Our cookie
policy

We use only strictly necessary cookies and analytics cookies. We do not use advertising, marketing, social media tracking, or retargeting cookies.

Strictly necessary cookies

• alma_session — maintains your authenticated session while you browse the site. Expires when the browser closes.
• alma_csrf — prevents cross-site request forgery attacks on form submissions. Expires when the browser closes.
• alma_cookie_consent — remembers your cookie consent preferences. Persistent, 1-year duration.

Analytics cookies

• _ga — distinguishes unique visitors with a pseudonymous client ID. Persistent, 2-year duration.
• _ga_<container-id> — maintains session state for GA4 measurement. Persistent, 2-year duration.
• _gid — distinguishes unique visitors within a 24-hour window. Persistent, 24-hour duration.

Google Analytics collects pseudonymized information about how visitors use our public website — page visits and time spent, referral sources, city/region-level location, and device and browser information.

We configure Google Analytics with privacy-protective settings: IP anonymization is enabled, data sharing with Google and Google Signals are disabled, data retention is set to 14 months, and all advertising features are disabled. Google Analytics does not run on any authenticated pages, account dashboards, or pages that display or transmit health data. Google is contractually prohibited from using Alma's analytics data for its own advertising purposes.

On your first visit you receive a cookie consent banner that lets you accept or decline analytics cookies. Analytics cookies are not set until you affirmatively click “Accept,” and you can change your preferences at any time via the footer link.

Most web browsers also let you control cookies through their settings, though blocking strictly necessary cookies may affect the functionality of our website. You can additionally install the Google Analytics Opt-Out Browser Add-on at tools.google.com/dlpage/gaoptout.

There is currently no universally accepted standard for how websites should respond to Do Not Track (DNT) signals, and at this time our website does not respond to them. We do, however, recognize and honor Global Privacy Control (GPC) signals as a valid opt-out request under the CCPA/CPRA; when a GPC signal is present, analytics cookies are not set.

Virginia residents have the right under the VCDPA to opt out of the processing of personal data for targeted advertising — we do not use cookies for targeted advertising.

California residents may opt out of the sale or sharing of personal information under the CCPA/CPRA. We do not sell personal information collected through cookies, and we honor GPC signals as described above.

This Cookie Policy applies to our website (heyalma.ai) only. The mobile app uses Firebase device identifiers, Firebase Cloud Messaging tokens, and device fingerprints. The mobile app does not use advertising SDKs, social media trackers, or third-party analytics SDKs.

We may update this policy to reflect changes in the cookies we use or for other operational, legal, or regulatory reasons. If we add new categories of cookies, we will update this policy and present the cookie consent banner again.

• Alethiom LLC, 11107 Sunset Hills Rd, Ste 400, Reston, VA 20190
• General inquiries: info@heyalma.ai
• Privacy Officer: privacy@heyalma.ai