Cookie Policy

This Cookie Policy explains how Rymeda, Inc. ("Rymeda," "we," "us") uses cookies and similar technologies on the Rymeda website (rymeda.com) and the Rymeda platform. This policy should be read together with our Privacy Policy, which provides full details on how we collect, use, and protect your personal information.

Rymeda takes a privacy-first approach to cookies and tracking technologies. We use only strictly necessary cookies required for platform functionality and security. We do not use advertising cookies, cross-site tracking pixels, or behavioral profiling technologies. Our analytics provider, Plausible Analytics, is entirely cookie-free.

1. What Are Cookies

Cookies are small text files that are placed on your device (computer, tablet, or mobile phone) when you visit a website. They are widely used to make websites work efficiently, provide security features, and give website operators information about how the site is being used.

Cookies can be classified in several ways:

2. Cookie Inventory

The following table provides a complete inventory of cookies used on the Rymeda website and platform. This list is reviewed and updated whenever cookies are added, modified, or removed.

Last inventory review: February 2026. This table reflects all cookies set by the Rymeda website and platform as of the effective date.

3. Strictly Necessary Cookies

Strictly necessary cookies are essential for the Rymeda website and platform to function correctly. They enable core features such as authentication, session management, and security protections. These cookies cannot be disabled without breaking platform functionality.

3.1 Authentication Cookies (AWS Cognito)

Rymeda uses Amazon Web Services (AWS) Cognito for user authentication. When you sign in, Cognito sets authentication tokens that maintain your session:

• ID Token — Contains user identity claims (name, email, role). Expires after one (1) hour. Used for authorization decisions. Transmitted only over TLS 1.3 encrypted connections.
• Access Token — Grants access to protected API endpoints. Expires after one (1) hour. Scoped to the minimum permissions required for the user's role.
• Refresh Token — Used to obtain new ID and Access tokens without requiring re-authentication. Expires after thirty (30) days or upon explicit sign-out. Stored securely and revocable by the user or administrator.

Authentication cookies are HttpOnly where technically feasible, meaning they cannot be accessed by client-side JavaScript, which reduces the risk of cross-site scripting (XSS) attacks. All authentication tokens are transmitted exclusively over HTTPS (TLS 1.3).

3.2 CSRF Protection

The XSRF-TOKEN cookie provides Cross-Site Request Forgery protection. It ensures that form submissions and API requests originate from the Rymeda platform and not from a malicious third-party site. This is a session cookie that is deleted when you close your browser.

3.3 Cookie Consent

The cookie-consent cookie stores your cookie preferences. It records which categories of cookies you have accepted or declined, ensuring your choices persist across visits. This cookie is itself classified as strictly necessary because it is required to honor your cookie preferences.

4. Functional Cookies

Functional cookies remember your preferences and settings to provide a more personalized experience. These cookies are optional and can be disabled without affecting core platform functionality.

Functional cookies do not track your behavior, build user profiles, or share data with third parties. They exist solely to remember your interface preferences.

5. Analytics

5.1 How Plausible Works

Unlike traditional analytics providers (such as Google Analytics), Plausible does not set any cookies or use browser fingerprinting. It collects only aggregate, non-personal metrics:

5.2 Plausible Privacy Guarantees

• No cookies — Plausible does not set any cookies or use browser storage mechanisms.
• No personal data — IP addresses are used transiently for country-level geolocation and then immediately discarded. No IP addresses are stored or logged.
• No cross-site tracking — Plausible does not track users across different websites or build user profiles.
• No browser fingerprinting — Plausible does not use canvas fingerprinting, WebGL fingerprinting, or any device fingerprinting technique.
• EU-hosted infrastructure — Plausible processes data on EU-based servers, subject to GDPR protections.
• Open source — Plausible's analytics script and server software are fully open source and auditable.
• Lightweight script — The Plausible script (< 1 KB) is loaded from plausible.io as permitted by our Content Security Policy.

5.3 Why We Chose Plausible

As a healthcare platform handling Protected Health Information (PHI), we selected Plausible specifically because it eliminates privacy risks associated with traditional analytics:

• No consent banner required — reduces user friction while maintaining full legal compliance.
• No data shared with advertising networks or data brokers.
• No risk of PHI leakage through analytics cookies or tracking pixels.
• Compliant with GDPR, ePrivacy Directive (Article 5(3)), CCPA/CPRA, PECR, and HIPAA requirements for minimum necessary data collection.

6. Local Storage & Similar Technologies

In addition to cookies, web browsers provide other storage mechanisms such as localStorage, sessionStorage, and IndexedDB. These technologies store data locally on your device and are not transmitted to servers with each request like cookies.

6.1 Current Usage

As of the effective date of this policy, the Rymeda website does not use localStorage, sessionStorage, or IndexedDB for data storage. All persistent data is managed through cookies (as documented in Section 2) or server-side session management.

6.2 Web Beacons & Pixels

Rymeda does not use web beacons (tracking pixels), clear GIFs, or similar invisible tracking technologies on the website or in emails. We do not embed third-party tracking pixels from advertising networks, social media platforms, or data brokers.

6.3 Browser Fingerprinting

Rymeda does not use browser fingerprinting techniques (canvas fingerprinting, WebGL fingerprinting, audio fingerprinting, or font enumeration) to identify or track users.

7. Consent Mechanism

Rymeda provides granular cookie consent controls in compliance with GDPR (Article 6, Article 7), the ePrivacy Directive (Article 5(3)), CCPA/CPRA, and UK PECR.

7.1 Consent Categories

7.2 Consent Controls

• Cookie banner — On your first visit, a cookie consent banner is displayed with clear options to accept or decline each category of non-essential cookies.
• Granular control — You can accept or decline each cookie category independently (e.g., accept functional cookies but decline all others).
• Modify preferences — You can change your cookie preferences at any time through the cookie settings link in the website footer or by contacting legal@rymeda.com.
• Withdraw consent — You may withdraw consent for any non-essential cookie category at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal (GDPR Article 7(3)).
• No cookie walls — Access to the Rymeda website is never conditioned on accepting non-essential cookies. Declining optional cookies does not restrict access to information or services.

7.3 Consent Record

Your consent preferences are stored in the cookie-consent cookie for one (1) year. Rymeda retains a server-side record of consent events (timestamp, categories accepted/declined, consent version) for compliance documentation purposes, as required by GDPR Article 7(1).

8. Do Not Track (DNT)

The Do Not Track (DNT) signal is a preference you can set in your browser to indicate that you do not want to be tracked across websites. There is currently no universally accepted standard for how websites should respond to DNT signals.

For California residents, under the California Online Privacy Protection Act (CalOPPA), we disclose our DNT response as stated above. For additional California-specific privacy rights, see our Privacy Policy.

9. Third-Party Cookies

• No advertising cookies — We do not use Google Ads, Facebook Pixel, LinkedIn Insight Tag, or any advertising network cookies.
• No cross-site tracking — We do not share browsing data with third-party trackers, data brokers, or advertising exchanges.
• No social media plugins — We do not embed social media widgets (Facebook Like, Twitter Share, etc.) that set third-party cookies.
• No retargeting — We do not use retargeting or remarketing cookies to serve ads to you on other websites.
• No third-party analytics cookies — We use Plausible Analytics, which is entirely cookie-free. We do not use Google Analytics, Adobe Analytics, Mixpanel, or similar services that set tracking cookies.

Our Content Security Policy (CSP) headers restrict the domains from which scripts can be loaded to self and plausible.io, providing a technical enforcement layer that prevents unauthorized third-party scripts from setting cookies. See our Information Security Policy for details on our security headers.

10. Managing Cookies in Your Browser

In addition to the consent controls described in Section 7, you can manage cookies directly through your browser settings. Most browsers allow you to view, block, and delete cookies.

10.1 Browser-Specific Instructions

10.2 Impact of Disabling Cookies

11. International Considerations

Rymeda's cookie practices are designed to comply with the strictest applicable cookie regulations globally:

12. Changes to This Policy

We may update this Cookie Policy from time to time. Changes will be handled as follows:

• Non-material changes — Updates to cookie names, durations, or descriptions that do not change the categories or purposes of cookies will be reflected by updating the effective date on this page.
• Material changes — Introduction of new cookie categories (e.g., analytics cookies, advertising cookies), new third-party cookies, or changes that expand data collection will trigger re-consent. We will reset your cookie preferences and display the consent banner again.
• Notification — For material changes, we will provide notice via email, in-platform notification, and/or website banner at least fourteen (14) days before the changes take effect.

We encourage you to review this policy periodically. The "Effective Date" at the top of this page indicates when the policy was last updated.