Summary and scope
This Privacy Policy covers the public Kanurra website at kanurra.com (the “Website”). That is all it covers.
The Website exists to do two things: explain how Kanurra works (a transparent, fully pass-through pharmacy benefit manager that earns only a flat, disclosed per-employee-per-month (PEPM) administrative fee) and let you book a 30-minute claims-audit call. It is built for businesses: brokers, third-party administrators, and self-funded employer plan sponsors. It is not built for patients or consumers.
The Website is separate from the Kanurra pharmacy-benefit platform (the “Platform”). The Platform is where member and claims data actually live. The Platform is governed by the plan and services agreement and by HIPAA Business Associate Agreements, not by this policy. The next section makes that wall explicit.
Here is our stewardship promise, in plain words: we collect the minimum we need to run the site and respond to you, we do not sell it, and we name everyone who touches it. The rest of this document is the detail behind that sentence.
This website does not handle PHI
This is the part that matters most, so we will be blunt about it.
- The Website does not collect, process, or store Protected Health Information (“PHI”) as defined under HIPAA. Do not submit PHI, member data, or patient data through the booking form or any other form on this site.
- Kanurra acts as a Business Associate of its health-plan and employer clients. Any PHI that Kanurra creates, receives, maintains, or transmits is handled inside the Platform, never on this Website.
- PHI is governed solely by HIPAA and HITECH, the applicable Business Associate Agreement between Kanurra and the covered entity, and the plan and services agreement, not by this Privacy Policy.
- This Privacy Policy is NOT a HIPAA Notice of Privacy Practices. To learn how your PHI is used and disclosed, request the Notice of Privacy Practices from your health plan or plan sponsor.
- As a business associate, Kanurra generally does not issue its own Notice of Privacy Practices. Covered entities (your health plan or plan sponsor) issue those.
Information we collect
We collect two kinds of information, and only two.
Information you give us. When you book a claims-audit call on the /audit page, you give us your name, your business email, and anything you type into the booking form. This is collected through our scheduling provider, iClosed.
Information collected automatically. When you visit the Website, our hosting provider, Vercel, records standard server-log data: your IP address, browser and device type, the pages you view, timestamps, and similar usage data. Separately, the iClosed scheduler on /audit is an embed loaded from app.iclosed.io; visiting that page transmits your IP address and basic request data to iClosed even if you never type or submit anything.
Cookies and tracking technologies. The Website uses the Meta Pixel, an advertising measurement tool from Meta Platforms, Inc. Unless your browser sends an opt-out signal (see below), the pixel loads on every page, records page views, and sets advertising cookies (_fbp and, after a click on one of our ads, _fbc) that let Meta connect your visit to ads we run on Meta platforms. The iClosed scheduling embed on /audit sets the cookies it requires to function. We also use PostHog, a product-analytics tool, described in the next paragraph; it sets its own cookies to recognize your browser across pages of a visit. We honor the Global Privacy Control (GPC) browser signal: when your browser sends it, neither the Meta Pixel nor PostHog loads, no session is recorded, and no data is sent to Meta or PostHog.
Product analytics and session recording. We use PostHog, operated by PostHog, Inc. (United States), to understand how visitors use this Website. PostHog records the pages you view, clicks and other interactions, and a replay of your session: a reconstruction of what was on your screen and how you moved through the page. Every value typed into a form field on this Website is masked before it leaves your browser, so recordings do not contain what you type. The iClosed scheduler is a separate embedded frame that PostHog cannot see into, so the name, email address, and phone number you give when booking a call are never part of a recording. We do not create a PostHog profile for anonymous visitors, we never send PostHog health information or claims data, and nothing PostHog collects is used for advertising. PostHog does not load at all when your browser sends the GPC signal.
Advertising measurement. When a booking is completed on /audit, we also send Meta a server-side “Schedule” conversion event so we can measure whether our ads lead to booked calls. That event contains your email address and phone number only in hashed (SHA-256) form, your IP address and browser user-agent, Meta’s own cookie and click identifiers, and generic campaign labels (UTM parameters). It never contains health information, claims data, or anything you would tell us on the call, and it is suppressed entirely when your browser sends the GPC signal. Meta and PostHog are the only two such providers we use; if we add another, we will update this section to name it and describe what it collects before relying on it.
CCPA categories. For state-law clarity, the data above maps to two statutory categories: identifiers (name, email, IP address) and internet or other electronic network activity (pages viewed, usage data, and the masked session recordings described above).
Notice at collection. The booking form on /audit links to this policy at the point of collection, so you can see what we collect and why before you submit anything.
How we use information
We use this data only for what the site is for:
- To schedule, confirm, and hold the claims-audit meeting you request.
- To respond to your inquiry and follow up about it.
- To operate, secure, debug, and improve the Website.
- To comply with law and enforce our terms.
- To measure and improve our own advertising, through the Meta Pixel and conversion events described above.
- To understand how the Website is used and where it confuses people, through PostHog analytics and session recordings.
We do not profile you beyond that advertising measurement, and we do not make any automated decisions that produce legal or similarly significant effects about you on this Website.
If we send you a marketing follow-up email, every such message includes an unsubscribe link. For recipients in the EU or UK, we send marketing email only on the basis of your consent.
How we share information (subprocessors)
We do not sell or rent your personal information. We do share limited data with Meta for advertising measurement, as described above; under some state laws that counts as “sharing” for cross-context behavioral advertising, and the Your privacy rights section explains how to opt out.
We use a small number of subprocessors and advertising partners to run the Website. Here they are, by name and function:
- iClosed (United States): demo and audit scheduling. The scheduler is an embed loaded from app.iclosed.io, so visiting /audit transmits your IP address and basic request data to iClosed on page load, before you enter anything. When you complete the form, iClosed also receives the name, email, and answers you enter, and its own subprocessors (for example, a messaging provider used for reminders) may process that data under iClosed’s terms.
- Meta Platforms, Inc. (United States): advertising measurement. Through the Meta Pixel, Meta receives page-view and device data and sets the advertising cookies described above; when you book a call, Meta also receives a conversion event containing your hashed email and phone, IP address, user-agent, its own identifiers, and campaign labels. Meta processes this data under its own terms and may use it for its own advertising purposes. None of it is sent when your browser sends the GPC signal.
- PostHog, Inc. (United States): product analytics and session recording. PostHog receives page-view, click, device, and IP data, plus a masked replay of your visit. Form values are masked in your browser before they are sent, and the iClosed frame is not visible to it. PostHog acts as our processor and does not use this data for its own advertising. Nothing is sent when your browser sends the GPC signal.
- Vercel (Vercel Inc., United States): website hosting, edge/CDN delivery, and server request logs. Processes visitor IP addresses and request metadata.
We serve our fonts from our own infrastructure, so visiting the Website does not transmit your data to a third-party font provider.
Subprocessors and other service providers receive data only under contract, only with appropriate privacy and confidentiality obligations, and only to perform services for us.
Beyond these, we disclose information only where required by law (legal process, or to protect safety and rights) or in connection with a business transfer such as a merger or acquisition.
In every case we collect and share the minimum necessary.
Data retention
We keep data only as long as we need it for the purposes above.
- Booking-form contact data (name, email, form answers): we retain this for 24 months after your last interaction with us, then delete or anonymize it.
- Server logs and usage data: we retain these for up to 90 days for security, debugging, and abuse prevention, then delete or anonymize them.
When data is no longer needed for the stated purposes, we delete or anonymize it.
Our subprocessors and advertising partners (iClosed, Vercel, Meta, PostHog) retain data according to their own policies and data processing agreements. Session recordings expire on PostHog’s standard retention schedule for our plan.
Your privacy rights and choices
You have rights over your personal information, and we honor them.
Core rights. You can ask us to access, correct, delete, or port your personal information, and you can object to or restrict certain processing. To exercise any of these, email us at the address in the Contact section.
GDPR and UK GDPR. If you are in the EU or UK, you have the right to access, rectification, erasure, restriction, portability, objection, to withdraw consent, and to lodge a complaint with a supervisory authority. Our legal bases are: the booking form is processed to take steps at your request before a contract and on our legitimate interest in responding to inquiries; any marketing email is on consent. We are a US-focused B2B business and do not target EU or UK visitors, so we have not appointed an Article 27 representative; the Meta Pixel described above is aimed at our US advertising and is suppressed for any browser sending an opt-out signal. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects under Article 22.
International transfers. We process data in the United States. Where EU or UK personal data reaches our subprocessors, those transfers rely on the subprocessors’ own transfer mechanisms, such as Standard Contractual Clauses or an applicable certification framework, as described in their data processing terms.
Verification and timelines. We will verify your identity before acting on a request. An authorized agent may act for you with signed permission or a power of attorney. We respond within 45 days for CCPA requests and within one month for GDPR requests, with extensions only where the law allows.
To exercise any right, email privacy@kanurra.com.
Security
We apply reasonable administrative and technical safeguards to the limited contact data and logs we hold, and we work only with subprocessors that maintain their own security programs.
We will be honest about the limit, though: no method of transmitting or storing data over the internet is perfectly secure, and we cannot guarantee absolute security.
If a breach involving your personal information occurs, we will notify affected individuals and authorities as required by law.
For security questions or to report a vulnerability, email security@kanurra.com.
Children’s privacy
The Website is not directed to children. It is intended for business users.
We do not knowingly collect personal information from anyone under 13, the standard under COPPA. We do not knowingly sell or share the personal information of minors, and we do not offer consent-based processing of minors below the applicable EU or UK age of digital consent. If we learn we have collected information from a child, we will delete it. If you believe a child has provided us information, email privacy@kanurra.com.
Third-party links and embeds
The Website links to and embeds tools operated by third parties. The iClosed scheduler embed on /audit, the Meta Pixel, and the PostHog analytics script are the main ones; any maps or video embeds we add later would be others.
These third parties operate under their own privacy policies, and we are not responsible for their practices. For the scheduler, our advertising partner, and our host specifically, see the subprocessor list above.
Changes to this policy
We may update this policy from time to time. When we make material changes, we will indicate them by updating the effective date and posting the revised policy to this page.
For changes that materially affect how we use personal information you already gave us, we will take additional reasonable steps to notify you, such as a notice on the site or, where we have your email, by email.
Contact us
For privacy questions, requests, or complaints, email privacy@kanurra.com.
Legal entity: Kanurra, Inc. (“Kanurra”).
Mailing address: New York, NY.
If you are in the EU or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.
Governing law and dispute terms for this Website are set out in the Terms of Service. Governing-law state is New York.