IN SHORT
This website sets a small number of cookies that are strictly necessary for security. It also offers Google Analytics, which only runs if you agree to it — nothing analytics-related loads until you choose, declining costs you nothing, and you can change your mind at any time using the Cookie Preferences link in the footer of every page. We do not run advertising or retargeting cookies of any kind.
1. What This Policy Covers
This Cookie Policy explains what cookies and similar technologies are used on the RedHalo website at www.redhalolife.com, what each one does, how long it lasts, and how you can control it. It applies to this website only.
Cookies are small text files that a website asks your browser to store. Related technologies — local storage, session storage, and pixels or beacons — do a similar job by different means. Throughout this Policy, "cookies and similar technologies" means all of them.
For how we handle personal data across the RedHalo Mobile App and the Blood Bank Management System (BBMS), please read our Privacy Policy.
2. Our Position on Tracking and Advertising
RedHalo operates in a sector where trust is not optional. We handle blood donor health information, and we hold our marketing website to a standard that reflects that.
What that means in practice:
- We run no advertising or marketing tags — no Google Ads, no Meta Pixel, no LinkedIn Insight Tag, no retargeting, no conversion pixels.
- Our analytics is opt-in, not opt-out. Google Analytics is not downloaded, and sets no cookie, unless and until you say yes.
- Declining is a real choice. Reject is one click, exactly as easy as Accept. Nothing on this site is withheld, degraded or nagged at if you decline.
- Closing or ignoring the notice counts as a refusal, not as agreement.
- We never connect website browsing to any health data held in the RedHalo App or BBMS.
WHY WE ASK AT ALL
Google Analytics tells us things a cookieless tool cannot: whether a visitor who read a blog post later looked at our products, and which routes through the site actually lead somewhere. That helps us write better material and build a clearer site. It is useful, but it is not worth taking without asking, so we ask.
3. Every Cookie and Storage Item We Use
This is the complete list. Nothing outside this table is set by this website.
3.1 Strictly Necessary — always active
These keep the site available and protect it from abuse. They cannot be switched off, and the site cannot be operated safely without them.
| Name | Type | Set by | Purpose | Retention |
|---|---|---|---|---|
| __cf_bm | Cookie | Cloudflare | Bot management. Separates human visitors from automated traffic. | About 30 minutes |
| _cfuvid | Cookie | Cloudflare | Supports rate limiting, so a single source cannot overwhelm the site. | Session |
| cf_clearance | Cookie | Cloudflare | Set only if you are shown and pass a security challenge, so you are not challenged repeatedly. | Up to 30 days |
| Turnstile challenge state | Cookie / local storage | Cloudflare | Set only on pages with a form. Supports the anti-spam widget protecting the Contact, Partner, Investor and Demo forms. | Short-lived; cleared after submission |
3.2 Preferences — your own choice, stored locally
| Name | Type | Set by | Purpose | Retention |
|---|---|---|---|---|
| redhalo_consent | Local storage | RedHalo | Records the analytics choice you made, with a version marker and a timestamp, so we honour it and do not ask again. Holds no identifier and no personal data. | Until you clear your browser storage |
We deliberately keep this record in local storage rather than in a cookie, so that refusing analytics leaves no new cookie on your device at all.
3.3 Analytics — only with your consent
These are set by Google Analytics 4 and appear only if you have accepted analytics. If you decline, or have not yet chosen, none of them exist on your device.
| Name | Type | Set by | Purpose | Retention |
|---|---|---|---|---|
| _ga | Cookie | Holds a randomly generated identifier so that repeat visits from the same browser can be counted as one visitor rather than many. | 2 years | |
| _ga_<id> | Cookie | Maintains session state for our specific Analytics property. The suffix is our property identifier. | 2 years |
NOTE
Cookie names and lifetimes used by Cloudflare and Google are set by those providers and may change without notice to us. We review this table periodically; their own documentation is the authoritative source.
4. How We Measure Website Traffic
We use two tools, and they are treated very differently because they behave very differently.
4.1 Cloudflare Web Analytics — cookieless, no consent needed
This is our baseline measurement. It sets no cookies, writes nothing to your device, does not fingerprint your browser, and builds no cross-site profile. Because it stores nothing on your device and reports only in aggregate, it needs no permission and is unaffected by your analytics choice.
It reports page paths and visit counts, referring sites, country, browser, operating system, device type, and page load performance. None of it identifies you.
4.2 Google Analytics 4 — consent required
Google Analytics 4 ("GA4") is provided by Google LLC. It sets the cookies listed in Section 3.3 and sends usage data to Google, which is why we ask first.
If you accept, GA4 collects:
| What is collected | What it is used for |
|---|---|
| Pages viewed, and the order and timing of them | Understanding which routes through the site work and which dead-end |
| A randomly generated client identifier | Recognising a returning browser so visits are not double-counted |
| Referring site or search engine | Knowing which channels bring people to us |
| Approximate location, to city level | Understanding where our audience is |
| Device, browser, operating system and screen size | Deciding what we must support and test |
| Interactions such as scroll depth and outbound clicks | Judging whether pages are actually read |
We have configured GA4 as follows:
- Google Consent Mode v2 is implemented, with all storage categories set to denied by default. The tag is not even requested until consent is granted.
- Advertising features, Google Signals and ad personalisation are not enabled. Analytics data is not used to build advertising audiences.
- Google states that GA4 does not log or retain IP addresses; the IP address is used in transit to derive approximate location and is then discarded.
Google processes this data as our processor for analytics purposes, and under its own terms for the operation and security of its service. Google's own privacy policy is available at policies.google.com/privacy.
5. Third Parties This Website Contacts
Loading a page causes your browser to contact the parties below. We list all of them, including those that set no cookies, because any such request necessarily discloses your IP address and browser details to that party.
| Provider | Why it is used | Cookies | Consent |
|---|---|---|---|
| Cloudflare | Hosting, content delivery, DDoS protection and bot management | Strictly necessary only | Not required |
| Cloudflare Web Analytics | Aggregate, cookieless traffic measurement | None | Not required |
| Cloudflare Turnstile | Protects our forms from spam and automated abuse | Strictly necessary only | Not required |
| Google Fonts | Serves the Sora and IBM Plex typefaces used across the site | None | Not required |
| Google Analytics 4 (Google LLC) | Detailed traffic and journey analytics | Yes — see Section 3.3 | Required |
We place no advertising, social media, live chat, heatmap or session-recording third parties on this website.
6. Transfers Outside India
If you accept analytics, the data GA4 collects is processed by Google LLC on infrastructure outside India, including in the United States. Google applies its own safeguards and contractual terms to those transfers.
Under Section 16 of the Digital Personal Data Protection Act, 2023, a Data Fiduciary may transfer personal data outside India except to territories restricted by notification of the Central Government. We monitor those notifications and will stop the transfer if Google's processing locations become restricted.
Cloudflare operates a global edge network and may serve this site, and process the strictly necessary security cookies, from a location outside India.
If you would prefer that nothing about your visit leaves India, decline analytics. The remaining processing is limited to the security cookies in Section 3.1 and the cookieless aggregate measurement in Section 4.1.
7. What We Do Not Do
So that there is no ambiguity, we confirm that on this website we do not:
- Use advertising, marketing, retargeting or conversion cookies.
- Sell, rent or share browsing data with data brokers or advertising networks.
- Enable Google Signals, ad personalisation or advertising audiences in GA4.
- Build commercial or behavioural profiles of visitors.
- Record your screen, mouse movements or keystrokes.
- Use device fingerprinting to identify you.
- Load any analytics before you have consented to it.
- Link website browsing to health data held in the RedHalo App or BBMS.
8. Your Choices and How to Change Them
8.1 Changing your mind, at any time
Every page on this site carries a Cookie Preferences link in the footer. It reopens the same panel you saw on your first visit, shows your current setting, and lets you switch analytics on or off.
When you withdraw consent, we instruct Google to stop using analytics storage and actively delete the _ga cookies already on your device. Withdrawal is as easy as consent was, as it should be.
8.2 Browser-level controls
Every major browser lets you view, delete and block cookies and local storage, either entirely or per site. Look under Settings → Privacy in Chrome, Firefox, Safari, Edge or Brave. Private or Incognito browsing discards all such storage when the window closes.
PLEASE NOTE
Blocking the strictly necessary Cloudflare cookies in Section 3.1 may cause security challenges to repeat, or may stop our Contact, Partner, Investor and Demo forms from submitting. The rest of the site will work normally.
Clearing local storage for this site also removes your redhalo_consent record, so you will be asked again on your next visit.
8.3 Opting out of Google Analytics everywhere
Google publishes a browser add-on that disables GA4 measurement across every site you visit, not only ours. It is available at tools.google.com/dlpage/gaoptout. A general-purpose content blocker will also prevent the GA4 script from loading.
8.4 Your rights under the DPDP Act
You may ask us what personal data we hold about you, ask for it to be corrected or erased, withdraw consent, or raise a grievance. Section 7 of our Privacy Policy sets out those rights and how to exercise them.
9. The RedHalo Mobile App and BBMS
This Policy covers the website only. The RedHalo Mobile App does not use browser cookies; it uses equivalent persistent identifiers such as device identifiers and push notification tokens, described in Section 12 of our Privacy Policy and controlled from within the App under Privacy Settings.
The BBMS is operated by blood banks under their own administration. Access is restricted to authorised staff, and its session cookies are strictly necessary for authentication.
10. Legal Basis Under the DPDP Act, 2023
RedHalo India Private Limited is the Data Fiduciary for personal data processed through this website, as defined under India's Digital Personal Data Protection Act, 2023.
| Processing | Basis | Why |
|---|---|---|
| Google Analytics 4 | Consent | GA4 stores an identifier on your device and discloses usage data to a third party, so we rely on your freely given, specific and informed consent, obtained before anything loads and withdrawable at any time. |
| Strictly necessary security cookies | Legitimate use | Set by our security provider to keep the site available, to verify a form submission comes from a person rather than a bot, and to prevent abuse. The site cannot be operated safely without them, and they are not used to profile you. |
| Consent record | Not personal data | A functional record of your own choice, holding a version marker and timestamp. It contains no identifier and cannot be linked to you, so it falls outside the scope of the Act. |
| Cookieless aggregate analytics | Not personal data | The measurement sets nothing on your device and the reporting is aggregated. No individual is identified or identifiable, so it falls outside the scope of the Act. |
Where you choose to submit a form, the personal data you provide is processed on the basis of your consent, as set out in our Privacy Policy.
11. Changes to This Cookie Policy
We will update this Policy whenever we add, remove or change a cookie or a third-party service. The "Last Updated" date at the top of this page always reflects the current version.
If we introduce a new category of non-essential technology, we will ask for your consent again rather than carry over a choice you made about something else. Our consent record is versioned specifically so that this is possible.
12. Contact and Grievance Officer
If you have a question about this Cookie Policy, or wish to exercise any right under the DPDP Act, please contact us:
| Entity | RedHalo India Private Limited (CIN: U62099KA2026PTC215436) |
| Registered office | Flat No. 003, Kingstone Lifestyle, Carmelram, Bangalore, Karnataka, India – 560035 |
| info@redhalolife.com | |
| Website | www.redhalolife.com |
| Response time | Within 48 hours of receipt |
You may also refer to Section 16 of our Privacy Policy for the designated Data Protection / Grievance Officer.