Privacy Policy

Privacy Notice (website) of Oncare

Welcome to our website and thank you for your interest in our company. We take the protection of your personal data very seriously. We process your data in accordance with the applicable legal provisions for the protection of personal data, in particular the EU General Data Protection Regulation (EU GDPR) and the country-specific laws applicable to us. With the help of this privacy notice, we inform you comprehensively about the processing of your personal data by ONCARE GmbH (hereinafter referred to as "Oncare") when using our website and the rights to which you are entitled.

Personal data is any information that makes it possible to identify a natural person. This includes, in particular, your name, date of birth, address, telephone number, email address and IP address. Data is considered anonymous if no personal reference to the individual/ user can be made.

Responsible body and data protection officer

Postal address:
Balanstrasse 71a
81541 Munich
E | service@myoncare.com

Contact info of the data protection officer
privacy@myoncare.com

Last updated on 23 May 2024.

Your rights as a data subject

We would first like to inform you of your rights as a data subject. These rights are set out in Articles 15 – 22 GDPR, and include:

  • The right of access (Art. 15 GDPR),
  • The right to rectification (Art. 16 GDPR),
  • The right to erasure / right to be forgotten (Art. 17 GDPR),
  • The right to restriction of data processing (Art. 18 GDPR),
  • The right to data portability (Art. 20 GDPR),
  • The right to object to data processing (Art. 21 GDPR).

To exercise these rights, please contact: privacy@myoncare.com. The same applies if you have any questions regarding data processing at our company or when you withdraw your consent. You also have the right of appeal to the relevant data protection supervisory authority.

Right to object

Please note the following with respect to your right to object:
When we process your personal data for the purpose of direct marketing, you have the right to object to this data processing at any time without providing the reasons for such objection. This also applies to profiling insofar as it is associated with direct marketing.
If you object to the processing for direct marketing purposes, we will no longer process your personal data for such purposes. The objection is free of charge and can be made in any form, if possible to: privacy@myoncare.com
Should we process your data to protect legitimate interests, you may object to such processing at any time for reasons that arise from your specific situation; this also applies to profiling based on these provisions.
We will then cease to process your personal information unless we can demonstrate compelling legitimate grounds for processing such information that outweigh your interests, rights and freedoms, or the processing is intended to assert, exercise or defend legal claims.

Purposes and legal bases of data processing

The processing of your personal data complies with the provisions of the EU GDPR and all other applicable data protection regulations. Legal bases for data processing arise in particular from Art. 6 GDPR.
We use your data to initiate business, to fulfil contractual and legal obligations, to conduct the contractual relationship, to offer products and services and to consolidate customer relationships, which may include marketing and direct marketing.
Your consent also constitutes permission to data processing under data privacy law. In this respect, we will inform you of the purposes of data processing and your right of objection. If the consent also relates to the processing of special categories of personal data, we will explicitly notify you in the consent process.
In many cases, service providers assist our specialist departments to fulfil their tasks. The necessary data protection contracts have been concluded with all service providers.

Processing of special categories of personal data within the meaning of Art. 9 (1) GDPR may only take place where necessary on the grounds of legal regulations and there is no reason to assume that your legitimate interests should prevail to the exclusion of processing such data or you have given your consent to the processing of these data according to Art. 9 (2) GDPR.

Google services may transfer data to countries outside the EU/EEA (third country data transfer), e.g. to the USA, as part of the processing for the aforementioned purposes. Countries outside the European Economic Area may not offer a level of data protection comparable to that in Europe. Such countries for which the Commission has not explicitly determined that they provide an adequate level of protection with respect to data privacy are referred to as "unsafe third countries." There is an increased risk that government authorities may access this data. We have no influence on these processing activities.

Data transfers / Disclosure to third parties

We will only transmit your data to third parties within the scope of given statutory provisions or based on consent. In all other cases, information will not be transferred to third parties unless we are obliged to do so owing to mandatory legal regulations (disclosure to external bodies, including the supervisory authorities or law enforcement authorities).

Data recipients / categories of recipients

In our organisation, we ensure that only individuals who are required to process the relevant data to fulfil their contractual and legal obligations are authorised to handle personal data.

Transfers of personal data to third countries

A transfer of data to third countries (outside the European Union or the European Economic Area) shall only take place if required by law or if you have provided your consent for such a transfer.
We transfer your personal data to service providers or group companies outside the European Economic Area as follows: United States of America.
In such cases, compliance with the required level of data protection is ensured by EU standard contractual clauses, the binding corporate data protection regulations of the service provider according to the established data protection contracts.

Period of data storage

We store your data for as long as such is required for the relevant processing purposes. Please note that numerous retention statutory periods require that data must be stored for a specific period of time. This relates in particular to retention obligations for commercial or fiscal purposes (e.g. commercial code, tax code, etc.). The data will be routinely deleted after use unless a further period of retention is required.
We may also retain data if you have given us your permission to do so, or in the event of any legal disputes and we use the evidence within the statutory limitation period, which may be up to 30 years; the standard limitation period is 3 years.

Secure transfer of data

We implement the appropriate technical and organisational security measures to ensure the optimal protection of the data stored by us against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. The security levels are continuously reviewed in collaboration with security experts and adapted to new security standards.
The data exchange to and from our website is encrypted. We provide https as the transmission protocol for our website and always use the latest encryption protocols. When you use the contact form on our website to get in touch with us, the content is sent via https to a secure server of Site Ground, where the data of the form is stored in an encrypted database. Site Ground employees do not have direct access to this data.
It is also possible to use alternative communication channels.

Obligation to provide data

A range of personal data is required to establish, implement and terminate the obligation and the fulfilment of the relevant contractual and legal obligations. The same applies to the use of our website and the various functions we provide.
We have summarised the relevant details in the above point. In some cases, legal regulations require data to be collected or made available. Please note that it will not be possible to process your request or execute the underlying contractual obligation without this information.

Data categories, sources and origin of data

The data we process is defined by the relevant context: it depends on whether, for example, you enter a request on our contact form or if you want to send us an application or submit a complaint.
Please note that we may also provide information at specific points for specific processing situations separately where appropriate, e.g. when downloading our flyer or when making a contact request.

We collect and process the following data when you visit our website:
Your IP address which is immediately hashed by removing the last two digits. The URL and the title of the page you are viewing. The browser (name) you are using Viewport or viewing pane (the size of the browser window)
Your screen resolution. Whether or not you have Java enabled. The language enabled in your browser. For reasons of technical security (in particular to safeguard against attempts to attack our web server), this data is stored in accordance with Article 6 (1) lit f GDPR. Anonymisation takes place immediately by abbreviating the IP address so that no reference is made to the user.

Webflow

The provider is Webflow, Inc, 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter referred to as Webflow). When you visit our website, Webflow collects various log files including your IP addresses. Webflow is a tool for creating and hosting websites. Webflow stores cookies or other recognition technologies that are required to display the page, to provide certain website functions and to ensure security (necessary cookies).
Details can be found in Webflow's privacy policy: https://webflow.com/legal/eu-privacy-policy.

Webflow is used on the basis of Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in displaying our website as reliably as possible. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art.6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find details here: https://webflow.com/legal/eu-privacy-policy.

SendGrid

We use Sendgrid for sending emails. The provider is Sendgrid Inc., 1801 California Street Suite 500, Denver, CO 80202, USA. Sendgrid is a service with which the sending of emails can be organized. Sendgrid is used to send confirmation emails, transaction confirmations and emails with important information regarding existing requests. The data you enter for the purpose of receiving emails is stored on Sendgrid’s servers. When we send email on your behalf through SendGrid, we use an SSL secured connection.
For the purpose of analysis, the e-mails sent with SendGrid contain a so-called “tracking pixel”, which connects to Sendgrid’s servers when the e-mail is opened. By this, it is possible to determine whether an email message has been opened.

Legal basis: The data processing is based on your consent (Art. 6 para. 1 lit. a GDPR). You can revoke this consent at any time. The legality of the data processing operations already carried out remains unaffected by the revocation.

Storage period: The data you provide us for the purpose of receiving emails will be stored by us until you unsubscribe from our services and will be deleted from our servers as well as from the servers of Sendgrid after you unsubscribe.
Please note that your data is usually transmitted by us to a SendGrid server in the USA and stored there. We have concluded a contract with Sendgrid incorporating the EU standard contractual clauses. This ensures that a level of protection comparable to that in the EU exists.
SendGrid (Privacy Policy): https://sendgrid.com/resource/general-data-protection-regulation-2/

Google Fonts

We use Google Fonts provided by Google Inc on our website. The company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for the European area. We have embedded the Google fonts locally, on our web server – not on Google’s servers. This means that there is no connection to Google servers and therefore no data transfer or storage. This is an interactive directory of over 800 fonts that Google provides free of charge. To prevent any information transfer to Google servers, we have downloaded the fonts to our server. In this way, we act in a privacy compliant manner and do not send any data to Google Fonts.

Cookiebot

We use the consent management service Cookiebot, from Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark (Usercentrics). This enables us to obtain and manage the consent of website users for data processing. The processing is necessary to fulfill a legal obligation (Art. 7 para. 1 GDPR) to which we are subject (Art. 6 para. 1 sentence 1 lit. c GDPR). For this purpose, the following data is processed with the help of cookies.
Your IP address (the last three digits are set to '0'). Date and time of consent. Browser information URL from which the consent was sent. An anonymous, random and encrypted key Your consent status of the end user, as proof of consent
The key and consent status are stored in the browser for 12 months using the "CookieConsent" cookie. This retains your cookie preference for subsequent page requests. With the help of the key, your consent can be verified and tracked.

If you enable the "bulk consent" service feature to enable consent for multiple websites through a single end-user consent, the service will additionally store a separate, random, unique ID with your consent. If all of the following criteria are met, this key is stored in the third-party cookie "CookieConsentBulkTicket" in your browser in encrypted form: You activate the bulk consent function in the service configuration. You allow third-party cookies via browser settings. You have deactivated "Do not track" via the browser settings. You accept all or at least certain types of cookies when you give your consent.
The functionality of the website is not guaranteed without the processing.
Usercentrics is the recipient of your personal data and acts as a processor for us.
The processing takes place in the European Union. Further information on objection and removal options vis-à-vis Usercentrics can be found at: https://www.cookiebot.com/de/privacy-policy/
Your personal data will be deleted on an ongoing basis after 12 months or immediately after termination of the contract between us and Usercentrics.
Please note our general information on the deletion and deactivation of cookies above.

Contact form / Contact via email (Article 6 (1) p.1. lit a, b GDPR)

We collect and process the following data as part of a contact request:

  • Name and salutation
  • E-mail address
  • Type of your request
  • Information on your interests and inquiries (your message)
  • Company / organization

A contact form is available on our website which can be used to contact us electronically. If you write to us using the contact form, we will process the data you submitted in the contact form to respond to your queries and requests.
In so doing, we respect the principle of data minimisation and data avoidance, such that you only have to provide the information we require to contact you, which is your name, salutation, email address and the type of your request. Your IP address will also be processed (and hashed immediately) for technical reasons and for legal protection. All other data is voluntary, and additional fields are optional (e.g. to provide a more detailed response to your questions).
If you contact us by email, we will process the personal information provided in the email solely for the purpose of processing your request.

Job Applications

We process the following data as part of a job application you send us:

  • Name and salutation
  • Contact details you provide to us
  • Information on your professional career (CV), qualifications and certificates
  • Information you provide during application interviews and our notes thereof
  • The position you applied for, your salary expectations, you expected entry date and in exceptional cases your piece of identification
  • Any other information you provide to us during the application process.

We collect and process the following data in the context of job applications:
Last name, first name (maybe also title)
Address
Contact details (telephone number, e-mail address)
If applicable, contact data in electronic communication solutions (e.g. Skye, MS Teams) that you submit to us
Qualification data (CV, professional qualifications, work experience)
In addition, we use data that we have permissibly obtained from publicly accessible directories (e.g. professional networks).

Thank you for your interest in working for Oncare GmbH. We are aware of the importance of your data and process the personal data you provide us only for the purpose of effective and correct processing and for contacting you as part of the job application process. The data will not be transferred to third parties without your consent.
You will be asked to provide personal information. We observe the principle of data economy and data avoidance by only requiring you to provide us with data that we need to review your job application documents, such as your CV, or that we are legally obligated to collect. To protect the security and confidentiality of your data, we implement appropriate security measures. In addition, we recommend that you send us your application documents in “zipped” form (e.g. 7z or .zip) with password protection by e-mail. Afterwards, please give us the password by telephone. Alternatively, you can also send us your application documents by post mail. We store your data for the above-mentioned purposes until the application process has been completed and related deadlines have expired – at the latest six months after receipt of a decision.
If your job application is unfortunately unsuccessful, your data will be deleted by us within six months of rejection. If your application is successful, your application documents will be included on the HR files and will only be deleted after you have left the company and statutory retention periods have expired.

We are supported by our service provider JOIN Solutions GmbH (hereinafter “Join”) in carrying out the application process. For this purpose, we use a widget of the provider JOIN, Schönhauser Allee 36, 10435 Berlin, Germany. If you apply to a job, your application data will be processed by Join on our behalf as instructed. We have concluded the required data protection agreement with Join for data processing on our behalf, in which Join is obligated to process the data in accordance with the principles of GDPR and in accordance with our instructions.
Join widget: We use a Join widget to display current job offers. Cookies are set by the Join widget. The legal basis for the processing is Art. 6 (1) p. 1 lit. a GDPR.

Calendly.com

On our website, we offer the option of (pre)booking appointments via the Calendly tool. By clicking on the "Book your free consultation now" button, you will be redirected to the website calendly.com of the company Calendly LLC, BB&T Tower, 271 17th St NW, Atlanta, GA 30363, USA (hereinafter referred to as "Calendly"). When making an appointment, it is generally necessary to provide personal data; please refer to the form to be completed to find out what this is. When booking an appointment via Calendly, your data entered on the Calendly website will be forwarded to us by Calendly and stored and processed by us in order to carry out the appointment. The legal basis for this is Art. 6 para. 1 sentence 1 lit. b GDPR. With regard to the processing of your data by Calendly itself, we refer you to Calendly's privacy policy, available at: https://calendly.com/pages/privacy.

It cannot be ruled out that your data will be transferred to the USA and thus to an insecure third country. You can find more information on this here: https://calendly.com/pages/security. Calendly's terms of use, which we agreed to when we registered with Calendly, also contain the following data processing addendum: https://calendly.com/pages/dpa with which Calendly promises you additional protection with regard to data transfer to the USA in order to comply with the GDPR requirements. There is currently neither an EU adequacy decision nor any other suitable guarantees for the USA. The protection of your data cannot be guaranteed in the USA.
There is currently no level of data protection in the USA that is equivalent to that in the EU. Therefore, the transfer is associated with corresponding risks. In particular, there are no guarantees that your transferred data will not be accessed by government agencies. For example, it cannot be ruled out that US authorities may access your data on the basis of Section 702 of the Foreign Intelligence Surveillance Act (FISA for short) and/or on the basis of the so-called CLOUD Act (Clarifying Lawful Overseas Use of Data Act). In this context, we would like to expressly point out that, as an EU citizen, you have no effective legal protection against the processing of your data by US authorities. If you book an appointment via Calendly, you do so in full knowledge of these risks, which you thereby consciously accept.

Google reCAPTCHA

We use "Google reCAPTCHA" (hereinafter referred to as "reCAPTCHA") on our websites. It is also integrated as standard in Calendly. The provider is Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). The purpose of reCAPTCHA is to check whether the data input on our websites (e.g. in a contact form) is made by a human or by an automated program. For this purpose, reCAPTCHA analyzes the behavior of the website visitor based on various characteristics. This analysis begins automatically as soon as the website visitor enters the website. For the analysis, reCAPTCHA evaluates various information (e.g. IP address, time spent on the website by the website visitor or mouse movements made by the user). The data collected during the analysis is forwarded to Google.
The reCAPTCHA analyses run completely in the background. Website visitors are not informed that an analysis is taking place. reCAPTCHA is only loaded after you have agreed to our essential cookies. Data processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in protecting its website from abusive automated spying and SPAM.
Further information about Google reCAPTCHA and Google's privacy policy can be found at the following links: https://www.google.com/intl/de/policies/privacy/ and https://www.google.com/recaptcha/intro/android.html.

Links to AI services:

Our website contains links to external AI services provided by third parties: ChatGPT (OpenAI), Perplexity, Gemini (Google), Grok (xAI), and Claude (Anthropic). When you click on one of these links, you leave our website and connection data (in particular your IP address and other technical information) is transmitted to the respective provider. In addition, the prompt text provided by us is transmitted as part of the URL. Further processing of your data is the responsibility of the respective provider; their privacy policy applies. Please do not enter any personal or confidential data in the AI services. We do not integrate any AI services on our website and do not transmit any data to these providers without your click.

Automated decisions in individual cases

We do not use purely automated processing to make decisions.

Cookies

Our website uses “cookies” at various locations, which serve to make our offer more user-friendly, effective and secure. Cookies are small text files that are placed on your computer and stored by your browser (locally on your hard disk). Cookies enable us to analyse how users use our websites so we can design the website content in accordance with the visitor’s needs. Cookies also allow us to measure the effectiveness of a particular advertisement and, for example, to place it based on the user’s interests.
When you first visit our website, a pop-up (CookiePro) opens from which you can give your consent to the use of categories of cookies which are described below as well as in the CookiePro pop-up itself.
The following categories of cookies are used on our website:

Necessary cookies: These cookies are necessary for the website to function and cannot be switched off in our systems. These cookies include for example the ones used by CookiePro (OneTrust) to maintain cookies based on your consent. You can set your browser to block or alert you about these cookies, but some parts of the site will then not work. These cookies do not store any personally identifiable information.

Performance cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site and will not be able to monitor its performance.

Targeting cookies: These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Most of the cookies we use are “session cookies”, which will be automatically deleted after your visit. Persistent cookies are automatically deleted from your computer when their validity period (maximum 14 months) has expired, or you delete them yourself prior to expiry.
In order to revoke your consent to the use of cookies (except for strictly necessary cookies which are always enabled), you can navigate to the footer of the website and deactivate categories of cookies in the CookiePro pop-up via the link ‘Cookies Settings’.

Furthermore, cookies are stored on the user’s computer which then transmits them to us. As a user, you therefore exercise full control over the use of cookies. You can change the settings in your Internet browser to disable or restrict the sending of cookies. In addition, cookies that have already been saved on your computer can be deleted at any time via an Internet browser or other software programs. All this is possible in all the current Internet browsers.
Please note: If you deactivate the placing of cookies on your device, you may not be able to access all our website functions in certain circumstances.

Web tracking (Article 6 (1) p. 1 lit a EU GDPR)

Google Analytics
Based on your consent (Art. 6 (1) lit a EU GDPR) we use Google Analytics, a web analysis service of Google LLC (“Google”). Google uses cookies. The information generated by the cookie about the use of the website by the user is usually transferred to a Google server in the USA and stored there.
Google will use this information on our behalf to evaluate the use of our online offer by users, to compile reports on the activities within this online offer and to provide us with further services associated with the use of this online offer and the use of the Internet. The processed data can be used to create pseudonymous user profiles of the users.
We only use Google Analytics with activated IP anonymisation. This means that the IP address of users is shortened by Google within member states of the European Union or in other states that are parties to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there.
The IP address transmitted by the user’s browser is not merged with other data from Google. Users can prevent the storage of cookies by adjusting their browser software accordingly; users can also prevent the collection of data generated by the cookie and related to their use of the online offer to Google and the processing of this data by Google as described in section ‘Cookies’ above.
Further information on the use of data by Google, setting and objection options, can be found in the privacy policy of Google and in the settings for the display of advertising by Google.

The personal data of users will be deleted or made anonymous after 12 months.


YouTube-Plugin
Our website uses YouTube plugins, YouTube is operated by Google. The operator is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. When you visit one of our pages equipped with a YouTube plugin, a connection to YouTube’s servers is established. This informs the YouTube server which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to assign your surf behavior directly to your personal profile. You can prevent this by logging out of your YouTube account. For more information on the handling of user data, please see YouTube’s privacy policy at: https://www.google.de/intl/de/policies/privacy


Vimeo
We may have integrated videos from the provider Vimeo LLC, headquartered at 555 West 18th Street, New York, New York 10011. Some of our Internet pages contain videos from Vimeo. When you access such a page on our website, a connection to the Vimeo servers is established. This tells the Vimeo server which of our web pages you have visited. If you are logged in as a member of Vimeo, Vimeo assigns this information to your personal user account. When you click on the start button of a video, this information can also be assigned to an existing user account. You can prevent this assignment by logging out of your Vimeo user account before using our website and deleting the corresponding cookies from Vimeo. We use this service within our online offer on the basis of a legitimate interest - in the analysis, optimization and economic operation of our online offer. The legal basis is Art. 6 para. 1 lit. f.) GDPR.
Further information on data processing and information on data protection by Vimeo can be found at vimeo.com/privacy.
In addition, Vimeo calls up the Google Analytics tracker via an iFrame in which the video is called up. This is Vimeo's own tracking, to which we have no access. You can prevent tracking by Google Analytics by using the deactivation tools that Google offers for some Internet browsers. Users can also prevent Google from collecting the data generated by Google Analytics and relating to their use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link: tools.google.com/dlpage/gaoptout


LinkedIn Insight Tag
Our website uses the conversion tool “LinkedIn Insight Tag” provided by LinkedIn Ireland Unlimited Company. The tool creates a cookie in your web browser that allows the collection of, among other things, the following data: IP address, device and browser properties, and page events (e.g. page views). LinkedIn itself also collects log files (URL, referrer URL, IP address, device and browser properties and time of access). IP addresses are shortened or (if used to reach LinkedIn members across devices) pseudonymized. The direct identifiers of LinkedIn members are deleted by LinkedIn after seven days. The remaining pseudonymized data are deleted within 180 days. The data collected by LinkedIn cannot be assigned to specific individuals by us. LinkedIn stores the personal data of the website visitors on its servers in the USA and uses it for its own advertising measures. You can find more detailed information on data protection at LinkedIn in the LinkedIn privacy notices.
The use of LinkedIn Insight is based on Art. 6 para. 1 p. 1 lit. f GDPR.

Privacy policy / Notes on data protection in social media

Oncare GmbH maintains presences in the social medias, especially on Xing and LinkedIn. In case that we have control over the processing of your data, we will ensure that applicable data protection regulations. Below you find the most important information on data protection laws regarding our social media presences.

Name and address of the controller
The following companies are responsible (as controller) for our social media presences, beside Oncare GmbH, according to the EU General Data Protection Regulation (GDPR) and other data protection provisions:
LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland)
Xing (New Work SE, Dammtorstraße 30, 20354 Hamburg, Deutschland)
However, you use these platforms and their functions on your own responsibility, especially the use of interactive functions (e.g. commenting, sharing, rating). We would also like to point out that your data may be processed outside the European Union.

Purposes and legal basis
We maintain the social media presences in order to communicate with users and to inform them about our products and services. Furthermore, we collect data for statistical purposes in order to develop and optimize our content and to design our products/services more attractive. The data required for this purpose (e.g. total number of page views, page activity and data provided by visitors, interactions) is processed by the social networks and made available to us. We have no influence on the generation and presentation.
In addition, your personal data will be processed by the social media providers for market research and advertising purposes. It is possible that, for example, based on your usage behavior and your interests, usage profiles are created. With the consequence that ads are placed inside and outside platforms that match your interests. Cookies are usually stored on your computer for this purpose. Data that are not collected directly on your end devices may also be stored in your usage profiles. Storage and analysis also takes place across devices; this applies in particular, but not exclusively, if you are registered as a member and logged in your account.
We do not collect or process any further personal data.
The processing of your personal data by Oncare GmbH is based on our legitimate interests to get appropriate information and reach sufficient communication pursuant to Art. 6 (1) p. 1 lit. f. GDPR. If you are asked for consent to data processing, i.e. if you declare your consent by confirming a button or similar (opt-in), the legal basis of the processing is Art. 6 (1) p. 1 lit. a., Art. 7 GDPR.

Your rights / objection option
If you are a member of a social network and do not want the network to collect data about you by our presence and link it to your social media membership data with the respective network, you must
log out of the social network before visiting our social media site,
delete the cookies present on the device and
close and restart your browser.
After logging in again, however, you will once more be recognizable to the network as a specific user. For a detailed description of the processing and the possibilities to object (opt-out), we refer to the following information:

LinkedIn
Privacy Statement: https://www.linkedin.com/legal/privacy-policy
Opt-Out: https://www.linkedin.com/legal/cookie-policy and http://www.youronlinechoices.com

You have the following rights regarding the processing of your personal data:
The right of access, right to rectification, right to erasure / right to be forgotten, right to restriction of data processing, right to data portability, right to object to data processing and the right to file a complaint about unlawful processing of your personal data with the competent data protection authority. As Oncare does not have full access to your personal data, you should contact the social media provider directly if you wish to assert your claim, because your provider has access to the personal data of the users and can take appropriate measures and provide information. If you still need help, we support you.
Please contact privacy@myoncare.com

Online offers for children

Persons under the age of 16 may not submit personal data to us or give a declaration of consent without the authorisation of their legal guardian. We encourage parents and guardians to actively participate in the online activities and interests of their children.

Links to other providers

Our website also contains clearly identifiable links to the Internet sites of other companies. Although we provide links to websites of other providers, we have no influence on their content, and no guarantee or liability can therefore be assumed for such. The content of these pages is always the responsibility of the respective provider or operator of the pages.
The linked pages were checked at the time of linking for potential legal violations and identifiable infringements. No illegal content was identified at the time of linking. However, a permanent content control of the linked pages is not reasonable without concrete evidence of an infringement and, upon notification of a violation of rights, such links will be promptly removed.

myoncare Inc.

Privacy Notice for Healthcare Providers and Platform Users
(Clinical and Administrative Staff)
Effective Date: April 15, 2026

NOTE: This Privacy Notice also applies to healthcare providers, clinical staff, administrative personnel, and other authorized users who access the myoncare Platform through an authorized contractual, organizational, or service-delivery framework rather than under a direct agreement with myoncare Inc. In such cases, references in this Privacy Notice to “your organization,” the applicable “Provider Agreement,” or the applicable “Business Associate Agreement” shall be understood to refer to the contractual and compliance framework through which access to the Platform is provided. Except for this clarification of applicability, this Privacy Notice applies unchanged.

Scope Limitation & Who This Notice Applies To

This Privacy Notice

  • governs only personal and professional information of Provider Users. It is not a HIPAA Notice of Privacy Practices and does not create or modify any rights of patients with respect to Protected Health Information (“PHI”). Patient PHI processed through the myoncare Platform is governed by the applicable Covered Entity’s Notice of Privacy Practices and by the Business Associate Agreement between that Covered Entity and myoncare Inc.
  • applies to physicians, clinicians, clinical staff, administrative personnel, practice managers, and other authorized users who access the myoncare Platform in a professional capacity (collectively, "Provider Users" or "you"). This Notice covers how myoncare Inc. collects, uses, and protects your personal and professional information in connection with your use of the myoncare Web Platform and associated services. It should be read together with your myoncare Provider Agreement and, where applicable, the Business Associate Agreement executed between your organization and myoncare Inc. This Notice is not a HIPAA Notice of Privacy Practices and does not govern patient rights with respect to PHI.

I.  Who We Are

myoncare Inc. ("myoncare," "we," "us," or "our") is a U.S.-based digital health technology company that provides and operates the myoncare Platform in the United States for healthcare organizations, physicians, clinics, and other healthcare providers.

The myoncare Platform is operated by myoncare Inc. in the United States. myoncare Inc. remains the sole U.S.-facing provider of the Platform and the sole contractual counterparty for U.S. healthcare providers under the applicable Provider Agreement.

The myoncare Platform includes the following key components:

  • myoncare Web Platform — a web-based professional portal for use by healthcare providers and clinical/administrative staff;
  • myoncare Mobile Application ("App") and Progressive Web Application ("PWA") — patient-facing mobile and browser applications licensed to healthcare providers for patient deployment;
  • Pathway and Caretask Management — tools for creating, configuring, and assigning structured clinical care programs ("Pathways") comprising individual care tasks ("Caretasks");
  • Digital Patient Monitoring — real-time and asynchronous monitoring of patient-submitted data, including vital sign data, symptom reports, wearable data, and questionnaire responses;
  • Clinical Scoring and Alerting — automated scoring algorithms that categorize and prioritize patient data to support clinical decision-making;
  • Reporting and Case Documentation — structured report generation based on patient-entered and provider-entered data;
  • Secure Communication — in-platform messaging and status update capabilities between provider teams and patients.
  • Video Consultation Service — real-time, encrypted video and audio consultations between Provider Users and their patients, facilitated through a self-hosted Jitsi Meet instance operated on behalf of myoncare Inc. (the "Video Consultation Service"). The Video Consultation Service does not involve a commercially operated third-party SaaS platform; it is deployed and controlled by myoncare Inc. on designated hosting infrastructure.

II.  HIPAA, BAA, and Your Obligations as a Covered Entity

myoncare Inc. is a HIPAA Business Associate — not a Covered Entity

myoncare Inc. does not provide clinical care and does not function as a HIPAA Covered Entity. Where your organization (as a Covered Entity or Business Associate) uses the myoncare Platform to process Protected Health Information (PHI) of your patients, myoncare Inc. acts as a Business Associate as defined under 45 C.F.R. § 160.103. This relationship must be formalized by a Business Associate Agreement (BAA) executed between your organization and myoncare Inc. before any PHI is entered into or processed through the Platform.

Your obligations as the Covered Entity or upstream Business Associate include:

  • Issuing a Notice of Privacy Practices (NPP) to your patients that accurately describes how their PHI may be disclosed to and processed by myoncare Inc. as your Business Associate;
  • Obtaining any required patient authorization for uses of PHI beyond treatment, payment, and healthcare operations;
  • Ensuring that your use of the myoncare Platform to process patient PHI is consistent with your HIPAA Privacy Policies and the terms of your BAA with myoncare Inc.;
  • Informing your patients of any breach of their unsecured PHI in accordance with the HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D), relying on timely notification from myoncare Inc.;
  • Being responsible for obtaining any required HIPAA authorizations and for entering into any required BAAs with third parties engaged directly by your organization outside the myoncare subcontractor chain. myoncare Inc. is responsible for entering into and maintaining HIPAA-compliant subcontractor Business Associate Agreements, where required, with subcontractors and support providers engaged directly or indirectly within myoncare Inc.’s authorized platform support chain that create, receive, maintain, or transmit PHI on myoncare Inc.’s behalf.
  • Ensuring, prior to initiating any Video Consultation session with a patient, that: (i) you have obtained all telehealth-specific informed consent required under applicable federal and state law, including any consent to the use of electronic audio/video communication technology; (ii) you have assessed and comply with all applicable state telehealth licensure and practice-location requirements in the jurisdiction where the patient is located at the time of the session; and (iii) where session recording is enabled, you have obtained all applicable patient consents required under federal law and the recording-consent laws of the relevant state (including, where applicable, all-party or two-party consent requirements). myoncare Inc. does not obtain telehealth informed consent, recording consent, or licensure compliance verification on your behalf.

Your organization remains with the HIPAA-responsible party (Covered Entity) with respect to patient PHI. myoncare Inc. will process PHI only as permitted under the BAA and will not use PHI for purposes beyond those permitted by HIPAA and the BAA.

III.  Personal and Professional Information We Collect About Provider Users

As a Provider User of the myoncare Platform, myoncare Inc. collects the following categories of information about you:

A. Registration and Account Information

  • Full name, professional title, and job function;
  • Medical license number, NPI number (where applicable), specialty, and practice area;
  • Employer/organization name and affiliated practice or institution;
  • Business email address, phone number, and mailing address;
  • Account credentials (username, password, multi-factor authentication data);
  • Tax identification information and bank account details (where applicable for provider payment or reimbursement features).

B. Professional Credentials and Verification Data

To verify your qualifications and maintain platform integrity, we may collect:

  • Medical license status, issue date, expiration, and issuing state(s);
  • Specialty board certifications;
  • DEA registration (where relevant to platform features);
  • Malpractice insurance details (where applicable);
  • Educational background and years of professional experience;

C. Platform Usage and Activity Data

  • Login timestamps, session duration, and device and browser information;
  • Pages, screens, features, and functions accessed within the Platform;
  • Pathway and Caretask configurations created, edited, or assigned;
  • Patient monitoring activities: notes entered, alerts reviewed, reports generated;
  • In-platform messages and communications transmitted through the Platform;
  • Audit trail and access log entries associated with your account.
  • Video Consultation session metadata: session identifiers, session initiation and termination timestamps, connection duration, connection quality indicators (e.g., packet loss, bandwidth utilization, jitter), and participant connection status logs, associated with Video Consultation sessions initiated through your account;
  • Provider-side connection and device data generated during Video Consultation sessions: IP address, device type and operating system, browser or application version, audio/video codec information, camera and microphone configuration, and network connection characteristics captured at the time of your connection to the Video Consultation infrastructure.

D. Communications and Support Data

  • Content of support requests, technical queries, and correspondence with myoncare Inc.;
  • Training and onboarding completion records;
  • Consent and agreement acknowledgment records.

E. Video Consultation Data (where the Video Consultation feature is activated for your organization)

Where your organization has enabled the Video Consultation feature, myoncare Inc. additionally processes the following data relating to you as a Provider User in connection with your participation in Video Consultation sessions:

  • Video Consultation session metadata: session identifiers, session initiation and termination timestamps, connection duration, connection quality indicators (e.g., packet loss, bandwidth utilization, jitter), and participant connection status logs, associated with Video Consultation sessions initiated through your account;
  • Provider-side connection and device data generated during Video Consultation sessions: IP address, device type and operating system, browser or application version, audio/video codec information, camera and microphone configuration, and network connection characteristics captured at the time of your connection to the Video Consultation infrastructure.
  • Appointment and scheduling metadata associated with Video Consultation sessions (where scheduling functionality is used through the Platform), including the Provider User's name and identifier, the session type, and the scheduled date and time. The identity of the patient associated with any appointment constitutes PHI and is governed by the applicable Business Associate Agreement.

IV.  How We Use Provider User Information

A. Platform Provisioning and Account Management

  • Registering and authenticating your account;
  • Enabling access to the myoncare Web Platform and applicable features;
  • Verifying your professional credentials and maintaining platform integrity;
  • Processing payments or reimbursements where applicable;
  • Sending administrative communications regarding your account, including security alerts, system updates, and service notifications.

B. Platform Features and Clinical Workflow Support

  • Enabling the creation, configuration, and management of Pathways and Caretasks;
  • Displaying patient monitoring data, alert notifications, and clinical scoring results (automated scoring, alerting, and reporting functionalities are intended solely to support provider workflows and do not diagnose, prescribe, or direct treatment. All clinical judgment and patient care decisions remain solely with the applicable healthcare provider);
  • Supporting the generation of structured patient reports and case documentation;
  • Facilitating secure in-platform communication with patients and care team members;
  • Providing access to the myoncare Pathway Library and any provider-facing analytics dashboards.
  • Enabling and facilitating real-time Video Consultation sessions between Provider Users and their patients through the Video Consultation Service, including session connection establishment, connection quality monitoring, session logging, and — where expressly activated by your organization — session recording; and maintaining session metadata and access logs for audit, security, HIPAA compliance, and platform operations purposes.

C. Compliance, Audit, and Security

  • Maintaining audit logs of access to patient data to support HIPAA compliance and security monitoring;
  • Investigating and responding to security incidents, unauthorized access, or misuse of the Platform;
  • Enforcing the terms of the Provider Agreement and BAA;
  • Complying with applicable federal, state, and professional regulatory obligations.

D. Platform Improvement

myoncare Inc. may analyze Platform usage patterns and clinical workflow information in aggregated and/or de-identified form to develop, improve, and optimize Platform features, Pathway libraries, and clinical tools.

myoncare Inc. may also use aggregated and/or de-identified information to conduct research and development relating to new digital health products, features, and applications.

myoncare Inc. will not use patient PHI or Provider User personal information to train general-purpose artificial intelligence models, except where such use is (i) expressly authorized in writing by the applicable customer, (ii) permitted under the applicable Business Associate Agreement, or (iii) based solely on information that has been de-identified in accordance with applicable law. To the extent any such information is derived from PHI, de-identification will be performed in compliance with HIPAA where HIPAA applies.

V.  How We Share Provider User Information

We do not sell Provider User information to third parties. We may share your information in the following circumstances:

A. Within Your Organization

If you are assigned to a multi-user organizational account, designated administrators within your organization may have access to account-level information about users in their organization, including account registration data and usage logs, to the extent permitted under your Provider Agreement.

B. Technology and Service Providers

We engage trusted third-party service providers, licensors, infrastructure providers, and technical support providers within myoncare Inc.’s authorized service and support chain to support Platform operations, including cloud infrastructure and hosting, identity verification, communications infrastructure, security services, and technical support. These parties may access only the data necessary to perform their contracted functions and are bound by appropriate contractual, confidentiality, security, and access-control obligations

In connection with the Video Consultation Service, audio and video stream data and session metadata are processed through a self-hosted Jitsi Meet instance deployed on behalf of myoncare Inc.; this infrastructure is operated by myoncare Inc. on designated cloud hosting infrastructure and is subject to appropriate data processing and confidentiality obligations. The Video Consultation infrastructure does not involve disclosure of session content to any commercially operated third-party video conferencing service for that party's own purposes.

C. Legal and Regulatory Authorities

We may disclose Provider User information to regulators, law enforcement authorities, courts, or other government bodies where required by applicable law, court order, or legal process, or where we reasonably believe disclosure is necessary to protect the safety of any person or enforce our legal rights.

D. Business Transfers

In connection with a corporate transaction (merger, acquisition, sale of assets), your information may be transferred to the relevant successor entity, subject to continued protection consistent with this Privacy Notice.

VI.  Data Controller and Processor Roles

Understanding the allocation of data responsibilities is essential for regulatory compliance. The following table describes the roles of the parties with respect to different categories of data processed through the myoncare Platform:

‍Data Category

Controller

Notes

Patient PHI (provider-directed use)

Healthcare Provider (CE)

myoncare Inc. acts as Business Associate (HIPAA) / Data Processor (contractual)

Provider User account and professional data

myoncare Inc.

Governed by this Provider Privacy Notice and Provider Agreement

Platform operational / technical  data

myoncare Inc.

IT security, fraud prevention,  system stability

Video Consultation session data — PHIcomponent (patient content in audio/video streams; patient-identifiablesession records; recordings where enabled)

Healthcare Provider (CE)

myoncare Inc. acts as BusinessAssociate (HIPAA / BAA); Video Consultation infrastructure operates astechnical sub-processor on myoncare Inc.'s behalf

Video Consultation session data — Provider  User component (provider's own audio/video feed; provider-side connection  metadata; session logs attributed to provider account)

myoncare Inc.

Governed by this Privacy Notice;  Video Consultation infrastructure operates as technical sub-processor on  myoncare Inc.'s behalf and does not process this data for independent  purposes

Note: Certain persons or entities engaged within myoncare Inc.’s authorized service and support chain may process limited data solely on behalf of myoncare Inc. in accordance with contractual, confidentiality, security, access-control, and lawful transfer obligations. Such parties do not independently act as controllers of Provider User data or as Covered Entities with respect to patient PHI solely by virtue of providing licensed technology, infrastructure, or technical support.

VII.  Authorized Service and Support Chain Disclosure

myoncare Inc. may use licensors, technology suppliers, infrastructure providers, subcontractors, and limited technical support providers within its authorized service and support chain in connection with the operation, hosting, maintenance, security, support, and remediation of the Platform.

Any access by such parties to operational data, Provider User data, or patient PHI shall be limited to what is strictly necessary for the specific service or support function, shall occur solely on behalf of myoncare Inc., and shall be subject to applicable contractual, confidentiality, security, access-control, and lawful transfer safeguards. No such party markets or provides the Platform in its own name to U.S. healthcare providers through this Privacy Notice, enters into contracts with U.S. healthcare providers or patients through this Privacy Notice, provides medical care, acts as a Covered Entity solely by virtue of such role, or independently determines the purposes or means of processing Provider User information or patient PHI solely by virtue of being engaged within myoncare Inc.’s authorized service and support chain.

VIII.  Data Security

myoncare Inc. implements technical and organizational security measures designed to protect the confidentiality, integrity, and availability of all data processed through the Platform, including Provider User personal data and patient PHI. Our security program includes:

  • Transport Layer Security (TLS 1.2 or higher) for all data in transit;
  • Encryption at rest for all PHI and sensitive personal data;
  • Role-based access control (RBAC) and principle of least privilege for all Platform access;
  • Multi-factor authentication (MFA) for Provider User accounts;
  • Comprehensive audit logging of all access to patient data;
  • Regular security risk assessments and vulnerability management;
  • Security incident response and breach notification procedures;
  • Employee and contractor security training and confidentiality obligations.

With respect to the Video Consultation Service specifically, the following additional security measures apply:

  • Audio and video streams transmitted through the Video Consultation infrastructure are encrypted in transit using WebRTC protocols with Secure Real-time Transport Protocol (SRTP) encryption; all signaling traffic is encrypted using TLS 1.2 or higher;
  • The self-hosted Jitsi Meet infrastructure is configured to transmit audio and video streams in real time without persistent storage of stream content by default; audio/video data is not retained on the Video Consultation infrastructure after session termination unless session recording has been expressly enabled.
  • Where session recording is enabled, recordings are stored on encrypted infrastructure (AES-256 or equivalent at rest) in the data region designated in your Provider Agreement, with access restricted to authorized personnel on a need-to-know basis and subject to audit logging;
  • Administrative access to the Video Consultation infrastructure is restricted to authorized myoncare Inc. technical personnel, governed by role-based access controls, and logged for security monitoring purposes;
  • The Video Consultation infrastructure undergoes regular security patching, vulnerability assessment, and configuration review as part of myoncare Inc.'s security program.

In the event of a security incident affecting Provider User personal information, myoncare Inc. will provide any notices required by applicable law. If an incident involves PHI processed by myoncare Inc. as a Business Associate, myoncare Inc. will notify the applicable Covered Entity or upstream Business Associate in accordance with HIPAA and the BAA. Notice to affected patients will be provided by the Covered Entity unless otherwise required by law or expressly delegated by contract.

IX.  Data Retention

We retain Provider User personal and professional information for the duration of the Provider Agreement and for a reasonable period thereafter, as necessary to:

  • comply with applicable legal and regulatory retention obligations;
  • resolve disputes or enforce our agreements;
  • support audit and compliance activities.

Audit logs relating to access to patient PHI are retained in accordance with HIPAA requirements. Account data will be deleted, de-identified, or retained in archived form in accordance with customer instructions, applicable law, contractual obligations, security requirements, and backup/record-retention processes.

X.  Your Privacy Rights as a Provider User

A. Access and Correction

You may access and update your account and professional information by logging into your account settings. For corrections to information that cannot be amended through self-service, please contact dataprotection@myoncare.com.

B. Data Portability

Upon written request, we will provide you with a copy of your personal information in a commonly used, machine-readable format, to the extent technically feasible and as required by applicable law.

C. Account Deletion

Upon termination of your Provider Agreement, your account will be deactivated, and personal information will be deleted or anonymized in accordance with our retention schedule, subject to applicable legal obligations. To request early deletion, contact dataprotection@myoncare.com.

D. California and State Privacy Rights

Provider Users who are California residents may have rights under the CCPA/CPRA with respect to personal information that is subject to the CCPA/CPRA and not otherwise exempt. Certain information may fall outside the CCPA/CPRA, including HIPAA-regulated PHI and publicly available information such as certain professional license information. myoncare Inc. will evaluate and respond to verifiable requests as required by applicable law.

E. HIPAA-Specific Requests

Requests relating to PHI (e.g., access to patient records, amendments, or restrictions) must be directed to your organization as the HIPAA Covered Entity. myoncare Inc. will support your organization in facilitating such requests in accordance with our BAA obligations.

XI.  International Users and Data Transfers

The myoncare Platform is operated from the United States. Provider Users who access the Platform from outside the United States should be aware that their data may be transferred to, stored in, and processed in the United States.

For Provider Users or healthcare organizations in the European Union or EEA: to the extent that personal data of EU/EEA-based Provider Users is processed by myoncare Inc. and the GDPR applies, such processing is subject to the terms of the EU Data Processing Agreement (DPA) incorporated into the Provider Agreement. Data transfers from the EU/EEA to the United States are conducted pursuant to Standard Contractual Clauses (Module 1: Controller to Controller, where applicable, or Module 2: Controller to Processor) and a Transfer Impact Assessment as required.

In limited circumstances, data may also be accessed from outside the United States by authorized persons or entities within myoncare Inc.’s service and support chain, solely where necessary for an authorized operational, maintenance, security, or escalated support purpose and always subject to applicable contractual safeguards and lawful transfer mechanisms

In addition, certain categories of data, including in particular Medical Profile data, may be hosted on dedicated infrastructure located in Germany. In such cases, the data remains processed solely within myoncare Inc.’s authorized service and support chain and subject to applicable contractual, confidentiality, security, and lawful transfer safeguards.

XII.  Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, applicable law, or Platform functionality. When we make material changes, we will notify affected Provider Users by email and/or by posting a notice within the Platform and will revise the effective date at the top of this Notice. Continued use of the Platform after the effective date of any changes constitutes acceptance of the updated Notice.

XIII.  Contact Us

For privacy-related questions, requests, or concerns, please contact:

Company

myoncare Inc.

Data Privacy Contact

dataprotection@myoncare.com

Address

120 Wall Street, 20th Floor, New York, NY 10005, United StatesData Category

***

myoncare Inc.

Privacy Notice for Patients and App Users
Effective Date: April 15, 2026

Important Notice – Please read carefully

Scope Clarification. This Privacy Notice is not a HIPAA Notice of Privacy Practices. Where myoncare Inc. processes Protected Health Information (“PHI”) on behalf of your healthcare provider, your healthcare provider remains the HIPAA Covered Entity, and your rights with respect to such PHI are governed by your provider’s Notice of Privacy Practices. This Privacy Notice primarily governs information that myoncare Inc. processes in its own capacity, including account, platform, support, and self-initiated or non-provider-directed use data.

I.  Who We Are

myoncare Inc. (“myoncare,” “we,” “us,” or “our”) is a U.S.-based digital health technology company that provides and operates the myoncare Platform and related patient-facing Services in the United States in its own name and on its own behalf. The Services enable provider-sponsored digital care programs, patient monitoring, structured digital communications, and, where offered, self-initiated health and wellness features.

myoncare Inc. operates these Services in the United States. myoncare Inc. remains the sole U.S.-facing provider of the Services and the sole contractual counterparty for U.S. users in relation to this Privacy Notice and the U.S. Services.

myoncare Inc. is not a healthcare provider, does not provide medical care, and does not make clinical decisions. The myoncare Platform includes:

  • The myoncare Web Platform — a professional portal for use by healthcare providers;
  • The myoncare Mobile Application ("App") — a mobile application for iOS and Android for use by patients and app users;
  • The myoncare Progressive Web Application ("PWA") — a browser-based application with app-like functionality that requires no download.

This Privacy Notice applies topatients, caregivers, and other end users of the myoncare App and PWA(collectively, "you" or "User"). A separate Privacy Noticeapplies to healthcare providers using the myoncare Web Platform.

II.  HIPAA Notice and Protected Health Information

myoncare Inc. is a HIPAA Business Associate — not a Covered Entity

We do not provide clinical care and do not bill insurance on our own behalf.

Where your healthcare provider has contracted with myoncare Inc. to use the myoncare Platform as part of your care, myoncare Inc. may process your Protected Health Information ("PHI") as a Business Associate of your provider. In that capacity, we process PHI solely as permitted under our Business Associate Agreement with your provider and applicable HIPAA regulations (45 C.F.R. Parts 160 and 164).

Your HIPAA rights are governed by your provider's Notice of Privacy Practices
Your rights with respect to your PHI — including the right to access, amend, and receive an accounting of disclosures of your PHI — are described in the Notice of Privacy Practices issued by your treating healthcare provider (the HIPAA Covered Entity). Please contact your healthcare provider directly for a copy of their Notice of Privacy Practices.

This Privacy Notice governs personal information that myoncare Inc. collects and processes in its own capacity as an independent data controller, including account data, platform usage data, and data processed in connection with self-initiated (non-provider-directed) use of the Services. Except as expressly stated in this Notice, no third party, including any upstream licensor, software licensor, or technical support subcontractor, independently determines the purposes or means of processing your personal information through the Services solely by virtue of licensing technology to or supporting myoncare Inc.

III. Roles and Responsibility Allocation

Depending on how you use the Services, different parties may be responsible for different categories of data:

A. Provider-Directed Care Use.

If you use the Services as part of care delivered by your healthcare provider, your healthcare provider remains the HIPAA Covered Entity and is solely responsible for medical care, clinical judgment, and the Notice of Privacy Practices applicable to your PHI. In this context, myoncare Inc. acts solely as a Business Associate or service provider to the extent permitted by applicable law and contract.

B. Self-Initiated or Non-Provider-Directed Use.

If you use self-initiated, wellness, prevention, or other non-provider-directed features, myoncare Inc. acts as the independent controller of the personal information and health data you choose to provide for those features.

C. Platform Operational Data.

myoncare Inc. acts as the independent controller of account, authentication, security, fraud-prevention, support, and operational platform data.

Except as expressly stated in this Notice, no third party, including any software licensor or technical support subcontractor, independently determines the purposes or means of processing your personal information through the Services.

IV.  Information We Collect

A. Information You Provide Directly

When you register for or use the Services, we may collect:

  • Account and contact data: full name, email address, phone number, mailing address, date of birth, and account credentials (username and password);
  • Demographic data: gender, language preference, and time zone;
  • Insurance and coverage information: insurance type and policy number (where applicable);
  • Health and medical information ("Health Data") that you voluntarily enter, including:
    • symptoms, health status, and general health information;
    • medication details and dosage information;
    • responses to questionnaires, assessments, and clinical scales ("Caretasks");
    • documents and images you upload, such as lab reports, physician letters, or medical findings;
    • any other health-related content you choose to enter into the Services;
  • Activity and vital sign data from connected wearables, health apps (such as Apple Health or Google Fit), medical devices, or connected laboratory services (only if you activate such connections);
  • Payment and transaction data (if you purchase content or services through the Platform): payment status and transaction identifiers. Full payment card details are processed by our third-party payment processor and are not stored by myoncare Inc.;
  • Communications and support data: the content of messages you send through the Platform or to our support team, technical log data, and consent documentation.

B. Information We Collect Automatically

When you access or use the Services, we automatically collect certain technical and usage data, including:

  • Device and technical data: IP address, device type and operating system, browser type and version, mobile device identifiers, app version, and device settings;
  • Usage and activity data: pages, screens, and features accessed; session duration; navigation paths; links clicked; features used; and time and date of access;
  • Crash and error diagnostics: when the App or PWA encounters a malfunction, we may collect limited diagnostic information reasonably necessary to identify, investigate, and remediate the issue, such as error codes, device state, and service telemetry. Where technically unavoidable, narrowly scoped fragments of active session data may be captured solely for debugging purposes; wherever feasible, such data will be masked, minimized, or pseudonymized before review. Access to diagnostic data is restricted to authorized personnel and, where escalated, approved technical subcontractors acting solely on behalf of myoncare Inc. under strict access controls.
  • Location data: approximate location derived from IP address; precise GPS location only if you expressly grant permission through your device settings.

We and our service providers use cookies, pixel tags, and similar tracking technologies to automatically collect some of this information. For details on our use of cookies and your choices, see Section VIII (Your Choices and Rights) below.

C. Information Received from Your Healthcare Provider

Where your healthcare provider uses the myoncare Platform as part of your care or treatment, we may receive information about you from your provider, including:

  • your enrollment or invitation to the Platform;
  • clinical assignments and care pathway configurations ("Pathways") assigned to you by your provider;
  • clinical notes, reports, or data shared by your provider for the purpose of your care program.

Data received in this context is processed pursuant to our Business Associate Agreement with your provider. Your provider remains the HIPAA Covered Entity and the controller of your PHI in this context.

D. Information from Connected Third-Party Services

If you choose to connect third-party health applications, wearable devices, or laboratory services to the myoncare Platform, we will receive data from those sources as authorized by you. Such connections are entirely optional and can be deactivated at any time. The data practices of third-party services are governed by their own privacy policies.

E. Video Consultation and Telehealth Data

If your healthcare provider offers video consultation, telehealth, or virtual care interactions through the Services, additional categories of information may be processed in connection with those features.

Categories of Data Processed

When you participate in a video consultation or telehealth session, the following categories of information may be processed:

  • Real-time audio and video data transmitted between you and your healthcare provider;
  • Participant identifiers (such as your name, account ID, or session ID);
  • Session metadata, including date, time, duration, and session identifiers;
  • Technical connection data, including IP address, device type, operating system, browser information, and network performance data (e.g., latency, packet loss, bandwidth);
  • Limited diagnostic and connection-quality data necessary to establish, maintain, and troubleshoot the session.

No Access to Communication Content

Video and audio communications are transmitted using secure encryption protocols. myoncare Inc. does not access, monitor, or store the content of video or audio communications except where:

  • necessary for the provision of the Service (e.g., real-time transmission), or
  • explicitly enabled by your healthcare provider and authorized by you (e.g., session recording, where permitted).

No Recording by Default

Video consultation sessions are not recorded by myoncare Inc. by default.
If recording functionality is enabled by your healthcare provider, such recording will occur only:

  • in accordance with applicable law, and
  • subject to any required consents obtained by your healthcare provider.

myoncare Inc. does not independently obtain telehealth or recording consent on behalf of providers.

Role Allocation

  • Your healthcare provider remains solely responsible for:
    • clinical care,
    • telehealth compliance,
    • informed consent, and
    • applicable medical and regulatory obligations.
  • myoncare Inc. acts solely as a technology provider and, where applicable, as a Business Associate processing data on behalf of your healthcare provider.

V.  How We Use Your Information

A. Service Delivery and Platform Operation

  • Creating and managing your account and enabling secure login;
  • Providing the digital health monitoring and engagement Services, including displaying your Caretask responses, tracking your assigned Pathways, and generating structured reports;
  • Processing and displaying data from connected wearables, health apps, and devices you have authorized;
  • Enabling communication features within the Platform (e.g., secure messaging with your provider's team, where available);
  • Enabling real-time audio and video communication between you and your healthcare provider, including session establishment, connection management, and technical support;
  • Facilitating the sharing of status updates, progress reports, and monitoring data with your healthcare provider, where you are enrolled in a provider-directed care program and such sharing is necessary for your care or authorized by you;
  • Sending you notifications, reminders, care task alerts, and administrative messages related to the Services;
  • Processing payments for Platform subscriptions or content you purchase.

B. Platform Improvement, Analytics, and Research

myoncare Inc. may use aggregated and/or de-identified information to maintain, evaluate, improve, and enhance the Services, including Pathways, Caretasks, reporting functions, and digital support tools.

myoncare Inc. may also use aggregated and/or de-identified information for internal research and development, quality improvement, benchmarking, and product development.

myoncare Inc. will not use identifiable Health Data or PHI to train general-purpose artificial intelligence or machine-learning models. Where data is derived from PHI, any de-identification will be performed in accordance with HIPAA where HIPAA applies. Any use of identifiable non-PHI health data for an optional, customer-specific or user-facing feature, if offered at all, will occur only pursuant to a separate, explicit, informed authorization that is not bundled into acceptance of these Services or this Privacy Notice

C. Legal Compliance, Safety, and Fraud Prevention

  • Complying with applicable federal, state, and local laws and regulations;
  • Responding to lawful requests, subpoenas, court orders, or government authority inquiries;
  • Detecting, investigating, and preventing fraudulent, unauthorized, or illegal activity;
  • Protecting the rights, safety, and interests of myoncare Inc., our users, and the public.

D. With Your Consent

In some cases, we will specifically request your consent before using your information for a particular purpose, such as for certain research activities, marketing communications, or where required by applicable law. You may withdraw any consent you have given at any time, though withdrawal will not affect uses already made prior to withdrawal.

VI.  How We Share Your Information

We do not sell your personal information to third parties. We do not share your personal information for third-party marketing purposes. We may share your information in the following circumstances:

A. With Your Healthcare Provider

If you are enrolled in a provider-directed program, we may disclose to your actively connected healthcare provider the information reasonably necessary to support your care, monitoring, care coordination, and the provider-directed functionality of the Services, consistent with applicable law and any authorization you have provided.

If you use self-initiated or non-provider-directed features, we will not disclose your health data to a healthcare provider unless you affirmatively request, authorize, or direct such disclosure.

B. Technology and Service Providers

We share data with trusted third-party service providers, licensors, infrastructure providers, and technical support providers within myoncare Inc.’s authorized service and support chain who support our operations, including cloud hosting and infrastructure, payment processing, technical support, data analytics, communications and notification services, cybersecurity, and business intelligence. These parties may access only the data necessary to perform their contracted functions and are bound by appropriate contractual, confidentiality, security, and access-control obligations. In connection with video consultation or telehealth features, certain infrastructure providers may process real-time communication data and related session metadata strictly for the purpose of enabling and maintaining the communication session and subject to contractual confidentiality, security, and data protection obligations.

C. Authorized Service and Support Chain Disclosure

myoncare Inc. may use licensors, software suppliers, infrastructure providers, subcontractors, and limited technical support providers within its authorized service and support chain in connection with the operation, hosting, maintenance, security, support, and remediation of the Services. Any access by such parties to operational data, account data, personal information, or PHI shall be limited to what is strictly necessary for the specific service or support function, shall occur solely on behalf of myoncare Inc., and shall be subject to applicable contractual, confidentiality, security, access-control, and lawful transfer safeguards. No such party markets or provides the Services in its own name to U.S. users through this Privacy Notice, enters into contracts with patients or app users through this Privacy Notice, provides medical care, acts as a Covered Entity solely by virtue of such role, or independently determines the purposes or means of processing your personal information or PHI solely by virtue of being engaged within myoncare Inc.’s authorized service and support chain.

D. Business Associates (HIPAA Context)

To the extent we process PHI on behalf of a Covered Entity healthcare provider, we may engage sub-processors (Sub-Business Associates), directly or indirectly within myoncare Inc.’s authorized platform support chain, to assist in delivering our services. Such sub-processors are required to enter into Business Associate Agreements where required and are bound by applicable HIPAA obligations.

E. Law Enforcement and Legal Obligations

We may disclose your information where required by applicable law, court order, or legal process, or where we reasonably believe disclosure is necessary to comply with a legal obligation, protect the safety of any person, or protect the rights and property of myoncare Inc. We will make reasonable efforts to notify you of such requests unless prohibited by law.

F. Business Transfers

In connection with a merger, acquisition, sale of assets, financing, or other corporate transaction, your information may be transferred to the relevant successor entity, subject to continued protection consistent with this Privacy Notice.

G. With Your Consent or at Your Direction

We may share your information for any purpose with your prior explicit consent or at your express direction.

VII.  Automated Processing, Pathways, and Clinical Scoring

The myoncare Platform uses automated scoring algorithms and clinical scales to categorize and prioritize the health data and Caretask responses you enter. These automated processes support the display of information to your healthcare provider and may result in:

  • prioritized alerts or flags visible to your provider indicating that a response threshold has been met;
  • automated suggestions for content, care tasks, or next steps within a Pathway, delivered to you through the App.

These automated processes do not constitute an independent medical diagnosis or treatment decision. They are designed exclusively to support your healthcare provider in structuring and prioritizing information. Your provider retains full clinical responsibility for all treatment decisions.

Where automated processing may produce legal or similarly significant effects, you have the right to request human review. Please contact us at dataprotection@myoncare.com for further information.

VIII.  Data Storage, Security, and Retention

A. Storage and Security

Your data is stored on secure cloud infrastructure located primarily in the United States. Certain categories of data, including in particular Medical Profile data, may be hosted on dedicated infrastructure located in Germany. In such cases, the data remains processed solely within myoncare Inc.’s authorized service and support chain and subject to applicable contractual, confidentiality, security, access-control, and lawful transfer safeguards.

We implement technical and organizational security measures appropriate to the sensitivity of the data we process, including:

  • transport encryption (TLS 1.2 or higher) for data in transit;
  • encryption at rest for PHI and other sensitive personal information;
  • role-based access controls, least-privilege access, and periodic access reviews;
  • case-based approval and audit logging for elevated support access.
  • secure real-time communication protocols (including encryption in transit and session-level access controls) for video and telehealth features;

No method of transmission or storage is completely secure. If you believe the security of your account has been compromised, please contact us immediately at dataprotection@myoncare.com.

B. Breach Notification

In the event of a breach of unsecured PHI processed by myoncare Inc. as a Business Associate, myoncare Inc. will notify the applicable Covered Entity and, where applicable, the relevant upstream Business Associate, without unreasonable delay and no later than 60 calendar days after discovery, in accordance with HIPAA and the applicable contractual arrangements.

If an incident involves non-HIPAA personal information or non-HIPAA health data, myoncare Inc. will provide notice to affected individuals and regulators as required by applicable federal or state law, including the FTC Health Breach Notification Rule where applicable.

C. Retention

We retain account and operational data for as long as reasonably necessary to provide the Services, maintain security, comply with legal obligations, resolve disputes, and enforce our agreements.

Where information is maintained as PHI on behalf of your healthcare provider, retention, amendment, restriction, and deletion are governed primarily by the provider’s medical-record retention obligations and applicable HIPAA requirements. Requests concerning such PHI should be directed to the provider.

For self-initiated or non-provider-directed data for which myoncare Inc. acts as controller, we will delete, de-identify, or retain the data in archived or backup form in accordance with applicable law, our retention schedule, security needs, and backup/record-retention processes. De-identified data may be retained for lawful purposes consistent with this Notice.

IX.  Your Choices and Privacy Rights

A. Account Information

You may access, update, or correct your account information by logging into your account settings. If you wish to close your account and request deletion of your data, please contact dataprotection@myoncare.com. We will honor such requests subject to applicable legal retention requirements.

B. Connected Devices and Third-Party Services

You may disconnect any wearable device, health application, or third-party data source at any time through the settings within the App. Disconnection will stop further data import; it will not automatically delete previously imported data.

C. Communications

You may opt out of marketing communications at any time by clicking the unsubscribe link in any promotional email or by contacting us at dataprotection@myoncare.com. You may not opt out of service-related and administrative communications required for the operation of the Services (e.g., security alerts, account notifications, care task reminders if you are enrolled in an active program).

D. Cookies and Tracking Technologies

You can manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Services. Where required by law, we will seek your consent before placing non-essential cookies.

E. Do Not Track

Our Services do not currently respond to "Do Not Track" signals from web browsers. However, you may use the cookie controls described above to manage tracking technologies.

F. California Residents — CCPA/CPRA Rights

To the extent your personal information is subject to the CCPA/CPRA and not otherwise exempt under applicable law, you may have the rights described in this Section. Certain data may be exempt, including PHI regulated by HIPAA and other information exempt under applicable law.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights:

Right

Description

Right to Know

Request disclosure of the categories and specific pieces of personal information collected about you, the purposes of collection, and the categories of third parties with whom we share it.

Right to Delete

Request deletion of personal information we have collected, subject to certain exceptions (e.g., legal retention obligations, completing transactions, security).

Right to Correct

Request correction of inaccurate personal information.

Right to Opt Out of Sale/Sharing

We do not sell or share your personal information for cross-context behavioral advertising.

Right to Limit Use of Sensitive PI

Request that we limit the use and disclosure of sensitive personal information, including health data, to purposes authorized under CPRA.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise any of these rights, please submit a verifiable consumer request to dataprotection@myoncare.com. We will respond within 45 days (or as otherwise required by applicable law). We may need to verify your identity before processing your request.

G. Virginia, Colorado, Connecticut, and Other State Privacy Rights

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states with comprehensive privacy laws may have rights to access, correct, delete, and port their personal data, and to opt out of certain processing activities. To exercise applicable rights, please contact us at dataprotection@myoncare.com.

H. Washington Consumer Health Data

If you are a Washington resident, or if we process consumer health data subject to similar state consumer health data laws, you may have additional rights with respect to non-HIPAA consumer health data, including rights to confirm/access such data, withdraw consent for collection or sharing, and request deletion. We do not sell consumer health data. We do not use geofencing around healthcare facilities to identify, track, or target individuals based on seeking health care services. To exercise applicable rights, please contact dataprotection@myoncare.com. If we deny your request relating to consumer health data subject to Washington law, you may appeal that decision by contacting us at dataprotection@myoncare.com with the subject line “Washington Consumer Health Data Appeal.” We will review and respond to your appeal within the time required by applicable law. If your appeal is denied, we will provide information about how to contact the Washington Attorney General. Except as expressly disclosed in this Notice, we do not share consumer health data with affiliates.

I. HIPAA Rights (PHI)

Your rights with respect to PHI — including the right to access your PHI, request amendments, receive an accounting of disclosures, and request restrictions on use and disclosure — are governed by HIPAA and must be exercised directly with your healthcare provider (the Covered Entity). myoncare Inc. will support your healthcare provider in facilitating the exercise of your HIPAA rights as required under our Business Associate Agreement.

X.  Children's Privacy

The Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. Users between the ages of 13 and 17 may use the Services only with the consent and involvement of a parent or legal guardian. If you believe we have inadvertently collected personal information from a child under 13, please contact us at dataprotection@myoncare.com and we will promptly delete such information.

XI.  Note to International Users

This U.S. Privacy Notice is intended primarily for users of the U.S.-operated myoncare Services. If separate international, EU/EEA, or provider-specific privacy terms apply to your use, those supplemental notices will govern to the extent applicable. Additional information regarding international transfers may be provided separately upon request or in a jurisdiction-specific notice.

In limited circumstances, data may also be accessed from outside the United States by authorized persons or entities within myoncare Inc.’s service and support chain, solely where necessary for an authorized operational, maintenance, security, or escalated support purpose and always subject to applicable contractual safeguards and lawful transfer mechanisms.

XII.  Changes to This Privacy Notice

We may update this Privacy Notice from time to time. When we make material changes, we will notify you by revising the effective date at the top of this Notice and, where appropriate, by providing additional notice (such as an in-app notification or email). We encourage you to review this Notice periodically. Any updated Privacy Notice will apply as of its effective date, except to the extent applicable law requires additional notice or consent.

XIII.  Contact Us

If you have questions, concerns, or requests regarding this Privacy Notice or our privacy practices, please contact us:

Company

myoncare Inc.

Address

120 Wall Street, 20th Floor, New York, NY 10005, United StatesData Category

Email

dataprotection@myoncare.com

For EU/EEA data protection inquiries, please also refer to the contact details for the EU Representative (if applicable) listed at https://www.myoncare.com/privacy-policy.

***

Ask AI about myoncare: