Privacy Policy | OYA Health

This Privacy Policy ("Privacy Policy") describes the data protection practices of OYA Wellness LLC, a Florida limited liability company, and its affiliates (collectively, "Company," "OYA," "we," "our," or "us"), including when you visit any OYA website that links to this Privacy Policy (including https://oya.health), use any affiliated mobile applications that link to or contain this Privacy Policy, receive in-person services at OYA Partner Locations (as defined in our Terms of Use) or through OYA Service Providers (as defined in our Terms of Use), or otherwise provide data to OYA. We refer to the websites, mobile applications, software platforms, in-person services, virtual services, and all other services facilitated by or provided directly by OYA together in this Privacy Policy as the "Services." This Privacy Policy is incorporated into our Terms of Use. All capitalized terms used in this Privacy Policy but not defined herein have the meanings assigned to them in the Terms of Use.

PLEASE READ THIS PRIVACY POLICY CAREFULLY TO UNDERSTAND HOW WE HANDLE YOUR INFORMATION. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, PLEASE DO NOT USE THE SERVICES.

We use your personal data to provide and improve the Services. By using the Services, you agree to the collection and use of information in accordance with this Privacy Policy. This Privacy Policy may change from time to time (see "Revisions to Our Privacy Policy" below). Any changes to this Privacy Policy will be effective immediately upon posting the updated Privacy Policy unless otherwise stated or as required by applicable law. Your continued use of the Services after we make changes is deemed to be acceptance of those changes to the fullest extent permitted by applicable law, so please check the Privacy Policy periodically for updates.

For purposes of this Privacy Policy, OYA is responsible for deciding how and why your Personal Information (as defined below) is collected, used, and disclosed in connection with the Services. If you have questions about this Privacy Policy, or wish to exercise any privacy rights described here, please see the "Contacting Us" section below.

The Services are not intended for persons under the age of 18 ("Minors" or "Children"). Minors are not authorized to use the Services or to provide any information through the Services. We do not solicit or knowingly collect information from Minors, and if we become aware of any such information being collected, we will take immediate action to delete it. We do not knowingly "sell" or "share" personal information of consumers under 18 years of age, as those terms are defined under applicable state privacy laws. Should you become aware that we have collected personal information from a Minor, please see the "Contacting Us" section below.

1. Scope of OYA Privacy Policy

This Privacy Policy applies to all aspects of our Services as well as to information we may collect offline, or through any other means in connection with your use of our Services. The Services may link to or incorporate websites or content hosted and served by others over which we have no control, such as third-party websites, online properties, platforms, social media, or systems, which are each governed by the privacy policy and business practices of the third party. You understand and agree that OYA is not responsible for the security, privacy, or business practices of any third party.

We obtain information about you through the means discussed below when you use the Services. Please note that we need certain types of information so that we can provide the Services to you. If you do not provide us with such information, or ask us to delete it, you may no longer be able to access or use part or all of our Services.

This Privacy Policy applies to Personal Information that we collect when you:

access or use the Services;
interact with us via email, text, or other electronic messages;
participate in our marketing, surveys, events, or promotions;
interact with our advertising and applications on third-party websites and services that link to this Privacy Policy;
or otherwise provide data to OYA.

This Privacy Policy does not apply to:

information collected by us offline or through any other websites or services that do not link to this Privacy Policy; or
information collected by any unaffiliated third party, including through applications or content that may link to or be accessible through the Services.

2. Your Information

2.1. The Information We Collect and the Sources of Such Information

We collect several types of information from and about users of the Services (collectively, "Personal Information"). The specific types of Personal Information we collect will depend upon the Services you use, how you use them, and the information you choose to provide. Personal Information includes but is not limited to the following categories:

Identifiers, such as name, date of birth, address, postcode, email address, and telephone number;
Billing information, such as shipping address, credit or debit card number, verification number, and expiration date, collected by our payment processors on our behalf;
Commercial information, such as information about purchases or other transactions with us;
Customer service information, such as information about your customer service and maintenance interactions with us;
Demographic information such as your gender, age, marital status, and similar information;
Information you provide in connection with Services, such as videos, lab results, photos, and signatures;
General geolocation information, such as city, state, or zip code;
Information about others, such as if you provide a family or friend's email address or contact information;
User-generated content you post in public online forums on our Services;
Wellness-related information, such as images, weight, height, gender, pre-existing health conditions, medical history, prescriptions, mental health, genetics, treatment options, lifestyle information, wellness goals, nutritional information, supplement usage, detoxification protocols, bio-optimization metrics, cognitive assessments, mind wellness evaluations, test results, and information collected during coaching sessions;
Internet or other electronic network activity information, including IP addresses, browser types, browser language, operating system, device IDs, referring and exit pages and URLs, and cookie identifiers;
Sensitive Personal Information that may qualify as "protected health information" ("PHI") as defined under HIPAA when provided in connection with Services facilitated through affiliated providers or Service Providers;
Information about your internet connection, the equipment you use to access the Services, and usage details; and/or
any other information you choose to directly provide to us in connection with your use of the Services.

We collect this information directly from you when you provide it to us.

2.2. Information You Provide

The information we collect on or through our Services may include:

information that you provide by filling in forms provided through our Services, including at the time of registering, purchasing products, subscribing to Services, posting material, or requesting further services;
details of transactions you carry out through our Services and of the fulfillment of your orders;
records and copies of your correspondence or communication that you submit to us via forms or email;
your participation in research, surveys, contests, and sweepstakes;
requests for customer support and technical assistance;
where explicit consent has been provided, information about your physical or mental health or condition; and
any other information you choose to directly provide to us in connection with your use of the Services.

You also may provide information to be published or displayed ("posted") on public areas of the website, or transmitted to other users of the Services or third parties (collectively, "User Contributions"). Your User Contributions are posted on and transmitted to others at your own risk. Although we take measures to ensure the security of our Services, please be aware that no security measures are perfect or impenetrable. We cannot control the actions of other users of the Services with whom you may choose to share your User Contributions.

2.3. Information We Collect Through Automatic Data Collection Technologies

When you use our Services and websites, we collect and analyze information such as your IP address, browser types, browser language, operating system, device IDs, referring and exit pages and URLs, and other information about your equipment, browsing actions, and patterns, including:

details of your visits to our websites, including traffic data, general geolocation information, logs, and other communication data;
information about your computer and internet connection, including your IP address, operating system, and browser type;
data collected through our Services by third party analytics and advertising companies.

The information we collect automatically helps us improve our Services and deliver a better, more personalized service, including by enabling us to:

estimate our Services usage statistics and usage patterns;
store information about your preferences, allowing us to customize our Services;
improve the Services we provide to our users;
recognize you when you return to engage with our Services.

The technologies we use for automatic data collection may include:

Cookies (or browser cookies). A cookie is a small file placed on your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of our Services.
Flash Cookies. Certain features of our Services may use local stored objects (or Flash cookies) to collect and store information about your preferences and navigation.
Web Beacons. Pages of the website and our emails may contain small electronic files known as web beacons that permit the Company to count users who have visited those pages or opened an email and for other related website statistics.

2.4. Third-Party Use of Cookies and Other Tracking Technologies

Some content or applications, including advertisements, on our website are served by third parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use our website. We do not control these third parties' tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible Service Provider directly.

2.5. Healthcare Information

OYA is not a healthcare provider, and therefore may not have to comply with HIPAA and other state laws regarding specific protections for medical records information. However, OYA may provide you with access to clinical care, tests, and prescriptions through our Service Providers, or pharmacies, each of which may be subject to HIPAA. If those groups rely on OYA to support their delivery of services to you, and they disclose your healthcare information to us for that purpose, we will only use and disclose such information in accordance with the applicable HIPAA Privacy Rule.

3. How We Use Your Information

We collect and use information that you provide to us directly, that we collect automatically through your use of the Services, and that we receive from other sources, for the following purposes:

Provide the Services. To operate, maintain, and provide the Services, including account and product registration, administration of your account, processing your orders and requests for wellness services, processing transactions and fulfilling orders.
Account Administration and Customer Support. To create and manage your account, communicate with you about your account and the Services, respond to your questions, provide customer support and technical assistance, and respond to your inquiries and requests.
Improve and Develop the Services. To analyze usage and performance, develop new features or products, improve the user experience, and enhance our Services through the use of artificial intelligence technologies.
Marketing and Communications. To send you newsletters, offers, surveys, and other marketing communications, and to personalize the content and ads you see (where permitted by law).
Security and Fraud Prevention. To protect the Services, our company, and others, including detecting, preventing, and responding to security incidents, abuse, and fraud.
Legal and Compliance. To comply with legal obligations, enforce our terms and policies, and protect our rights, privacy, safety, and property.
Wellness Services. To provide your Personal Information to Service Providers and others involved in your health and wellness plan or with vendors, agents, or subcontractors who assist us in providing wellness services.
With Your Consent. For any other purpose that you consent to at the time of collection.
Identity Verification. To verify your identity and administer your account, including processing your payments and fulfilling your orders.

We may also use your information to contact you about our own and third-parties' goods and services that may be of interest to you. If you do not want us to use your information in this way, please contact us at weare@oya.health.

4. Retention and Transfer of Information

4.1. Retention of Your Personal Information and Data

We retain Personal Information for as long as reasonably necessary to achieve the purposes described in this Privacy Policy, including to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. The criteria we use to determine retention periods include: the nature of the information, the purpose for which it is processed, applicable legal requirements, and our legitimate business needs.

4.2. Transfer of Your Personal Data

Your Personal Information and data is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ.

5. Security of Your Personal Data

The security of your Personal Information and data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information and data, we cannot guarantee its absolute security. We also use third-party service providers, including providers of artificial intelligence technologies, to process Personal Information on our behalf, subject to contractual obligations that require them to implement appropriate security measures and only process Personal Information in accordance with our instructions.

6. Disclosure of Your Information

6.1. Information We May Disclose

We may disclose Personal Information that we collect or you provide as described in this Privacy Policy:

to our subsidiaries and affiliates;
to contractors, Service Providers, and other third parties we use to support our business (including providers of artificial intelligence technologies) who may be bound by contractual obligations to keep Personal Information confidential;
to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of the Company's assets;
to third parties to market their products or services to you if you have consented to or not opted out of these disclosures;
to fulfill the purpose for which you provide it;
for any other purpose disclosed by us when you provide the information;
with your consent;
to service providers who assist in collecting usage information through automated means.

We may also disclose your Personal Information or PHI:

to comply with any court order, law, or legal process, including to respond to any government or regulatory request;
to enforce or apply our Terms of Use and other agreements, including for billing and collection purposes;
in connection with healthcare operations-related activities such as communications about your wellness plan, case management, care coordination, and communications pursuant to a valid authorization by you;
if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of OYA, our customers, or others.

Other uses and disclosures of your PHI or Personal Information will be made only with your written authorization. If you give OYA written authorization to use or disclose your PHI or Personal Information for a purpose that is not described in this Privacy Policy, then you may revoke it in writing at any time unless OYA has taken action in reliance on your authorization. De-identified information is not PHI and therefore is not subject to the same protections as PHI under the HIPAA Privacy Rule.

6.2. Choices About How We Use and Disclose Your Information

We strive to provide you with choices regarding the Personal Information you provide to us:

Tracking Technologies and Advertising. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, some parts of this site may be inaccessible or not function properly.
"Do Not Track" Signals. Because there is not yet a common understanding of how to interpret DNT signals, our Services do not currently respond to DNT signals.
We and our third-party partners may use cookies and similar technologies to collect information about your activities for advertising and analytics purposes, including targeted advertising. You may have the right to opt out as described in the "State Privacy Rights" section below.

We do not control third parties' collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt out of receiving targeted ads from members of the Network Advertising Initiative ("NAI") on the NAI's website.

California, Colorado, Connecticut, Virginia, Utah and Texas residents may have additional Personal Information rights and choices. Nevada residents who wish to exercise their sale opt-out rights under Nevada Revised Statutes Chapter 603A may submit a request to weare@oya.health.

7. State Privacy Rights

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, you may have certain rights including:

to know whether or not we are processing your personal data;
to access your personal data;
to correct inaccuracies in your personal data;
to request the deletion of your personal data;
to obtain a copy of the personal data you previously shared with us;
to non-discrimination for exercising your rights; and
to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling.

Depending on the state you live in, you may also have the following rights:

to access the categories of personal data being processed;
to obtain a list of the categories of third parties to which we have disclosed personal data;
to obtain a list of specific third parties to which we have disclosed personal data;
to review, understand, question, and correct how personal data has been profiled;
to limit use and disclosure of sensitive personal data; and
to opt out of the collection of sensitive data and personal data collected through voice or facial recognition features.

If you are a resident of one of the states listed above, you may exercise your applicable privacy rights by contacting us at: weare@oya.health. We may need to verify your identity to protect your security and privacy. You may also designate an authorized agent to submit certain requests on your behalf.

You may also have the right to opt out of (i) the "sale" of your Personal Information, (ii) the "sharing" of your Personal Information for cross-context behavioral or targeted advertising, and (iii) our processing of your Personal Information for targeted advertising. To opt out, please submit a request using the contact information above and indicate "Do Not Sell or Share My Personal Information."

8. Your Rights

8.1. Right to Receive Confidential Communications

You have the right to request that OYA communicate your Personal Information to you through alternate means (e.g., alternate address or mode of communication). OYA will accommodate reasonable requests. Electronic communications such as e-mail and facsimile are not completely secure. OYA is not responsible for incorrect e-mail addresses or facsimile numbers.

8.2. Right to Access Your Personal Information

You generally have the right of access to inspect and obtain a copy of your Personal Information which OYA collects or maintains. OYA will provide you with access to your Personal Information in the form or format requested if feasible, in a readable hardcopy form, or another form as agreed. OYA may charge you for the cost of copying the materials and any postage. OYA will not provide you access to certain Personal Information compiled for use in civil, criminal, or administrative proceedings, or information that is subject to legal privilege.

8.3. Right to Correct Personal Information

You have the right to request that OYA correct inaccuracies in your Personal Information or a record about you. Any request must be made in writing and you must provide a reason to support a requested correction. OYA will act on your request within the timeframe required by applicable law. If OYA denies your request, the denial will be written in plain language and contain the basis for the denial.

9. Use of Artificial Intelligence Technologies

OYA uses artificial intelligence (AI) technologies to enhance and improve our Services and users' experiences. Specifically, we may use AI technologies to: personalize content and recommendations; improve the efficiency and accuracy of our Services; enhance customer support through AI-assisted responses; analyze patterns and trends; and detect and prevent fraud or security risks. While AI assists in many processes, critical decisions regarding your health and wellness plan always involve human oversight from qualified Service Providers and health and wellness professionals. Certain AI-powered services may require separate consents.

The information we process through our use of AI systems is subject to the same data protection and security measures discussed in this Privacy Policy. In some cases, we may use third-party AI services, subject to our vendor management processes and appropriate data protection standards.

10. Data Security

We have implemented measures designed to secure your Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure. The safety and security of your information also depends on you. Where we have given you a password for access to certain parts of our Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your Personal Information, we cannot guarantee the security of your Personal Information transmitted to our Services. Any transmission of Personal Information is at your own risk. In the event we become aware of a data security incident that compromises the confidentiality or integrity of your Personal Information, we will investigate and take reasonable steps to mitigate the incident, and where required by law, notify you and/or relevant authorities.

11. Changes to Our Privacy Policy

It is our policy to post any changes we make to our Privacy Policy on this page with a notice that the Privacy Policy has been updated. If we make material changes to how we treat our users' Personal Information, we will notify you by email to the primary email address specified in your account and/or through a notice on the website home page at https://oya.health. The date the Privacy Policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our website and this Privacy Policy to check for any changes.

12. Relationship to Terms of Use

Your use of the Website and Services is subject to our Terms of Use and any applicable consent forms, including their provisions on limitations of liability, dispute resolution, and governing law. If there is any conflict between this Privacy Policy and the Terms of Use, the Terms of Use will control to the extent of the conflict, unless otherwise required by applicable law.

13. Third Parties

This Privacy Policy does not create rights enforceable by third parties, nor does it require us to take any actions beyond those required by applicable law.

14. Complaints and Additional Information

If you believe your privacy rights have been violated by OYA or if you wish to file a complaint or to ask questions or comment about this Privacy Policy and our privacy practices, contact us at: weare@oya.health. Alternatively, you may file a complaint online at the www.hhs.gov website. You will not be retaliated against if you choose to file a complaint with OYA or with the U.S. Department of Health and Human Services.