This page contains two separate sets of terms. Choose the one that applies to you.
Privacy Notice for Healthcare Providers and Platform Users
(Clinical and Administrative Staff)
Effective Date: April 15, 2026
NOTE: This Privacy Notice also applies to healthcare providers, clinical staff, administrative personnel, and other authorized users who access the myoncare Platform through an authorized contractual, organizational, or service-delivery framework rather than under a direct agreement with myoncare Inc. In such cases, references in this Privacy Notice to “your organization,” the applicable “Provider Agreement,” or the applicable “Business Associate Agreement” shall be understood to refer to the contractual and compliance framework through which access to the Platform is provided. Except for this clarification of applicability, this Privacy Notice applies unchanged.
This Privacy Notice
myoncare Inc. ("myoncare," "we," "us," or "our") is a U.S.-based digital health technology company that provides and operates the myoncare Platform in the United States for healthcare organizations, physicians, clinics, and other healthcare providers.
The myoncare Platform is operated by myoncare Inc. in the United States. myoncare Inc. remains the sole U.S.-facing provider of the Platform and the sole contractual counterparty for U.S. healthcare providers under the applicable Provider Agreement.
The myoncare Platform includes the following key components:
myoncare Inc. is a HIPAA Business Associate — not a Covered Entity
myoncare Inc. does not provide clinical care and does not function as a HIPAA Covered Entity. Where your organization (as a Covered Entity or Business Associate) uses the myoncare Platform to process Protected Health Information (PHI) of your patients, myoncare Inc. acts as a Business Associate as defined under 45 C.F.R. § 160.103. This relationship must be formalized by a Business Associate Agreement (BAA) executed between your organization and myoncare Inc. before any PHI is entered into or processed through the Platform.
Your obligations as the Covered Entity or upstream Business Associate include:
Your organization remains with the HIPAA-responsible party (Covered Entity) with respect to patient PHI. myoncare Inc. will process PHI only as permitted under the BAA and will not use PHI for purposes beyond those permitted by HIPAA and the BAA.
As a Provider User of the myoncare Platform, myoncare Inc. collects the following categories of information about you:
To verify your qualifications and maintain platform integrity, we may collect:
Where your organization has enabled the Video Consultation feature, myoncare Inc. additionally processes the following data relating to you as a Provider User in connection with your participation in Video Consultation sessions:
myoncare Inc. may analyze Platform usage patterns and clinical workflow information in aggregated and/or de-identified form to develop, improve, and optimize Platform features, Pathway libraries, and clinical tools.
myoncare Inc. may also use aggregated and/or de-identified information to conduct research and development relating to new digital health products, features, and applications.
myoncare Inc. will not use patient PHI or Provider User personal information to train general-purpose artificial intelligence models, except where such use is (i) expressly authorized in writing by the applicable customer, (ii) permitted under the applicable Business Associate Agreement, or (iii) based solely on information that has been de-identified in accordance with applicable law. To the extent any such information is derived from PHI, de-identification will be performed in compliance with HIPAA where HIPAA applies.
We do not sell Provider User information to third parties. We may share your information in the following circumstances:
If you are assigned to a multi-user organizational account, designated administrators within your organization may have access to account-level information about users in their organization, including account registration data and usage logs, to the extent permitted under your Provider Agreement.
We engage trusted third-party service providers, licensors, infrastructure providers, and technical support providers within myoncare Inc.’s authorized service and support chain to support Platform operations, including cloud infrastructure and hosting, identity verification, communications infrastructure, security services, and technical support. These parties may access only the data necessary to perform their contracted functions and are bound by appropriate contractual, confidentiality, security, and access-control obligations
In connection with the Video Consultation Service, audio and video stream data and session metadata are processed through a self-hosted Jitsi Meet instance deployed on behalf of myoncare Inc.; this infrastructure is operated by myoncare Inc. on designated cloud hosting infrastructure and is subject to appropriate data processing and confidentiality obligations. The Video Consultation infrastructure does not involve disclosure of session content to any commercially operated third-party video conferencing service for that party's own purposes.
We may disclose Provider User information to regulators, law enforcement authorities, courts, or other government bodies where required by applicable law, court order, or legal process, or where we reasonably believe disclosure is necessary to protect the safety of any person or enforce our legal rights.
In connection with a corporate transaction (merger, acquisition, sale of assets), your information may be transferred to the relevant successor entity, subject to continued protection consistent with this Privacy Notice.
Understanding the allocation of data responsibilities is essential for regulatory compliance. The following table describes the roles of the parties with respect to different categories of data processed through the myoncare Platform:
Note: Certain persons or entities engaged within myoncare Inc.’s authorized service and support chain may process limited data solely on behalf of myoncare Inc. in accordance with contractual, confidentiality, security, access-control, and lawful transfer obligations. Such parties do not independently act as controllers of Provider User data or as Covered Entities with respect to patient PHI solely by virtue of providing licensed technology, infrastructure, or technical support.
myoncare Inc. may use licensors, technology suppliers, infrastructure providers, subcontractors, and limited technical support providers within its authorized service and support chain in connection with the operation, hosting, maintenance, security, support, and remediation of the Platform.
Any access by such parties to operational data, Provider User data, or patient PHI shall be limited to what is strictly necessary for the specific service or support function, shall occur solely on behalf of myoncare Inc., and shall be subject to applicable contractual, confidentiality, security, access-control, and lawful transfer safeguards. No such party markets or provides the Platform in its own name to U.S. healthcare providers through this Privacy Notice, enters into contracts with U.S. healthcare providers or patients through this Privacy Notice, provides medical care, acts as a Covered Entity solely by virtue of such role, or independently determines the purposes or means of processing Provider User information or patient PHI solely by virtue of being engaged within myoncare Inc.’s authorized service and support chain.
myoncare Inc. implements technical and organizational security measures designed to protect the confidentiality, integrity, and availability of all data processed through the Platform, including Provider User personal data and patient PHI. Our security program includes:
With respect to the Video Consultation Service specifically, the following additional security measures apply:
In the event of a security incident affecting Provider User personal information, myoncare Inc. will provide any notices required by applicable law. If an incident involves PHI processed by myoncare Inc. as a Business Associate, myoncare Inc. will notify the applicable Covered Entity or upstream Business Associate in accordance with HIPAA and the BAA. Notice to affected patients will be provided by the Covered Entity unless otherwise required by law or expressly delegated by contract.
We retain Provider User personal and professional information for the duration of the Provider Agreement and for a reasonable period thereafter, as necessary to:
Audit logs relating to access to patient PHI are retained in accordance with HIPAA requirements. Account data will be deleted, de-identified, or retained in archived form in accordance with customer instructions, applicable law, contractual obligations, security requirements, and backup/record-retention processes.
You may access and update your account and professional information by logging into your account settings. For corrections to information that cannot be amended through self-service, please contact dataprotection@myoncare.com.
Upon written request, we will provide you with a copy of your personal information in a commonly used, machine-readable format, to the extent technically feasible and as required by applicable law.
Upon termination of your Provider Agreement, your account will be deactivated, and personal information will be deleted or anonymized in accordance with our retention schedule, subject to applicable legal obligations. To request early deletion, contact dataprotection@myoncare.com.
Provider Users who are California residents may have rights under the CCPA/CPRA with respect to personal information that is subject to the CCPA/CPRA and not otherwise exempt. Certain information may fall outside the CCPA/CPRA, including HIPAA-regulated PHI and publicly available information such as certain professional license information. myoncare Inc. will evaluate and respond to verifiable requests as required by applicable law.
Requests relating to PHI (e.g., access to patient records, amendments, or restrictions) must be directed to your organization as the HIPAA Covered Entity. myoncare Inc. will support your organization in facilitating such requests in accordance with our BAA obligations.
The myoncare Platform is operated from the United States. Provider Users who access the Platform from outside the United States should be aware that their data may be transferred to, stored in, and processed in the United States.
For Provider Users or healthcare organizations in the European Union or EEA: to the extent that personal data of EU/EEA-based Provider Users is processed by myoncare Inc. and the GDPR applies, such processing is subject to the terms of the EU Data Processing Agreement (DPA) incorporated into the Provider Agreement. Data transfers from the EU/EEA to the United States are conducted pursuant to Standard Contractual Clauses (Module 1: Controller to Controller, where applicable, or Module 2: Controller to Processor) and a Transfer Impact Assessment as required.
In limited circumstances, data may also be accessed from outside the United States by authorized persons or entities within myoncare Inc.’s service and support chain, solely where necessary for an authorized operational, maintenance, security, or escalated support purpose and always subject to applicable contractual safeguards and lawful transfer mechanisms
In addition, certain categories of data, including in particular Medical Profile data, may be hosted on dedicated infrastructure located in Germany. In such cases, the data remains processed solely within myoncare Inc.’s authorized service and support chain and subject to applicable contractual, confidentiality, security, and lawful transfer safeguards.
We may update this Privacy Notice from time to time to reflect changes in our practices, applicable law, or Platform functionality. When we make material changes, we will notify affected Provider Users by email and/or by posting a notice within the Platform and will revise the effective date at the top of this Notice. Continued use of the Platform after the effective date of any changes constitutes acceptance of the updated Notice.
***
For privacy-related questions, requests, or concerns, please contact:
Privacy Notice for Patients and App Users
Effective Date: April 15, 2026
Scope Clarification. This Privacy Notice is not a HIPAA Notice of Privacy Practices. Where myoncare Inc. processes Protected Health Information (“PHI”) on behalf of your healthcare provider, your healthcare provider remains the HIPAA Covered Entity, and your rights with respect to such PHI are governed by your provider’s Notice of Privacy Practices. This Privacy Notice primarily governs information that myoncare Inc. processes in its own capacity, including account, platform, support, and self-initiated or non-provider-directed use data.
myoncare Inc. (“myoncare,” “we,” “us,” or “our”) is a U.S.-based digital health technology company that provides and operates the myoncare Platform and related patient-facing Services in the United States in its own name and on its own behalf. The Services enable provider-sponsored digital care programs, patient monitoring, structured digital communications, and, where offered, self-initiated health and wellness features.
myoncare Inc. operates these Services in the United States. myoncare Inc. remains the sole U.S.-facing provider of the Services and the sole contractual counterparty for U.S. users in relation to this Privacy Notice and the U.S. Services.
myoncare Inc. is not a healthcare provider, does not provide medical care, and does not make clinical decisions. The myoncare Platform includes:
This Privacy Notice applies topatients, caregivers, and other end users of the myoncare App and PWA(collectively, "you" or "User"). A separate Privacy Noticeapplies to healthcare providers using the myoncare Web Platform.
We do not provide clinical care and do not bill insurance on our own behalf.
Where your healthcare provider has contracted with myoncare Inc. to use the myoncare Platform as part of your care, myoncare Inc. may process your Protected Health Information ("PHI") as a Business Associate of your provider. In that capacity, we process PHI solely as permitted under our Business Associate Agreement with your provider and applicable HIPAA regulations (45 C.F.R. Parts 160 and 164).
Your HIPAA rights are governed by your provider's Notice of Privacy Practices
Your rights with respect to your PHI — including the right to access, amend, and receive an accounting of disclosures of your PHI — are described in the Notice of Privacy Practices issued by your treating healthcare provider (the HIPAA Covered Entity). Please contact your healthcare provider directly for a copy of their Notice of Privacy Practices.
This Privacy Notice governs personal information that myoncare Inc. collects and processes in its own capacity as an independent data controller, including account data, platform usage data, and data processed in connection with self-initiated (non-provider-directed) use of the Services. Except as expressly stated in this Notice, no third party, including any upstream licensor, software licensor, or technical support subcontractor, independently determines the purposes or means of processing your personal information through the Services solely by virtue of licensing technology to or supporting myoncare Inc.
Depending on how you use the Services, different parties may be responsible for different categories of data:
If you use the Services as part of care delivered by your healthcare provider, your healthcare provider remains the HIPAA Covered Entity and is solely responsible for medical care, clinical judgment, and the Notice of Privacy Practices applicable to your PHI. In this context, myoncare Inc. acts solely as a Business Associate or service provider to the extent permitted by applicable law and contract.
If you use self-initiated, wellness, prevention, or other non-provider-directed features, myoncare Inc. acts as the independent controller of the personal information and health data you choose to provide for those features.
myoncare Inc. acts as the independent controller of account, authentication, security, fraud-prevention, support, and operational platform data.
Except as expressly stated in this Notice, no third party, including any software licensor or technical support subcontractor, independently determines the purposes or means of processing your personal information through the Services.
When you register for or use the Services, we may collect:
When you access or use the Services, we automatically collect certain technical and usage data, including:
We and our service providers use cookies, pixel tags, and similar tracking technologies to automatically collect some of this information. For details on our use of cookies and your choices, see Section VIII (Your Choices and Rights) below.
Where your healthcare provider uses the myoncare Platform as part of your care or treatment, we may receive information about you from your provider, including:
Data received in this context is processed pursuant to our Business Associate Agreement with your provider. Your provider remains the HIPAA Covered Entity and the controller of your PHI in this context.
If you choose to connect third-party health applications, wearable devices, or laboratory services to the myoncare Platform, we will receive data from those sources as authorized by you. Such connections are entirely optional and can be deactivated at any time. The data practices of third-party services are governed by their own privacy policies.
If your healthcare provider offers video consultation, telehealth, or virtual care interactions through the Services, additional categories of information may be processed in connection with those features.
When you participate in a video consultation or telehealth session, the following categories of information may be processed:
Video and audio communications are transmitted using secure encryption protocols. myoncare Inc. does not access, monitor, or store the content of video or audio communications except where:
Video consultation sessions are not recorded by myoncare Inc. by default.
If recording functionality is enabled by your healthcare provider, such recording will occur only:
myoncare Inc. does not independently obtain telehealth or recording consent on behalf of providers.
myoncare Inc. may use aggregated and/or de-identified information to maintain, evaluate, improve, and enhance the Services, including Pathways, Caretasks, reporting functions, and digital support tools.
myoncare Inc. may also use aggregated and/or de-identified information for internal research and development, quality improvement, benchmarking, and product development.
myoncare Inc. will not use identifiable Health Data or PHI to train general-purpose artificial intelligence or machine-learning models. Where data is derived from PHI, any de-identification will be performed in accordance with HIPAA where HIPAA applies. Any use of identifiable non-PHI health data for an optional, customer-specific or user-facing feature, if offered at all, will occur only pursuant to a separate, explicit, informed authorization that is not bundled into acceptance of these Services or this Privacy Notice
In some cases, we will specifically request your consent before using your information for a particular purpose, such as for certain research activities, marketing communications, or where required by applicable law. You may withdraw any consent you have given at any time, though withdrawal will not affect uses already made prior to withdrawal.
We do not sell your personal information to third parties. We do not share your personal information for third-party marketing purposes. We may share your information in the following circumstances:
If you are enrolled in a provider-directed program, we may disclose to your actively connected healthcare provider the information reasonably necessary to support your care, monitoring, care coordination, and the provider-directed functionality of the Services, consistent with applicable law and any authorization you have provided.
If you use self-initiated or non-provider-directed features, we will not disclose your health data to a healthcare provider unless you affirmatively request, authorize, or direct such disclosure.
We share data with trusted third-party service providers, licensors, infrastructure providers, and technical support providers within myoncare Inc.’s authorized service and support chain who support our operations, including cloud hosting and infrastructure, payment processing, technical support, data analytics, communications and notification services, cybersecurity, and business intelligence. These parties may access only the data necessary to perform their contracted functions and are bound by appropriate contractual, confidentiality, security, and access-control obligations. In connection with video consultation or telehealth features, certain infrastructure providers may process real-time communication data and related session metadata strictly for the purpose of enabling and maintaining the communication session and subject to contractual confidentiality, security, and data protection obligations.
myoncare Inc. may use licensors, software suppliers, infrastructure providers, subcontractors, and limited technical support providers within its authorized service and support chain in connection with the operation, hosting, maintenance, security, support, and remediation of the Services. Any access by such parties to operational data, account data, personal information, or PHI shall be limited to what is strictly necessary for the specific service or support function, shall occur solely on behalf of myoncare Inc., and shall be subject to applicable contractual, confidentiality, security, access-control, and lawful transfer safeguards. No such party markets or provides the Services in its own name to U.S. users through this Privacy Notice, enters into contracts with patients or app users through this Privacy Notice, provides medical care, acts as a Covered Entity solely by virtue of such role, or independently determines the purposes or means of processing your personal information or PHI solely by virtue of being engaged within myoncare Inc.’s authorized service and support chain.
To the extent we process PHI on behalf of a Covered Entity healthcare provider, we may engage sub-processors (Sub-Business Associates), directly or indirectly within myoncare Inc.’s authorized platform support chain, to assist in delivering our services. Such sub-processors are required to enter into Business Associate Agreements where required and are bound by applicable HIPAA obligations.
We may disclose your information where required by applicable law, court order, or legal process, or where we reasonably believe disclosure is necessary to comply with a legal obligation, protect the safety of any person, or protect the rights and property of myoncare Inc. We will make reasonable efforts to notify you of such requests unless prohibited by law.
In connection with a merger, acquisition, sale of assets, financing, or other corporate transaction, your information may be transferred to the relevant successor entity, subject to continued protection consistent with this Privacy Notice.
We may share your information for any purpose with your prior explicit consent or at your express direction.
The myoncare Platform uses automated scoring algorithms and clinical scales to categorize and prioritize the health data and Caretask responses you enter. These automated processes support the display of information to your healthcare provider and may result in:
These automated processes do not constitute an independent medical diagnosis or treatment decision. They are designed exclusively to support your healthcare provider in structuring and prioritizing information. Your provider retains full clinical responsibility for all treatment decisions.
Where automated processing may produce legal or similarly significant effects, you have the right to request human review. Please contact us at dataprotection@myoncare.com for further information.
Your data is stored on secure cloud infrastructure located primarily in the United States. Certain categories of data, including in particular Medical Profile data, may be hosted on dedicated infrastructure located in Germany. In such cases, the data remains processed solely within myoncare Inc.’s authorized service and support chain and subject to applicable contractual, confidentiality, security, access-control, and lawful transfer safeguards.
We implement technical and organizational security measures appropriate to the sensitivity of the data we process, including:
No method of transmission or storage is completely secure. If you believe the security of your account has been compromised, please contact us immediately at dataprotection@myoncare.com.
In the event of a breach of unsecured PHI processed by myoncare Inc. as a Business Associate, myoncare Inc. will notify the applicable Covered Entity and, where applicable, the relevant upstream Business Associate, without unreasonable delay and no later than 60 calendar days after discovery, in accordance with HIPAA and the applicable contractual arrangements.
If an incident involves non-HIPAA personal information or non-HIPAA health data, myoncare Inc. will provide notice to affected individuals and regulators as required by applicable federal or state law, including the FTC Health Breach Notification Rule where applicable.
We retain account and operational data for as long as reasonably necessary to provide the Services, maintain security, comply with legal obligations, resolve disputes, and enforce our agreements.
Where information is maintained as PHI on behalf of your healthcare provider, retention, amendment, restriction, and deletion are governed primarily by the provider’s medical-record retention obligations and applicable HIPAA requirements. Requests concerning such PHI should be directed to the provider.
For self-initiated or non-provider-directed data for which myoncare Inc. acts as controller, we will delete, de-identify, or retain the data in archived or backup form in accordance with applicable law, our retention schedule, security needs, and backup/record-retention processes. De-identified data may be retained for lawful purposes consistent with this Notice.
You may access, update, or correct your account information by logging into your account settings. If you wish to close your account and request deletion of your data, please contact dataprotection@myoncare.com. We will honor such requests subject to applicable legal retention requirements.
You may disconnect any wearable device, health application, or third-party data source at any time through the settings within the App. Disconnection will stop further data import; it will not automatically delete previously imported data.
You may opt out of marketing communications at any time by clicking the unsubscribe link in any promotional email or by contacting us at dataprotection@myoncare.com. You may not opt out of service-related and administrative communications required for the operation of the Services (e.g., security alerts, account notifications, care task reminders if you are enrolled in an active program).
You can manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Services. Where required by law, we will seek your consent before placing non-essential cookies.
Our Services do not currently respond to "Do Not Track" signals from web browsers. However, you may use the cookie controls described above to manage tracking technologies.
To the extent your personal information is subject to the CCPA/CPRA and not otherwise exempt under applicable law, you may have the rights described in this Section. Certain data may be exempt, including PHI regulated by HIPAA and other information exempt under applicable law.
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights:
To exercise any of these rights, please submit a verifiable consumer request to dataprotection@myoncare.com. We will respond within 45 days (or as otherwise required by applicable law). We may need to verify your identity before processing your request.
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states with comprehensive privacy laws may have rights to access, correct, delete, and port their personal data, and to opt out of certain processing activities. To exercise applicable rights, please contact us at dataprotection@myoncare.com.
If you are a Washington resident, or if we process consumer health data subject to similar state consumer health data laws, you may have additional rights with respect to non-HIPAA consumer health data, including rights to confirm/access such data, withdraw consent for collection or sharing, and request deletion. We do not sell consumer health data. We do not use geofencing around healthcare facilities to identify, track, or target individuals based on seeking health care services. To exercise applicable rights, please contact dataprotection@myoncare.com. If we deny your request relating to consumer health data subject to Washington law, you may appeal that decision by contacting us at dataprotection@myoncare.com with the subject line “Washington Consumer Health Data Appeal.” We will review and respond to your appeal within the time required by applicable law. If your appeal is denied, we will provide information about how to contact the Washington Attorney General. Except as expressly disclosed in this Notice, we do not share consumer health data with affiliates.
Your rights with respect to PHI — including the right to access your PHI, request amendments, receive an accounting of disclosures, and request restrictions on use and disclosure — are governed by HIPAA and must be exercised directly with your healthcare provider (the Covered Entity). myoncare Inc. will support your healthcare provider in facilitating the exercise of your HIPAA rights as required under our Business Associate Agreement.
The Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. Users between the ages of 13 and 17 may use the Services only with the consent and involvement of a parent or legal guardian. If you believe we have inadvertently collected personal information from a child under 13, please contact us at dataprotection@myoncare.com and we will promptly delete such information.
This U.S. Privacy Notice is intended primarily for users of the U.S.-operated myoncare Services. If separate international, EU/EEA, or provider-specific privacy terms apply to your use, those supplemental notices will govern to the extent applicable. Additional information regarding international transfers may be provided separately upon request or in a jurisdiction-specific notice.
In limited circumstances, data may also be accessed from outside the United States by authorized persons or entities within myoncare Inc.’s service and support chain, solely where necessary for an authorized operational, maintenance, security, or escalated support purpose and always subject to applicable contractual safeguards and lawful transfer mechanisms.
We may update this Privacy Notice from time to time. When we make material changes, we will notify you by revising the effective date at the top of this Notice and, where appropriate, by providing additional notice (such as an in-app notification or email). We encourage you to review this Notice periodically. Any updated Privacy Notice will apply as of its effective date, except to the extent applicable law requires additional notice or consent.
***
For privacy-related questions, requests, or concerns, please contact: