General Security and Specific Security

I am making an online Mental Health site. There are three sections two at different levels of protection. In both, I use COOKIES and SESSION STORAGE.
In the therapy section:
How do I check that the user has the ability to use COOKIES AND SESSION STORAGE?
On finally leaving and not returning, how can the user, from the app remove all traces of both?
In the servicing auditing section:
I cannot allow the details about the utilisation and the identifying details of the patient to be matched online.
I have to build a ‘stand-alone’ LT app.
I can have utilisation data identifying the user with a random key number-- this can be online.
The indentity of the utiliser must never be online. The auditor will receive a list of users by a dedicated means. He matches the two whilst offline.
On the auditor’s stand-alone LT will now be a table containing both the user id and the identifying details. Any updates on utilisation are updated online (without passing the users identification.)
At the end of the session, the auditor destroys the identifying file.
In other words, two sets of tables matched offline. One of which is received online (utilisation ) and the other by other means say as a CSV file on secure e-mail as the work session begins.
Can I build the desktop app where these criteria are doable?