1. Introduction and Scope

Cronic Care, Inc. (“Cronic Care,” “Company,” “we,” “us,” or “our”) is committed to transparency regarding the technologies used on our website and digital services.

This Cookie Policy explains how cookies, browser storage, and similar technologies may be used when individuals access:

• The Cronic Care public website at https://cronic.care.
• Website pages describing our clinical documentation and clinical intelligence capabilities.
• Contact, inquiry, and clinical evaluation request forms.
• Authorized provider registration and authentication services.
• Secure physician documentation review and approval pages.
• CareInsights™ clinical intelligence reporting interfaces.
• Other web-based services made available by Cronic Care.

Collectively, these are referred to as the “Services.”

This Policy explains the purposes of these technologies, the types of information they may process, the circumstances in which third parties may be involved, and the choices available to users.

This Cookie Policy does not independently authorize the collection, use, or disclosure of Protected Health Information (PHI). Any processing of PHI must comply with applicable law, including HIPAA where applicable, and governing contractual agreements.

This Policy should be read together with Cronic Care’s Privacy Policy, Terms of Use, HIPAA & Patient Data Protection statement, and applicable Business Associate Agreements.

2. What Are Cookies and Similar Technologies?

Cookies are small text files that a website or service may store on a user’s browser or device.

Cookies help websites recognize browser sessions, remember preferences, maintain functionality, and support certain security and operational activities.

Cronic Care may also use other browser-based technologies that perform related functions.

• HTTP Cookies: Small pieces of information exchanged between a browser and a website or service.
• Session Storage: Browser-based storage generally associated with a particular browser tab or session.
• Local Storage: Browser-based storage that may persist beyond a single browser session until cleared.
• Authentication Tokens: Digital credentials or identifiers used to support authenticated access to restricted platform functions.
• Pixels and Tags: Technologies that may collect information about website interactions when enabled.
• Security and Performance Technologies: Mechanisms that help detect suspicious activity, maintain availability, or assess technical performance.

These technologies differ in their operation, persistence, security characteristics, and privacy implications.

References to “cookies” in this Policy may include similar technologies where appropriate.

3. First-Party and Third-Party Technologies

3.1 First-Party Cookies

First-party cookies are generally set by the website or domain a visitor is accessing.

They may support website preferences, security, authentication, and other functions.

3.2 Third-Party Cookies

Third-party cookies may be set by external services integrated with a website.

Depending on the services enabled, third-party technologies may support:

• Website security.
• Authentication.
• Embedded content.
• Performance measurement.
• Analytics.
• Customer communication.
• Advertising measurement, if implemented.

Third-party cookies may be subject to the privacy practices of their respective providers.

Cronic Care should evaluate third-party services before enabling them, particularly when they could interact with authenticated healthcare workflows or sensitive information.

4. Session Cookies and Persistent Cookies

4.1 Session Cookies

Session cookies are generally temporary and may expire when a browser session ends.

They can support authentication, navigation, and temporary website functions.

4.2 Persistent Cookies

Persistent cookies remain stored for a configured period or until deleted.

They may be used to remember preferences, consent selections, or other settings.

Cookie duration depends on the service that creates the cookie and its technical configuration.

Not all browser storage expires automatically when the browser closes. For example, some local storage values can remain until removed, while session storage is generally scoped to the relevant browser session.

5. Purposes for Which Cookies May Be Used

Cronic Care may use cookies and similar technologies for the following purposes, where those technologies are implemented:

1. Maintaining website functionality and navigation.
2. Supporting secure authentication and authorized sessions.
3. Remembering visitor or user preferences.
4. Protecting accounts and preventing unauthorized access.
5. Supporting website and application reliability.
6. Diagnosing technical errors.
7. Measuring public website performance.
8. Understanding general visitor interactions.
9. Recording cookie consent preferences.
10. Supporting other permitted operational functions.

The use of a particular technology depends on the website or platform feature involved.

Not all technologies or purposes described in this Policy are necessarily active at all times.

6. Categories of Cookies

6.1 Strictly Necessary Cookies

Strictly necessary cookies and similar technologies support functions required to operate the website or provide a service requested by the user.

Examples may include:

• Authentication and login.
• Session continuity.
• Security protections.
• Load balancing.
• Prevention of unauthorized activity.
• Saving privacy preference selections.
• Maintaining essential website functions.

Disabling these technologies may prevent portions of the Services from operating properly.

Strictly necessary technologies should not be used for unrelated advertising purposes.

6.2 Functional Cookies

Functional cookies may remember settings that improve the website experience.

• Interface preferences.
• Display settings.
• Language preferences, if supported.
• Accessibility-related preferences.
• Previously selected website options.

These technologies are used only where the relevant functionality exists.

6.3 Analytics and Performance Cookies

Analytics and performance technologies may be used to understand how visitors interact with the public website.

Depending on the services enabled, information collected may include:

• Pages viewed.
• Approximate time spent on pages.
• Navigation paths.
• General browser and device characteristics.
• Referring websites.
• Approximate geographic location derived from network information.
• Technical errors and performance measurements.

Cronic Care may use such information to improve website content, performance, accessibility, and usability.

Analytics technologies should be configured to avoid collecting PHI or sensitive clinical information.

6.4 Marketing and Advertising Cookies

If marketing or advertising technologies are enabled on the public website, they may support campaign measurement or other disclosed marketing activities.

Such technologies may involve third-party providers and may be subject to additional privacy requirements.

Cronic Care does not authorize the disclosure of PHI through advertising or marketing tracking merely by publishing this Policy.

Any implementation of advertising technologies must be evaluated for compliance with applicable privacy laws and contractual obligations.

The inclusion of this category does not represent that Cronic Care currently uses advertising cookies.

7. Cookie and Technology Inventory

The exact cookies and similar technologies used by Cronic Care depend on the website configuration, active plugins, authentication services, and third-party integrations.

An accurate inventory should identify:

Cronic Care should maintain a current inventory based on the technologies actually deployed.

A cookie inventory should not list assumed cookie names, providers, or expiration periods as verified facts.

Where appropriate, a detailed inventory may be incorporated into this Policy or maintained through an accessible cookie preference center.

8. WordPress Website Cookies

The Cronic Care public website operates using WordPress and associated website technologies.

Depending on the configuration, WordPress and installed plugins may use cookies or browser storage for:

• Website administration.
• Authorized login.
• Form processing.
• Website security.
• User preferences.
• Session management.
• Performance optimization.
• Other enabled features.

WordPress themes, page-building tools, and plugins may introduce additional cookies or third-party resources.

The exact technologies used may change as the website is updated.

Cronic Care should periodically review installed plugins and external scripts to ensure that cookie disclosures remain accurate.

9. Physician Authentication and Secure Login

Certain Cronic Care Services are restricted to authorized healthcare professionals and organizational users.

These Services may require authentication before users can access clinical information or platform functionality.

Authentication-related technologies may support:

• User identity verification.
• Secure login and logout.
• Session establishment.
• Session expiration.
• Access to authorized encounters.
• Physician review and approval.
• Clinical intelligence reporting.
• Protection against unauthorized access.

Cronic Care uses Amazon Web Services infrastructure, including Amazon Cognito, for applicable authentication workflows.

Depending on the configuration, authentication may involve cookies, browser storage, tokens, or related mechanisms.

Authentication technologies are used to support authorized access and should not be repurposed for advertising or unrelated tracking.

10. Browser Storage and Authentication Tokens

Certain secure application workflows may use browser-based storage to support authentication and session continuity.

Depending on the technical implementation, these mechanisms may store information such as:

• Authentication tokens.
• Session identifiers.
• Temporary workflow information.
• Security-related state.
• Authorized application preferences.

Authentication tokens can be sensitive because possession of a valid token may permit access to protected application functions.

Cronic Care should apply appropriate technical controls to reduce the risk of unauthorized token access, disclosure, or misuse.

Such controls may include appropriately configured token expiration, access validation, secure communication, and protections against malicious scripts.

Users should avoid accessing clinical Services from untrusted devices and should sign out when appropriate.

11. Physician Documentation and Approval Workflows

Cronic Care provides authorized workflows for reviewing, editing, and approving clinical documentation.

These may include:

• Accessing physician-ready SOAP notes.
• Reviewing encounter information.
• Editing documentation.
• Approving clinical documentation.
• Accessing available clinical intelligence reports.

Cookies or browser storage may be required to maintain authorized access to these functions.

Clinical documentation, patient identifiers, diagnostic findings, and other sensitive information should not be unnecessarily placed in tracking cookies or disclosed to unrelated third-party analytics providers.

The platform’s handling of PHI is governed by applicable privacy, security, and contractual obligations.

12. CareInsights™ and Clinical Intelligence Reporting

CareInsights™ supports clinical intelligence workflows based on authorized clinical information.

Depending on available capabilities, these workflows may involve:

• Physician-approved documentation.
• Clinical context analysis.
• Relevant report recommendations.
• Physician report selection.
• Generation of clinical intelligence reports.
• Authorized access to resulting documentation.

Browser technologies used to support these functions should be limited to necessary and authorized purposes.

Advertising or unnecessary third-party tracking should not be introduced into authenticated clinical reporting workflows where doing so could expose patient information.

13. Cookies and Protected Health Information

Protected Health Information is subject to specific legal and contractual requirements.

Cronic Care’s use of cookies and similar technologies must not undermine these protections.

In particular:

• PHI should not be included in advertising cookie values.
• Clinical transcripts should not be stored in marketing technologies.
• SOAP notes and diagnostic findings should not be transmitted to unrelated analytics providers.
• Patient identifiers should not be unnecessarily exposed through tracking URLs or third-party scripts.
• Authentication credentials should not be disclosed to unauthorized parties.
• Tracking technologies must be assessed for HIPAA implications where applicable.

A technology can create privacy risks even if it does not directly store a patient’s name or medical record.

For example, combinations of identifiers, page information, URLs, and other contextual data may reveal sensitive information in certain circumstances.

Cronic Care must evaluate such risks based on the actual information collected and transmitted.

14. HIPAA and Tracking Technologies

Where Cronic Care acts as a Business Associate, its processing of PHI is governed by HIPAA and applicable Business Associate Agreements.

Website tracking technologies may create HIPAA obligations when they collect or transmit PHI.

The applicable requirements depend on the nature of the information, the context in which it is collected, and the role of the parties involved.

Where a third-party technology provider creates, receives, maintains, or transmits PHI on behalf of a regulated entity, appropriate contractual protections may be required.

Cookie consent alone does not necessarily authorize a HIPAA-regulated disclosure of PHI.

Cronic Care should evaluate tracking technologies on authenticated and unauthenticated pages and implement safeguards appropriate to the information involved.

15. Public Website Forms and Contact Information

Visitors may submit information through contact, demonstration, or clinical evaluation inquiry forms.

Depending on the form, information may include:

• Name.
• Professional title.
• Organization.
• Email address.
• Telephone number.
• Inquiry details.
• Requested services.

Cookies or related technologies may support form functionality, security, or submission processing.

Public contact and marketing forms should not be used to collect patient records or PHI unless specifically designed and authorized for that purpose.

Cronic Care should provide appropriate instructions to discourage submission of sensitive clinical information through general inquiry forms.

16. Analytics on Public Website Pages

Cronic Care may use analytics services to understand general visitor behavior and improve the public website.

If analytics are enabled, their configuration should be reviewed to determine:

• What data is collected.
• Whether identifiers are stored.
• Whether IP addresses are processed.
• Whether information is transmitted to third parties.
• Whether analytics operate on authenticated pages.
• Whether consent is required.
• Whether applicable privacy opt-outs are supported.
• Whether sensitive information could be inadvertently collected.

Analytics services should not be assumed to be HIPAA-compliant merely because they offer privacy-related settings.

17. Third-Party Service Providers

Cronic Care may use external providers for infrastructure and website operations.

These may include providers of:

• Hosting.
• Authentication.
• Website security.
• Content delivery.
• Form processing.
• Analytics.
• Embedded media.
• Customer communication.
• Technical monitoring.

Third-party technologies may have their own cookies, retention periods, and data-processing practices.

Cronic Care should evaluate relevant providers, their contractual commitments, and their access to information before implementation.

Where PHI is involved, additional HIPAA and Business Associate Agreement requirements may apply.

18. Embedded Content and External Websites

Certain public website pages may include embedded content or links to external websites.

Examples could include:

• Demonstration videos.
• Educational materials.
• External documentation.
• Social media content.
• Third-party scheduling services.

If embedded content is implemented, the provider may use cookies or similar technologies.

Cronic Care should disclose relevant third-party tracking where required and consider privacy-preserving configurations.

Links to external websites are generally governed by those websites’ own privacy and cookie policies.

19. Cookie Consent

Where applicable law requires consent for nonessential cookies or similar technologies, Cronic Care should obtain the necessary consent before activating them.

A cookie consent mechanism may provide options to:

• Accept optional cookies.
• Reject optional cookies.
• Select cookie categories.
• Review additional information.
• Update previously selected preferences.

Consent should be informed, appropriately specific, and consistent with applicable law.

Strictly necessary technologies may operate without optional-cookie consent where permitted by law.

Publishing a Cookie Policy does not itself establish that legally required consent has been obtained.

20. Cookie Preference Center

Where implemented, a cookie preference center may allow visitors to manage optional cookie categories.

Available controls may include:

• Strictly necessary cookies.
• Functional cookies.
• Analytics cookies.
• Marketing cookies.

Strictly necessary cookies may remain enabled where required for website functionality or security.

Preference controls should reflect the actual technologies deployed.

If optional tracking technologies are used, a preference center should accurately implement visitor choices rather than merely display them.

21. Withdrawing or Changing Consent

Where cookie consent is used, visitors should be able to change or withdraw their consent in accordance with applicable requirements.

Changing consent may affect future use of optional cookies.

Previously collected information may remain subject to applicable retention and legal obligations.

Visitors may also clear existing cookies through browser settings.

If a preference center is available, its controls should be accessible through the website.

22. Managing Cookies Through Browsers

Most browsers allow users to manage cookies and website storage.

Users may be able to:

• View stored cookies.
• Delete individual cookies.
• Clear all website data.
• Block third-party cookies.
• Restrict persistent storage.
• Adjust privacy settings.

Common browsers include Google Chrome, Microsoft Edge, Mozilla Firefox, and Apple Safari.

Browser controls vary by version and device.

Blocking cookies may affect website functionality, including authenticated clinical Services.

23. Effects of Disabling Cookies

Disabling certain cookies or browser storage mechanisms may result in:

• Inability to remain signed in.
• Repeated authentication requests.
• Loss of saved preferences.
• Interrupted website functionality.
• Difficulty accessing restricted platform pages.
• Errors in authorized application workflows.

Cronic Care cannot guarantee that all Services will operate correctly when essential browser technologies are disabled.

Optional analytics and marketing technologies should not be necessary for core physician documentation and clinical intelligence functions.

24. California Privacy Rights

California residents may have privacy rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, where applicable.

Depending on the information involved and whether Cronic Care is subject to the relevant provisions, rights may include:

• Access to certain personal information.
• Information about collection and disclosure practices.
• Deletion of certain personal information.
• Correction of inaccurate personal information.
• Opting out of certain sales or sharing of personal information.
• Limiting certain uses and disclosures of sensitive personal information.
• Protection against unlawful discrimination for exercising applicable rights.

Certain information regulated by HIPAA may be exempt from specific California consumer privacy requirements.

However, the presence of HIPAA-regulated information does not automatically exempt all website data or business activities.

Cronic Care’s Privacy Policy should explain any applicable rights and request procedures.

25. Sale and Sharing of Personal Information

Certain tracking and advertising arrangements may constitute a “sale” or “sharing” of personal information under California law, depending on the circumstances.

These legal definitions may apply even when no money is exchanged.

If Cronic Care engages in covered activities, it must provide applicable notices and opt-out mechanisms.

This Cookie Policy does not establish that Cronic Care currently sells or shares personal information for cross-context behavioral advertising.

Any public statement that Cronic Care does not sell or share personal information should be verified against its actual website technologies, vendor contracts, and data practices.

26. Global Privacy Control

Global Privacy Control (GPC) is a browser-based mechanism through which users may communicate certain privacy preferences.

Where applicable California law requires recognition of qualifying opt-out preference signals, Cronic Care must process those signals appropriately for covered activities.

If the website does not engage in activities subject to those opt-out requirements, the legal and technical implications may differ.

Cronic Care should test the website’s actual response to GPC before making specific representations about how signals are handled.

27. Do Not Track

Some browsers transmit a Do Not Track (DNT) preference.

DNT and GPC are distinct technologies and should not be treated as interchangeable.

Because DNT does not have a universally adopted implementation standard, website responses may vary.

Cronic Care should accurately disclose its actual handling of DNT signals if required by applicable law.

28. Data Collected Through Cookies

Depending on the technologies enabled, cookies and similar mechanisms may process:

• Browser identifiers.
• Session identifiers.
• Device information.
• IP addresses.
• Approximate location information.
• Website interaction data.
• Authentication-related information.
• Preference settings.
• Technical diagnostic information.
• Consent records.

The presence of a particular category in this Policy does not mean that all listed information is currently collected.

Cronic Care should ensure that actual collection is consistent with its published privacy disclosures.

29. Legal Bases for Processing

Where applicable privacy laws require a legal basis for processing personal information, Cronic Care should identify and document the relevant basis.

Depending on the jurisdiction and processing activity, this may involve:

• Providing requested website functionality.
• Fulfilling contractual obligations.
• Meeting legal obligations.
• Protecting website and account security.
• Legitimate operational purposes where permitted.
• Consent where required.

The applicable legal basis depends on the information, processing purpose, and governing law.

This Policy does not replace the need to obtain HIPAA authorizations or other permissions when required.

30. Data Minimization and Purpose Limitation

Cronic Care should limit information collected through cookies and similar technologies to what is reasonably necessary for disclosed and authorized purposes.

Relevant practices may include:

• Avoiding unnecessary identifiers.
• Limiting optional tracking.
• Restricting collection on authenticated clinical pages.
• Reviewing external scripts.
• Preventing sensitive information from appearing in tracking URLs.
• Applying appropriate retention limits.
• Limiting third-party access.

Information collected for one purpose should not be reused for an incompatible purpose without an appropriate legal basis.

31. Cookie Retention and Deletion

Cookie retention varies according to the purpose and configuration of the technology.

Session cookies may expire automatically, while persistent cookies may remain until their expiration or deletion.

Cronic Care should establish reasonable retention settings and periodically review unnecessary persistent identifiers.

Deleting a cookie from a browser does not necessarily delete information already transmitted to a service provider.

Requests involving previously collected personal information are governed by applicable privacy laws, retention requirements, and contractual obligations.

Clinical documentation retention is governed separately from ordinary website cookie retention.

32. Security of Cookies and Browser Storage

Cookies and browser storage may create security risks if improperly configured.

Relevant safeguards may include:

• HTTPS communication.
• Secure cookie attributes where applicable.
• Appropriate SameSite settings.
• HttpOnly attributes for cookies that do not require script access.
• Short-lived authentication credentials.
• Token validation and expiration.
• Protection against cross-site scripting.
• Appropriate session termination.
• Restricted access to sensitive application data.

Not every safeguard applies to every type of browser storage.

For example, HttpOnly is a cookie attribute and does not apply to local storage or session storage.

Cronic Care should select safeguards appropriate to its actual authentication architecture and security requirements.

33. Security Monitoring and Fraud Prevention

Security technologies may collect limited technical information to identify suspicious or unauthorized activity.

Such activities may include:

• Detecting unusual login attempts.
• Identifying abusive requests.
• Protecting against automated attacks.
• Monitoring application errors.
• Supporting incident investigation.
• Maintaining system availability.

Security monitoring should be limited to authorized purposes and subject to appropriate access, confidentiality, and retention controls.

34. International Access and Data Processing

Visitors may access the Cronic Care public website from locations outside the United States.

Depending on the technologies and service providers involved, certain website-related information may be processed in different jurisdictions.

Where international privacy or data-transfer laws apply, Cronic Care must implement any required notices, legal mechanisms, or safeguards.

This section does not establish that Cronic Care currently transfers clinical information internationally.

The actual locations of data processing should be verified against relevant infrastructure configurations and service-provider arrangements.

35. Children’s Privacy

Cronic Care’s public website and clinical platform are directed primarily toward healthcare professionals, healthcare organizations, and authorized business users.

The Services are not intended as general consumer services for children.

Cronic Care does not intend to use website cookies to knowingly target children with behavioral advertising.

Where information relating to minors is processed in authorized healthcare workflows, applicable healthcare privacy, consent, and contractual requirements govern that processing.

36. Website Updates and New Technologies

Cronic Care may introduce new website features, authentication mechanisms, plugins, or service providers.

Before implementing technologies that collect or disclose personal information, Cronic Care should assess:

• The purpose of the technology.
• The categories of information processed.
• Whether PHI could be involved.
• Whether a third party receives information.
• Whether consent or an opt-out is required.
• Appropriate contractual safeguards.
• Data retention.
• Security risks.
• Required updates to privacy disclosures.

Material changes may require updates to this Policy and related website controls.

37. Cookie Compliance Reviews

Cronic Care should periodically review its cookie and tracking technology practices.

Reviews may include:

• Identifying active cookies and storage mechanisms.
• Reviewing WordPress plugins.
• Evaluating external scripts.
• Testing consent controls.
• Verifying optional-cookie blocking where required.
• Testing applicable privacy preference signals.
• Reviewing authenticated clinical pages.
• Confirming that PHI is not improperly transmitted.
• Updating cookie inventories.
• Reviewing third-party vendor arrangements.

These reviews support the accuracy of the Policy and the effectiveness of implemented privacy controls.

38. Relationship to the Privacy Policy

This Cookie Policy addresses cookies and related technologies specifically.

Cronic Care’s Privacy Policy provides broader information about the collection, use, disclosure, retention, and protection of personal information.

If a website interaction involves information that qualifies as PHI, HIPAA and applicable healthcare agreements may impose additional requirements.

Visitors should review both policies for a more complete understanding of relevant privacy practices.

39. Relationship to HIPAA and Healthcare Agreements

This Cookie Policy does not replace:

• A Business Associate Agreement.
• A healthcare organization’s Notice of Privacy Practices.
• Required patient authorizations.
• Applicable clinical service agreements.
• Cronic Care’s HIPAA security obligations.
• Any other legal requirement governing PHI.

Where a conflict exists, applicable law and governing contractual provisions control.

The publication of this Policy does not authorize otherwise prohibited uses or disclosures of patient information.

40. Changes to This Cookie Policy

Cronic Care may update this Cookie Policy to reflect changes in technology, website functionality, business practices, or applicable law.

Updates may involve:

• New website plugins.
• Changes to authentication.
• Introduction or removal of analytics.
• New embedded content.
• Changes in consent mechanisms.
• New privacy requirements.
• Security improvements.
• Changes in service providers.

The updated Policy will be published on the Cronic Care website with a revised effective date.

Where legally required, additional notice or consent will be provided.

41. Contact and Privacy Inquiries

For questions regarding cookies, tracking technologies, privacy preferences, or this Cookie Policy, contact:

Cronic Care, Inc.
Fresno, California, United States

privacy@cronic.care

For questions about patient medical records or healthcare privacy rights, individuals may also need to contact the healthcare organization responsible for their information.