CareLoop Health – Cookie Policy US

CareLoop Health Ltd (“CareLoop Health Ltd”, “we”, “us”, “our”) 

We are company number 13219481 registered in the United Kingdom. 
Our registered office is at CareLoop Health Ltd, Renold building, 81 Sackville Street, Manchester, M1 3NJ. 

Effective date: 16 Jan 2026 
Last reviewed: 16 Jan 2026 

Introduction 

CareLoop Health Ltd (“CareLoop Health Ltd”, “we”, “us”, “our”) designs and develops products (“Apps”) to empowers patients and clinicians to improve outcomes for people with mental illness.  

This Cookies Policy explains how [CareLoop] (“we”, “us”, or “our”) uses cookies and similar technologies when you visit or use our websites, mobile applications, and other digital services (together, the “Services”). 

We provide digital mental health services and recognise the importance of privacy, confidentiality, and trust. This Cookies Policy should be read alongside our Privacy Policy, which explains how we process personal data more generally. 

  1. What are cookies?

Cookies are small text files placed on your device (computer, smartphone, tablet) when you visit a website or use a digital service. Similar technologies (such as local storage, pixels, or SDKs) may also be used. For simplicity, we refer to all of these as “cookies”. 

Cookies may be: 

  • Session cookies, which expire when you close your browser; or 
  • Persistent cookies, which remain on your device for a set period or until deleted. 
  1. How we use cookies

We use cookies only where they are necessary for the operation of our Services or where they provide clear and proportionate benefits. We do not use cookies in ways that undermine the privacy or confidentiality required for mental health services. 

  1. a) Strictly necessary cookies

These cookies are essential for the operation and security of the Services and are permitted under UK PECR without consent. 

They are used for purposes such as: 

  • Secure login and authentication 
  • Session management 
  • Security 
  • Service reliability and load balancing 

Without these cookies, the Services cannot function properly. 

  1. b) Functional cookies

Functional cookies allow us to remember choices you make and provide a more consistent experience, such as: 

  • Language or accessibility preferences 
  • Remembering settings or selections within the platform 
  • Keeping you signed in where you choose to do so 

These cookies are not strictly necessary and are used only where permitted by law and, where required, with your consent. 

  1. c) Analytics and performance cookies

With your consent (as required under UK GDPR and PECR), we may use analytics cookies to understand how users interact with our Services so we can improve performance and usability. 

These cookies may collect information such as: 

  • Pages visited and features used 
  • Time spent on the Services 
  • Technical performance and error information 

We do not use analytics cookies to: 

  • Support advertising or marketing 
  1. d) Cookies we do not use

Given the sensitive nature of our Services, we do not use: 

  • Advertising or marketing cookies 

We do not sell personal data or share personal data for targeted advertising. 

  1. e) Cookies we use

CareLoop Clinician Dashboard Website 

Storage Overview Table – Detailed Breakdown 

Storage Item 

Storage Type 

Storage Location 

Purpose 

Duration 

Auto-Expires? 

PostHog Cookies (ph_*) 

HTTP Cookie 

Browser (sent with requests) 

Analytics 

365 days 

Yes 

PostHoglocalStorage (ph_*) 

HTML5 localStorage 

Browser (window.localStorage) 

Analytics 

Until cleared 

No 

Cognito JWT Token (usertoken) 

HTML5 localStorage 

Browser (window.localStorage) 

Strictly necessary 

60 min (validated server-side) 

Yes (server-validated) 

Cognito Refresh Token 

HTML5 localStorage 

Browser (window.localStorage) 

Strictly necessary 

30 days 

Yes (server-validated) 

User Login (login) 

HTML5 localStorage 

Browser (window.localStorage) 

Strictly necessary 

Until cleared 

No 

User Role (role) 

HTML5 localStorage 

Browser (window.localStorage) 

Strictly necessary 

Until cleared 

No 

User ID (id) 

HTML5 localStorage 

Browser (window.localStorage) 

Strictly necessary 

Until cleared 

No 

Install Config Ready (install_configReady) 

HTML5 localStorage 

Browser (window.localStorage) 

Strictly necessary 

Until cleared 

No 

Install Study Started (install_studyStarted) 

HTML5 localStorage 

Browser (window.localStorage) 

Strictly necessary 

Until cleared 

No 

Install Config Errors (install_configNotReadyErrors) 

HTML5 localStorage 

Browser (window.localStorage) 

Strictly necessary 

Until cleared 

No 

Questions List Selector (questionsListSelector) 

HTML5 localStorage 

Browser (window.localStorage) 

Strictly necessary 

Until cleared 

No 

Demo Reset Selected File (demoResetSelectedFile) 

HTML5 localStorage 

Browser (window.localStorage) 

Strictly necessary 

Until cleared 

No 

Onboarding Redirect Flag (onboardingRedirect) 

HTML5 sessionStorage 

Browser (window.sessionStorage) 

Strictly necessary 

Until tab closed 

Yes (browser) 

Session Cookie (TENANT_ID) 

HTTP Cookie 

Browser (sent with requests) 

Strictly necessary 

~30 min inactivity 

Yes 

 

 

Careloop-App; 

 

Storage Item Name 

Storage Type 

Storage Location 

Purpose 

Duration 

Auto-Expires 

Security Sensitive 

configuration 

SecureStore 

Device Secure Storage 

Strictly Necessary; Stores server config, user credentials, mobile code 

Persistent 

No 

Yes 

authToken 

SecureStore 

Device Secure Storage 

Strictly Necessary; JWT authentication token 

Persistent 

Yes (server-controlled) 

Yes 

encounters 

SecureStore 

Device Secure Storage 

Strictly Necessary; Questionnaire responses/encounters 

Persistent 

No 

Yes 

notes 

SecureStore 

Device Secure Storage 

Strictly Necessary; User notes/CBT notes 

Persistent 

No 

Yes 

CBT_EXERCISES_COMPLETED 

SecureStore 

Device Secure Storage 

Strictly Necessary; CBT exercise completion data 

Persistent 

No 

Yes 

liked 

SecureStore 

Device Secure Storage 

Strictly Necessary; Liked content IDs 

Persistent 

No 

No 

settings 

SecureStore 

Device Secure Storage 

Strictly Necessary; App preferences/settings 

Persistent 

No 

No 

alarms 

SecureStore 

Device Secure Storage 

Strictly Necessary; Notification alarm configurations 

Persistent 

No 

No 

diaryEntries 

SecureStore 

Device Secure Storage 

Strictly Necessary; User diary entries 

Persistent 

No 

Yes 

hasSyncedDate 

SecureStore 

Device Secure Storage 

Strictly Necessary; Daily sync status flag 

1 day 

Yes (daily reset) 

No 

screens 

AsyncStorage 

Device AsyncStorage 

Strictly Necessary; Screen content data 

Persistent 

No 

No 

networkLog 

AsyncStorage 

Device AsyncStorage 

Strictly Necessary; Network request/response logs 

Persistent 

No 

Yes 

appTourModals 

AsyncStorage 

Device AsyncStorage 

Strictly Necessary; App tour completion state 

Persistent 

No 

No 

pathway_data 

AsyncStorage 

Device AsyncStorage 

Strictly Necessary; Questionnaire pathway configuration 

Persistent 

No 

No 

first_login_date 

AsyncStorage 

Device AsyncStorage 

Strictly Necessary; First login timestamp for bi-yearly calculations 

Persistent 

No 

Yes 

lastBiYearlyScheduleDate 

AsyncStorage 

Device AsyncStorage 

Strictly Necessary; Last bi-yearly notification schedule date 

Persistent 

No 

No 

CLHRotatingCounterStore 

AsyncStorage 

Device AsyncStorage 

Strictly Necessary; Rotating counter indices for screen display 

Persistent 

No 

No 

ph_<api_key>_posthog_distinct_id 

AsyncStorage 

Device AsyncStorage 

Analytics: PostHog distinct user ID 

Persistent 

No 

Yes 

ph_<api_key>_posthog_session_id 

AsyncStorage 

Device AsyncStorage 

Analytics: PostHog session identifier 

Session 

Yes (session-based) 

Yes 

ph_<api_key>_posthog_events 

AsyncStorage 

Device AsyncStorage 

Analytics: Queued analytics events (pending upload) 

Persistent 

Yes (after upload) 

Yes 

ph_<api_key>_posthog_super_properties 

AsyncStorage 

Device AsyncStorage 

Analytics: User super properties/metadata 

Persistent 

No 

Yes 

ph_<api_key>_posthog_feature_flags 

AsyncStorage 

Device AsyncStorage 

Analytics: Feature flag states 

Persistent 

Yes (on refresh) 

No 

ph_<api_key>_posthog_config 

AsyncStorage 

Device AsyncStorage 

Analytics: PostHogconfiguration settings 

Persistent 

No 

No 

 

  1. Third-party cookies

Some cookies may be set by carefully selected third-party service providers who support the operation, security, or analytics of our Services. 

Where third-party cookies are used: 

  • Providers act only on our instructions and for defined purposes 
  • Appropriate contractual and data protection safeguards are in place 
  • Third parties are not permitted to use cookie data for their own purposes, including advertising or profiling 
  1. Consent and legal basis
  • UK and EU users: In line with UK GDPR, EU GDPR, and PECR, we ask for your consent before placing any non-essential cookies on your device. 
  • US users: We provide transparency and choice in line with applicable US state privacy laws. 

You can manage or withdraw your cookie preferences at any time by: 

  • Adjusting your browser or device settings to block or delete cookies 

Please note that blocking certain cookies may affect the availability or functionality of some features. 

  1. US “Do Not Sell or Share”

We do not sell personal data and do not share personal data for cross-context behavioural advertising, as defined under US state privacy laws (including CCPA/CPRA). 

Further information about your rights is available in our Privacy Policy. 

  1. Managing cookies in your browser or device

Most browsers and devices allow you to: 

  • View cookies stored on your device 
  • Delete cookies 
  • Block cookies from specific websites 
  • Block cookies entirely 

Instructions can usually be found in your browser or device’s help section. 

  1. Changes to this Cookies Policy

We may update this Cookies Policy from time to time to reflect changes in law, technology, or our Services. Any updates will be posted on this page, and the “Last updated” date will be revised. 

  1. Contact us

If you have any questions about this Cookies Policy or our use of cookies, please contact us: 

CareLoop Health 
Email: dpo@careloop.health Address: Renold building, 81 Sackville Street, Manchester, M1 3NJ