Additional Disclosures and Notice at Collection for California Residents
This California Privacy Notice ("Notice") supplements the Onsera Health Privacy Policy and applies solely to individuals who reside in the State of California ("consumers" or "you"). We adopt this Notice to comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations (collectively, "CCPA"). Terms defined in the CCPA have the same meaning when used in this Notice.
Onsera Health is a HIPAA-covered entity (or acts as a business associate on behalf of HIPAA-covered entities). Protected health information ("PHI") that we collect, use, or disclose in compliance with the Health Insurance Portability and Accountability Act ("HIPAA") is exempt from the CCPA. That information is instead governed by our Notice of Privacy Practices and applicable federal and state health privacy laws.
This Notice addresses personal information we collect that falls outside the scope of HIPAA — for example, information collected through our website, marketing communications, account registration, and similar channels. Where we collect health or medical information that is not PHI under HIPAA (for example, wellness information you voluntarily submit through a public-facing form before becoming a patient/member), that information may still be considered "sensitive personal information" under the CCPA, and the rights described below apply to it.
In the preceding 12 months, we have collected the following categories of personal information about California consumers:
We do not knowingly collect personal information from consumers under 16 years of age for purposes of selling or sharing it, and we do not knowingly sell or share the personal information of consumers we know to be under 16 years of age without the opt-in consent required by the CCPA (affirmative authorization from a parent/guardian for consumers under 13, or from the consumer for those 13–15).
We collect personal information from:
We use the personal information described above for the business and commercial purposes described in our main Privacy Policy, including to: provide and improve our services; process transactions; communicate with you; personalize and market our services; maintain the security and integrity of our website and systems; comply with legal obligations; and for other purposes disclosed to you at the time of collection.
Our AI-powered chatbot is offered to patients as part of our services. Because the chatbot is used within the context of your care or account with us, information you input into the chatbot — including any health or medical information you choose to share — is generally treated as protected health information ("PHI") and is retained and used in accordance with HIPAA and our Notice of Privacy Practices, rather than under this CCPA Notice. This may include use of your inputs to respond to you, support your care, and improve the chatbot and related AI systems, consistent with our HIPAA policies and any applicable Business Associate Agreements governing our AI vendors.
To the extent any information you provide to the chatbot falls outside the scope of PHI (for example, technical or device information generated by your use of the chatbot interface, such as timestamps or browser/device identifiers), that information is personal information subject to this Notice, and the rights described in Section 7 apply to it, including the right to request deletion or to limit our use of sensitive personal information.
Disclosures for business purposes. In the preceding 12 months, we have disclosed the following categories of personal information to service providers and contractors for business purposes: identifiers, customer records information, commercial information, internet/network activity, and inferences.
"Sale" and "Sharing." Under the CCPA's broad definitions, allowing certain advertising and analytics cookies/pixels on our website to operate may be considered a "sale" or "sharing" of personal information (specifically, identifiers and internet/network activity), even though we do not sell information for money. In the preceding 12 months, we may have "sold" or "shared" the following categories of personal information with advertising and analytics partners for cross-context behavioral advertising purposes:
We do not sell or share protected health information governed by HIPAA, and we do not sell or share the personal information of consumers we know to be under 16 years of age.
Subject to certain exceptions and limitations, California consumers have the right to:
How to Exercise Your Rights
You may submit a request to know, delete, or correct by:
Verification. To protect your information, we will need to verify your identity before processing a request to know, delete, or correct, typically by matching information you provide against information we already have on file. We may need to request additional information to verify certain requests (e.g., requests for specific pieces of information). If you use an authorized agent to submit a request on your behalf, we may require proof of the agent's authority and may still require you to verify your own identity directly with us.
Response time. We will confirm receipt of your request within 10 business days and will respond substantively within 45 calendar days, unless we notify you that additional time (up to another 45 days) is needed.
You can opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising at any time by:
Opting out will not affect information already shared prior to your request, and it may affect the personalization of ads and content you see on our site.
At or before the point we collect personal information, we provide notice of the categories of personal information to be collected and the purposes for which the categories will be used, as described in Sections 2 and 4 above. This Notice serves as our notice at collection for our website and related digital properties.
We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Notice, unless a longer retention period is required by law (including HIPAA and other health record retention laws) or is necessary to protect our legal interests.
We do not currently offer any financial incentive or price/service difference programs in connection with the collection of personal information.
If you have questions about this Notice or wish to exercise your California privacy rights, please contact us at:
Onsera Health: privacy@onserahealth.com
Better adherence. Lower cost. Measurable outcomes.
