Privacy & Cookie Policy
Version 2026-10-23 · Soro Health · data.soro.health
This policy says what we collect on data.soro.health, why, and what we will never do with it. The platform holds market data about hospitals and insurers. It holds no patient records, and this policy is about you, the professional using it.
1. What we collect
| When | What | Why |
|---|---|---|
| You create an account | Email, name, password (held by AWS Cognito; we never see or store the password itself), and the IP address and browser signature at the moment you accepted the Terms | Running your account; proof of the agreement |
| You tell us about yourself | Company, role, what you do and what brought you here (the optional signup fields and welcome questions) | Shaping the product and, plainly, sales: knowing who is evaluating the platform |
| You arrive from somewhere | The referring page, the landing path, and any utm_ campaign tags on the link | Knowing which channels bring the right visitors |
| You use the platform | First-party usage signals: which section you opened, which locked figure you hit, searches typed into the Ask box, checkout starts | Seeing what matters and what sells (see the cookies section below for the switch that turns this off) |
| You subscribe or buy | Card and payment details go directly to Stripe; we hold only the Stripe customer reference, what you bought, and every download link we issued to you | Billing, delivery, and the export log our data licenses require |
2. Cookies, all of them
| Name | Kind | What it does |
|---|---|---|
| soro_market_sess | Essential cookie | Keeps you signed in. Encrypted and HttpOnly. With "Keep me signed in" ticked it lasts 30 days from your last visit; unticked, it ends when the browser closes, and after 12 hours at most. The platform cannot work without it. |
| soro_market_oauth | Essential cookie | Ten minutes of state while a Google sign-in completes, then gone. |
| soro_market_guest | Essential cookie | Set only if you choose "Continue without an account" on the sign-in screen, so the logo does not send you back there. It holds nothing else, and it is gone when the browser closes. |
| soro.portal.prefs | localStorage | Your light/dark choice. Never leaves the browser. |
| soro.market.attr | localStorage | The referrer and campaign tags from your first visit, sent once if you sign up. |
| soro.market.cookies | localStorage | Your answer to the cookie bar. |
| soro.market.who | localStorage | Your name, so the account button shows it before the page asks who you are. Cleared when you sign out. |
| soro.market.tier | localStorage | Whether your account subscribes, so the page does not flash. Cleared when you sign out. |
| soro.market.benchmarks | localStorage | The searches you have run, shown on Saved work. Cleared when you sign out. |
| soro.market.simulator | localStorage | The rates and volumes you type into the simulator. They never leave the browser, and they are cleared when you sign out. |
| soro.market.wizard | sessionStorage | Whether the welcome questions have been answered in this tab. Gone when the tab closes. |
There are no third-party trackers: no ad pixels, no Google Analytics, no session recorders. The usage signals in row four are sent only if you choose "Accept all" on the cookie bar: until you answer, and if you choose "Essential only", nothing is sent and the essential session cookie is the only thing left. Signing out clears every browser store above except your light/dark choice and your cookie-bar answer.
3. What we do with it
We use this information to run the platform, deliver what you bought, improve the product, and, for accounts that look like evaluations, to reach out about it. If you signed up, we may email you about the platform; every such email has a working unsubscribe.
4. What we never do
- We never sell your personal information, to anyone.
- We never share it except with the processors that run the service (AWS for hosting and login, Stripe for payments) or when the law compels us.
- We never mix it with patient data; the data business and Soro's patient tools are separate systems with separate stores.
5. Keeping and deleting
Account and lead records live for as long as the account does, plus what tax and audit law requires for billing. Email data@soro.health to see what we hold about you, correct it, or have the account and its records deleted; deletion requests are honored within 30 days, save what billing law makes us keep. Depending on where you live (GDPR, CCPA), these are your legal rights; we treat them as everyone's.
6. Changes
Substantive changes move the version date above and are flagged to signed-in users on their next visit.
7. Contact
Soro Health · data@soro.health.