Oncera

Some states, including Washington, Nevada, and Connecticut, require companies that handle health information outside the traditional health care system to publish a policy in a particular form: what consumer health data they collect, why, where it comes from, who it goes to, and how you can exercise your rights over it. This is that policy. We apply it to everyone who uses Oncera, wherever you live, because the protections in it are the ones we believe everyone should have.

This policy adds to our Privacy Policy, which describes everything Oncera holds about you. Where the two overlap, they say the same thing.

1. Who we are

Oncera Health LLC, 13492 N Hwy 183 #120-191, Austin, TX 78750. Email hello@oncerahealth.com.

Oncera is a survivorship support platform for adults who have completed active treatment for breast cancer. It is not a hospital, clinic, doctor's office, or health plan. Oncera Health LLC is HIPAA compliant, and we apply the safeguards of the HIPAA Privacy and Security Rules to your consumer health data.

2. What consumer health data means

Consumer health data is information that identifies you and says something about your physical or mental health, past, present, or future. It includes symptoms, conditions, treatments, medicines, health measurements, and the fact that you use a health related service at all. It also includes anything worked out from other information that says something about your health.

Almost everything you enter into Oncera is consumer health data, because Oncera is built for people who have completed breast cancer treatment and everything in it is about how you are doing.

3. What consumer health data we collect, and why

Everything below comes from you. Oncera collects no health information from anyone else.

What we collect	Why
Your confirmation that you have completed active cancer treatment.	To confirm that Oncera is built for you, and to keep a record that we asked.
Your answers to Oncera's questionnaire about your habits, routines, sleep, food and drink, alcohol and nicotine, physical activity, emotional wellbeing, treatment history, hormone therapy, medicines, symptoms, intimacy, and health measurements you choose to share, such as weight, blood pressure, or results your doctor has given you.	To choose the daily actions and information Oncera shows you, to leave out actions that are not suitable for what you have reported, and to calculate your Oncera Health Index, which reflects what you have shared and is shown only to you.
Your daily check ins: how you rate your sleep, energy, mood, and pain, and the symptoms you log from Oncera's list, each with its date.	To show you your own entries over time and patterns in them, to choose actions that fit how you are doing, and to show you a safety message when fixed rules, written and reviewed in advance, say that something you logged may be worth raising with a doctor or your care team.
The medicines you list in the medicine tracker, as you type them, the schedule you set, the doses you mark as taken, and any reminder times you choose.	To keep your medicine record for you, to include it on your Doctor Prep page if you want, and to send you reminders if you ask for them. Reminders never contain the medicine's name.
Your notes and the questions you write for your care team.	To put them on your Doctor Prep page.
What Oncera works out from your answers: your Oncera Health Index and the value for each area, internal tags describing what you reported, and patterns Oncera has noticed in what you logged.	To choose what to show you. These describe what you told us. They are not a diagnosis, a risk level, or a judgment about your health, and they are never shown to anyone but you.
The safety messages Oncera showed you, when, what you had logged, and when you acknowledged them.	To be able to show what you were told and when.
Your Doctor Prep pages and any share links you create.	So that you can bring your own record to an appointment and share it with whoever you choose.
If you are in a research study, the fact that you are, and an optional answer about race or ethnicity.	As the study consent form you signed describes.

How we use it, in one sentence: to run Oncera for you, and for nothing else without asking you first. We do not use your consumer health data for advertising, we do not sell it, and we do not use it to make decisions about your care or anyone else's.

4. Where it comes from

You. Every piece of consumer health data Oncera holds was entered by you in the app, or was calculated from what you entered. We do not receive information from your doctor, hospital, pharmacy, insurer, employer, a wearable, or any other source.

5. Who we share it with

We share consumer health data with no third parties. We have no affiliates.

Service providers work on our behalf and may hold or handle your information only on our instructions and under contract. They are not third parties in the sense these laws use, and they may not use your information for their own purposes. They are:

a cloud hosting provider, whose servers in the United States store Oncera;
a network security service that protects the website and the app;
an email delivery provider;
a text message delivery provider;
the notification services of your phone's maker, for phone notifications;
the engineering and support firm that builds and maintains Oncera for us.

None of our emails, texts, or notifications contains any consumer health data. A notification only ever says that you have a new message in Oncera.

You may share your own information. When you create a Doctor Prep share link and give it to someone, they can open that page until you cancel the link or delete your account. A share link does not expire on its own. Creating the link is your decision and your consent, and you can cancel it at any time from the Doctor Prep page. Oncera never sends a Doctor Prep page to anyone.

If you are in a research study, the study team receives what the study consent form you signed says they receive, and nothing more.

If a court order or a law with proper authority requires us to disclose information, we will comply, and we will tell you unless the law forbids it.

If Oncera Health LLC is sold or merges with another company, your information would pass to the new owner under this policy and our Privacy Policy, and we would tell you first. That is not a sale of your data.

6. What we never do

We never sell consumer health data, and we never have. Selling it would require your separate, signed authorization, and we will not ask for one.

We never share consumer health data with advertisers or use it for advertising of any kind.

We never tell an employer, hospital, clinic, nonprofit, or other organization that gave you access to Oncera whether you signed up, or anything you record.

We never collect your precise location, and we never use geofencing.

We never let anyone review what you record as part of your care. No one is notified when you log something.

7. Your rights

You have the right to:

Know whether we collect, share, or sell your consumer health data, and see what we hold. Because we share it with no third parties and no affiliates, and never sell it, the answer to the second part is always the same. On request we will also tell you which service providers hold it on our behalf and how to contact them.

Get a copy. Download my data, on the Data & Privacy page in Settings, gives you everything we hold about you as a ZIP of spreadsheet files, once every 24 hours.

Withdraw your consent. You can turn off email, text messages, phone notifications, and medicine reminders on the Notifications tab in Settings. You can cancel any Doctor Prep share link from the Doctor Prep page. You can withdraw your consent to Oncera collecting and using your health information at all by deleting your account, because Oncera cannot give you a plan without it.

Delete. Delete my account, on the Data & Privacy page, removes your account and everything in it after a seven day waiting period. After that, your account details, answers, check ins, plan, medicines, notes, Doctor Prep pages, and share links are permanently deleted, we tell our email and text message providers to remove you, and copies in our backups are removed within six months. Three kinds of records stay, with your name, email, phone number, and account reference removed so that they no longer identify you: that you agreed to our terms and the other agreements in Oncera, that safety messages were shown to you, and that messages were sent to you. Our Privacy Policy explains why.

Appeal. If we refuse a request, we will tell you why. Reply and tell us you disagree, and we will look at it again and reply within one month. If you still disagree, you can contact the attorney general of your state.

How to ask. Everything above is available in Settings without asking anyone. For anything else, email hello@oncerahealth.com from the email address on your account. We may ask you to confirm it is you. We reply within one month. If a request is complicated and we need more time, we will tell you why and when to expect an answer.

We will never treat you differently, charge you, or reduce what Oncera offers you because you used any of these rights.

8. Changes

When we change this policy, the date at the top changes, and if the change matters we will tell you in the app before it takes effect.

9. How to reach us