SONATA Privacy Policy

Effective Date: 04/08/2026

HealthOS, Inc., dba SONATA ("SONATA", "we", or "us") provides a comprehensive, personalized, and human approach to healthcare by collecting and aggregating your information across providers, labs and devices to offer you personalized recommendations, treatment and care (the "Services"). This Privacy Policy describes how SONATA handles personal information that we collect through our website and mobile application (the “Sites”).

The information we collect, use, disclose, or otherwise process from registered users and patients may be "Protected Health Information" or "PHI" subject to the Health Insurance Portability and Accountability Act ("HIPAA"). Our HIPAA Notice of Privacy Practices governs these practices, and a copy is available at app.sonata.health/legal/npp.

Personal information we collect

Information you submit to us:

  • Contact information, such as your first and last name, email address and phone number.
  • Feedback or correspondence, such as information you provide when you contact us with questions, feedback, or otherwise correspond with us online.
  • Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Personal information from other sources, including personal information you provide to third-party partners, such as health plans, health care providers, labs and clinics that partner with us to offer the Services.

Automatic data collection. We may automatically collect your IP address, your device and browser type, and information about your interactions with our Sites.

How we use your personal information

To operate and administer the Services. This includes:

  • Providing, operating, and monitoring the Services;
  • Responding to inquiries, providing customer service, communicating with you, and addressing your questions and feedback; and
  • Understanding your needs and interests, and personalizing your experience and our communications.

To develop and improve the Services. We may use personal information to analyze and improve the Services, to identify usage trends, and to operate and expand our business activities.

To market our Services. Where permitted by applicable laws, we may use personal information for marketing and advertising purposes, including:

  • Direct marketing. We may send you newsletters and email and text message marketing in accordance with your preferences, and we may tailor our communications with you to accommodate your interests and use of the Services. We may also contact you by telephone to provide you with information about our Services.
  • Interest-based advertising. To the extent permitted by applicable laws, we may engage third-party advertising companies to display ads promoting our services across the web. These companies may use cookies and similar technologies to collect information about interactions over time across the Internet and use that information to serve online ads that they think will be of interest. We do not use health information for interest-based advertising purposes.

For compliance and protection.We may use your personal information to: protect our, your or others' rights, privacy, safety or property (including by making and defending legal claims); audit our internal processes; comply with applicable laws, lawful requests, and legal process; and prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

How we disclose your personal information

We may share personal information with:

  • Service providers, including companies and individuals that provide services on our behalf or help us operate the Services (such as text messaging platforms, hosting, analytics, marketing, and other information technology services).
  • Research and commercial partners, including research institutions, healthcare organizations, and life sciences and pharmaceutical companies, but only in de-identified form as described above.
  • Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.
  • Authorities and others, such as law enforcement, government authorities, and private parties, where we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.
  • Business transferees, such as acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving without limitation, a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, SONATA (including, in connection with a bankruptcy or similar proceedings) in accordance with applicable law.

Our Use of Cookies and Other Tracking Technologies

We may use cookies, pixel tags, web beacons and other similar tracking technologies (“tracking technologies”) to automatically collect information on certain parts of our website. Tracking technologies are small data files placed on your computer, tablet, mobile phone, or other devices that record certain pieces of information when you visit our website. We may use these tracking technologies to help identify irregular behavior, prevent fraudulent activity and improve security, as well as making it possible for you to save your preferences and help us understand how you interact with us.

We also allow third parties (including Google and Meta) to use third party cookies, web beacons, and other storage technologies to collect or receive information about how you interact with certain limited parts of our website and elsewhere on the Internet and use that information to provide analytics and other measurements services, and to deliver and target advertisements tailored to you. Third parties may also use some of these technologies to assist us in determining if you require assistance or are having problems navigating on our website, and this may include technologies that record your interactions with the website, including without limitation, your keystrokes, mouse clicks, screen touches, and information about when, how and from where you accessed our website.

We use Google Analytics to evaluate the use of our website. Google Analytics uses cookies and other identifiers to collect information, such as how often users visit a Site, what pages they visit when they do so, and what other websites they visited prior to visiting our website. For information about Google's privacy practices, please refer to the Google Privacy Policy: https://policies.google.com/privacy?hl=en-US#infocollect.

Your Choices

Opt out of marketing communications. You may opt out of our marketing-related communications by following the opt out or unsubscribe instructions contained in the marketing communication we send you.

Online tracking opt out. There are a number of ways to opt out of having your online activity and device data collected on our Site, which we have summarized below:

  • Blocking cookies in your browser. Most browsers let you remove or reject cookies, including cookies used for interest-based advertising. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit www.allaboutcookies.org.
  • Blocking advertising ID use in your mobile settings. Your mobile device settings may provide functionality to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.
  • Using privacy plug-ins or browsers. You can block our websites from setting cookies used for interest-based ads by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, Ghostery, or uBlock Origin, and configuring them to block third party cookies/trackers. You can also opt out of Google Analytics by downloading and installing the browser plug-in available at: https://tools.google.com/dlpage/gaoptout.

Note that because these opt out mechanisms are specific to the device or browser on which they are exercised, you will need to opt out on every browser and device that you use.

Do Not Track.Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to "Do Not Track" or similar signals. To find out more about "Do Not Track," please visit http://www.allaboutdnt.com.

Security

We employ a number of technical, organizational and physical safeguards designed to protect the personal information we collect. However, no security measures are fail-safe and we cannot guarantee the security of your personal information.

Children

Our Site is not intended for children under the age of 18, and we do not knowingly collect such personal information. If we learn that we have collected personal information from children, we will take reasonable measures to promptly delete such data from our records. If you become aware of any data we have collected from children, please contact us as provided in the "Contact Us" section below.

SMS Consent and Terms and Conditions

Information obtained as part of SMS or text messaging consent will not be shared with third parties or affiliates; it will only be shared with service providers that operate our SMS/text messaging service for the purpose of providing that service.

If you have consented to receive text messages from us, you may receive commercial or transactional text messages, including about our services and offerings. Message rates may apply and messaging frequency may vary. You may opt out of text messages by texting STOP. For additional information, you can text HELP. Links to our Terms of Service and this Privacy Policy may also be provided.

California Shine the Light

California Civil Code Section 1798.83, also known as the “Shine the Light” law, permits California residents that have an established business relationship with a business to annually request, free of charge, information about certain categories of Personal Information a business has disclosed to third parties for those parties' direct marketing purposes in the preceding calendar year. For information and to make a request, please contact us at concierge@sonata.health.

Other websites and social media buttons

Our Sites may contain links to other websites or social media buttons. We are not responsible for the privacy practices or the content of those websites or social media platforms. This Privacy Policy applies only to our business and the personal information we collect.

Accessibility

We are committed to ensuring that our communications are accessible to people with disabilities. To make accessibility-related requests or report barriers, please contact us at concierge@sonata.health.

Changes to This Privacy Policy

We may modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy unless otherwise required by applicable law.

How to contact us

Please direct any questions or comments about this Policy or our privacy practices to concierge@sonata.health or by mail at the address below.

HealthOS, Inc. dba SONATA
287 Park Ave S, #204
New York, NY 10010