InHealth Cookie and Tracking Technologies Notice

Effective date: October 26, 2026 Version 1.1

1. What this notice covers

This notice explains the cookies and similar technologies used on the InHealth member website and in the InHealth mobile applications, and the choices you have. It supplements our Privacy Policy.

2. The short version

We do not use advertising cookies, advertising software development kits, or third party marketing trackers anywhere in the member experience. No advertising network collects information about you through our application or member website. We do not sell information collected by cookies, and we do not share it for targeted advertising.

What we do use is the minimum needed to keep you logged in, keep the platform secure, remember your preferences, and understand where the product is failing so we can fix it.

3. What we use, and why

3.1 Strictly necessary

Required for the Services to work. These cannot be turned off.

Purpose	What it does
Authentication and session	Keeps you signed in, and signs you out after inactivity
Security	Protects against fraud, unauthorized access, and cross site request forgery
Load balancing	Routes your request to a working server
Consent record	Remembers the choices you have made here

3.2 Functional

Remember your preferences, such as language and notification settings, so you do not have to set them again. If you turn these off, the Services still work but forget your preferences.

3.3 Analytics and performance

Help us understand how the Services are used in aggregate: which screens are reached, where people drop out of a flow, how long something takes to load. We use this to fix problems and improve the product.

3.4 Diagnostics and crash reporting

Capture errors and crashes so we can find and fix defects. These reports include device type, operating system, application version, and technical information about the failure.

We do not include health information in analytics or crash reports. Our analytics and diagnostics providers operate under contract and, where they could touch protected health information, under an executed business associate agreement.

[To confirm: name the analytics and crash reporting tools in use, confirm that no health information is transmitted to them, and confirm that any identifier sent is a pseudonymous account identifier rather than a name, email address, or member identifier.]

4. What we do not use

• No advertising or marketing cookies or SDKs. No advertising pixels, no conversion tracking, no retargeting, no social media tracking pixels.
• No third party data brokers.
• No cross site or cross app tracking.
• No precise geolocation. We infer a general region from IP address for security purposes only.
• No fingerprinting for advertising or identification.
• No sale or sharing of information collected through these technologies.

5. Your choices

In the application. Adjust notification and preference settings in the app. You can limit diagnostics collection in your device settings: on iOS, Settings, Privacy and Security, Analytics and Improvements; on Android, Settings, Google, then the usage and diagnostics setting.

On the member website. Use the cookie preference control in the website footer to manage functional and analytics cookies. Strictly necessary cookies cannot be turned off.

In your browser. You can block or delete cookies in your browser settings. Blocking strictly necessary cookies will prevent you from logging in.

Global Privacy Control. We treat a Global Privacy Control signal, or a comparable universal opt out signal, as a valid opt out request from the browser that sends it. Because we do not sell information or use it for targeted advertising, there is nothing further for the signal to switch off, but we honor it and we do not override it.

Do Not Track. Browser Do Not Track signals are not standardized. We respond to Global Privacy Control instead, as described above.

6. How long these last

Type	Duration
Session cookies	Deleted when you close your browser
Authentication	The length of your session, subject to inactivity timeout
Preference	12 months
Analytics	12 months
Diagnostics and crash reports	90 days

7. Changes

We may update this notice. The current version is posted on the member website and in the application, with the effective date at the top. If we ever introduce a technology that is not described here, we will update this notice, and where consent is required we will obtain it first.

8. How to reach us

InHealth Medical Services security@inhealthonline.com · 888-219-5299 Privacy Officer: Johnnie Jenkins, Chief Operating Officer