This Cookies and Tracking Technologies Policy (the 'Policy') explains how Natural Person-Entrepreneur Serhii Halych (ФОП Галич Сергій Сергійович), doing business as LapaHub ('LapaHub', 'we', 'us', or 'our'), uses cookies, local storage, device identifiers, and similar technologies across our products.

This Policy applies to: the lapahub.com website, the clinic.lapahub.com web application (Lapa Clinic), and the Lapa and Lapa Clinic mobile applications (collectively, the 'Services').

By using our Services, you acknowledge that you have read and understood this Policy. For information about how we collect and process personal data generally, please refer to our Privacy Policy.

Cookies are small text files placed on your device by a website or web application. They are widely used to make websites function correctly, improve performance, and provide information to site operators.

In addition to cookies, our Services may use the following similar technologies:

• Local Storage and Session Storage — browser-based storage mechanisms that allow web applications to store data locally on your device. Unlike cookies, this data is not automatically sent with every HTTP request.
• Device Identifiers — unique identifiers associated with your mobile device, used for authentication and push notification delivery.
• Software Development Kits (SDKs) — third-party libraries integrated into our mobile applications that may collect device information for specific purposes such as authentication or crash reporting.

Throughout this Policy, the term 'cookies' is used broadly to refer to all of these technologies unless otherwise specified.

2.1 Essential / Strictly Necessary

These technologies are required for our Services to function and cannot be disabled. They do not require your consent under applicable privacy laws.

• Authentication tokens — used to keep you signed in and verify your identity across requests.
• Session management — used to maintain your active session and ensure continuity as you navigate between pages.
• CSRF protection — security tokens used to prevent cross-site request forgery attacks.
• Language and locale preferences — used to display the Services in your selected language.

2.2 Functional

Functional technologies remember your preferences and settings to provide a more personalised experience.

• User interface preferences — such as sidebar state, table column settings, or selected view modes.
• Theme and display settings — remembering your visual preferences across sessions.

2.3 Analytics and Performance

As of the date of this Policy, we have not yet implemented analytics or performance tracking tools in our Services. No analytics cookies or similar technologies are currently in use.

When we select and implement analytics tools in the future, this section will be updated to identify the specific technologies used, the data they collect, and how you can opt out. Any such implementation will comply with applicable data protection laws.

2.4 Marketing and Advertising

We do not currently use any marketing, advertising, or retargeting cookies or tracking technologies. We do not serve targeted advertisements in any of our Services.

If this changes in the future, we will update this Policy, obtain your consent where required by law, and provide you with clear opt-out mechanisms.

Our mobile applications (Lapa and Lapa Clinic) do not use browser cookies. However, they may use the following technologies:

• Local storage — to store authentication tokens, cached data, and user preferences on your device.
• Push notification tokens — device-specific tokens used to deliver push notifications. These tokens are issued by Apple Push Notification Service (APNs) or Firebase Cloud Messaging (FCM) and are stored securely on our servers.
• Session tokens — used to authenticate your identity and maintain your signed-in state within the app.

These technologies are essential for the proper functioning of our mobile applications and are limited to what is necessary to provide the service.

We use a limited number of third-party services that may set their own cookies or use similar technologies:

• Firebase Authentication (Google LLC) — used for user authentication across our web and mobile applications. Firebase may store authentication-related tokens and session data on your device. For more information, see the Firebase Privacy Policy.

As of the date of this Policy, we do not use any third-party advertising networks, social media tracking pixels, or behavioural analytics platforms. This section will be updated if additional third-party technologies are integrated in the future.

You can control and manage cookies and similar technologies through the following methods:

5.1 Browser Settings

Most web browsers allow you to view, delete, and block cookies through their settings. The exact steps vary by browser. You can typically find cookie management options in your browser's privacy or security settings.

5.2 Mobile Device Settings

On mobile devices, you can manage app permissions, local storage, and notification preferences through your device's system settings. You may also clear app data or revoke push notification permissions at any time.

5.3 Important Notice

Please note that disabling or deleting essential cookies and technologies may prevent our Services from functioning correctly. You may be unable to sign in, your preferences may not be saved, and certain features may become unavailable.

Under applicable data protection laws, including the General Data Protection Regulation (GDPR) and the Law of Ukraine on Personal Data Protection, different legal bases apply depending on the type of technology:

• Essential technologies — do not require your consent. They are necessary for the provision of the Services you have requested and are justified under the legitimate interest or contractual necessity legal bases.
• Functional technologies — are used based on our legitimate interest in providing a personalised user experience. You may opt out by clearing your browser or app data.
• Analytics and marketing technologies — when implemented, will require your prior consent. You will be presented with a clear choice to accept or decline these technologies.

You may withdraw your consent at any time by adjusting your browser or device settings, or by contacting us at legal@lapahub.com.

We may update this Policy from time to time to reflect changes in the technologies we use or in applicable legal requirements. When we make changes:

• We will update the 'Last Updated' date at the top of this Policy.
• For material changes — such as the introduction of analytics or advertising technologies — we will provide prominent notice within our Services.
• Where required by law, we will obtain your consent before using new types of non-essential technologies.

We encourage you to review this Policy periodically. Your continued use of our Services after changes are published constitutes your acknowledgement of the updated Policy.

If you have any questions about this Policy or our use of cookies and similar technologies, please contact us:

• Operator: ФОП Галич Сергій Сергійович (Sole Proprietor Serhii Halych)
• Email: legal@lapahub.com
• Location: Ukraine

We aim to respond to all enquiries within 30 days.