This notice supplements our Privacy Policy and applies only to California residents, under the California Consumer Privacy Act as amended by the CPRA.
An important scope note. The CCPA does not cover everything. It excludes protected health information governed by HIPAA, medical information governed by the California Confidentiality of Medical Information Act (CMIA), and patient information we maintain in the same manner. For that information, see our Notice of Privacy Practices. This notice covers the rest — principally website and waitlist data.
1. What we collect, and why
In the preceding twelve months we have collected, or may collect, the following categories:
| Category | Examples | Purpose |
|---|---|---|
| Identifiers | Name, email, postal address, phone, IP address, account identifiers | Communicate with you; deliver the service; security |
| Customer records | Billing and shipping details | Process payment; ship orders |
| Protected classifications | Age, sex | Confirm 18+ eligibility; clinical assessment |
| Commercial information | Products considered or obtained | Fulfil and support your membership |
| Internet activity | Pages viewed, referring page, aggregate session data | Understand which pages work; site security |
| Geolocation | Approximate location inferred from IP | Confirm we can lawfully serve your state |
| Inferences | That you are interested in a treatment service | Notify you at launch |
| Sensitive personal information | Health information; information about sex life or sexual orientation | Provide clinical care. See section 4. |
2. Sources
Directly from you; automatically as you browse the site; and from service providers acting on our behalf. We do not purchase personal information from data brokers.
3. Disclosure and sale
We do not sell or share your personal information.
Not in the ordinary sense, and not in the broad statutory sense either. In particular, we do not use third-party advertising cookies that would constitute “sharing” for cross-context behavioral advertising, and we do not disclose health information to advertising platforms. In the preceding twelve months we have sold or shared no personal information, and none belonging to anyone under 16.
We do disclose limited personal information to service providers for business purposes: email delivery, payment processing, shipping, clinical and pharmacy services, and security. Each is bound by contract to use it only to perform that service.
4. Sensitive personal information
Health information and information relating to sex life are sensitive personal information under the CPRA. We collect it only where you provide it in the course of seeking care, and we use it only to provide that care and for purposes the CPRA permits without a right to limit — performing the service, security, and legal compliance.
We do not use or disclose sensitive personal information to infer characteristics about you, and we never use it for advertising. Because our use is confined to permitted purposes, the “Limit the Use of My Sensitive Personal Information” right has no practical application here — but if you would like us to confirm that in writing for your own records, email us and we will.
5. Retention
| Data | Kept for |
|---|---|
| Waitlist email | Until you unsubscribe or ask us to delete, or [X MONTHS] after launch |
| Account and order records | [X] years, for tax and financial compliance |
| Medical records | As required by the law of your clinician’s licensing state, typically [X] years |
| Website analytics | [X] months, in aggregate |
6. Your rights
- Know what we collect, use, disclose, and sell, including specific pieces
- Delete personal information we hold, subject to legal exceptions
- Correct inaccurate personal information
- Opt out of sale or sharing — we do neither, so there is nothing to opt out of
- Limit use of sensitive personal information — see section 4
- Non-discrimination for exercising any of these rights
7. How to exercise them
Email privacy@getoh.co. We confirm receipt within 10 business days and respond within 45 days, extendable once by a further 45 where permitted.
We must verify your identity, and will ask for more where the request concerns sensitive information. An authorized agent may submit a request with written permission signed by you, proof of their registration with the California Secretary of State or a power of attorney, and direct confirmation from you.
We honor Global Privacy Control signals sent by your browser as a valid opt-out request.
8. Shine the Light
California Civil Code §1798.83 permits residents to request details of personal information disclosed to third parties for their own direct marketing. We make no such disclosures.
9. Notice at collection
This page, together with the Privacy Policy and Consumer Health Data Policy, serves as our notice at collection. It is linked from the footer of every page.
10. Contact
[LEGAL ENTITY NAME]
[MAILING ADDRESS]
privacy@getoh.co