Cookie Policy

1. Who is responsible for cookies?

The controller responsible for the use of cookies in connection with the Service is:

Attentia Laurenzgasse 12/20 1050 Vienna Austria

You can reach us via the contact details in our Imprint and by email at zach@attentia.at

2. What types of cookies we use

"Cookies" are small text files that are stored on your device when you visit a website or use a web application. Similar technologies include localStorage, sessionStorage and certain types of tags or scripts.

3. How cookies relate to ADHD tests and health data

Attentia is designed for ADHD-related tests and may process data that is health-related or otherwise highly sensitive (for example, gaze metrics, prosody features and video recordings linked to tasks). Cookies themselves are typically not health data, but they can be linked to test sessions that contain such data.

We therefore minimise the use of cookies and similar technologies, collect only what is necessary for security and functionality, and use optional analytics only with your prior consent.

4. Categories of cookies and similar technologies

4.1 Essential (strictly necessary) cookies

These cookies are necessary for the basic functioning of the Service, such as:

• create and maintain secure login sessions;
• route requests reliably between front-end and back-end;
• apply security protections (for example CSRF protection);
• store your cookie choices and privacy preferences;
• protecting the Service from misuse, for example through rate limiting.

Examples include:

• sb-[project-ref]-auth-token – Supabase authentication cookies that keep you logged in securely.
• attentia_csrf – protects against cross-site request forgery (if implemented as a cookie).
• attentia_cookie_consent (or a similar key stored in localStorage) – stores your cookie consent choices.

4.2 Analytics cookies (optional)

You cannot turn these cookies off via our cookie settings, because the Service would not function without them. The underlying processing of personal data is described in more detail in our Privacy Policy.

5. Supabase and other back-end services

We use Supabase for authentication, database and storage. Supabase may set its own cookies or use localStorage to manage sessions and security.

We may also use additional infrastructure providers (for example, for hosting, logging or error monitoring). Where these providers place cookies or use similar technologies, this will be for security, core functionality or, with your consent, analytics.

6. How long cookies and related data are kept

Cookie lifetimes depend on their purpose. Session cookies are deleted when you close your browser. Persistent cookies remain on your device until they expire or you delete them manually.

We keep ADHD test data and related health-sensitive data in line with the retention periods described in the Privacy Policy. Where possible, we delete or irreversibly anonymise data once it is no longer needed and only retain aggregated statistics and models to improve reliability, safety and usability.

7. Your choices and rights

When you first visit Attentia, we display a cookie banner that lets you choose between using only essential cookies and accepting all cookies, with a "Customize settings" option for granular control. You can change your choices at any time via the "Cookie settings" link in the footer.

Your rights under GDPR (for example access, rectification, erasure, restriction, objection, and withdrawal of consent) are described in detail in our Privacy Policy. You can contact us at zach@attentia.at to exercise these rights. You also have the right to lodge a complaint with the competent data protection authority.

• adjust your cookie preferences through our in-product cookie settings;
• disable non-essential cookies in your browser settings; and
• exercise rights described in our Privacy Policy, such as access, deletion or objection to processing.