Privacy Policy

Effective date: 7 August 2026 · Last updated: 7 August 2026

1. Scope and who is responsible

This Privacy Policy explains how OnlineCare AI ("we", "us", "our") collects, uses, discloses and protects personal information when you use our mobile application, our website and related services (together, the "Services").

For most of the Services we act as the controller (in US terminology, the business) of your information. There is one important exception: when you have a consultation with an independently licensed clinician through the app, that clinician is the covered entity responsible for the clinical record, and we act as their business associate. Section 9 explains what that means for you.

2. Information we collect

2.1 Account and profile information

First and last name, email address
Optionally: phone number, date of birth, language preference, and the persona you select (for example student, working professional, caregiver, veteran)
Authentication identifiers if you sign in with Apple or Google — we receive a unique identifier and, unless you hide it, your email address. We never receive your password.
Profiles you create for dependants you are responsible for

2.2 Health information you provide

The Services are designed to hold health information for you, so we collect:

Symptoms you describe, including body area, severity, duration and timing
Answers to mental-health check-ins and structured screening questionnaires, and the resulting scores
Medications, allergies and conditions you record
Documents you upload to your health wallet — insurance and ID cards, prescriptions, immunisation records, laboratory and test results, and travel documents
Time-off notes you generate and the dates and reported symptoms they contain

2.3 Conversations

The content of your text chats and real-time voice sessions with the AI companion, including audio and its transcript, together with session metadata such as duration and language.

2.4 Device, wearable and activity data

Metrics you explicitly authorise from Apple Health, Google Health Connect or a supported wearable — for example steps, sleep, heart rate, active energy. Permissions are granted per metric and can be withdrawn at any time.
Manually entered data such as water intake

2.5 Technical and usage data

Device model, operating system, app version, language and time zone
Crash reports and diagnostic logs
Which features you use and when, so we can find and fix problems
IP address, used for security, fraud prevention and coarse country detection

2.6 Location

Approximate or precise location, only when you use the pharmacy locator or ask for local emergency information, and only for that request. We do not build a location history, and you can disable the permission at any time in your device settings.

2.7 Payment information

Paid services are processed by Apple, Google or our payment processor. We receive confirmation of the transaction, the amount and a token — we never receive or store your full card number.

3. Where the information comes from

Directly from you — everything you type, say, upload or select
Automatically from your device — technical, usage and (with permission) location data
From services you connect — Apple Health, Google Health Connect, wearables, and Apple or Google sign-in
From clinicians you consult — consultation notes, prescriptions and referrals generated during a consultation you booked

4. How we use your information

To provide AI health guidance, symptom checks, assessments and the other features you use
To maintain your health wallet and keep your records available to you
To arrange and host consultations with licensed clinicians at your request
To detect safety-critical situations and surface emergency and crisis resources
To personalise the experience — language, reading level, reminders, and insights measured against your own history
To process payments and prevent fraud
To operate, secure, debug and improve the Services
To communicate with you about your account and, only with your consent, about product news
To comply with law and to establish, exercise or defend legal claims

We do not use your health information for advertising, and we do not carry out automated decision-making that produces legal or similarly significant effects about you.

5. Why we are permitted to process your information

Where a legal-basis framework applies to you (for example GDPR in the EEA or UK), we rely on:

Performance of a contract — to deliver the Services you asked for
Explicit consent — for health data processing, location, wearable sync, marketing communications and optional AI training. You may withdraw consent at any time.
Legitimate interests — security, fraud prevention, debugging and service improvement, balanced against your rights
Legal obligation — record-keeping and regulatory requirements
Vital interests — where processing is necessary to protect someone's life

6. AI processing and model training

To generate guidance we send the content of your query to AI model providers acting as our processors under written contracts. Those contracts prohibit them from using your content for their own purposes, including training their own models.

Your health conversations are not used to train models unless you explicitly enable that setting. It is off by default, you can turn it off again at any time, and turning it off does not reduce any feature you have access to.

Where we use data for evaluation and safety work, we de-identify it wherever possible, limit access to trained personnel, and log every access. AI systems can produce inaccurate output; please read the Medical Disclaimer.

We disclose personal information only in these circumstances:

On your instruction — when you share wallet items with a clinician, pharmacy, employer or educational institution, or when you book a consultation. Every share is scoped to the specific items you select and carries an expiry you can revoke.
To service providers — cloud hosting, AI model providers, video infrastructure, payment processors, email and SMS delivery, error monitoring and mapping. All are bound by written contracts, may process data only on our instructions, and may not use it for their own purposes. Where they handle information subject to HIPAA, a Business Associate Agreement is in place.
To clinicians you choose to consult — only the information you approve before the consultation begins.
To pharmacies and retailers you select — only what is needed to complete the transaction you initiated.
For legal reasons — to comply with a valid legal process, to enforce our terms, or where we believe in good faith that disclosure is necessary to prevent imminent serious harm. We notify you unless legally prohibited from doing so.
In a corporate transaction — if we are acquired or merge, information may transfer, and this policy continues to apply until you are notified of any change.

8. We do not sell or share your personal information

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act and comparable state laws. We have not done so in the preceding twelve months. We do not disclose consumer health data to third parties for advertising under the Washington My Health My Data Act or the Nevada Consumer Health Data Privacy Law.

9. Consultation records and HIPAA

Most consumer health apps are not covered by HIPAA. However, when you book a consultation through OnlineCare AI, the clinician who treats you is a HIPAA covered entity, the record they create is protected health information, and we handle it as their business associate under a Business Associate Agreement.

That means consultation records are subject to the clinician's Notice of Privacy Practices as well as this policy, and are retained for the period your state's medical record-retention rules require — which may be longer than the retention periods in Section 10 and may survive deletion of your account.

Information you provide outside a consultation — AI conversations, self-recorded wallet items, wearable data — is generally not covered by HIPAA. We protect it under this policy and under applicable state health-privacy laws and the FTC Health Breach Notification Rule regardless.

10. How long we keep information

Account and health records — while your account is active, then deleted on request.
AI conversations — retained so you can review them, and deleted when you delete them or your account.
Voice audio — retained only as long as needed to produce the transcript and session summary, then deleted; the transcript remains with your account.
Deletion timeline — personal data is removed from live systems within 30 days of a verified request and rolls off encrypted backups within 90 days.
Consultation records — retained for the period required by the clinician's state medical-record rules, typically six to ten years, and cannot be deleted on request during that period.
Transaction records — retained as required by tax and accounting law.
Cloud backups you enable — stored in your own iCloud or Google Drive account and governed by Apple's or Google's terms. Deleting your OnlineCare AI account does not remove them; you must delete them yourself.

11. How we protect information

TLS 1.2+ encryption in transit and AES-256 encryption at rest
Role-based access control, least-privilege access and full audit logging
Optional biometric lock on the health wallet, separate from your device passcode
Item-level, time-limited sharing links that you can revoke instantly
Regular security testing, dependency monitoring and staff security training
Written security commitments from every subprocessor that handles health information

No system is perfectly secure. Please use a strong, unique password, enable device-level protection, and tell us immediately at security@onlinecareai.com if you believe your account has been accessed without your permission.

12. Your rights

Subject to verification and to legal exceptions, you may:

Access the personal information we hold and learn how it is used
Export it in a portable, machine-readable format
Correct anything inaccurate or incomplete
Delete your account and associated data
Withdraw consent for optional processing
Object to or restrict certain processing
Not be discriminated against for exercising any of these rights

Use Settings → Privacy in the app for most of these, or email privacy@onlinecareai.com. We acknowledge requests within 72 hours and complete them within the period your law requires — generally 45 days in the US and 30 days under GDPR, extendable once where genuinely necessary. There is no charge, and we will not ask you to justify the request. You may use an authorised agent; we will ask for proof of authorisation.

If you are unhappy with our response you may complain to your state Attorney General or, in the EEA or UK, to your data protection authority.

13. United States state privacy laws

Depending on where you live you may have additional rights, including under the California Consumer Privacy Act as amended by the CPRA, the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law, and the comprehensive privacy statutes of Colorado, Connecticut, Virginia, Texas, Utah, Oregon, Montana, Delaware and other states as they take effect. Your Privacy Rights sets out, state by state, what you can ask for and how.

California "Shine the Light": we do not disclose personal information to third parties for their own direct marketing purposes.

14. Children and teenagers

You must be 18 or older to create your own account. Users aged 13–17 may use the Services only through an account created and supervised by a parent or legal guardian who accepts our terms on their behalf and is responsible for that use.

We do not knowingly collect personal information from children under 13. If we learn that we have, we delete it promptly. A parent or guardian who believes we hold information about a child under 13 should contact privacy@onlinecareai.com and we will remove it.

15. International transfers

We operate from the United States, so if you use the Services from outside the US your information will be transferred to and processed in the US, which may have different data protection rules than your own country. Where we transfer personal information out of the EEA, UK or Switzerland we rely on the European Commission's Standard Contractual Clauses and apply supplementary safeguards. We apply the protections described in this policy wherever your information is processed.

16. Breach notification

If a breach affects your personal information we will notify you and the relevant regulators within the timeframes required by law — including, where applicable, the FTC Health Breach Notification Rule, HIPAA's Breach Notification Rule and state breach statutes. Our notification will describe what happened, what information was involved, what we are doing and what you can do.

17. Changes to this policy

We may update this policy. If a change is material we will notify you in the app or by email before it takes effect and update the date at the top of this page. Continuing to use the Services after a change takes effect means you accept the updated policy. Previous versions are available on request.

18. Contact us

Privacy questions and data requests: privacy@onlinecareai.com
Security reports: security@onlinecareai.com
General support: support@onlinecareai.com

OnlineCare AI, [registered company name and mailing address to be inserted].

Questions about this document? Email legal@onlinecareai.com. For privacy requests use privacy@onlinecareai.com. For anything urgent about your health, contact a licensed clinician or your local emergency number.