The short version
If you join our waitlist, we hold your email address and the fact that you asked about a treatment service. That is all. We do not sell it, we do not share it with advertisers, and you can have it deleted at any time by emailing privacy@getoh.co.
This policy is provided under Washington’s My Health My Data Act and Nevada’s SB 370. It is a separate document from our general Privacy Policy, because those laws require it to be. Where this policy and the general Privacy Policy conflict as to consumer health data, this one controls.
It applies to all visitors, not only Washington and Nevada residents. We decided it was simpler and more honest to extend the same protections to everyone than to sort people by state.
1. Why this applies to a waitlist
“Consumer health data” is defined broadly under these laws. It includes information that identifies your past, present, or future physical or mental health status — and that can include inferences. Because OH! offers a treatment service for a specific health concern, the act of joining our list can imply something about your health. We therefore treat every waitlist email as consumer health data, whether or not the law strictly requires it.
2. What we collect
| Category | What it is |
|---|---|
| Waitlist data | Your email address, and the inference that you are interested in treatment for a sexual health concern. |
| Technical data | IP address, browser and device type, pages viewed. Used for security and aggregate analytics. |
| Patient data (only if you later become a patient) | Intake responses, symptoms, medical history, current medications, allergies, and correspondence with your clinician. |
We do not ask waitlist subscribers any health questions, and you should not send us health information by email. We built the signup form to collect an email address and nothing else, specifically to keep this category as small as possible.
3. Where it comes from
Directly from you. We do not buy consumer health data, we do not obtain it from data brokers, and we do not infer it from third-party tracking or purchased audience segments.
4. Why we collect it
- To notify you when the service launches
- To determine clinical eligibility and provide care, if you become a patient
- To meet legal, pharmacy, and medical recordkeeping obligations
We will not use consumer health data collected for one of these purposes for a materially different purpose without first obtaining your consent.
5. Who we share it with
Only the service providers required to deliver the service, each under a written contract restricting their use of it:
| Recipient | What they receive, and why |
|---|---|
| Email service provider | Your email address, to deliver messages you asked for. |
| Licensed clinicians (patients only) | Your intake, to assess eligibility and provide care. |
| Pharmacy or outsourcing facility (patients only) | Prescription and shipping details, to dispense and ship. |
| Payment processor (patients only) | Billing details. They do not receive health information. |
| Legal compliance | Where required by law, subpoena, or to prevent serious harm. |
What we never do
We do not sell consumer health data. Not now, and not in future without your separate, signed authorization that meets the requirements of RCW 19.373.
We do not share consumer health data with advertising platforms, ad networks, analytics vendors that build cross-site profiles, or data brokers.
We do not use consumer health data to build advertising audiences, including custom or lookalike audiences.
6. Geofencing
Washington law prohibits geofencing around facilities that provide health care services in order to identify, track, or advertise to consumers. We do not use geofencing of any kind, and have no plans to.
7. Your rights
- Confirm whether we collect, share, or sell your consumer health data
- Access it, including a list of every third party it has been shared with, along with contact details for each
- Withdraw consent to its collection and sharing at any time
- Delete it — including from archives and backups, and we will direct our service providers to do the same
Deleting waitlist data is straightforward and we will do it without argument. Deleting a medical record may be limited by state retention law; if so, we will tell you exactly which law applies and what we can delete.
8. How to exercise them
Email privacy@getoh.co with the subject line “Health Data Request.” You do not have to explain why.
- We respond within 45 days, and may extend once by a further 45 days where permitted, telling you why.
- We will verify your identity before acting on a request involving health information. For waitlist deletion, replying from the email address on file is sufficient.
- An authorized agent may act for you with written permission.
- There is no charge.
If we say no
You may appeal by replying to our decision. We will respond in writing within 45 days explaining our reasoning. If we deny the appeal, we will provide you with a link to submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint. Nevada residents may contact the Nevada Attorney General.
9. How long we keep it
- Waitlist emails: until you unsubscribe or request deletion, or [X MONTHS] after launch if you never become a patient.
- Medical records: as required by the law of the state where your clinician is licensed, typically [X] years.
10. Security
Encryption in transit and at rest, role-based access limits so staff see only what their job requires, and vendors selected in part for their security posture. No system is perfectly secure and we will not claim otherwise. If a breach affects your data we will notify you as required by law, including under the FTC Health Breach Notification Rule where it applies.
11. Changes
Material changes will be posted here with a new effective date and, where required, emailed to you. We will not apply a materially different use to previously collected consumer health data without your consent.
12. Contact
[LEGAL ENTITY NAME]
[MAILING ADDRESS]
privacy@getoh.co