Legal
Cookie Policy
Version 2 · effective November 2, 2026
This Cookie Policy explains the cookies OMNIBIO LLC, a Wyoming limited liability company (OMNIBIO), sets on the OMNIBIO portal at app.omnibio.com, on a clinic's store pages and on a clinic's own storefront domain. It adds detail to Section 6 of the Privacy Policy, "Cookies and Similar Technologies".
What cookies are
A cookie is a small piece of text a website asks your browser to keep and send back when you return. Some cookies last until you close your browser; others until a set time. A cookie set by the site you are visiting is a first-party cookie. A cookie set by another company, for example inside a payment form on that site, is a third-party cookie.
Cookies OMNIBIO sets
OMNIBIO sets only strictly necessary cookies: each one is needed for something you asked for. None is used for analytics or advertising, or to follow you across other sites. They:
- keep you signed in after you use a sign-in link, until you sign out or the session ends;
- tie a sign-in link to the browser that asked for it, and confirm that you pressed the sign-in button;
- protect the sign-in step against requests from other sites, and remember where to take you afterwards;
- keep a cart your clinic prepared for you through sign-in, so its link is not shown in the address bar;
- protect the sign-in hand-off between the portal and your clinic's own storefront domain.
The table at the end of this page lists every cookie by name, with what it does, how long it lasts and where it is set. The table is produced from the code that sets the cookies, so it always matches what the platform does. A cookie marked "never set in production" exists only on demonstration and test sites.
The public pages at omnibio.com set no cookies. OMNIBIO's own code does not keep information in your browser's local storage or session storage.
Cookies set inside payment and domain flows
Two flows open a form or window run by another company, and only when you start them:
- Card payments. The card form at checkout and in Settings is the payment gateway's own hosted form, from Authorize.Net or NMI, whichever OMNIBIO uses at the time. Your card number goes directly to the gateway, never to OMNIBIO. The gateway may set its own strictly necessary cookies, for example to prevent fraud, under its own privacy policy.
- Connecting a clinic's own domain. When a clinic owner connects the clinic's own web domain, the set-up window is run by Entri, which may set its own strictly necessary cookies under its own privacy policy.
OMNIBIO does not read these companies' cookies, and they are not set on any other OMNIBIO page.
Consent
Strictly necessary cookies do not need your consent, so OMNIBIO shows no cookie banner. If OMNIBIO ever wants to add a cookie that is not strictly necessary, such as one for analytics, it will first update this policy and ask for your consent before setting it.
You can block or delete cookies in your browser's settings. If you block the cookies above, you will not be able to sign in or to finish a step you started, such as checkout.
Changes
When the cookies OMNIBIO sets change, the table on this page changes with them. Any change to the wording of this policy is published as a new version with its effective date, and earlier versions stay readable from this page.
Questions about this policy: support@omnibio.com, or OMNIBIO LLC, Attention: Privacy, 1309 Coffeen Avenue, Suite 1200, Sheridan, WY 82801.
Every cookie OmniBio sets
All of them are strictly necessary for something you asked for. None is used for analytics, advertising or tracking, so there is no consent banner.
| Name | Purpose | Lifetime | Where |
|---|---|---|---|
| __Host-omni_session | Keeps you signed in. An opaque token; only its hash is stored.Strictly necessary · set by OmniBio | Until you sign out, or 7 days | Portal; a clinic's storefront domain |
| __Host-omni_signin | Ties a sign-in link to the browser that asked for it.Strictly necessary · set by OmniBio | 15 minutes | Portal |
| __Host-omni_confirm | Confirms that you pressed the sign-in button on the confirmation page.Strictly necessary · set by OmniBio | 2 minutes | Portal |
| __Host-omni_curated | Keeps a cart your clinic sent you through sign-in, so the link is not put in the address bar.Strictly necessary · set by OmniBio | 30 minutes | Portal |
| __Host-omni_smscart | Keeps an order you texted to OmniBio through sign-in, so the link is not put in the address bar.Strictly necessary · set by OmniBio | 30 minutes | Portal |
| __Host-omni_handoff | Protects the sign-in hand-off between the portal and your clinic's own domain.Strictly necessary · set by OmniBio | 10 minutes | A clinic's storefront domain |
| __Secure-authjs.callback-url | Remembers where to return after a sign-in link is requested.Strictly necessary · set by Auth.js (configured by OmniBio) | Until the browser closes | Portal |
| __Host-authjs.csrf-token | Protects the sign-in link's callback against cross-site requests.Strictly necessary · set by Auth.js (configured by OmniBio) | Until the browser closes | Portal |
| omni_gate | Remembers the shared demo password, so the demo gate is not shown on every page.Strictly necessary · set by OmniBio · never set in production | 7 days | Portal (demo and staging only) |
On a local development server the names drop the __Host- and __Secure- prefixes, which need HTTPS.