

Preference cookies such as billing currency (rp_billing_currency) are documented for transparency; they are not required for core use and can be deleted in your browser.

Before Google tags run, Consent Mode defaults are denied for ads and analytics storage (wait_for_update: 500). Allowing Statistics grants analytics_storage; allowing Marketing grants the ads signals. Google Tag Manager (GTM-PZWSP2X6) loads under those defaults in Advanced Consent Mode.

Each preference change pushes a rp_consent_update event to the dataLayer (rp_consent_analytics / rp_consent_marketing).

First-party metrics

An anonymised, cookieless page-view beacon (rpq / daily hashed IP+UA, no advertising ID) helps us understand funnel traffic. Legal basis: legitimate interests (Art. 6(1)(f) GDPR). It is outside the CMP opt-in.

Portal & apps

The customer account portal does not show this marketing CMP or load Google Ads / GA4 tags. In-app analytics and Crashlytics use a separate opt-in in the RehabPilot apps (see Privacy Policy).

Withdraw or change consent

Use Cookie settings in the site footer, or clear site data for rehabpilot.org in your browser. Declining marketing still allows cookieless modelled conversions where Google supports them.

Essential cookies: contract performance / legitimate interests as applicable. Statistics and Marketing cookies: consent (Art. 6(1)(a) GDPR / § 25 TDDDG) via the CMP.