Privacy Policy

Effective Date: July 4, 2026

1. Eligibility

You must be at least 18 years old, or the legal age of majority in your jurisdiction, to create a Canba Health account. Age is self-attested at account creation; we do not currently verify age through third-party means. If you are using Canba on behalf of another person, you represent that you have the legal authority or permission to do so.

2. Information We Collect

We collect information you choose to provide and certain technical information necessary to operate and improve our Services.

A. Account Information

When you create an account, we may collect:

● Full name
● Email address
● Password (if registering with email)
● Authentication information through Google or Apple Sign-In
● Profile photo (optional)

B. Health Information

You may voluntarily add health-related information to your account, including:

● Cancer diagnosis
● Treatment information
● Medications
● Appointments
● Symptoms
● Mood tracking
● Personal notes
● Medical documents
● Laboratory or imaging results
● Other health-related information you choose to provide

Providing this information is optional and under your control.

C. Caregiver Information

If you invite a caregiver or family member, we may collect:

● Name
● Email address
● Relationship to you (optional)

Only caregivers you authorize can access the information you choose to share.

D. Device and Technical Information

We may automatically collect information such as:

● Device type
● Operating system
● Browser type
● App version
● IP address
● Device identifiers
● Crash reports
● Log files
● Usage information necessary to maintain and improve our Services

E. Cookies and Similar Technologies

We and our service providers may use cookies, mobile SDKs, and similar technologies to keep you signed in, remember your preferences, understand how the Services are used, and maintain security. We do not use these technologies to serve targeted advertising. Where required by law, we honor opt-out preference signals, including the Global Privacy Control (GPC), as a valid request to opt out of the sale or sharing of personal information. You can also control cookies through your browser or device settings, though some features of the Services may not function properly if you disable them.

3. How We Use Your Information

We use your information to:

● Create and manage your account.
● Provide the Services you request.
● Organize your appointments, medications, and documents.
● Enable caregiver collaboration.
● Send reminders and notifications.
● Improve and personalize our Services.
● Respond to customer support requests.
● Detect fraud, unauthorized access, or security incidents.
● Comply with applicable legal obligations.

We do not sell your personal information or health information, and we do not use your health information to serve targeted advertising or to engage in geofencing around healthcare facilities, treatment centers, or similar locations.

We may create de-identified or aggregated information from data you provide — for example, to understand usage trends or to support research and grant applications related to cancer care. De-identified information does not identify you and is not linked back to your account.

4. Artificial Intelligence Features

Canba Health may use artificial intelligence (“AI”) to help explain medical reports, laboratory results, treatment-related information, and other health information you choose to add to your account in simpler language. AI-generated responses are provided for informational purposes only. They are intended to help you better understand your health information and are not medical advice, diagnosis, or treatment recommendations. Always consult your healthcare provider before making decisions about your health or treatment.

AI Chat. Canba Health includes an AI chat feature that lets you ask questions about your condition and your care. To provide relevant, personalized responses, the AI assistant may reference the information you have added to your account — such as your diagnosis, treatments, medications, appointments, symptoms, mood entries, and uploaded documents. This information is used only to generate a response to you at the time of your request.

Chat History. Your chat conversations are stored solely so that you can view them within the app. We do not use your chat history for advertising, profiling, or any purpose other than displaying it to you and operating the feature. You may delete individual conversations or your entire chat history at any time from within the app, and deleted conversations are permanently removed from our systems. If you delete your account, your chat history is deleted along with it.

To provide AI features, the information needed to answer your request (such as your questions and relevant health information from your account) is processed by Google (Gemini), our current AI model provider, and may in the future also be processed by other AI model providers such as OpenAI or Anthropic as we adopt additional tools. Each such provider is engaged under a written agreement that restricts their use of your information to providing the service to us. Our AI model providers do not use your information to train their models.

5. Sharing Your Information

We only share your information in the following circumstances:

● With caregivers you choose to invite.
● With trusted service providers that help us operate our Services, such as cloud hosting, authentication, secure storage, AI processing, analytics, and customer support, under contracts that limit their use of your information to providing services to us.
● When required by law or legal process.
● To protect the rights, safety, or security of our users or Canba Health.
● In connection with a merger, acquisition, financing, or sale of assets, in which case we will require the receiving party to honor the commitments in this Privacy Policy.

We do not sell or rent your personal or health information to third parties.

6. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect your information, including encryption in transit and at rest, secure authentication, access controls, system monitoring, and regular security updates. While we strive to protect your information, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your information for as long as your account is active. If you delete your account, your personal information will be permanently deleted from our systems within 30 days of your deletion request, except where we are legally required to retain certain records for a longer period, such as to comply with a legal obligation, resolve a dispute, or enforce our agreements. This 30-day window allows us to reverse accidental deletions and complete any operational or legal steps required before permanent removal.

Caregiver Data. If you delete your account, any caregiver access linked to your account is terminated, and caregiver information collected in connection with your account is deleted as part of the same process. You may also revoke an individual caregiver’s access at any time from your account settings.

Deceased Users. In the event of a user’s death, an authorized caregiver or the user’s legal representative may request deletion of the user’s account by contacting us at support@canbahealth.com. We may request reasonable proof of death and of the requester’s relationship to the user or legal authority before acting on the request. Once verified, the account will be deleted in accordance with this section.

At the end of this 30-day period:

● Information that directly identifies you (such as your name, email address, and contact details) is permanently and irreversibly deleted.
● Health and usage data that is not fully deleted may be retained only after being de-identified in accordance with industry-recognized practices, meaning that identifiers such as your name, email address, and account identifiers are removed or altered so that the data can no longer reasonably be used to identify you or be linked back to you. We do not attempt to re-identify de-identified data, and we contractually prohibit our service providers from doing so.

Anonymized data is used only in aggregate form — reflecting overall patterns across our user population rather than any individual’s information — for purposes such as improving our Services, understanding health trends, and supporting research. It is never re-associated with you or shared in a way that identifies you.

Where we use third-party service providers to store or process your information (such as Firebase or our cloud hosting provider), we will instruct those providers to delete your personal information from their systems as part of fulfilling your deletion request, consistent with applicable law.

Any information we retain beyond the 30-day period because we are legally required to do so is limited to what is necessary for that purpose, is not used for any other purpose, and is permanently deleted once the applicable legal retention requirement expires.

Deletion from our backup and disaster-recovery systems may take longer than deletion from our active, production systems, since backups are not continuously accessible for routine deletion. Data in backups is not accessed or used for any purpose other than restoring service in the event of data loss, and is permanently removed once the affected backup is cycled out or overwritten in the ordinary course, consistent with our backup retention schedule.

8. Your Privacy Choices and Rights

Depending on your location and applicable law, you may have the right to:

● Access the personal information we hold about you.
● Correct inaccurate information.
● Request deletion of your information.
● Delete individual AI chat conversations or your entire chat history at any time from within the app.
● Download a copy of your data (data portability).
● Withdraw consent for the collection or processing of your health information at any time.
● Limit or opt out of the use of sensitive personal information.
● Not be discriminated against for exercising any of these rights.

To exercise these rights, contact us at support@canbahealth.com. We will respond within 45 days of a verifiable request, or notify you if we need additional time. If we decline a request, you may appeal by replying to our response, and we will respond to your appeal within 45 days.

Consumer Health Data Consent: Because information such as cancer diagnosis and treatment details is classified as “consumer health data” under certain state laws (including Washington’s My Health My Data Act), we ask for your separate, standalone consent before you add health information to your account — distinct from your general agreement to this Privacy Policy and our Terms of Service. You may withdraw this consent at any time from your account settings without losing access to the rest of the Services.

9. International Users

Canba Health is operated from the United States, and information you provide is processed and stored in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, which may have different data protection laws than your country of residence.

10. Children’s Privacy

Canba Health is intended for adults and requires users to be at least 18 years old (see Section 1). We do not knowingly collect personal information from anyone under the age of 18, including children under 13. If we learn we have collected such information, we will delete it promptly.

11. Third-Party Service Providers

Our Services rely on trusted third-party providers, including:

● Firebase
● Google Cloud
● Google Sign-In
● Apple Sign-In
● Push notification providers
● Google (Gemini) — our current AI model provider, with the possibility of adding others (such as OpenAI or Anthropic) in the future

These providers process information according to their own privacy policies and under contractual obligations that limit their use of your information to providing services to us.

12. HIPAA Notice

Canba Health is a personal health management platform. Unless otherwise stated in a written agreement with a healthcare provider or other covered entity, Canba Health is not acting as a HIPAA Covered Entity or Business Associate. We are committed to protecting your information using industry-standard security practices regardless.

13. Data Breach Notification

As a platform that collects health information directly from consumers, Canba Health may be subject to the FTC Health Breach Notification Rule. In the event of a breach of unsecured personal information, we will notify affected individuals without unreasonable delay and in accordance with applicable law, which may include notifying the Federal Trade Commission and, for larger breaches, prominent media outlets. Notifications will describe what happened, what information was involved, and steps you can take to protect yourself.

14. Governing Law

This Privacy Policy is governed by the laws of the State of Delaware, without regard to conflict-of-law principles, except where applicable law requires otherwise (for example, certain consumer protection or health data laws in your state of residence).

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes — particularly changes affecting how we use health information or AI processing — we will notify users through the Services or by other appropriate means and, where required, seek renewed consent. Your continued use of Canba Health after changes become effective constitutes your acceptance of the updated Privacy Policy.

16. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

● Canba Health, Inc.
● Address: 8 The Green STE A, Dover, DE 19901, United States
● Email: support@canbahealth.com
● Website: www.canbahealth.com

Registration Screen Consent Text

☐ I have read and agree to the Privacy Policy.
☐ I agree to the Terms of Service.
☐ I consent to the collection, use, and processing of my personal information as described in the Privacy Policy.
☐ I separately consent to Canba Health’s collection and use of my health information (such as diagnosis, treatment, and medication details), and understand I may withdraw this consent at any time in my account settings.