Cookie Policy

Published on 06.07.2026

Updated on 07.08.2026

Purpose

This Cookie Policy explains how Aurelia Private Health ('Aurelia', 'we', 'our') uses cookies and similar technologies on AureliaPrivateHealth.com. It should be read together with Aurelia Private Health’s Privacy Policy and Terms of Service.

1. About Aurelia

Aurelia Private Health is a physician-led concierge preventative medicine practice focused on longitudinal health intelligence, executive health assessments, evidence-informed preventative medicine and the Aurelia Age™️ Framework.

Regulatory Framework

Aurelia intends to operate consistently with the Protection of Personal Information Act, 2013 (POPIA), the Electronic Communications and Transactions Act, the Consumer Protection Act where applicable, HPCSA ethical obligations relating to confidentiality and electronic communications, and other applicable South African laws.

What Are Cookies?

Cookies are small text files placed on a user's device to improve website functionality, security, user experience and performance. Similar technologies may include pixels, local storage and software development kits where applicable.

Types of Cookies Used

Essential cookies support website security, authentication and core functionality. Preference cookies remember user settings. Performance and analytics cookies help understand website usage using aggregated information. Marketing cookies are used on this website only with consent, and the Meta pixel described below is the only one in use.

Why Aurelia Uses Cookies

Cookies may be used to protect website security, improve navigation, remember consent preferences, support appointment and waitlist functionality, improve accessibility, analyse website performance, detect fraud or malicious activity and enhance the member experience.

Healthcare Privacy

Cookies are not intended to replace Aurelia's secure clinical systems. Aurelia aims to minimise the use of technologies that could unnecessarily identify website visitors and will avoid using cookies to infer health conditions except where lawful, transparent and appropriate. The one exception is the Meta pixel described below. It is the only identifying technology on this website, it loads only with consent, it is limited to two events that carry no parameters, and nothing entered into the waitlist form is sent to Meta. One of those two events does, however, tell Meta that an application was completed. The position is set out in full under Health Information and the Pixel.

POPIA Principles

Where cookie-related information constitutes personal information, Aurelia intends to process it lawfully, transparently and only for specified, legitimate purposes consistent with POPIA principles of accountability, processing limitation, purpose specification, information quality, openness, security safeguards and data subject participation.

Consent

Non-essential technologies are stored only after the visitor selects 'Accept' on the cookie banner. The banner offers two choices, 'Accept' and 'Essential only', and the choice can be changed at any time using the 'Manage cookie preferences' button under User Choices below.

Third-Party Technologies

The website may integrate carefully selected third-party services such as advertising and measurement platforms, analytics providers, embedded content, booking systems or payment providers. Those third parties remain responsible for their own cookies and privacy practices. The only such technology in use at present is the Meta pixel, described below.

The Meta Pixel

AureliaPrivateHealth.com uses the Meta pixel (pixel identifier 1050298607530341), an advertising and measurement technology supplied by Meta Platforms Ireland Limited, the company behind Facebook and Instagram. Aurelia uses it for one purpose, which is to measure how Aurelia advertising on Facebook and Instagram performs, meaning how many people reach this website from an Aurelia advertisement and how many of them go on to submit a waitlist application. The pixel is present on every page of this website, including this one.

The pixel is a marketing technology and is not essential to the operation of this website. It loads only after a visitor selects 'Accept' on the cookie banner. Selecting 'Essential only', or making no choice at all, means the pixel never loads, no request is made to Meta and no Meta cookie is created on the device. Meta's image-based fallback beacon, which runs in browsers that cannot use JavaScript, has deliberately been left out of this website because it cannot be held back until consent is given.

Legal Basis for the Pixel

Aurelia processes this information on the basis of consent under section 11(1)(a) of POPIA. Consent requires a positive action. Nothing is selected in advance, continued browsing and silence are not treated as consent, and the pixel does not load before a choice is made. The choice, and the date and time it was made, are recorded in the visitor's own browser under the name aurelia-cookie-consent-v2, and that record is what the website reads to enforce the choice on later visits. It stays on the device and is never sent to Aurelia, to Meta or to anyone else.

An earlier version of the cookie banner described analytics rather than advertising. Consent given against that earlier wording has not been carried over. Every visitor is asked again against the wording now shown, and the pixel does not load until that fresh choice is made.

Consent may be withdrawn at any time under section 11(2)(b) of POPIA, using the 'Manage cookie preferences' button under User Choices below. Withdrawal deletes the _fbp and _fbc cookies immediately and stops the pixel loading on any page opened afterwards. It does not affect the lawfulness of processing carried out while consent was in force, and it does not delete information Meta has already received.

What the Meta Pixel Sends

Once loaded, Aurelia fires two events, and both reach Meta. A PageView event records that a page on AureliaPrivateHealth.com was opened. A second event, named WaitlistSubmit01, is sent once the waitlist application form has been successfully submitted, and records only that a submission happened. It should be stated plainly that this second event tells Meta that the person using that browser completed an enquiry for a private healthcare service. It carries none of what was typed into the form, but the fact of the submission is itself information about that person, and Meta receives it. A visitor who would rather Meta did not receive it should choose “Essential only” on the cookie banner, or withdraw consent later, and no event of either kind will be sent. Aurelia passes Meta no parameters with either event, and the pixel is initialised with the pixel identifier alone, with no customer matching information passed alongside it. Nothing is sent to Meta from the Aurelia clinical, member or patient systems, and no server-to-server connection to Meta is used.

Aurelia sends Meta no name, email address or telephone number, and no answer given on any form on this website. Advanced matching, the optional feature that would send Meta a scrambled copy of an email address or telephone number, is switched off in the code of this website rather than by a setting that could be changed elsewhere.

Meta also receives the technical information that every browser sends when it requests a file, including the IP address, the browser and device in use, the address of the page being viewed and the address of the page that referred the visitor to it. That information is gathered by the Meta script itself, and its exact composition is set by Meta rather than by Aurelia.

One further point is stated here rather than left out. The pixel reports events by making a request to an address that Meta owns, so the browser attaches to that request any Meta cookies it is already holding. A visitor who is signed in to Facebook or Instagram in the same browser can therefore be connected by Meta to that Meta account. Passing no parameters limits what Aurelia tells Meta about a visitor. It does not make the visitor anonymous to Meta. Aurelia does not control this, cannot switch it off and receives no Meta account details in return.

Cookies and Stored Preferences

The pixel sets two cookies on the AureliaPrivateHealth.com domain. The record of the cookie choice itself is not a cookie and is not set by the pixel, and it is listed below so that the full picture appears in one place.

The two Meta cookies are set on the Aurelia domain, which makes them first-party cookies in the technical sense. Their values are sent to Meta, so in practical effect they work as identifiers for Meta, and that is stated here rather than left behind the label. The 90 day period is the Meta default. Aurelia does not set it and cannot change it, and some browsers shorten cookie lifespans independently of both Aurelia and Meta. Both cookies are deleted as soon as a visitor selects 'Essential only'.

How long Meta keeps the event information once Meta has received it is governed by Meta. Aurelia does not set that period, cannot see it and cannot change it. Aurelia keeps no separate copy of pixel event data, and the only pixel-derived information Aurelia holds is aggregated reporting inside the Meta advertising tools.

Health Information and the Pixel

Aurelia is a concierge preventative medicine practice, which makes this website different from an ordinary commercial website. The fact that a person visited it, and more particularly the fact that a person submitted a waitlist application, can support an inference about an interest in health services.

Section 26 of POPIA treats information concerning the health of a person as special personal information and prohibits processing it unless an authorisation in section 27 applies. Section 27(1)(a) permits processing with the consent of the data subject. Section 32, which authorises the processing of health information by health practitioners, covers proper treatment, care and practice administration, and it does not cover advertising. Where advertising technology on a medical practice website touches health information, consent is therefore the only authorisation available, which is why the consent gate on this pixel is load-bearing rather than decorative.

Because this website belongs to a medical practice, Aurelia treats the fact of a visit to it, and the fact of a waitlist application, as capable of being special personal information concerning health. Selecting 'Accept' is therefore consent, for the purposes of section 27(1)(a) of POPIA, to the processing described in this policy and to the transfer described below. Aurelia sends Meta no clinical information and no part of what is entered into the waitlist form. What is transferred is the fact of the visit and the fact of a completed application, and it is that transfer to which consent is given.

What can be inferred from it is limited in specific ways. The events carry no parameters, so Aurelia adds nothing to an event beyond its name. Meta still receives the technical information described above, which no parameter-free configuration can prevent. Nothing is sent from the clinical, member or patient systems, because the pixel is installed on this public website only. No custom, lookalike or retargeting audience is built from visitors to this website. No server-to-server connection to Meta is used. The fallback beacon that runs without JavaScript is not installed, so a visitor whose browser cannot run the consent gate is not tracked at all.

Aurelia advertising is also subject to the ethical rules of the Health Professions Council of South Africa on advertising and canvassing. Measurement is limited to counting responses to Aurelia advertisements, and no Aurelia advertisement is targeted using health status, health interest, symptoms or any clinical or diagnostic characteristic.

Transfers Outside South Africa

Meta Platforms Ireland Limited is situated in Ireland and Meta Platforms, Inc. is situated in the United States of America. When the pixel reports an event, the information described above leaves South Africa and is processed in those countries and in other countries where Meta operates its infrastructure. That is a transborder flow of personal information governed by section 72 of POPIA.

Aurelia relies on section 72(1)(b) of POPIA, which permits the transfer where the data subject consents to it. Consent to the pixel, given through the cookie banner, is consent to this transfer, and this policy is how Aurelia describes the transfer before that consent is given. A visitor who does not want information to leave South Africa in this way should select 'Essential only', in which case no transfer takes place.

What Aurelia does not rely on is stated as plainly. Aurelia has not carried out an assessment of United States law and does not represent that United States law affords a level of protection substantially similar to POPIA. Use of the pixel is governed by the standard business tools terms set by Meta, which Aurelia accepts rather than negotiates, and Aurelia does not put those terms forward as a binding agreement providing POPIA-equivalent protection for the purposes of section 72(1)(a). Consent is the operative basis for this transfer, and withdrawing it stops any further transfer.

The Relationship with Meta

Meta is not an operator of Aurelia. Under POPIA an operator processes personal information on behalf of a responsible party and not for its own purposes, and that is not what happens here.

Aurelia decides to place the pixel on this website and decides what is measured with it, and to that extent Aurelia is the responsible party. Once the information reaches Meta, Meta processes it as a responsible party in its own right and for its own purposes. Those purposes include the delivery and optimisation of advertising, measurement and the development of Meta advertising systems and other products. They also include the security and platform integrity purposes of Meta. Aurelia does not instruct Meta on those purposes, cannot vary them, cannot audit them and cannot require Meta to delete what it holds.

Because Aurelia cannot control what happens to the information after Meta receives it, Aurelia controls what reaches Meta in the first place. The pixel loads only on consent. Two events are fired and both are received by Meta, but no parameters are passed with either. No customer matching information is passed alongside the pixel identifier. No server-to-server connection is used. The fallback beacon is not installed. No audience is built from visitors to this website. Withdrawing consent stops any further transfer. Those are the measures by which Aurelia accounts for this processing under section 8 of POPIA, and the controls a visitor can operate directly are set out under Meta Advertising Choices below.

What comes back to Aurelia is aggregated reporting, meaning counts of page views and of completed waitlist applications, attributed to Aurelia advertising. These are counts only. Aurelia does not receive, and does not ask for, a list of the individuals who visited this website or of those who applied.

Retention

Cookie lifespans may vary depending on their purpose. Aurelia intends to retain cookie-related information only for as long as reasonably necessary or as required by law.

Security

Aurelia aims to implement reasonable technical and organisational safeguards including encrypted connections (HTTPS), secure website configuration, access controls and cybersecurity monitoring to reduce unauthorised access or misuse.

User Choices

Users can manage cookie preferences through Aurelia's cookie banner where available or through browser settings. Disabling certain cookies may reduce website functionality, including appointment booking, authentication or preference storage.

Manage cookie preferences

Meta Advertising Choices

The quickest way to stop the pixel is the 'Manage cookie preferences' button above. Selecting 'Essential only', which the line above records as 'Declined', deletes the _fbp and _fbc cookies immediately and stops the pixel loading on any page opened afterwards. Nothing further is required on the Aurelia side. Cookies can also be blocked or deleted through browser settings, which works whether or not a Meta account exists.

Information that Meta has already received is controlled through Meta. A signed-in Facebook or Instagram user can review and disconnect the activity that businesses share with Meta, a setting Meta currently calls 'Activity off Meta Technologies' and previously called 'Off-Facebook Activity', and can limit how that activity is used to select advertisements through the Meta advertising preferences. Meta renames and moves these controls from time to time, and Aurelia cannot operate them on behalf of a visitor. Meta describes its own processing in the Meta Privacy Policy.

Rights in Relation to the Pixel

Section 11(3)(b) of POPIA gives every data subject the right to object at any time to the processing of personal information for the purposes of direct marketing. Advertising measurement of this kind is direct marketing for that purpose. An objection may be made on the form prescribed by the POPIA Regulations, or by writing to the Information Officer at concierge@aureliaprivatehealth.com, and Aurelia will assist with the prescribed form. Once an objection is made, section 11(4) of POPIA prohibits further processing for that purpose.

Sections 23 and 24 of POPIA give the right to ask what personal information is held and to ask for it to be corrected or deleted. Pixel event data is held by Meta, so a request about it has to be directed to Meta, and Aurelia will assist by identifying the pixel and the events described above. Aurelia makes no decision about a visitor that has legal consequences, or that affects the visitor to a substantial degree, based solely on automated processing of pixel data.

Concerns should be raised with the Information Officer at concierge@aureliaprivatehealth.com. A complaint may also be lodged with the Information Regulator of South Africa, whose contact details and prescribed complaint form are published on its website at inforegulator.org.za.

International Visitors

If Aurelia serves international visitors, cookie processing may also be subject to additional legal requirements depending on the visitor's jurisdiction.

Updates

Aurelia may amend this Cookie Policy to reflect legal, operational or technological changes. The latest version should be published on the website together with an effective date.

Contact

Privacy or cookie-related questions should be directed to Aurelia's Information Officer using the contact details published on the website. Email concierge@aureliaprivatehealth.com.