CANBA HEALTH
Privacy Policy
Effective Date: July 4, 2026
1. Eligibility
You must be at least 18 years old, or the legal age of majority in your jurisdiction, to create a Canba Health account. Age is self-attested at account creation; we do not currently verify age through third-party means. If you are using Canba on behalf of another person, you represent that you have the legal authority or permission to do so.
2. Information We Collect
We collect information you choose to provide and certain technical information necessary to operate and improve our Services.
A. Account Information
When you create an account, we may collect:
B. Health Information
You may voluntarily add health-related information to your account, including:
Providing this information is optional and under your control.
C. Caregiver Information
If you invite a caregiver or family member, we may collect:
Only caregivers you authorize can access the information you choose to share.
D. Device and Technical Information
We may automatically collect information such as:
E. Cookies and Similar Technologies
We and our service providers may use cookies, mobile SDKs, and similar technologies to keep you signed in, remember your preferences, understand how the Services are used, and maintain security. We do not use these technologies to serve targeted advertising. Where required by law, we honor opt-out preference signals, including the Global Privacy Control (GPC), as a valid request to opt out of the sale or sharing of personal information. You can also control cookies through your browser or device settings, though some features of the Services may not function properly if you disable them.
3. How We Use Your Information
We use your information to:
Create and manage your account.
Provide the Services you request.
Organize your appointments, medications, and documents.
Enable caregiver collaboration.
Send reminders and notifications.
Improve and personalize our Services.
Respond to customer support requests.
Detect fraud, unauthorized access, or security incidents.
Comply with applicable legal obligations.
We do not sell your personal information or health information, and we do not use your health information to serve targeted advertising or to engage in geofencing around healthcare facilities, treatment centers, or similar locations.
We may create de-identified or aggregated information from data you provide — for example, to understand usage trends or to support research and grant applications related to cancer care. De-identified information does not identify you and is not linked back to your account.
4. Artificial Intelligence Features
Canba Health may use artificial intelligence (“AI”) to help explain medical reports, laboratory results, treatment-related information, and other health information you choose to add to your account in simpler language. AI-generated responses are provided for informational purposes only. They are intended to help you better understand your health information and are not medical advice, diagnosis, or treatment recommendations. Always consult your healthcare provider before making decisions about your health or treatment.
AI Chat. Canba Health includes an AI chat feature that lets you ask questions about your condition and your care. To provide relevant, personalized responses, the AI assistant may reference the information you have added to your account — such as your diagnosis, treatments, medications, appointments, symptoms, mood entries, and uploaded documents. This information is used only to generate a response to you at the time of your request.
Uploaded Documents and Photos. Documents and photos you upload within Canba AI chat are not stored on our servers or in our database. File content is transmitted to our AI model provider only temporarily to generate a response and is discarded immediately afterward. Our records retain only the file's type (such as PDF or image), size, and page count — never the file itself. Under the paid tier of the Gemini API we use, this information is not used to train or improve the AI model.
Chat History. Your chat conversations are stored solely so that you can view them within the app. We do not use your chat history for advertising, profiling, or any purpose other than displaying it to you and operating the feature. You may delete individual conversations or your entire chat history at any time from within the app, and deleted conversations are permanently removed from our systems. If you delete your account, your chat history is deleted along with it.
Medical Knowledge Sources. Canba AI generates educational responses using trusted medical references, including the National Cancer Institute (NCI), National Institutes of Health (NIH), MedlinePlus, the Centers for Disease Control and Prevention (CDC), the U.S. Food and Drug Administration (FDA), and other reputable medical references, as applicable. Where appropriate, Canba Health may display the medical references used to generate an AI response within the app so users can review the underlying information.
AI Processing Consent. Before using Canba AI for the first time, users are informed that their questions and any relevant health information they choose to submit may be securely processed by our AI model provider solely for the purpose of generating an AI response. Users are asked to provide their consent before using these AI features. Users may choose not to use Canba AI at any time without affecting their ability to use the core features of Canba Health.
To provide AI features, the information needed to answer your request (such as your questions and relevant health information from your account) is securely processed by Google (Gemini), our current AI model provider. In the future, Canba Health may integrate additional AI model providers, such as OpenAI or Anthropic, as additional AI features become available. Each provider is engaged under a written agreement that limits its use of your information solely to providing AI services to Canba Health. Our AI providers are contractually prohibited from using your information to train or improve their own AI models. Only the minimum information reasonably necessary to generate a response is shared with the AI provider.
5. Sharing Your Information
We only share your information in the following circumstances:
With caregivers you choose to invite.
With trusted service providers that help us operate our Services, such as cloud hosting, authentication, secure storage, AI processing, analytics, and customer support. These providers process your information only on our behalf and only for the purposes described in this Privacy Policy. They are contractually prohibited from using your information for their own purposes, including training artificial intelligence models.
When required by law or legal process.
To protect the rights, safety, or security of our users or Canba Health.
In connection with a merger, acquisition, financing, or sale of assets, in which case we will require the receiving party to honor the commitments in this Privacy Policy.
We do not sell or rent your personal or health information to third parties.
6. Data Security
We use reasonable administrative, technical, and organizational safeguards designed to protect your information, including encryption in transit and at rest, secure authentication, access controls, system monitoring, and regular security updates. While we strive to protect your information, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Data Retention
We retain your information for as long as your account is active. If you delete your account, your personal information will be permanently deleted from our systems within 30 days of your deletion request, except where we are legally required to retain certain records for a longer period, such as to comply with a legal obligation, resolve a dispute, or enforce our agreements. This 30-day window allows us to reverse accidental deletions and complete any operational or legal steps required before permanent removal.
Caregiver Data. If you delete your account, any caregiver access linked to your account is terminated, and caregiver information collected in connection with your account is deleted as part of the same process. You may also revoke an individual caregiver's access at any time from your account settings.
Deceased Users. In the event of a user's death, an authorized caregiver or the user's legal representative may request deletion of the user's account by contacting us at support@canbahealth.com. We may request reasonable proof of death and of the requester's relationship to the user or legal authority before acting on the request. Once verified, the account will be deleted in accordance with this section.
At the end of this 30-day period:
Information that directly identifies you (such as your name, email address, and contact details) is permanently and irreversibly deleted.
Health and usage data that is not fully deleted may be retained only after being de-identified in accordance with industry-recognized practices, meaning that identifiers such as your name, email address, and account identifiers are removed or altered so that the data can no longer reasonably be used to identify you or be linked back to you. We do not attempt to re-identify de-identified data, and we contractually prohibit our service providers from doing so.
Anonymized data is used only in aggregate form — reflecting overall patterns across our user population rather than any individual's information — for purposes such as improving our Services, understanding health trends, and supporting research. It is never re-associated with you or shared in a way that identifies you.
Where we use third-party service providers to store or process your information (such as Firebase or our cloud hosting provider), we will instruct those providers to delete your personal information from their systems as part of fulfilling your deletion request, consistent with applicable law.
Any information we retain beyond the 30-day period because we are legally required to do so is limited to what is necessary for that purpose, is not used for any other purpose, and is permanently deleted once the applicable legal retention requirement expires.
Deletion from our backup and disaster-recovery systems may take longer than deletion from our active, production systems, since backups are not continuously accessible for routine deletion. Data in backups is not accessed or used for any purpose other than restoring service in the event of data loss, and is permanently removed once the affected backup is cycled out or overwritten in the ordinary course, consistent with our backup retention schedule.
8. Your Privacy Choices and Rights
Depending on your location and applicable law, you may have the right to:
Access the personal information we hold about you.
Correct inaccurate information.
Request deletion of your information.
Delete individual AI chat conversations or your entire chat history at any time from within the app.
Download a copy of your data (data portability).
Withdraw consent for the collection or processing of your health information at any time.
Limit or opt out of the use of sensitive personal information.
Not be discriminated against for exercising any of these rights.
To exercise these rights, contact us at support@canbahealth.com. We will respond within 45 days of a verifiable request, or notify you if we need additional time. If we decline a request, you may appeal by replying to our response, and we will respond to your appeal within 45 days.
Consumer Health Data Consent: Because information such as cancer diagnosis and treatment details is classified as “consumer health data” under certain state laws (including Washington’s My Health My Data Act), we ask for your separate, standalone consent before you add health information to your account — distinct from your general agreement to this Privacy Policy and our Terms of Service. You may withdraw this consent at any time from your account settings without losing access to the rest of the Services.
9. International Users
Canba Health is operated from the United States, and information you provide is processed and stored in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, which may have different data protection laws than your country of residence.
10. Children's Privacy
Canba Health is intended for adults and requires users to be at least 18 years old (see Section 1). We do not knowingly collect personal information from anyone under the age of 18, including children under 13. If we learn we have collected such information, we will delete it promptly.
11. Third-Party Service Providers
Our Services rely on trusted third-party providers, including:
Firebase
Google Cloud
Google Sign-In
Apple Sign-In
Push notification providers
Google (Gemini) — our current AI model provider for AI-powered explanations and chat responses. In future versions of the Services, we may also integrate additional AI providers, such as OpenAI or Anthropic. Any AI provider we use is contractually required to process your information only for the purpose of providing AI services to Canba Health and is prohibited from using your information to train or improve its own AI models.
These providers process information according to their own privacy policies and under contractual obligations that limit their use of your information to providing services to us.
12. HIPAA Notice
Canba Health is a personal health management platform. Unless otherwise stated in a written agreement with a healthcare provider or other covered entity, Canba Health is not acting as a HIPAA Covered Entity or Business Associate. We are committed to protecting your information using industry-standard security practices regardless.
13. Data Breach Notification
As a platform that collects health information directly from consumers, Canba Health may be subject to the FTC Health Breach Notification Rule. In the event of a breach of unsecured personal information, we will notify affected individuals without unreasonable delay and in accordance with applicable law, which may include notifying the Federal Trade Commission and, for larger breaches, prominent media outlets. Notifications will describe what happened, what information was involved, and steps you can take to protect yourself.
14. Governing Law
This Privacy Policy is governed by the laws of the State of Delaware, without regard to conflict-of-law principles, except where applicable law requires otherwise (for example, certain consumer protection or health data laws in your state of residence).
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes — particularly changes affecting how we use health information or AI processing — we will notify users through the Services or by other appropriate means and, where required, seek renewed consent. Your continued use of Canba Health after changes become effective constitutes your acceptance of the updated Privacy Policy.
16. Contact Us
If you have any questions about this Privacy Policy or our privacy practices, please contact us:
Canba Health, Inc.
Address: 8 The Green STE A, Dover, DE 19901, United States
Email: support@canbahealth.com
Website: www.canbahealth.com
Registration Screen Consent Text
☐ I have read and agree to the Privacy Policy.
☐ I agree to the Terms of Service.
☐ I consent to the collection, use, and processing of my personal information as described in the Privacy Policy.
☐ I separately consent to Canba Health’s collection and use of my health information (such as diagnosis, treatment, and medication details), and understand I may withdraw this consent at any time in my account settings.
☐ I understand that if I choose to use Canba AI, my questions and relevant health information may be securely processed by our AI service provider(s) solely to generate AI responses, as described in the Privacy Policy.