Medoura Cookie and Tracking Notice

Effective Date: July 26, 2026
Last Updated: July 26, 2026

This Cookie and Tracking Notice explains how CoFabri LLC, operating as Medoura (“Medoura,” “we,” “us,” or “our”), uses cookies and similar technologies on medoura.co and other Medoura-operated websites and web applications.

This Notice should be read together with the Medoura Privacy Policy.

1. Scope of This Notice

This Notice applies to:

• Medoura’s public business and marketing websites;
• customer, provider, workforce, and administrator login pages;
• authenticated Medoura Platform pages;
• Medoura-powered patient workflows; and
• other Medoura-operated web applications.

Different technologies and restrictions apply depending on the page.

Medoura applies heightened restrictions to patient-facing, authenticated, intake, clinical, messaging, payment, and other pages that may reveal health-related or confidential information.

This Notice does not govern tracking technologies placed on a customer-owned website or other system outside Medoura’s control.

2. Cookies and Similar Technologies

Cookies are small text files stored on a browser or device.

Medoura and its approved providers may also use:

• local or session storage;
• software development kits;
• pixels, tags, and conversion events;
• browser or device identifiers;
• authentication and session tokens;
• server and security logs;
• fraud-prevention technologies;
• error-monitoring tools;
• analytics technologies; and
• embedded third-party features.

These technologies may recognize a browser or device, maintain a session, remember preferences, measure performance, diagnose errors, prevent misuse, or support public-site advertising.

3. Categories of Technologies

A. Strictly Necessary

Strictly necessary technologies are used to provide, secure, or maintain a service or feature requested by the user.

They may support:

• login and authentication;
• multi-factor authentication;
• session management;
• fraud and unauthorized-access prevention;
• security logging;
• traffic management;
• cookie-preference storage;
• checkout and account functions;
• error diagnosis necessary to maintain the service; and
• other core Website or Platform functions.

These technologies generally cannot be disabled through Medoura’s cookie controls. Blocking them through a browser may prevent login, checkout, or other functions from working correctly.

B. Preferences

Preference technologies remember choices such as:

• language;
• region;
• display or accessibility settings;
• saved interface preferences; and
• cookie selections.

Where required, Medoura uses nonessential preference technologies only after consent.

C. Analytics and Performance

Analytics and performance technologies may help Medoura understand:

• public Website traffic and navigation;
• page-load and reliability information;
• browser, device, and general geographic information;
• aggregated usage patterns;
• errors, crashes, and technical failures; and
• whether Website features function as intended.

Where required, nonessential analytics are activated only after consent.

Medoura seeks to configure analytics and monitoring tools so they do not collect patient intake answers, message contents, diagnoses, prescriptions, clinical records, full payment information, or other PHI or Consumer Health Data.

D. Advertising and Targeting

Medoura may use advertising, conversion-measurement, and retargeting technologies on public business-to-business marketing pages.

These technologies may help Medoura:

• measure an advertising campaign;
• attribute a Website visit or demonstration request;
• limit or sequence advertisements;
• understand whether a public marketing action occurred; or
• present advertisements based on public-Website activity.

Some state privacy laws may describe these disclosures as a “sale,” “sharing,” or processing for targeted advertising even when Medoura does not receive money for the information.

Medoura does not use PHI or Consumer Health Data for targeted advertising.

Medoura does not permit advertising or retargeting technologies on sensitive patient or authenticated Platform pages.

E. Embedded Content

Public Website pages may contain an approved:

• live-chat or support widget;
• form;
• scheduling tool;
• video;
• map;
• social-media feature; or
• other embedded third-party service.

The provider may receive information when the feature loads or is used.

Where appropriate, Medoura may delay nonessential embedded content until the visitor provides consent.

4. Sensitive and Patient-Facing Pages

On patient-facing, authenticated, intake, clinical, messaging, payment, or other sensitive pages, Medoura intends to use only technologies reasonably necessary for:

• authentication;
• security and fraud prevention;
• session management;
• Platform operation;
• customer-requested communications;
• payment processing;
• appropriately limited error diagnosis; and
• other legally permitted service functions.

Medoura does not permit a customer or user to add an advertising pixel, retargeting tag, unapproved analytics tool, or session-replay technology to a sensitive Medoura Platform page.

Approved error and performance tools used on sensitive pages must be configured, where reasonably practicable, to:

• exclude form-field contents and message bodies;
• avoid recording keystrokes or sensitive screen contents;
• limit URLs, identifiers, and metadata;
• mask or redact sensitive values; and
• restrict access and retention.

A healthcare practice remains responsible for tracking technologies it places on a website, landing page, application, or system outside Medoura.

5. Information Collected

Depending on the technology, page, and configuration, information may include:

• IP address;
• browser and device information;
• operating system and language;
• general geographic information derived from IP address;
• referring and exit page;
• pages viewed and buttons or links selected;
• date, time, and duration of activity;
• session, account, tenant, or security identifiers;
• cookie and advertising preferences;
• campaign and conversion information;
• authentication and security events;
• error, crash, and performance information; and
• information needed to provide a requested transaction or feature.

Public-site advertising providers may receive device identifiers, IP address, browser information, campaign information, and public marketing-page interactions.

Medoura does not intend to send patient form contents, diagnoses, treatment details, prescriptions, messages, clinical records, or Consumer Health Data to public-site advertising providers.

6. Purposes

Medoura may use cookies and similar technologies to:

• operate and secure the Website and Platform;
• authenticate users and preserve sessions;
• prevent fraud, misuse, and unauthorized access;
• remember preferences;
• provide requested features;
• process checkout and payment functions through approved providers;
• diagnose technical errors;
• measure public Website performance and usage;
• understand advertising and campaign performance;
• improve usability, reliability, and accessibility;
• maintain records of privacy choices; and
• comply with legal and contractual obligations.

7. Current Providers

The following table reflects Medoura’s current intended configuration. A provider’s exact technology, name, or duration may vary by browser, feature, configuration, and provider update.

Provider	Purpose	Category	Where Permitted	Typical Duration
Google Analytics 4	Measures traffic, page views, and aggregated usage patterns	Analytics	Public marketing pages; other pages only if approved and appropriately limited	Up to 2 years
Google Ads	Measures advertising campaigns and public-site conversions	Advertising	Public marketing pages only	Up to 90 days
Meta Pixel	Measures advertising performance and may support retargeting	Advertising	Public marketing pages only	Up to 90 days
Reddit Pixel	Measures advertising performance and may support retargeting	Advertising	Public marketing pages only	Up to 1 year
Hotjar	Provides usability and aggregated session analytics	Analytics	Public marketing pages only; sensitive inputs must not be recorded	Up to 1 year
GoHighLevel Chat Widget	Provides live chat for business, support, or sales inquiries	Embedded Content	Approved public pages; users must not submit PHI or patient information	Up to 1 year
Sentry	Captures limited application errors and diagnostic information	Strictly Necessary / Performance	Website and Platform where approved, with sensitive-data controls	Session or provider-configured period
Vercel Analytics	Measures aggregated page-load performance and usage	Analytics	Website and approved Platform routes	Typically cookieless

This table must be updated when Medoura materially changes the technologies it deploys.

A listed provider must not be treated as authorized for every Medoura page. Page-level restrictions in this Notice control.

8. Your Choices

A. Cookie Settings

Where available, use the Cookie Settings link to:

• accept all nonessential technologies;
• reject nonessential technologies;
• select categories; or
• change a prior choice.

Medoura may store your selection through a necessary cookie or local-storage record.

Rejecting nonessential technologies will not disable strictly necessary technologies.

B. Consent

Where consent is required, Medoura will not activate nonessential analytics, advertising, targeting, or embedded technologies until consent is provided.

Consent must be freely given and may be withdrawn through Cookie Settings.

Withdrawing consent does not affect processing that occurred lawfully before withdrawal.

C. Sale, Sharing, and Targeted-Advertising Opt-Out

Where applicable law provides an opt-out right, you may opt out through:

• Cookie Settings;
• a recognized browser-based opt-out preference signal, such as Global Privacy Control; or
• an email request to legal@cofabri.com.

Medoura will process a legally recognized opt-out preference signal for the browser or device sending the signal as required by applicable law.

You do not need to create an account to submit an opt-out request by email.

D. Browser and Device Controls

Most browsers allow you to block, delete, or restrict cookies.

A browser or mobile operating system may also limit advertising identifiers, location access, or cross-site tracking.

Blocking necessary technologies may prevent authentication, checkout, account access, or other functions.

E. Do Not Track

Some browsers provide a “Do Not Track” setting.

Because there is no universally adopted legal standard for every Do Not Track signal, Medoura may not respond to that setting in all contexts.

Medoura responds to legally recognized opt-out preference signals where required.

9. Duration and Retention

A session technology generally expires when the browser session ends.

A persistent technology remains until:

• its stated expiration;
• it is deleted through browser or device settings;
• consent is withdrawn and the technology is removed where applicable; or
• Medoura or the provider changes the configuration.

The table above provides typical maximum durations, not guaranteed retention periods.

Medoura seeks to limit identifiers and tracking information to periods reasonably necessary for the stated purpose, legal compliance, security, and recordkeeping.

Deleting a cookie does not necessarily delete information already received and retained under the Privacy Policy.

10. Customer-Configured Websites and Technologies

A Medoura customer may operate separate websites, landing pages, advertising accounts, forms, communication systems, or applications.

The customer is responsible for:

• its own cookie and privacy notices;
• obtaining legally required consent;
• honoring opt-out signals and requests;
• selecting and configuring its technologies;
• preventing unlawful disclosure of PHI or Consumer Health Data; and
• ensuring that its use complies with law and its agreements with Medoura.

Medoura’s approval of an integration or technical connection does not constitute approval of the customer’s tracking practices.

Customers may not use Medoura patient data to create advertising audiences or operate unauthorized advertising, retargeting, or session-replay technologies.

11. Changes to This Notice

Medoura may update this Notice when its technologies, providers, Website, Platform, privacy practices, or legal obligations change.

The “Last Updated” date identifies the current version.

Where required, Medoura will provide additional notice, request consent, or reset preferences before a materially different nonessential use begins.

12. Contact Us

CoFabri LLC / Medoura

Privacy and legal email: legal@cofabri.com Privacy request form: Log into your account and use the Privacy/Data Requests option, or contact your telehealth provider directly Cookie choices: Use the Cookie Settings link where available

For healthcare records, treatment, a healthcare practice’s Notice of Privacy Practices, or tracking technologies on a practice-owned website outside Medoura, contact the applicable healthcare practice.