Your Privacy Rights
What you can ask us to do with your data, how to ask, how long we take — and the extra rights you have depending on which US state you live in.
Effective date: 7 August 2026 · Last updated: 7 August 2026
Summary
Wherever you live, you can ask us to show you what we hold, correct it, export it or delete it — using Settings → Privacy in the app or by emailing privacy@onlinecareai.com. We do not charge for this, we do not ask why, and we will never treat you differently for asking.
We do not sell personal information and we do not share it for cross-context behavioural advertising. So there is no "Do Not Sell or Share" opt-out to exercise — there is nothing to opt out of.
1. How to make a request
- In the app — Settings → Privacy gives you export, correction and deletion directly, which is usually fastest.
- By email — write to privacy@onlinecareai.com from the address on your account, stating what you want.
We acknowledge every request within 72 hours and complete it within the period your law requires — generally 45 days in the United States (extendable once by a further 45 where genuinely necessary, with notice to you) and 30 days under GDPR.
2. How we verify you
Because these requests concern health information, we verify identity before acting. Normally that means confirming control of the email address on the account, and for deletion or export we may ask you to re-authenticate in the app. For sensitive requests we may ask for additional information, which we use only for verification and then delete.
3. Authorised agents
You may use an authorised agent to make a request. We will ask for written proof of authorisation signed by you, and we may still ask you to verify your own identity directly.
4. California (CCPA/CPRA)
If you are a California resident you have the right to:
- Know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients
- Delete personal information we hold, subject to legal exceptions
- Correct inaccurate personal information
- Opt out of sale or sharing — not applicable, as we do neither
- Limit the use of sensitive personal information — we use sensitive personal information, including health information, only to provide the services you request and for the purposes permitted without a right to limit
- Non-discrimination for exercising any of these rights
Categories of personal information collected in the last 12 months: identifiers; personal information under Cal. Civ. Code §1798.80; protected classification characteristics (age, where you provide it); commercial information (transactions); internet and network activity; geolocation data; audio (voice sessions); and sensitive personal information (health data, precise geolocation where enabled, account credentials).
Shine the Light: we do not disclose personal information to third parties for their own direct marketing purposes.
5. Washington and Nevada consumer health data
The Washington My Health My Data Act and the Nevada Consumer Health Data Privacy Law give residents specific rights over consumer health data. If you are a Washington or Nevada resident you may:
- Confirm whether we collect, share or sell your consumer health data, and access it
- Obtain a list of all third parties with whom we have shared it
- Withdraw consent to its collection and sharing
- Have it deleted, including from our backups and from our service providers
We do not sell consumer health data and we do not share it for advertising. We do not use geofencing around any healthcare facility. Requests under these laws should be sent to privacy@onlinecareai.com with "Consumer Health Data Request" in the subject line.
6. Colorado, Connecticut, Virginia, Texas, Utah, Oregon and other states
If you live in a state with a comprehensive consumer privacy law, you generally have the right to confirm processing and access your data, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale and certain profiling. Because we do not conduct targeted advertising, sell data or carry out profiling with legal effects, the opt-out rights do not apply to us in practice — but the access, correction, deletion and portability rights all do, and we honour them for every US resident regardless of state.
Where your state requires opt-in consent for processing sensitive data, including health data, we obtain that consent before processing.
7. EEA, UK and Switzerland
If you are in the EEA, UK or Switzerland, you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You also have the right to complain to your supervisory authority. We rely on the Standard Contractual Clauses for transfers to the United States.
8. If we say no
If we decline a request we will tell you why in writing, and explain what you can do next. Several states give you a right of appeal: send an appeal to privacy@onlinecareai.com with "Privacy Appeal" in the subject line and we will respond within 45 days. You may also complain to your state Attorney General at any time.
Questions about this document? Email legal@onlinecareai.com. For privacy requests use privacy@onlinecareai.com. For anything urgent about your health, contact a licensed clinician or your local emergency number.
