Consumer Health Data Privacy Policy

In short

Octo Health is a health-record product, so most of what you give us is consumer health data. We use it to run your record and your membership. We do not sell data that identifies you, and we do not disclose such data to advertisers or data brokers, we do not use geofencing. Producing your insights sends part of your record to an AI model provider that cannot train on it, as set out in our AI Data Processing page. You can see it, export it, or delete it whenever you want.

For purposes of this policy, “consumer health data” means personal information that is linked or reasonably linkable to an individual and that identifies the individual's past, present, or future physical or mental health status. We may also de-identify or collect de-identified data for these purposes. When collecting de-identified data, we will only process such data in a de-identified fashion and will not make any attempts to re-identify such data. Below we describe how state-specific definitions apply to your rights requests.

1. What we collect

Records and documents you upload (e.g., photographs, PDFs, or discharge letters); lab results delivered through Octo; biomarkers, measurements and wearable data; medications, symptoms, habits and other logs; conditions or goals you flag; information you provide about your family health history, including health conditions of relatives and the degree of relationship you report (but not the names of those relatives); and what Octo works out from your record to build your insights and your protocol. Please take note, this may include any information you upload or authorize us to collect. This may contain sensitive health condition information that you provide or direct to us.

We do not collect precise location, we do not use geofencing anywhere, least of all around care facilities, and we do not use health data to identify or follow you in the physical world.

2. Where it comes from

From you, through uploads, logs and connected sources. From the laboratory network and its physicians, with your explicit consent, when you order a panel. And from the processing we do on your own record to deliver what you asked for.

3. What we use it for

To provide our services to you and to improve those services. For example: your timeline, your insights, your protocol and your lab panels. To keep the service secure. To meet legal or regulatory obligations. To investigate and respond to potential health and safety issues, consumer claims, and/or to establish, exercise or defend a legal claim and for any other purpose required or allowed under applicable law. And to talk to you about your record and your membership.

Acting on what your record shows is the product: your insights, your protocol, the panels and next steps Octo suggests for you specifically. That is personalization, and it is what you joined for.

What we do not do is use your health data to sell to you. It does not decide which commercial offers, campaigns or advertising you see, here or anywhere else.

4. How we disclose consumer health data

We only disclose consumer health data as directed by you, to deliver our services to you, or as explained in this section.

• We neither “sell” consumer health data to third parties, nor do we use or allow consumer health data to be used for third-party advertising.
• We may use service providers to process consumer health data on our behalf, such as processors we rely on for hosting, infrastructure, document processing inside our own cloud, AI model providers, and security. All bound by contract to act only on our instructions. Our agreements with our service providers include data protection requirements and limit their processing of consumer health data on our behalf to that which is required to provide services to us.
• We may disclose consumer health data to the laboratory network and its physicians, with your explicit consent, to perform your panel.
• We may disclose consumer health data to anyone you choose, when you export or share your record yourself. We may also offer functionality through the Services that allows you to share your records with people of your choosing (e.g., doctor, relative, or nutritionist) within a certain time period and revoke access automatically after a certain time period or manually prior to the expiration of that time period.
• We may disclose or transfer consumer health data in connection with business transfers (for example, as part of a merger or a sale of assets) or for the protection of Octo or others.
• We may disclose consumer health data to our commonly owned affiliate Octo Health S.A. which works with us as a sister company to provide you with services and to help us improve those services.
• We may also disclose consumer health data if it has been called into question in conjunction with exercising or defending a legal claim and for any other purpose required or allowed under applicable law.

The categories of third parties that can receive consumer health data, and our current processor list, are available from members@octohealth.com.

5. Your rights

You can exercise any of these in the app, or by writing to members@octohealth.com. Any clear written request will be given effect. Remember, you may always withdraw your consent for our processing of your health information.

Exercising Your Privacy Rights Regarding Consumer Health Data

Connecticut residents, Nevada residents, Washington residents and individuals that have their consumer health data collected by us in Nevada or Washington may exercise the following rights with respect to their consumer health data we collect:

• Right to Know: The right to confirm whether we are collecting, sharing or selling their consumer health data and to access such consumer health data.
• Right to Access: The right to a portable and technically feasible copy of the consumer health data we have collected from them.
• Right to Know Third Parties: The right to obtain a list of all third parties and/or affiliates with whom we have shared or sold their consumer health data and an online mechanism to contact these third parties.
• Right to Opt-Out: The right to require that we stop collecting, sharing or selling their consumer health data, including for targeted advertising and profiling purposes.
• Right to Delete: The right to request deletion of the consumer health data that we have collected about them.
• Right to Correct: The right to ask that we correct inaccuracies in the consumer health data we have collected about them.

Please note that for purpose of this section of this policy, we consider “consumer health data” to mean:

• For Connecticut residents: “consumer health data” as defined under the Connecticut Data Privacy Act, as amended.
• For Nevada residents or individuals that have their consumer health data collected by us in Nevada: “consumer health data” as defined under the Nevada Consumer Health Data Privacy Law.
• For Washington residents or individuals that have their consumer health data collected by us in Washington: “consumer health data” as defined under the Washington My Health My Data Act.

Exercising Your Rights and How We Will Respond

If you have other questions, comments or concerns about our privacy practices, or if you wish to issue a request to exercise your rights where applicable by law, please contact us by email at members@octohealth.com. Please provide your name and contact information along with the request. We will respond to such requests within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.

We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations.

Verification of Identity - Request to Know, Request to Know Third Parties, Request a Copy, Delete, Correct

We will ask you for two pieces of personal information and attempt to match those to information that we maintain about you.

If we are unable to verify your identity with the degree of certainty required, we will not be able to respond to the request. We will notify you to explain the basis of the denial.

When We Do Not Act on a Request - Appeal Process

In some cases, we may not act on your requests (e.g., if we cannot do so under other laws that apply). When this is the case, we will explain our reasons for not providing you with the information or taking the action (e.g., correcting data) you requested.

Additionally, you have the right to appeal our decision by contacting us at members@octohealth.com within 30 days after your receipt of our decision. We will respond to your appeal within 45 days of our receipt of the request. If your appeal is unsuccessful, Washington residents can raise a concern or lodge a complaint with the Washington State Attorney General at https://www.atg.wa.gov/file-complaint. You may also generally complain to your Attorney general if you have any concerns about our practices or our responses to your requests.

Third Party Collection of Consumer Health Data

When you use our website or other online services, third parties will not be allowed to collect your consumer health data over time and across different websites and other online services we offer.

How We Keep Your Consumer Health Data Secure

We implement and maintain reasonable security appropriate to the nature of the consumer health data that we collect, use, retain, transfer or otherwise process. However, there is no perfect security, and reasonable security is a process that involves risk management rather than risk elimination. While we are committed to maintaining a reasonable information security program, no such program can be perfect; in other words, all risk cannot reasonably be eliminated. Data security incidents and breaches can occur due to factors that cannot reasonably be prevented.

6. Changes to This Policy

We will review and update this policy from time to time. If changes are made, we will update this policy and reflect the date of such modification in the date above. If the changes are material, you will be notified as required by law, such as by posting those changes here, as indicated by the “Last Updated” date above, and/or by contacting you, such as, by sending you an email.

7. Contact Us

If there are any questions regarding this policy or to request a copy of this Health Data Privacy policy in another format you may contact us at members@octohealth.com.