Privacy Policy

1. What we collect

Three kinds of information:

What you give us

Account and identity: your name, email, phone number, date of birth, membership tier and purchase status.

Your health record: the documents you upload (e.g., photographs, PDFs, or discharge letters), the sources you connect such as wearables and provider portals, and the medications, symptoms and habits you log. You may also provide information about your family health history, including health conditions of relatives and the degree of relationship you report (but not the names of those relatives). This is the product, and it is yours. Please note that this can and may include sensitive health information that you elect to provide.

Messages: what you send to support, and survey answers you choose to give.

What arrives with your consent

If you order lab panels, your orders and physician-reviewed results are delivered into your record under your Release of Laboratory Results, and your intake information is shared with the laboratory physicians under your Laboratory Data-Sharing and Telehealth Consent.

What is collected automatically

Technical basics: IP address, device and browser type, app version, pages and features used, and crash diagnostics. We, or service providers on behalf of Octo Health, may also collect approximate city-level or state-level location from your IP. We do not collect precise GPS location.

Cookies and similar technologies, described in our Cookies Notice.

We do not collect or store payment card numbers within Octo Health systems. Your card number is handled by our payment processor, Stripe, inside its own secure form. Our payment processor may also receive your name and email address and perform fraud detection using device and IP data.

In short, we collect the following categories of information from you and may share with advertisers as described:

2. What we use it for

Each of these has a purpose you would recognise.

To run your record: for example, to parse and organize what you add, show your timeline, and generate your insights and protocol. This is the service itself and requires no additional authorization. Access to record contents by Octo Health personnel is limited to defined roles and permitted only to support a request you make, to respond to a security incident, to debug a fault, or to comply with a legal obligation. Our systems are designed to enable every access to be logged and audited.

To run lab testing: for example, to transmit your requests and intake to the laboratory physicians and deliver reviewed results back to your timeline, under your consents.

To run your membership: for example, for billing, renewal reminders, receipts, support.

To keep Octo Health safe: such as security, fraud and abuse prevention, audit logging.

To create de-identified or aggregated data: Octo Health may use personal information to create de-identified and/or aggregated information. De-identified datasets are not personal information.

To improve Octo Health: for example, debugging, and aggregated and/or de-identified usage analysis for our platform. Reading your documents runs on our own servers. Producing your insights and your protocol sends part of your record to an AI model provider, under contracts that forbid that provider and our cloud provider from using your data for their own purposes. What we send, what we never send and who receives it are set out in our AI Data Processing page.

To meet our legal obligations: such as for accounting, tax and lawful requests.

To talk to you: transactional messages always, marketing only with your consent.

For other legitimate business purposes: for other legitimate business purposes as permitted by law.

3. The boundary

Using your record to run the product for you, your timeline, your insights, your protocol, the suggestions Octo Health makes for you specifically, and answers about your own data, is service delivery. It is what you joined for and it needs nothing extra.

Using your health data to bring you commercial offers is a different thing, and we do not do it. It plays no part in deciding what advertising or campaigns you see, here or anywhere else.

4. Health-privacy laws

Octo Health is a technology company, not a healthcare provider, so Octo Health itself is generally not a HIPAA covered entity in the United States, but in certain circumstances, Octo Health may operate in the capacity of a business associate on behalf of certain of its business partners. The laboratories and physicians who perform and review lab panels are inside their own practices, and they maintain their own privacy notices. When your identifiable health information flows from them to us, we handle your information under your authorizations, our agreements with the laboratories and providers, and this policy. If you live in Washington, Nevada or Connecticut, our Consumer Health Data Privacy Policy adds specific protections on top of this one.

Outside the United States, health data is special category personal data under the General Data Protection Regulation and equivalent laws. Whatever the legal label, everything in your record gets the same protection.

5. Who else sees it

We disclose your personal information to third parties for a variety of business purposes, including to provide our Services, to protect us or others, or in the event of a major business transaction such as a merger, sale, or asset transfer, as described below.

• Service providers that help us run Octo Health: for example, hosting and infrastructure, document processing, email and message delivery, analytics, payments, support tooling, security.
• The laboratory network and its physicians, with your explicit consent, to perform your panels.
• Anyone you choose, when you export or share your record yourself. We may also offer functionality through the Services that allows you to share your records with people of your choosing (e.g., doctor, relative, or nutritionist) within a certain period and revoke access automatically after a certain time period or manually prior to the expiration of that time period.
• Our commonly owned affiliate Octo Health S.A. which works with us as a sister company to provide you with Services and to help us improve those Services.
• If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, your information may be disclosed, sold or transferred as part of such a transaction, as permitted by law and/or contract.
• We may access, preserve, and disclose any information we store associated with you to external parties if we, in good faith, believe doing so is required or appropriate to: comply with law enforcement or national security requests and legal process, such as a court order or subpoena; protect your, our, or others’ rights, property, or safety; enforce our policies or contracts; collect amounts owed to us; or assist with an investigation or prosecution of suspected or actual illegal activity.

In limited circumstances we may share internet and network activity information with advertising partners through our Meta Pixel integrated in our Website. At no point, will we share your health information or other sensitive personal information with advertising partners. You may opt out of this sharing in certain jurisdictions or through your interactions with our cookies preferences on the Website.

6. Where your data is held

We host in infrastructure we control, and personal data is encrypted in transit and at rest. Where information moves between regions, those transfers rely on the mechanisms the law provides for them.

7. How long we keep it

While your account is open, for as long as you want it. When your membership ends or you close your account, your record stays available to export for 30 days and then we delete it. We remind you before that window closes.

You can ask us to delete it immediately at any time, without waiting for the window, in the app or by emailing members@hioctohealth.com. Deletion removes your record from our live systems straight away and from backups within 90 days, and we cannot restore it afterwards. Limited retention that the law requires of us, such as accounting records, is the only exception.

8. Security

Personal data is protected using industry standard information security practices. No system is perfect, and if a breach affects your information we will tell you and the relevant authority within the time the law requires.

Social Security Protection Policy Statement‎.

It is our policy to protect the confidentiality of Social Security numbers (SSNs) ‎from ‎misuse ‎and improper disclosure by maintaining and enforcing physical, ‎‎‎electronic, and procedural ‎‎safeguards. We prohibit unlawful disclosure of ‎SSNs, and limit access to SSNs to our ‎personnel ‎who need access to SSNs in ‎order to perform their job functions. We do not ‎disclose SSNs to ‎third parties ‎except where required or ‎‎permitted by law.

9. Children

Our sites and applications are intended for general audiences, and we do not knowingly seek or collect personal information from children under the age of eighteen (18). In accordance with the Child Online Privacy Protection Act, in the event that we learn that we have collected personal information from a child under age thirteen (13) without verification of parental consent, we will delete that information as quickly as possible unless we are required to retain it by applicable law. If you believe that we might have any personal information from or about a minor, please contact us at our contact information in the “contact us” section below.

10. Your rights

Wherever you live, you can see what we hold, export it, correct it, and delete it, in the app, or by writing to members@hioctohealth.com. Using any of these rights never affects your membership, your price or your features.

We respect requests under universal opt-out mechanisms such as the Global Privacy Control. Please review our Cookies Notice for additional information.

If you live in the European Union, the United Kingdom or the EEA, or Switzerland

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting what happened before. We process your record to deliver the contract you entered into, your explicit consent for health data, our legitimate interests in keeping the service secure, and our legal obligations. You can complain to your national supervisory authority, and in Portugal that is the CNPD.

Other Jurisdictions

If you are a resident of a jurisdiction other than those identified here, please be aware that the laws of your jurisdiction may confer upon you similar or additional rights with respect to your personal information. To learn more about your specific rights and how to exercise them, please contact us at members@hioctohealth.com.

Opt-out

If you would like to opt out of a marketing message(s) or sharing/targeted advertising (which may be considered a “sale” of personal information under certain privacy laws as discussed below), you may contact us using the information in Contact Us section below.

More information about opting out of targeted advertising is available at the links below:

• Network Advertising Initiative: https://optout.networkadvertising.org/?c=1
• Digital Advertising Alliance: https://youradchoices.com/
• European Interactive Digital Advertising Alliance: https://youronlinechoices.eu/

If you live in the United States

Depending on your state you may have rights to know, access, delete, correct and port your information, to opt out of targeted advertising and of any sale of personal data, and to appeal a decision we make. We do not sell personal information. Washington, Nevada and Connecticut residents should also read our Consumer Health Data Privacy Policy.

California

In this section, we provide information for California residents as required under California privacy laws, including the CCPA.

Categories of personal information that we collect and disclose. Our collection, use, and disclosure of personal information about a California resident will vary depending upon the circumstances and nature of our interactions or relationship with such resident. The section above entitled “What we collect” sets out the categories of personal information (as defined by the CCPA) about California residents that we have collected and disclosed (in “Who else sees it”) to others for a business purpose within the past twelve months. We collect these categories of personal information from the sources described in that section of the policy and for the purposes described in the section above entitled “What we use it for.”

If you are a California resident, the CCPA grants you certain rights and imposes restrictions on particular business practices as set forth below:

• Opt-Out of Sale or Sharing: California residents have the right to opt out of the sale of their personal information. California residents also have the right to opt out of the “sharing” of their personal information, which under the law means making available, transferring, or otherwise communicating personal information to a third party for cross-context behavioral advertising. We do not sell your personal information.
• Right to Limit: California residents have the right to limit the use of sensitive personal information in certain situations.
• Request to Delete: California residents have a right to request deletion of their personal information that we have collected about them and to have such personal information deleted, except where an exemption applies.
• Request to Know: California residents have the right to request and, subject to certain exemptions, receive a copy of the specific pieces of personal information that we have collected, used, disclosed and sold about them in the prior 12 months. Please refer to the table in “what we collect” above.
• Request to Correct: California residents have the right to request correction of inaccurate personal information that we maintain about them.
• Right to Non-Retaliation: The CCPA prohibits retaliation against California residents for exercising their rights under the CCPA. We do not and will not retaliate against individuals based on their exercise of rights under the CCPA.

If you are a California resident, you may opt out of the sale or sharing of your personal information by emailing members@hioctohealth.com, and you can make a request to exercise your other rights under the CCPA by e-mailing us at members@hioctohealth.com or via the address provided in the “Contact Us” section below.

We will respond to your request within forty-five (45) days. However, in certain circumstances, we may require additional time to process your request, as permitted by applicable law. We will advise you within forty-five (45) days after receiving your request if such an extension is necessary and why it is needed. If we cannot fulfill your request, our response to you will also explain the reason why we cannot fulfill your request.

We do not charge a fee to process or respond to your consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Verification: We are required by law to take reasonable steps to verify your identity prior to responding to your request. Please note that your exercise of these rights is subject to certain exemptions to safeguard the public interest (e.g., the prevention or detection of crime) and our interests (e.g., the maintenance of legal privilege). If we are unable to process your request via you authenticating yourself on the Services, we may verify your request by asking for information sufficient to confirm your identity, based on the information we have on file. Requests to exercise these rights may be granted in whole, in part, or not at all, depending on the scope and nature of the request and as permitted by applicable law. Where required by applicable law, we will notify you if we reject your request, and notify you of the reasons we are unable to honor your request.

Authorized agent requests: An authorized agent can make a CCPA request on a California resident’s behalf by providing either: (1) a power of attorney valid under California law; or (2) proof that the consumer gave the agent signed permission to submit the request. The consumer must also provide either: (1) verification of their own identity with respect to a right to know categories, right to know specific pieces of personal information, or requests to delete which are outlined above; or (2) direct confirmation that the consumer provided the authorized agent permission to submit the request.

California Shine the Light. The California “Shine the Light” law permits users who are California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their personal information (if any) for their direct marketing purposes in the prior calendar year, as well as the type of personal information disclosed to those parties.

Right for minors to remove posted content. Where required by law, California residents under the age of 18 may request to have their posted content or information removed from the publicly-viewable portions of the Services by contacting us directly as set forth in “Contact Us’ below.

Other U.S. States with Privacy Rights

Under the following U.S. state laws, if and as applicable, individuals may have certain privacy rights described in this section: the Colorado Privacy Act; Connecticut Data Privacy Act; Delaware Personal Data Privacy Act; Indiana Consumer Data Protection Act; Iowa Consumer Data Protection Act; Kentucky Consumer Data Protection Act; Maryland Online Data Privacy Act; Minnesota Consumer Data Privacy Act; Montana Consumer Data Privacy Act; Nebraska Data Privacy Act; New Hampshire Data Privacy Act; New Jersey Data Protection Act; Oregon Consumer Privacy Act; Rhode Island Data Transparency and Privacy Protection Act; Tennessee Information Protection Act; Texas Data Privacy and Security Act; Utah Consumer Privacy Act; and Virginia Consumer Data Protection Act. Collectively these laws, each if and as applicable, are referred to as the “Multi-State Privacy Laws.”

In this section, we provide information for individuals who are entitled to rights under Multi-State Privacy Laws.

Categories of personal information that we collect and disclose. Our collection, use, and disclosure of personal information about individuals entitled to rights under Multi-State Privacy Laws will vary depending upon the circumstances and nature of our interactions or relationship with such individual. The section above entitled “What we collect” sets out the categories of personal information about individuals that we have collected and disclosed (in “Who else sees it”) to others for a business purpose within the past twelve months. We collect these categories of personal information from the sources described in that section of the policy and for the purposes described in the section above entitled “What we use it for.” Please note that some Multi-State Privacy Laws use the term Personal Data, rather than Personal Information. For purposes of this policy, Personal Information has the same meaning as Personal Data.

If you are a resident of a state covered by the Multi-State Privacy Laws, these laws may grant you certain rights and impose restrictions on particular business practices as set forth below:

• Opt-Out of Certain Processing: You may have the right to opt out of certain processing activities. These include the right to opt out for purposes of (i) targeted advertising, (ii) the sale of Personal Data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. We do not sell your personal data.
• Withdraw your Consent to our processing of your personal data. Where our processing is based on your consent or subject to your objection, please note that your withdrawal will only take effect for future processing and will not affect the lawfulness of processing before the withdrawal.
• Access and Obtain a Copy of your personal data, including: (i) confirming whether and how we are processing your personal data; (ii) obtaining access to or a copy of your personal data; and (iii) receiving an electronic copy of personal data that you have provided to us; (iv) for automated information where our processing is based on consent or the performance of a contract with you, or (v) data portability (asking us to send that information to another company in a structured, commonly used, and machine-readable format).
• In some jurisdictions you may also have the right to request more specific information in certain circumstances, which may include the right to know which third parties your personal information was disclosed to or specific information used and decisions made as part of certain profiling activities.
• Request Correction of your personal data where it is inaccurate or incomplete. In some cases, we may provide self-service tools that enable you to update your personal data;
• Request Deletion of your personal data. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Appeal. You may have the right to appeal our decision or response to your request. To exercise your right to appeal, you can submit an appeal request using the same method used to submit your original request, including by contacting us at any time as set forth below.
• Lodge a Complaint. While we are always willing and eager to listen and respond to your concerns about this Notice or our data practices, at any time you have the right to lodge a complaint with the data protection authority or other regulatory body in charge of enforcing data protection laws in your jurisdiction.

You may opt out of the sale of your personal information or request your other opt-out rights provided by applicable Multi-State Privacy Law described above by emailing us at members@hioctohealth.com, and you can make a request to exercise your other rights under the Multi-State Privacy Laws by e-mailing us at members@hioctohealth.com or via the address provided in the “Contact Us” section below.

We will respond to your request within forty-five (45) days or within the time provided for under applicable law. However, in certain circumstances, we may require additional time to process your request, as permitted by applicable law. We will advise you within forty-five (45) days (or other period under applicable law) after receiving your request if such an extension is necessary and why it is needed. If we cannot fulfill your request, our response to you will also explain the reason why we cannot fulfill your request.

We do not charge a fee to process or respond to your consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Verification: We are required by law to take reasonable steps to verify your identity prior to responding to your request. Please note that your exercise of these rights is subject to certain exemptions to safeguard the public interest (e.g., the prevention or detection of crime) and our interests (e.g., the maintenance of legal privilege). If we are unable to process your request via you authenticating yourself on the Services, we may verify your request by asking for information sufficient to confirm your identity, based on the information we have on file. Requests to exercise these rights may be granted in whole, in part, or not at all, depending on the scope and nature of the request and as permitted by applicable law. Where required by applicable law, we will notify you if we reject your request, and notify you of the reasons we are unable to honor your request.

Authorized agent requests: An authorized agent can make a privacy rights request on an individual’s behalf by providing either: (1) a power of attorney valid under applicable law; or (2) proof that the consumer gave the agent signed permission to submit the request. The consumer must also provide either: (1) verification of their own identity with respect to a right to know categories, right to know specific pieces of personal information, or requests to delete which are outlined above; or (2) direct confirmation that the consumer provided the authorized agent permission to submit the request.

11. Changes to this policy

We may revise this Privacy Policy from time to time in our sole discretion. If there are any material changes to this Privacy Policy, we will notify you as required by applicable law, including, at a minimum, by posting an amended version on our Website with a new “Last Updated” date. You understand and agree that you will be deemed to have accepted the updated Privacy Policy if you continue to use our Services after the new Privacy Policy takes effect.

12. Contact

Privacy questions and requests: members@hioctohealth.com. Membership and support: members@hioctohealth.com. Legal: legal@hioctohealth.com.