Cookie Policy

Last Updated: September 14, 2026

1. Scope

This Cookie Policy explains cookies, pixels, local storage, session storage, SDKs, and similar technologies used by
CareTabs. It applies to the public CareTabs website and, where specifically stated, the authenticated application.

2. Privacy-by-design rule for the authenticated app

CareTabs will not intentionally load Meta Pixel, Google Ads remarketing/conversion
tags, or comparable behavioral advertising trackers on authenticated care-profile pages or other screens that display
sensitive profile information or expose profile-specific identifiers.

CareTabs’ own product analytics should use route templates or other controls designed to prevent care-profile contents,
document names, search terms, free text, SSNs, health information, financial information, credentials, and profile
identifiers from being included in analytics events.

3. Strictly necessary technologies

Strictly necessary technologies support authentication, account security, session management, fraud prevention, and
payment functionality. These may be provided by vendors such as Clerk and Stripe and generally cannot be disabled
without preventing core Service functions.

4. Analytics

On public pages, CareTabs may use analytics services such as Google Analytics to understand traffic and product
usage. Analytics may collect IP address, device/browser information, page viewed, referral information, and event data.

Where consent is required by applicable law, non-essential analytics will not be activated until the user has provided the
required consent. Users will be able to withdraw or modify consent through the cookie settings mechanism.

5. Advertising and conversion tracking

CareTabs may use Google Ads, Meta, or similar technologies on public marketing pages to measure advertising
performance. These technologies may set cookies or receive page-view and conversion-event information.

CareTabs will configure these technologies so they are not intentionally sent care-profile content, medical information,
financial information, SSNs, passwords/PINs, document names, search terms, or profile-specific identifiers.

Where applicable law treats these activities as targeted advertising, sale, or sharing of personal information, CareTabs
will provide legally required notice and opt-out controls before or at the time the technology is used.

6. Consent and opt-out choices

CareTabs will provide a cookie preference mechanism where required by applicable law. Non-essential technologies will
be categorized so users can make available choices regarding analytics and advertising.

California residents and other users with applicable rights will be provided a mechanism to opt out of sale/sharing or
targeted advertising where required. CareTabs will honor legally required opt-out preference signals, including Global
Privacy Control, where applicable.

Browser controls can also block or delete cookies, although blocking strictly necessary cookies may prevent login or
payment functions.

7. Address autocomplete and embedded services

When a user types into an address autocomplete field, address text may be sent to Google Places API to return
suggestions. CareTabs should load third-party scripts only where reasonably necessary and should avoid loading
mapping or advertising scripts globally across authenticated pages when they are not needed.