Legal

Cookie Policy

Last updated: 10 October 2026

1. Introduction

This Cookie Policy explains how Vanta (Private) Limited ("Vanta", "we", "us"), a company incorporated in Pakistan and operator of the marketing website healthease.app (the "Site"), uses cookies and similar technologies on the Site. It should be read together with our Website Privacy Policy.

This Policy covers the Site only. Cookies and similar technologies used inside the HealthEase product (for example, session tokens that keep clinic staff signed in) are covered by the product documentation and customer agreement, not by this Policy.

We may update this Policy from time to time; the "Last updated" date above shows when it was most recently revised (see the section on changes to this Policy below).

2. Our Approach: As Few Cookies as Possible

We have deliberately built the Site to use no advertising cookies, and analytics cookies only with your consent:

No advertising pixels. We do not use ad-tech pixels or advertising cookies of any kind, and we tell our analytics tools that advertising storage is denied.
No cross-site tracking by us. We do not track you across other websites, and we do not share Site behaviour with advertising networks for advertising.
Analytics cookies only with your consent. We use Microsoft Clarity to understand how the Site is used. It does not run at all until you accept analytics cookies; if you decline or make no choice, Clarity never loads and nothing about your visit is recorded by it. Anything you type into our forms is masked and never sent to it.
Google Tag Manager, under the same choice. The Site loads Google Tag Manager, which manages the scripts on the Site. It sets no cookies itself. Before it loads we tell Google that every kind of storage is denied; analytics storage is granted only if you accept analytics cookies, and advertising storage is never granted.
A visitor ID only if you ask for it. If you accept Visitor ID in our banner, the Site sets one first-party cookie holding a random ID, so we can count how many visitors come back (see section 3.4). It is never set without your consent, wherever you are visiting from.
Visit and time-on-page counts without cookies. Each page sends one small request to the Site itself when you leave or hide it, saying which page it was and how long it was visible to you, so we can count sessions and time on page without any cookie (see section 3.5).
One campaign label, with no identifier. When you arrive from one of our campaign links, or from another website, the Site remembers which campaign or site brought you, so that an enquiry or signup can be credited to it (see section 3.2). It holds nothing that identifies you and is not analytics. If you are visiting from the EU, the EEA or the UK, it is stored on your device only if you accept cookies (section 3.2 explains what happens if you do not, which is not much).

We ask for that consent with one banner on your first visit to one of the pages that load analytics. It has three buttons of equal size: Accept all, Reject all and Choose. Choose opens the categories inside the same banner, each with a short description and a checkbox:

Strictly necessary: always on, because the Site needs it to work (section 3.1).
Analytics: Microsoft Clarity, analytics storage for Google tags and, if you are visiting from the EU, the EEA or the UK, permission to store the campaign note (sections 3.2 and 3.3).
Visitor ID: the he_vid cookie that lets us count returning visitors (section 3.4).

The optional boxes start unticked, and nothing optional is set until you tick it and press Save choices, or press Accept all. Cookie settings in the footer of those pages reopens the same banner with your current choices ticked, so you can change any of them at any time. Rejecting is as easy as accepting, and the Site works the same either way.

If you made a choice under our earlier banner, it still counts. If you accepted, Analytics stays accepted and we do not ask you again; Visitor ID stays off unless you turn it on in Cookie settings. If you declined, everything optional stays off. If your browser sends a Global Privacy Control signal, Clarity does not run, no banner is shown, and Visitor ID is never set.

Our campaign landing pages are the exception: to stay fast on a phone they load no analytics and no third-party scripts at all, and are built without the Site's own header and footer, so they show no banner and no Cookie settings control. Section 3.2 explains what that means, which is that nothing is stored on those pages for visitors from the EU, the EEA or the UK. They do send the cookieless engagement request described in section 3.5.

3. What We Actually Use

3.1 Strictly-necessary cookies and storage

The Site limits itself to a small number of strictly-necessary items — those required for the Site to function and to support its security. These do not require consent under most laws, though we disclose them here for transparency. They fall into the following categories:

Category	Purpose	Type / duration
Security / anti-abuse token	Protects forms against spam and abuse (for example, request-forgery protection)	Cookie or session storage; kept for the browsing session only
Preference storage	Remembers a display preference you choose, such as a light/dark theme	Local storage; remains on your device until you clear it
Cookie choice	Remembers your choice for each optional category (Analytics and Visitor ID), so we do not ask on every page. It carries a version number, so that if we ever add a new optional category we can ask you again	Local storage (`he_cookie_consent`); remains on your device until you clear it or change your choice
Country of your visit	The two-letter country code of the country your visit comes from, so the Site knows whether it must ask you before storing the campaign note described in section 3.2. Only the country code is stored, never your IP address or the city described in section 3.2	Session storage (`he_geo`); discarded when you close the tab

No item in these categories identifies you personally, tracks your browsing on other sites, or is shared with advertisers. If you would like the current list of items set by the Site at any given time, contact us at info@healthease.app and we will provide it.

3.2 Campaign attribution

When you first arrive on the Site from one of our campaign links (for example, a link in an Instagram post) or from another website, the Site keeps a short note of what brought you. If you then send us an enquiry or sign up for HealthEase, the note goes with it, so we can tell which campaigns bring clinics to HealthEase:

Name	Set by	What it holds	Type / duration
`he_attr`	Vanta (first-party, on healthease.app)	The campaign labels on the link you followed (such as the source, the campaign and the post it belongs to), the Site page you landed on, the website you came from (the site only, such as `l.instagram.com`, never the page), whether the link carried an advertising platform's click tag and whose (never the tag itself), and the date you arrived (the date only, not the time)	Cookie and local storage; 90 days from that date (see section 4)

It holds no identifier: nothing that identifies you, your device or your click, and nothing you type. It is set on your first arrival from a campaign link or another website, and later visits do not change it, with one exception: if it names none of our campaigns (for example, because you first came from a search engine), the first of our campaign links you later arrive by replaces it, so that campaign is credited instead. If you come to the Site directly, for example by typing its address, it is not set at all.

The cookie is set for healthease.app and its subdomains so that the HealthEase signup page at console.healthease.app can read it too: that is how an account created there is credited to the campaign that brought you. The campaign details are then kept with your enquiry, or with your organisation's HealthEase account.

In the EU, the EEA and the UK, we ask first. If your visit comes from a country in the European Union or the wider European Economic Area, or from the United Kingdom, he_attr is not stored on your device at all unless you accept cookies. Until you do, the note exists only while you are reading the page you are on, and nothing is left behind when you leave it. In our banner the note belongs to the Analytics category, so in this section "accept cookies" means accepting Analytics (with Accept all, or by ticking Analytics and saving), and "decline" means Reject all, or saving your choices with Analytics unticked. Three things follow:

An enquiry you send from the page a campaign link opened still carries that link's campaign labels, whether or not you accept cookies. The Site does not need to store anything to do that, and a form never waits on your choice or breaks because of it.
If you accept cookies later in the same visit, the note is stored then, and it still expires 90 days after the date you arrived — not 90 days after you accepted.
If you decline, or you never choose, nothing is stored. Only enquiries you send from the page the campaign link opened are credited to it, and nothing else about the Site changes.
If you accept and then change your mind, declining removes the note from your device — the cookie and the copy in local storage — as soon as you decline, and no later page sends it. You do not have to clear anything yourself.

On our campaign landing pages we do not ask, so nothing is stored. A campaign landing page — for example the page an Instagram bio link opens — is deliberately built without analytics, without third-party scripts and without the Site's header and footer, so that it loads quickly on a phone on mobile data. That means it shows no cookie banner and offers no Cookie settings control. For a visitor from the EU, the EEA or the UK, he_attr is therefore never stored on such a page: the only thing that carries the campaign is the enquiry you choose to send from it, which needs nothing stored. If you go on to the rest of the Site, the banner appears there and your choice applies from then on.

To know which visitors to ask, the Site asks our hosting network which country the visit comes from and keeps only the two-letter country code, for the browsing session (see section 3.1). If the country cannot be determined, we treat you as a visitor we have to ask.

The same answer also includes the city the visit appears to come from, as estimated by our hosting network from your connection. The Site uses it only to show nearby example branch names in the product demo on the page you are viewing. It is held in the page's memory while that page is open and is never stored on your device, sent back to us, or linked to you.

It is not analytics and not advertising. It records where a visit came from, not what you do on the Site; it is not shared with advertising platforms; and it is not used to recognise you on other websites. So outside the EU, the EEA and the UK it is set whatever your analytics choice, and Cookie settings does not change it; inside them, accepting cookies is what allows it to be stored at all. Section 4 explains how to remove it.

3.3 Analytics

Our analytics tool is Microsoft Clarity. It sets cookies only if you accept analytics cookies (the Analytics category in our banner):

Cookie	Set by	Purpose	Duration
`_clck`	Microsoft Clarity (first-party, on healthease.app)	Keeps a pseudonymous Clarity ID so that a returning browser is recognised	1 year
`_clsk`	Microsoft Clarity (first-party, on healthease.app)	Connects the pages you view into a single session recording	1 day

When you accept, we still tell Clarity that advertising storage is denied. Microsoft may also set its own cookies on its own domains (third-party cookies, such as MUID and CLID); those are governed by the Microsoft Privacy Statement, and many browsers block them by default.

If you decline, or make no choice, Clarity does not load at all: it sets no cookies, first- or third-party, and records nothing. If you accept and later decline, Clarity deletes its cookies. What Clarity records is described in our Website Privacy Policy.

Google Tag Manager sets no cookies itself. Google tags loaded through it follow Google Consent Mode: they may use analytics storage only after you accept analytics cookies, and advertising storage stays denied either way. If we add a Google tag that sets cookies, we will list those cookies here before it goes live.

3.4 Visitor ID

If you tick Visitor ID in our banner, or press Accept all, the Site sets one more cookie so that we can tell a browser that comes back from one that is new, and count returning visitors. It is set only with your consent, wherever you are visiting from.

Name	Set by	What it holds	Purpose	Duration
`he_vid`	Vanta (first-party, on healthease.app only, not its subdomains)	A random ID made by your browser, and the date it was created. Nothing about you	Counting how many visitors return to the Site	At most 13 months from the date it was created. The Site rewrites it at most once a day, which never moves that end date. When it ends, a new random ID replaces it only if your consent still stands

It is sent to us only with the engagement request described in section 3.5. It is never sent to a third party and never used for advertising.
We never keep the ID as it is. We store a salted one-way hash of it, one list per day, and each day's list is deleted automatically after 92 days (a 90-day look-back window plus a short margin). The salt is kept separately and never published. What we read from these lists is how many visitors returned, which identifies nobody.
If you withdraw Visitor ID, in Cookie settings or with Reject all, the cookie is deleted from your device straight away and no ID is sent again.
If your browser sends a Global Privacy Control signal, it is never set.

To learn which pages hold people's attention, every page of the Site that runs the Site's own scripts, including our campaign landing pages, sends one small request back to healthease.app itself (to the address /_e) when you leave the page or hide it, for example by switching tabs. It carries:

the page's address path, without any query string;
how long the page was visible to you, counting visible time only and capped at 30 minutes;
your Visitor ID, only if you accepted Visitor ID (section 3.4).

It sets no cookie and reads none, apart from the Visitor ID when you have accepted it. Our hosting network answers it with an empty response, so it becomes one more line in the same access logs as every other request to the Site (our Website Privacy Policy says what those contain): kept for 30 days and then deleted, after which only aggregate counts remain. Requests from bots are excluded.

From those logs we also count sessions without any cookie. Each day's requests from the same connection and browser are grouped using a value held only in memory while that day is counted and never stored, and a session ends after 30 minutes without a new page. That gives us totals such as sessions, pages per session, the share of single-page visits, session length and time on page, which identify nobody. We rely on our legitimate interests (knowing which pages help our visitors) for these cookieless counts, and on your consent for Visitor ID.

3.6 Embedded videos (YouTube)

Some pages show a video from our YouTube channel (@HealthEase-app). Until you press play, it is only a picture and a play button served by the Site itself: nothing is loaded from YouTube, and YouTube sets nothing and receives nothing.

When you press play, that is your own request to watch the video, so we do not ask about it in the cookie banner. The Site then loads YouTube's player from www.youtube-nocookie.com, YouTube's privacy-enhanced mode. From that moment YouTube (Google) receives your IP address and your activity with the video, and may store data on your device, under Google's own privacy policy:

Name	Set by	Purpose	Duration
Storage set by YouTube's player	YouTube (Google), on youtube-nocookie.com and Google's domains	Playing the video, and whatever YouTube uses it for under Google's privacy policy	As set by Google

The Site itself sets nothing for the video, before or after you press play. If you would rather YouTube received nothing, simply do not press play.

3.7 What we do NOT use

No advertising or targeting cookies of our own, and advertising storage is denied to Clarity and to Google tags
No social-media tracking cookies
No third-party cookies except Microsoft's (Clarity), and those only after you accept analytics cookies, and YouTube's, and those only after you press play on a video (section 3.6)
No cookies used to build an advertising profile of you

4. How to Control Cookies

You are in control of every item described here:

Cookie settings. Use Cookie settings in the footer of any page that loads analytics (see section 2) to reopen the banner with your current choices ticked and change any of them. Reject all turns off every optional category at once. Withdrawing Analytics tells Clarity to delete its cookies, tells Google tags that analytics storage is denied and, in the EU, the EEA and the UK, removes the campaign note. Withdrawing Visitor ID deletes the he_vid cookie straight away and stops any ID being sent.
The engagement request. It sets no cookie, so there is nothing to clear. It carries a Visitor ID only while you have Visitor ID accepted.
The campaign label. he_attr stops being used 90 days after the date it holds: the cookie expires then, and the copy in local storage is deleted the next time you visit the Site. To remove both sooner, clear cookies and site data for healthease.app in your browser. In the EU, the EEA and the UK it is stored only if you accept cookies, so declining — or simply not choosing — leaves nothing stored, and declining after an earlier acceptance removes what was stored, there and then. Elsewhere Cookie settings does not affect it, because it is not an analytics cookie and was never stored on your acceptance in the first place. Blocking it does not change how the Site works: nothing is stored, but an enquiry you send from the page a campaign link opened still carries that link's campaign labels.
Global Privacy Control. Turning on Global Privacy Control in your browser stops Microsoft Clarity recording your visits altogether, because Clarity honours it. The Site then shows no banner and never sets a Visitor ID.
Browser settings. All major browsers let you block or delete cookies and clear local storage (usually under Settings → Privacy). Blocking strictly-necessary items may stop some forms on the Site from working.
Private/incognito browsing discards cookies when you close the window.

Guidance for common browsers is available in each browser's help pages (search "manage cookies" plus your browser's name).

5. Third Parties

The Site is hosted with a reputable cloud hosting provider operating in the Asia-Pacific (Singapore) region under appropriate data-protection safeguards. The network that serves the Site keeps access logs of the requests made to it — no cookies are involved, and our Website Privacy Policy says what they contain and how long we keep them. The only third parties whose cookies the Site allows are Microsoft, for Clarity analytics, and only after you accept analytics cookies (see section 3.3), and YouTube, only after you press play on a video (see section 3.6). The Site also loads Google Tag Manager from Google's servers, so Google receives standard technical information, such as your IP address, when your browser requests it. If you press play on an embedded video, YouTube (Google) receives your IP address and your activity with the video and may store data on your device, as section 3.6 explains; nothing is loaded from YouTube until you do. If you follow a link from the Site to a third-party website (for example, an app store), that site's own cookie practices apply.

Online payments. Where you pay for a HealthEase subscription online, the payment is processed by United Bank Limited (UBL), a licensed commercial bank in Pakistan acting as our payment processor, on secure payment pages operated by the UBL payment gateway (for example, a hosted payment page or a redirect to the gateway's checkout), not on the Site itself. During a transaction, the UBL payment gateway may set its own strictly-necessary cookies on its payment pages — for example, to maintain the payment session and to protect against fraud. Those cookies are set on UBL's pages, are governed by UBL's own cookie and privacy policies, and are not controlled by Vanta. Card details are handled by UBL under its own PCI-DSS-compliant terms; Vanta does not receive or store full card numbers. These cookies do not change the Site's own cookie inventory described earlier in this Policy, which remains as stated. (The free trial requires no payment card, so no payment pages — and no payment-processor cookies — are involved in starting a trial.)

6. Changes to This Policy

We may update this Policy from time to time — for example, if the Site's technical implementation changes. We will post the updated version with a new "Last updated" date. If we ever add a new optional category of cookies, we will ask you again before setting anything in it, even if you accepted everything before; your choice record carries a version number for exactly that reason.

7. No Warranty and Limitation of Liability

This Policy is provided for information and transparency only. It does not form part of any contract and does not create obligations beyond those required by applicable law.

The Site and its content are provided on an "as is" and "as available" basis, without warranties or conditions of any kind, whether express or implied (including any implied warranties of merchantability, fitness for a particular purpose, or non-infringement), to the maximum extent permitted by applicable law.

To the maximum extent permitted by applicable law, Vanta's liability arising out of or in connection with the Site, this Policy, and the cookies or similar technologies described here is governed by, and subject to the limitations and exclusions of liability set out in, the HealthEase Subscription Agreement (or other written agreement) between Vanta and the relevant customer. Where no such agreement applies to you, then to the maximum extent permitted by applicable law Vanta shall not be liable for any indirect, incidental, special, consequential or punitive damages, or for any loss of profits, revenue, data, or goodwill, arising out of or in connection with your use of the Site.

Nothing in this Policy limits or excludes any liability that cannot be limited or excluded under applicable law — including liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or under any non-excludable data-protection or consumer-protection rights.

8. Contact

Questions about this Policy or our data practices:

Email: info@healthease.app
Post: Vanta (Private) Limited, Pakistan — write to us at info@healthease.app to request our postal correspondence address.