Privacy Policy

Effective date: September 14, 2026

Crates Health Inc., a Delaware corporation (“Crates,” “we,” “us”) provides services that help people organize health-related purchases and documentation, request medical-necessity documentation, and prepare and manage reimbursement requests. This Privacy Policy explains how we collect, use and disclose personal information through our websites, applications and related services.

The information we handle depends on the services you use and the information you provide. Additional notices or consent requests may apply to a particular service. Our Consumer Health Data Privacy Notice explains our handling of consumer health data under applicable state laws. A separate clinical privacy notice may govern records maintained by a healthcare professional where applicable; this policy does not replace that notice or reduce your rights under it.

Information we collect

Account and contact information. Your name, email address, contact details, account credentials or authentication identifiers, preferences, and communications with us. If you sign in with Google, we receive information such as your name, email address and authentication information. Google sign-in alone does not authorize access to your email messages.

Health and patient information. Information you submit in questionnaires, requests and supporting records, including patient identity and date of birth, health conditions, health and family history, reasons for seeking documentation, and information in medical-necessity letters and clinical review records. Information about a purchase or a request can itself reveal health information. If you provide information for someone else, you must have authority to do so.

Purchase and reimbursement information. Receipts, merchant and item details, purchase dates and amounts, supporting documents, reimbursement requests and their status, and correspondence about those requests. Depending on the request, we also collect administrator and account identifiers, addresses, signatures and identifying information required by an administrator, which can include a Social Security number. Provide sensitive identifiers only through the service's designated collection process when needed for your request.

Payments and service history. Purchases, subscriptions, payment status, billing details, transaction identifiers, credits and refunds. Payment providers process payment information under their own terms and privacy notices; we receive information needed to administer your purchase and account.

Technical and usage information. IP address, browser and device information, pages and features used, interaction events, referring pages, campaign identifiers, approximate location derived from IP address, and diagnostics. Cookies and similar technologies support authentication, preferences, measurement, customer support and advertising. Some measurement tools record interactions with pages to help us understand usability and errors.

Information from other sources. We receive information from you, people you authorize, authentication and payment providers, clinicians involved in requested reviews, service providers, and recipients or administrators involved in your reimbursement requests. Where an optional connection is available and you authorize it, we receive the information described in its connection notice. We request additional permissions when a feature requires them; these terms do not grant access to another account.

How we use information

We use information appropriate to each purpose to:

• Create and secure accounts, authenticate users and provide requested services.
• Organize purchases and supporting records, prepare documentation, facilitate clinical review, and prepare or transmit reimbursement requests you authorize.
• Process payments, administer subscriptions and maintain transaction records.
• Answer questions, resolve service problems, and send account, security, billing and service communications.
• Evaluate reliability and usability, correct errors and improve our services. Automated tools may assist document preparation, organization and other processing; applicable health-data and connection-specific restrictions also apply to those tools.
• Measure marketing and communicate about our services, subject to applicable consent and opt-out requirements. The health-data and connected-account restrictions described below limit this use.
• Detect fraud and abuse, protect people and systems, resolve disputes, enforce agreements and meet legal obligations.

We use sensitive information for the service, safety and legal purposes relevant to that information, subject to applicable law and required consent. We do not treat acceptance of our Terms as permission for every possible future use of health information. Where a new purpose or category requires additional notice or consent, we provide that notice and obtain the required consent first.

AI and document processing

We may use contracted AI and document-processing providers to extract, organize, and analyze information as needed to provide the services you request. We do not permit these providers to use your health information to train their own models. Any more specific restrictions in a connected-service notice also apply.

Access by our personnel

Authorized support and operations personnel may access relevant information only as needed to deliver and support the requested service. Clinical determinations remain with the licensed reviewer. Any more specific restrictions in a connected-service notice also apply.

How we disclose information

Technology and operational service providers. Companies and professionals help us host and secure systems, store and process documents, operate automated processing tools, process payments, deliver communications, provide support and analyze service performance. They receive information relevant to their work, subject to applicable contractual and legal restrictions. Provider processing remains subject to any more specific limits that apply to health data or a connected service.

Clinical review and authorized recipients. Information relevant to a requested review is made available to the professionals involved. At your direction, we also disclose supporting documentation and identifying information to benefit administrators and other recipients involved in a reimbursement request. Recipients may maintain their own records and apply their own privacy practices. We cannot retract information already delivered to an authorized recipient by disconnecting an account or deleting your Crates copy.

Marketing and measurement partners. On our marketing surfaces, analytics and advertising partners may receive technical identifiers, page and interaction information, and campaign information through cookies and similar technologies. Depending on the circumstances and applicable law, these disclosures may constitute a “sale” or “sharing” of personal information even without a monetary payment. We do not sell health information. We do not use or share consumer health data for targeted advertising, including advertising for Crates. This includes medical questionnaire answers, health information derived from receipts, and information about clinical interactions. General marketing analytics remain subject to applicable privacy requirements, consent and opt-out choices, and this health-data restriction. Our consumer health data notice and any connection-specific notice impose additional restrictions; those restrictions take precedence over this paragraph.

Legal and safety purposes. We may disclose information when required by law or as legally permitted to address fraud, security incidents, legal claims or threats to safety. A general business purpose does not override specific health-data or connected-service restrictions.

Business transactions. Information may be involved in a financing, merger, acquisition, reorganization or sale of assets, subject to appropriate safeguards and applicable law. Any transfer must respect applicable health-data requirements and restrictions imposed by connected services, including consent requirements. A transaction does not eliminate those restrictions.

With your authorization. We may disclose information to another recipient for a purpose you specifically authorize. We do not publish your private receipts or medical documentation as testimonials or promotional content without separate permission.

Your choices and requests

You may update account information through available account controls or contact us for assistance. You may unsubscribe from marketing emails using the link in those emails. We may still send necessary account and transaction messages. Browser controls can block or remove cookies, although some functions may stop working.

Depending on where you live and the law that applies, you may have rights to access, receive a copy of, correct or delete personal information; withdraw consent; restrict certain processing; or opt out of sale, sharing or targeted advertising. Our team handles privacy requests. To make a request, email info@crateshealth.com. Put “Privacy request” in the subject and describe your request without sending medical records or sensitive identifiers in the initial email. We will arrange appropriate verification and a suitable way to provide any additional information needed. An authorized representative may submit a request where permitted by law.

To request an opt-out of sale, sharing or targeted advertising where applicable, email our team. Browser cookie settings and advertising preferences may provide additional controls. We do not currently automatically apply browser opt-out signals; please contact us to exercise these choices.

We respond within applicable legal deadlines and explain any permitted denial or limitation. Where you have an appeal right, reply to the decision using “Privacy appeal”; we will explain the outcome and available complaint route. We will not unlawfully discriminate against you for exercising privacy rights. Withdrawing information or permissions necessary for a requested service may prevent us from continuing that service.

Cancellation of a subscription, disconnection of another account, and deletion of stored information are different actions. Cancellation does not itself delete your saved documentation. You may request a copy of your documentation before requesting deletion. An account disconnection stops future access through that connection; its notice explains what happens to information already saved. Deletion requests are subject to applicable law and verified retention obligations, not a general right to keep all data indefinitely.

Retention and security

We retain information for the purposes described here, considering your choices, whether you maintain an account or saved documentation, the nature of the service, applicable recordkeeping duties, and the need to address transactions, disputes, fraud and security. Different records can have different retention periods. Keeping documentation for future reimbursement is distinct from keeping temporary processing data or routine analytics.

When information is no longer needed for an authorized purpose, we delete it or, where legally permitted and consistent with applicable source restrictions, de-identify it. De-identification is not an alternative to deletion where the applicable rule requires deletion. Backup handling and records subject to legal retention must follow applicable deletion requirements. We explain any applicable retention limitation when responding to your request.

We use administrative, technical and organizational safeguards designed to protect personal information. No system or transmission method can be guaranteed completely secure. Information may be processed where we and our providers operate, subject to applicable transfer requirements and service-specific restrictions.

Children and information about other people

An account holder must be at least 18. Services are not directed to children creating their own accounts. If an available service permits a parent, guardian or other authorized person to provide a patient's information, we handle that information for the requested service and applicable legal purposes. Contact us if you believe a child has submitted information without appropriate authorization.

Changes and contact

We may update this policy as our services or requirements change. We post the effective date and provide additional notice or obtain consent when required. An update does not retroactively authorize a use that required consent when the information was collected.

Crates Health Inc.

Email: info@crateshealth.com

Mailing address: 945 Market Street, Floor 5, San Francisco, CA 94103, United States