Cookie Policy

1. Introduction / What This Covers

This Cookie Policy explains how CREBRAL AI, LLC, operating as Crebral Health (“Crebral Health,” “we,” “us,” or “our”), uses cookies and similar tracking technologies on our public-facing website and marketing pages (collectively, “Website”).

This Cookie Policy should be read alongside our Privacy Policy (crebral.ai/privacy) and our Terms of Service (crebral.ai/terms).

2. What Are Cookies

Cookies are small text files placed on your device by a website you visit. They are widely used to make websites work or work more efficiently, to remember your preferences, and to provide information to website owners. In addition to traditional cookies, we may use the following similar technologies:

• Pixels and web beacons: Tiny transparent images embedded in web pages or emails that allow us to track whether a page was loaded or an email was opened;
• Local storage and session storage: Browser-based mechanisms that store data locally on your device, similar to cookies but not transmitted with every HTTP request;
• SDKs and tracking scripts: JavaScript code loaded from first- and third-party providers that may collect interaction data about your use of the Website; and
• Session replay tools: Technologies that record user interactions with a webpage (mouse movements, clicks, scrolls) to help diagnose usability issues. Session replay tools are NOT deployed on any authenticated or health-data page.

Cookies can be “session cookies,” which expire when you close your browser, or “persistent cookies,” which remain on your device for a set period or until you delete them. Cookies can also be “first-party” (set by us) or “third-party” (set by a third-party provider on our behalf or on their own behalf).

3. Categories We Use

3.1 Strictly Necessary / Essential Cookies

These cookies are required for the Website to function and cannot be disabled. They do not collect personal information for advertising purposes. Examples include: session management cookies that keep you logged in during a session on public pages, CSRF-protection tokens, and load-balancing cookies. Because these are essential, they do not require consent and cannot be turned off through our preference center.

3.2 Functional / Preference Cookies

These cookies allow the Website to remember choices you have made (such as language preference, cookie consent status, or form field data) and to provide enhanced, personalized features. Disabling these cookies may affect the functionality of some features of the Website but will not prevent you from using it.

3.3 Analytics / Performance Cookies

These cookies collect aggregate information about how visitors use our Website — for example, which pages are most visited, how long visitors stay, and where they come from. We use this information to improve our Website and Services. These cookies do not directly identify you. Analytics cookies may be placed by us or by third-party analytics providers (see Section 5).

In the EU/UK, analytics cookies require your opt-in consent before being set. In the U.S., you may opt out as described in Section 8.

3.4 Marketing / Advertising Cookies

Marketing and advertising cookies are OFF by default. If enabled (with your consent in the EU/UK, or subject to opt-out in the U.S. where applicable), these cookies track your browsing activity across websites to deliver targeted advertising. In any event, marketing and advertising cookies are completely BLOCKED on any authenticated platform page, portal page, or any other page that may display, reference, or accept input of patient health information. This is not configurable by users or administrators.

4. How We Use Cookies + HEALTH DATA EXCLUSION

We use cookies on our public Website for the following purposes:

• Keeping the Website secure and preventing fraudulent activity;
• Understanding how visitors interact with the Website to improve its design and content;
• Remembering your preferences and settings on the public site;
• Measuring the effectiveness of our marketing campaigns (where you have consented or not opted out); and
• Enabling certain embedded features (such as scheduling demos or live chat).

5. Third-Party Cookies & Tracking

We may allow the following categories of third-party providers to place cookies on our public Website:

• Analytics providers (e.g., aggregated website analytics): Collect aggregate, non-personally-identifying usage data. These providers may offer opt-out mechanisms (see Section 8).
• Advertising / demand-generation platforms (e.g., LinkedIn Insight Tag, Google Ads Conversion): Enabled only with consent in the EU/UK, subject to opt-out in the U.S.; blocked entirely on authenticated pages.
• Customer engagement tools (e.g., chat widgets, demo-scheduling embeds): May place functional cookies to power their features.
• Video and content embeds (e.g., embedded video players): May place their own cookies when you interact with embedded content.

Third-party providers that process data in connection with our Website under our direction are bound by data processing agreements restricting their use of that data to providing the contracted service. We do not share cookie data with any advertising partner for the purpose of training artificial-intelligence or machine-learning models, or to build health-related audience segments.

Third-party cookies are subject to those third parties’ own privacy and cookie policies, which we encourage you to review. Common opt-out links include: Google Analytics Opt-Out (tools.google.com/dlpage/gaoptout); LinkedIn Advertising Opt-Out (linkedin.com/psettings); and network-level opt-outs via the DAA, NAI, and EDAA (see Section 8).

6. HIPAA + Tracking Technology Compliance

We have assessed our use of online tracking technologies against HHS Office for Civil Rights (OCR) guidance on tracking technology and HIPAA, as originally issued December 1, 2022, and updated March 18, 2024. Our approach reflects the following positions:

• Authenticated platform pages: No marketing, analytics, or third-party advertising tracking technologies are deployed on authenticated platform pages or on any pages where PHI may be accessed, displayed, or input. This eliminates the primary HIPAA-tracking-technology risk vector identified in HHS guidance.
• Public Website pages with health context: We do not deploy tracking technologies on any page whose URL or content could reasonably indicate an individual’s health condition, status, or treatment (such as symptom-checker pages or diagnostic intake forms). Our public Website does not contain such pages.
• BAAs with analytics and tracking vendors touching PHI pages: To the extent any tracking vendor could potentially access PHI (including via server-side analytics), we require that vendor to execute a BAA before deployment. Vendors unwilling or unable to execute a BAA are not deployed on PHI-adjacent infrastructure.
• Cookie consent banners are not HIPAA authorizations: Consent obtained through a cookie consent banner does not constitute a valid HIPAA authorization for the use or disclosure of PHI. PHI may only be shared with tracking vendors to the extent covered by a valid BAA and permitted by HIPAA.
• Session replay tools: Session replay technologies that could capture keystrokes, form inputs, or displayed patient data are not deployed on authenticated platform pages under any circumstances.

7. Your Consent and Cookie Preferences

EU / UK Visitors (GDPR / UK GDPR)

If you are visiting from the European Economic Area, United Kingdom, or another jurisdiction that requires prior consent for non-essential cookies, we will display a cookie consent banner when you first visit the Website. Only strictly necessary cookies are set before you provide consent. You may accept all categories, reject non-essential cookies, or configure your preferences by category. Your consent is recorded and stored for a period of up to twelve (12) months, after which we will ask again.

California and U.S. Visitors (CCPA/CPRA)

Under the CCPA/CPRA, certain sharing of Personal Information via cookies for cross-context behavioral advertising may constitute a “sale” or “share” of Personal Information. You have the right to opt out of such sharing. Crebral Health does not sell Personal Information. To the extent any third-party advertising cookies deployed on our Website (with your initial consent) could constitute a “share” under CCPA/CPRA, you may opt out at any time using the preference center, or by submitting a request to team@Crebral.ai.

You may change your cookie preferences at any time by accessing our cookie preference center accessible via the Cookie preferences link in our Website footer.

8. Managing and Disabling Cookies

You have several options for managing or disabling cookies:

• Cookie preference center: Use the preference center on our Website to enable or disable cookies by category (except strictly necessary cookies, which cannot be disabled).
• Browser settings: Most browsers allow you to view, manage, and delete cookies through their settings or preferences menus. Instructions for common browsers are available at: allaboutcookies.org. Note that disabling cookies may affect the functionality of some Website features.
• Digital Advertising Alliance (DAA): U.S. opt-out at optout.aboutads.info;
• Network Advertising Initiative (NAI): Opt-out at optout.networkadvertising.org;
• European Digital Advertising Alliance (EDAA): EU opt-out at youronlinechoices.com; and
• Google: Opt out of Google advertising cookies at adssettings.google.com, and Google Analytics at tools.google.com/dlpage/gaoptout.

Please note that opting out of advertising cookies does not mean you will stop seeing advertisements — you may continue to see generic ads that are not targeted to you.

9. Do Not Track Signals

Some browsers include a “Do Not Track” (DNT) feature that sends a signal to websites requesting that your browsing not be tracked. Because there is no uniform industry standard for how to respond to DNT signals, our Website does not currently respond differently to DNT browser signals. We will reassess this approach if a legally binding DNT standard is established. California residents are advised that we do not currently respond to DNT signals consistent with the current state of the law.

The Global Privacy Control (GPC) signal, where technically feasible, will be treated as an opt-out of sale or sharing of Personal Information by California and Colorado residents as required by applicable law.

10. Data Collected via Cookies — Retention

Cookies and similar technologies collect limited technical and usage data. The retention periods for data collected via cookies are as follows:

• Session cookies: Expire when you close your browser session. No data is persisted beyond the session.
• Functional / preference cookies: Typically retained for up to twelve (12) months to remember your settings across visits.
• Analytics cookies: Retained for a maximum of thirteen (13) months; we recommend and target six (6) months where feasible consistent with industry best practices and CNIL/ICO guidance.
• Marketing / advertising cookies: Retention varies by third-party provider; typically up to twelve (12) to twenty-four (24) months, subject to the provider’s own policies. Check individual third-party cookie policies for exact durations.

Data collected via cookies is processed in accordance with our Privacy Policy. It may be processed in the United States and other countries. We apply appropriate safeguards for international data transfers as described in Section 8 of our Privacy Policy.

11. Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in the technologies we use, applicable law, or our data practices. The “Last updated” date at the top of this page reflects the most recent revision. Where changes are material — for example, the introduction of a new category of cookie or a new third-party provider that could affect your privacy — we will provide notice via a cookie consent banner refresh or by other appropriate means. Your continued use of the Website after we post an updated Cookie Policy constitutes your acceptance of the revised Policy (for non-EU/UK visitors); EU/UK visitors will be asked for fresh consent where required.

12. Contact Us

If you have questions about our use of cookies or this Cookie Policy, please contact us: