Privacy and cookie policy
Last updated: October 27, 2026
This policy explains what the website onlyonemedical.co.il collects, through which channel, why, who receives it, how long it is kept, and how you can see, correct or delete it. It follows the Israeli Protection of Privacy Law, 5741-1981, as amended by Amendment 13 (in force since August 2025), and the Privacy Protection (Data Security) Regulations, 5777-2017. The Hebrew version at /privacy is the governing text; this English version says the same thing.
1. Who is responsible
The controller of the data is Only One Medical, a business owned by Adir Fargon, David Sakharov 22, Floor 1, Rishon LeZion, Israel. Privacy requests: adir@onlyonemedical.co.il or +972-54-622-5222.
2. No medical information
This site is for physicians, clinics and healthcare businesses, and offers marketing services. It does not collect medical information and has no form that asks about anyone's health. Please do not send patient details or medical information through the site, the chat or WhatsApp. When we work for a clinic, its patients' enquiries belong to that clinic as the controller; we process them only on its behalf and under its instructions. This policy covers our own website only.
3. What we collect, where and why
| Channel | What is collected | Why |
|---|---|---|
| Contact forms (/en/contact and the Hebrew /contact) | Name, phone, and depending on the form: email, practice website, country, specialty and a short message. Also the page the form was sent from and how you reached the site (see first-party attribution below). | To get back to you, to manage the enquiry in our CRM, and to know which channel brought it. |
| Clinic visibility check (/diagnosis-score) | Your answers to 8 questions, an email address, and optionally name, specialty, city, website and phone. The consent wording you ticked is stored with it. | To calculate the score and email you the full report. Marketing email only if you ticked a separate consent. |
| Check funnel (no identifiers) | Which step you reached, the answer at that step, device type and traffic source. No name, phone, email or IP address. | To see where people drop off and improve the check. |
| Site chat | The messages you write. The first question of each conversation is kept without any identifier. | To answer you (the reply is generated by an AI model) and to learn which questions physicians ask. Please do not type personal details. |
| WhatsApp button clicks | An internal record of the click: page, button, first referring site, landing page, campaign tags if any, and country. No phone number, no personal identifier. | To know which channels lead to WhatsApp conversations. |
| First-party usage measurement | One anonymous record per page view: path, device type, scroll and time ranges, which buttons were shown and clicked. No identifiers, no cookies, nothing you typed. Only daily totals are kept. | To improve the site and the path to contacting us. |
| First-party attribution | If you arrived from an ad or a tagged link: UTM tags, the ad click id, landing page and referring site. Kept in your browser for 30 days and sent to us only with a form you choose to submit. | To credit an enquiry to the campaign that brought it. |
| Technical data | IP address, browser type and country, which pass through Cloudflare on every visit. IP addresses are also used for rate limiting and kept for that purpose for up to two days. | Running and securing the site. |
| Third-party measurement | Google Analytics, the Meta pixel and Microsoft Clarity, according to your choice in the cookie banner. Clarity can record how the page is used (scrolling, clicks) and masks what is typed into fields by default. | Measuring the site and our ads. See the cookie table below. |
We do not sell, rent or hand personal data to anyone for their own marketing.
4. Notice and voluntary disclosure
Under section 11 of the Privacy Protection Law: you are under no legal obligation to give us any information. Giving it depends on your free will and consent. Without a name and phone we cannot call you back, and without an email we cannot send the check report. We process data on the basis of your consent (submitting a form, ticking a box, or your banner choice), to provide the service you asked for, and to meet legal duties.
5. Who receives the data
| Provider | Role | Data |
|---|---|---|
| Cloudflare | Hosting, the site's server (Worker) and enquiry store (KV), security and encryption | Everything sent through the site, IP address |
| Make (Celonis) | Automation: forwarding enquiries, emailing the check report, an internal WhatsApp alert to the owner, the automation demo message | Enquiry details and check results |
| Vercel and Supabase | Our CRM: application hosting and database | Name, phone, email, specialty, message, attribution |
| Google Analytics (with consent), sending the report email from our business mailbox (Google Workspace), site fonts (Google Fonts), the map on the contact page and YouTube preview images | Usage data, email address and report, IP address | |
| Meta | The Meta pixel (with marketing consent), and WhatsApp when you choose to message us | Usage and conversion events; WhatsApp conversation |
| Microsoft | Microsoft Clarity (with marketing consent): heatmaps and session recordings | Usage data and recordings of page interaction |
| Anthropic | The AI model that writes the chat replies | Chat messages, with no identifiers added by us |
Beyond these, data is disclosed only where the law or a competent authority requires it.
6. Transfers outside Israel
Most providers above are international companies, and some data is stored or processed outside Israel, mainly in the United States and the European Union. Transfers follow the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, to providers committed to protecting the data and using it only to serve us.
7. How long data is kept
- Form enquiries: as long as needed to handle the enquiry and the business relationship, or until you ask us to delete them.
- Visibility check: the full record is kept in the site's store for 12 months and then deleted automatically. If it became an enquiry in our CRM, it is kept there like any enquiry.
- WhatsApp clicks and chat questions: 90 days, then deleted automatically.
- First-party usage measurement and check funnel: anonymous totals, up to 180 days.
- IP addresses for rate limiting: one hour to two days.
- Attribution in your browser: 30 days, on your device only.
- Third-party tools: per each provider, see the table below.
8. Security
All traffic to the site is encrypted (HTTPS/TLS). The enquiry store is reachable only through the site's server, endpoints that show data require a key, and keys for outside services are kept as server secrets, never in code sent to the browser. Access is limited to the owner and whoever handles your enquiry, and the forms are protected against flooding and bots. No system connected to the internet is perfectly secure; if a serious incident occurs we will act as the law requires, including notifying the Privacy Protection Authority where needed.
9. Your rights
- Access the data we hold about you (section 13 of the Law).
- Correct or delete data that is wrong, incomplete or out of date (section 14).
- Opt out of direct marketing and be removed from our mailing list (section 17F).
- Change your cookie choice at any time: cookie settings.
Write to adir@onlyonemedical.co.il or call +972-54-622-5222 with the name and the phone or email you gave us. We may ask you to verify your identity, and we reply within 30 days. You may also contact the Israeli Privacy Protection Authority.
10. Cookies and local storage
Essential items are always on. Statistics and marketing cookies load only after you agree in the banner. Until then Google Analytics runs in Google Consent Mode, without cookies and sending only basic measurement signals with no identifier; the Meta pixel and Clarity are not loaded at all.
| Name | Provider | Purpose | Kept for | Type |
|---|---|---|---|---|
| oo-consent | Only One Medical | Stores your cookie banner choice | 12 months | Essential |
| a11y-prefs | Only One Medical | Accessibility settings and light or dark display | Until you clear it | Essential |
| oo-src, oo-attr | Only One Medical | How you reached the site and which campaign, to credit an enquiry; sent only with a form you submit | oo-src: this visit. oo-attr: 30 days | Essential (first-party measurement) |
| oo-ux, oo-v | Only One Medical | Anonymous usage measurement: pages in this visit, first or returning visit | oo-ux: this visit. oo-v: until cleared | Essential (first-party measurement) |
| oo_ab_home_hero_v1 | Only One Medical | Keeps the same home page header version between visits | Until cleared | Essential |
| dsAns, dsVisit | Only One Medical | Keeps your check answers if you reload the page | This visit | Essential |
| oo-exit, oo-ai-teaser | Only One Medical | Prevents the exit prompt and chat invitation from repeating | This visit | Essential |
| oo-internal | Only One Medical | Marks our team's browsers so they are not counted | Until cleared | Essential |
| _ga | Google (Analytics) | Distinguishes visitors for statistics | 2 years | Statistics |
| _ga_LP7THMKF44 | Google (Analytics) | Keeps the current session state | 2 years | Statistics |
| _fbp | Meta (pixel) | Browser id for ad measurement and audiences | 90 days | Marketing |
| _fbc | Meta (pixel) | Keeps the ad click id when you arrive from Facebook or Instagram | 90 days | Marketing |
| _clck | Microsoft (Clarity) | Persistent Clarity user id | 1 year | Marketing |
| _clsk | Microsoft (Clarity) | Joins page views into one session recording | 1 day | Marketing |
| CLID, MUID | Microsoft (Clarity) | Microsoft ids that recognise the browser across sites | 1 year | Marketing |
Fonts load from Google Fonts, the contact page map from Google Maps and video previews from YouTube; like any server they receive the browser's IP address, and the map may set Google cookies under Google's policy. You can also delete or block cookies and local storage in your browser settings; blocking essential items may break features such as saved accessibility settings.
11. Marketing messages
We send marketing email only with your explicit consent, as required by section 30A of the Israeli Communications Law, and every message has a simple way to unsubscribe. The check report you requested is not marketing.
12. Minors
The site is meant for adult professionals and business owners. We do not knowingly collect data about minors.
13. Changes
When this policy changes, the new version is published on this page with its date. Last updated: October 27, 2026.