This policy explains what [LEGAL ENTITY NAME] ("OH!," "we," "us") collects when you use getoh.co, why we collect it, who we share it with, and what control you have over it.
We have written this in plain language on purpose. If anything here is unclear, email privacy@getoh.co and we will explain it.
The short version
We collect your email if you join the waitlist. If you later become a patient, we collect the health information a clinician needs to treat you safely. We do not sell your personal information or your health information, and we do not share it with advertisers. You can ask us to delete it at any time.
1. Who we are
[LEGAL ENTITY NAME]
[STREET ADDRESS]
[CITY, STATE ZIP]
privacy@getoh.co
OH! is a technology and administrative services company. OH! does not practice medicine. Clinical services are provided by independently licensed clinicians affiliated with [AFFILIATED PROFESSIONAL ENTITY], and pharmacy services by [PHARMACY PARTNER]. Those parties maintain their own records and their own privacy obligations, described in Section 8.
2. What we collect
If you only join the waitlist
- Your email address.
- Basic technical data — IP address, browser and device type, referring page, and pages viewed.
That is all. We do not ask waitlist subscribers for health information, and you should not send us any.
If you become a patient
- Identity and contact information — name, date of birth, shipping address, phone.
- Health information — the intake questionnaire, symptoms, medical history, current medications, allergies, and your correspondence with your clinician.
- Payment information — processed by [PAYMENT PROCESSOR]. We never see or store your full card number.
3. Why we collect it
| Purpose | What we use |
|---|---|
| Tell you when we launch | Email address |
| Determine clinical eligibility and provide care | Health information |
| Fill and ship prescriptions | Identity, address, prescription details |
| Process payments and prevent fraud | Payment and technical data |
| Improve the site and understand which pages work | Aggregate technical data |
| Meet legal, pharmacy, and recordkeeping obligations | As required by law |
4. What we never do
- We do not sell your personal or health information. Not to data brokers, not to anyone.
- We do not share your health information with advertising platforms and do not use it for targeted advertising.
- We do not send marketing email you did not ask for. Waitlist subscribers receive launch notification only.
- We do not use identifying information in advertising. We will never build an ad audience from your health data.
5. Advertising, analytics, and tracking technologies
We advertise on third-party platforms and use analytics to understand how the site performs. This matters more than usual here, so we are being specific.
- We use [ANALYTICS PROVIDER] to measure aggregate site traffic.
- We use advertising measurement tools from [AD PLATFORMS] to understand which advertisements lead people to the site.
- We do not transmit health information, intake responses, or any data indicating you are seeking or receiving treatment to any advertising platform.
- Where required, we obtain your consent before setting non-essential cookies, and you can withdraw it at any time via [COOKIE PREFERENCES LINK].
You can also send a Global Privacy Control signal from your browser, and we will treat it as a valid opt-out of sale and targeted advertising.
6. Consumer Health Data
Washington and Nevada residents: Washington's My Health My Data Act and Nevada SB 370 give you specific rights over "consumer health data," which is defined broadly and can include the fact that you sought information about a health condition. This section serves as our consumer health data policy under those laws.
What consumer health data we collect: your email address in connection with a waitlist for a treatment service, and, if you become a patient, the health information described in Section 2.
Sources: directly from you.
Purpose: to notify you of launch, determine clinical eligibility, and provide and support treatment.
Who we share it with: only the service providers listed in Section 8, each under contract restricting their use of it.
We do not sell consumer health data. We will not do so without first obtaining your separate, valid written authorization.
Your rights: to confirm whether we collect, share, or sell your consumer health data; to access it; to withdraw consent for its collection and sharing; and to have it deleted, including from our archives and backups. To exercise any of these, email privacy@getoh.co. We will respond within 45 days and may extend once by 45 days where permitted. If we deny your request you may appeal by replying to our response, and you may contact the Washington Attorney General.
7. How HIPAA applies
HIPAA does not apply to everything on this site, and we would rather be precise than sound more protected than we are.
- Waitlist email addresses are not protected health information under HIPAA, because no clinician relationship exists and no treatment has been provided. They are still protected under this policy and, where applicable, under state consumer health data law.
- Once you complete a clinical intake and a clinician reviews it, HIPAA applies to the information held by the affiliated professional entity and its business associates, including OH! in its administrative capacity.
8. Who we share information with
We share only what each party needs to do its job, and each is contractually restricted from using it for anything else.
- Licensed clinicians — to review your intake and provide care.
- Pharmacy partner — to fill and dispense prescriptions.
- Shipping carrier — name and address only. Packages are unmarked.
- Payment processor — to process payment.
- Email service provider — to deliver messages to you.
- Legal compliance — where required by law, subpoena, or to prevent serious harm.
- Business transfer — if OH! is acquired, information may transfer, subject to this policy and applicable law.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your information; to opt out of sale, sharing, or targeted advertising; to limit use of sensitive information; and to be free from discrimination for exercising these rights. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws are covered here, as are Washington and Nevada residents under Section 6.
Email privacy@getoh.co. We will verify your identity before acting on a request involving health information.
Unsubscribing is always one click, in the footer of every email we send.
10. How long we keep it
- Waitlist emails: until you unsubscribe or ask us to delete, or [X MONTHS] after launch if you never became a patient.
- Medical records: as required by the law of the state where your clinician is licensed, typically [X] years.
- Payment records: as required by tax and financial regulation.
11. Security
We use encryption in transit and at rest, access controls limiting staff access to what their role requires, and vendors selected for their security posture. No system is perfectly secure, and we will not claim otherwise. If a breach affects your information, we will notify you as required by law, including under the FTC Health Breach Notification Rule where it applies.
12. Age
This service is for adults 18 and over. We do not knowingly collect information from anyone under 18. If we learn we have, we will delete it.
13. Changes
If we make material changes we will post the revised policy here with a new effective date and, where the change is significant or legally required, email you. For consumer health data, we will not use previously collected data for a materially different purpose without your consent.
14. Contact
privacy@getoh.co
[LEGAL ENTITY NAME], [MAILING ADDRESS]