Privacy Policy

Who this policy covers

Cabana is a technology platform that connects patients with independently licensed healthcare providers and pharmacies. Cabana is not a healthcare provider, pharmacy, or manufacturer. This policy describes how [Cabana legal entity, to be finalized with counsel] (“Cabana,” “we,” “us”) handles information collected through this website and our services.

Your clinical care is delivered by licensed clinicians of an independently owned and operated Cabana-affiliated medical group. That medical group is a HIPAA covered entity, and its handling of your protected health information (PHI) is described in our Notice of Privacy Practices. Where we act on the medical group’s behalf, we do so as a business associate under a written agreement.

Information we collect

• Account information, name, email, phone, date of birth, shipping and billing address, and login credentials.
• Health information, the intake questionnaire you complete, your medical history and medication list, lab results ordered through the platform, and messages with your care team.
• Payment information, processed by our payment providers; we do not store full card numbers.
• Device and usage information, IP address, browser type, pages viewed, and similar analytics, collected through cookies and similar technologies (see “Tracking technologies and your choices”).

How we use your information

• To operate the platform and connect you with licensed providers, pharmacies, and CLIA-certified laboratories.
• To coordinate your care, shipments, billing, and concierge support.
• To communicate with you about your account, orders, and service updates.
• To improve, secure, and troubleshoot our services, and to meet legal and regulatory obligations.

Your health information and HIPAA

Protected health information created or received in the course of your care is handled by the affiliated medical group under HIPAA and applicable state law. For a full description of how PHI is used and disclosed, and of your rights over that information, see our Notice of Privacy Practices. Where information is governed by HIPAA, the terms of that Notice control over any conflicting statement in this policy.

We do not sell your health information

We do not sell your protected health information, and we do not use identifiable health information for third-party advertising. We do not share your health information with advertising platforms or data brokers. We will not use or disclose your PHI for marketing purposes without your written authorization, except as permitted by HIPAA.

Tracking technologies and your choices

Our public marketing pages use cookies and similar technologies for basic functionality and aggregate analytics. Because we treat your privacy as a clinical matter, we take a HIPAA-aware approach to tracking:

• We do not deploy standard third-party advertising pixels on pages where you are identifiable and engaged in health-related activity, such as intake, checkout for a specific condition, lab results, or the patient portal.
• Where analytics or tracking vendors could touch identifiable health-related data, we use consent-based, server-side, or HIPAA-compliant configurations and require a business-associate agreement. [Specific vendors and consent mechanics to be finalized with privacy counsel.]
• You can control cookies through your browser settings and, where offered, our on-site consent controls. Some features may not work without certain cookies.

How we share information

We share information only as needed to provide the service and as permitted by law, including with: your licensed providers, pharmacies, and laboratories; service providers and business associates who process data on our behalf under contract; and authorities when required by law or to protect safety. We do not sell personal information as that term is defined under applicable state law.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or port your information, to opt out of certain processing, and to withdraw consent. Residents of states with comprehensive privacy laws (including California and Washington’s My Health My Data Act) may have additional rights. To exercise any right, contact us at concierge@trycabana.com. We will not discriminate against you for exercising your rights. [State-specific disclosures and verification process to be finalized with counsel.]

Data security and retention

We use administrative, technical, and physical safeguards designed to protect your information, and we retain information for as long as needed to provide services and meet legal, medical-record, and regulatory requirements. No system is perfectly secure; we cannot guarantee absolute security. [Retention schedules to be finalized with counsel.]

Children

Cabana’s services are intended only for adults 18 and older. We do not knowingly collect information from anyone under 18.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice.