Privacy Policy

Effective November 1, 2026 · Version 2026-11-01 · Health information notice version 2026-09-09 · Connected health records notice version 2026-10-11 · Apple Health notice version 2026-10-23

This policy explains what information Hypersimple Labs, Inc., the company that operates OA (“OA”, “we”, “us”), collects through the participant platform at app.oa-bio.com and the OA app for iPhone (together, the “Service”), why, who we share it with, and the choices and rights you have. It also serves as our Consumer Health Data Privacy Policy under Washington’s My Health My Data Act, Nevada’s consumer health data law and similar state laws (see section 4). Plain language is intentional: if anything is unclear, write to support@oa-bio.com.

The short version

You decide what health information to share, and you can edit or delete it at any time.
Connecting your hospital’s or doctor’s patient portal is optional and needs a separate consent. When you do, OA reads your records once and keeps only your conditions, medications and allergies; the rest of your records, and any access to your portal, are never kept.
Sharing readings from Apple Health with a study you joined is optional too, study by study and type by type, and needs its own consent. OA only reads the types you choose, for the period the study names, and never writes to Health.
We use your information to show you studies you may be eligible for and to connect you with a Study Team only when you ask to join their study.
We never sell your information and never use it for advertising. We do not use geofencing.
You can download everything we hold about you and delete your account yourself, immediately.

1. What we collect

Information you give us

Account: email address, password (stored hashed), sign-in activity and, for accounts created with an invitation code, that code.
Profile: first and last name, date of birth, sex at birth, ethnicity (optional, with a “prefer not to answer” choice), mobile phone (optional), ZIP code, city and state, how you want to be contacted, and the kinds of studies you are interested in.
Health information (consumer health data): the conditions, medications and allergies you choose to enter, with any details you add (status, dates, dose, reaction). This is optional and requires your separate consent.
Connected health records (consumer health data): if you choose to connect a hospital or clinic’s patient portal, the conditions, medications and allergies retrieved from your medical records there (names, codes, dates, status, dose, reaction), together with the list of systems you connected and the date of each retrieval. This is optional and requires a further consent, the Connected Health Records Notice, which explains it in full.
Apple Health readings (consumer health data): if you choose to share Apple Health data with a study you joined, using the OA app for iPhone, the readings of the types that study asks for and you select (for example sleep, heart rate or steps), each with its time, its value and the device or app that recorded it, for the period the study names; and a record of each share (the study, the types, the period, the dates you started and stopped). This is optional and requires a further consent, the Apple Health Notice, which explains it in full.
Consents: each consent decision you make, with the document version, the time, a hashed (irreversible) form of your IP address and your browser or app type, so we can prove what you agreed to.
Study activity: the studies you request to join, the status of each request, and notes a Study Team or OA adds about it.
Messages you send us, for example to support.

Information collected automatically

Technical data needed to run the Service securely: IP address, browser and device type, pages viewed and timestamps, held in server logs for a limited time.
Cookies: only the strictly necessary cookies that keep you signed in. We do not use advertising or cross-site tracking cookies. We use no analytics beyond aggregate page views.
The OA app for iPhone sends us the same information as the website, and nothing more. On your iPhone it keeps your sign-in session in the Keychain and your display preferences (such as light or dark appearance). It reads data from Apple Health (HealthKit) only when you share it with a study, as described above, after Apple’s own permission screen; it never writes to Health and never places Health data in iCloud. It does not use your location, contacts, photos, camera or microphone, does not read your advertising identifier, does not track you across other companies’ apps or websites, and contains no advertising, analytics or tracking software from other companies.

Information from others

Study Teams may update the status of your request (for example “enrolled” or “completed”).
Hospitals, clinics and doctor’s offices you connect. When you connect a patient portal, you sign in there and authorize your health system to send a copy of your records to OA, under your HIPAA right of access. OA retrieves that copy itself, directly from the portal, once; it keeps only the parts described above, discards the rest during processing, and keeps no portal password or access token, so it cannot retrieve your records again without a new authorization from you. Nothing is retrieved without your separate consent (the Connected Health Records Notice).
The Health app on your iPhone. When you share Apple Health data with a study, the OA app reads the readings you selected from Health on your device and sends them to OA. Apple does not send your data to OA. Readings your Apple Watch or another device or app wrote to Health reach OA only this way.
We do not buy data about you and do not connect to pharmacies, insurers or wearable devices directly.

2. How we use it

Matching: comparing your profile and health information (entered by you or retrieved from the portals you connected) with each study’s eligibility rules to show you studies you may qualify for. Matching runs inside OA; Study Teams do not see your information at this stage.
Connecting you with a study: when you request to join a study, sharing your profile and relevant health information with that Study Team so they can screen and contact you.
Taking part in a study: when you share Apple Health readings with a study you joined, storing them under that study and making them available to its Study Team as part of your participation. Apple Health readings are used only for the study you shared them with: not for matching, not for any other study, and never for advertising, marketing or data mining.
Running the Service: creating and securing your account, sending the emails the Service needs (sign-in links, confirmations, updates about your requests), answering support questions.
Safety, security and legal: preventing fraud and abuse, keeping consent records, complying with law and enforcing our Terms.
Improving OA using aggregate, de-identified statistics (for example how many participants live in a state). We do not use your identifiable information to train models or for research of our own without asking you first.

We do not use your information for advertising, do not sell it, do not “share” it for cross-context behavioral advertising, and do not make decisions with legal or similarly significant effects about you by automated means.

Study Teams you choose. Only for the study you requested to join, and only what that study needs: your name, contact details you allowed, date of birth, sex at birth, location, and the health information relevant to eligibility; and, if you share Apple Health readings with that study, those readings. Once you are in contact with a Study Team, their handling of your information is governed by their own study consent form and privacy practices, which may include HIPAA.
Service providers that process information on our behalf under contracts that restrict them to our instructions: cloud hosting and database (Supabase, United States), account emails (Resend, United States), web hosting and delivery (Vercel, United States). When you connect a patient portal, OA retrieves your records directly from it; no other company receives them on the way. Two lookups leave OA without any account information attached: when you type a medication name we query the National Library of Medicine’s RxNorm service with the text you typed, and when you enter a ZIP code we look up its city and state (Zippopotam.us). Neither receives your name, email, account or any other data.
Legal reasons: when required by law, subpoena or court order, or to protect the rights, safety or property of participants, OA or others. Where the law allows, we will tell you first.
Business transfers: if OA is involved in a merger, acquisition or sale of assets, your information may be transferred with it, under this policy and with notice to you.

We do not share your information with data brokers, advertisers or affiliates for their own purposes.

4. Consumer health data notice

The health information you enter, and any other information that identifies your past, present or future health status, is consumer health data under the Washington My Health My Data Act (RCW 19.373), the Nevada consumer health data law (SB 370) and comparable laws. This section is our notice under those laws.

Categories collected: self-reported conditions (with status and onset date), medications (with dose, frequency and dates), allergies (with reaction and severity); the same three categories retrieved from the patient portals you choose to connect, with the name of each connected system and the date of each retrieval; readings from Apple Health that you share with a study you joined (the types that study asks for and you select, such as sleep, heart rate, steps or blood glucose, with their time, value and source). Study requests can also reveal health status, for example applying to a study about a specific condition.
Sources: you, and, only with your separate consent, the hospitals, clinics and doctor’s offices whose patient portals you connect (retrieved by OA directly), and the Health app on your iPhone for the readings you share with a study. Study Teams may add the status of a request.
Purposes: study matching and connecting you with Study Teams you choose, running and securing the Service, keeping consent records, and complying with law. No other purpose without a new consent.
Sharing: with the Study Team of a study you request to join, and with the service providers listed in section 3 in their role as processors. We do not sell consumer health data, and we do not share it with affiliates for their own use. A full list of the third parties and affiliates with whom we share consumer health data is available on request at support@oa-bio.com.
Consent: we collect health information only after you give a specific, versioned consent in the app (“health information notice”, version 2026-09-09). Connecting a patient portal requires a further, specific consent (the Connected Health Records Notice, version 2026-10-11), given before your first connection. Sharing Apple Health data with a study requires the Apple Health Notice (version 2026-10-23), accepted before your first share, and your choice of types for each study. You can withdraw any of them by deleting the corresponding health entries, disconnecting your health systems, stopping sharing with a study, deleting your account, or writing to us.
Geofencing: we do not use geofences around any facility that provides health services.
Your rights: to confirm whether we collect, share or sell consumer health data about you; to access it, including a list of third parties it was shared with; to withdraw consent; and to have it deleted. See section 7 for how to exercise them and appeal.

5. California residents

Under the Confidentiality of Medical Information Act (CMIA), we treat the health information you give us as medical information: we do not disclose it without your authorization except as the law permits, and the consent you give in the app is meant to be that authorization for the disclosures described here. Under the California Consumer Privacy Act (as amended by the CPRA), you have the right to know what personal information we collect, use and disclose; to correct it; to delete it; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined by the CCPA, and we use sensitive personal information (health information, sex at birth, ethnicity) only for the purposes you would reasonably expect from a research-matching service, so no “Do Not Sell or Share” or “Limit the Use” link is required. Section 1 lists the categories we collect, section 2 why, section 3 who receives them, and section 8 how long we keep them.

6. Washington and Nevada residents

Section 4 is the consumer health data privacy policy required by Washington’s My Health My Data Act and by Nevada SB 370. Your rights under those laws (access, withdrawal of consent, deletion, and a list of third parties) are described there. If we deny a request, you can appeal by replying to our decision; we will answer the appeal within the time the law requires and tell you how to contact the Washington Attorney General (or the Nevada Attorney General) if you are not satisfied.

7. Your choices and rights, and how to use them

Everyone who uses OA, whatever their state, can:

Access and export: Profile → Account → “Download my data” gives you everything we hold about you as a file, instantly.
Correct: edit your profile and health entries directly in the app.
Delete: remove individual health entries, or delete your whole account (Profile → Account). Deletion is immediate. We keep only what the law requires us to keep, for example consent records needed to demonstrate compliance, and then only for as long as required.
Withdraw consent: deleting your health entries withdraws your health information consent; disconnecting your health systems or deleting your connected data withdraws your connected records consent; stopping sharing with a study (My health in the iPhone app) withdraws your Apple Health consent for that study, and turning OA off in the Health app stops any further reading; deleting your account withdraws everything. You can also write to us to withdraw.
Pause: “Opt out of studies” under Preferences stops matching and contact without deleting anything.
Control contact: choose whether Study Teams may email, text or call you. Reply STOP to any text to stop texts from that sender.

For anything you cannot do in the app, or to appeal a decision, email support@oa-bio.com from the address on your account. We may ask you to confirm your identity through that address. We respond within 45 days, and we never treat you differently for exercising a right. An authorized agent may act for you with your written permission.

8. How long we keep information

Profile and health information: while your account exists. Deleted immediately when you delete your account.
Connected health records: until you disconnect the system they came from, delete them (“Delete connected data”) or delete your account; each new connection replaces the previous copy from that system. OA keeps no portal credentials and no access tokens: the authorization a portal gives is used for one retrieval and discarded.
Apple Health readings: while you share with the study. Deleted immediately when you stop sharing with that study or delete your account; the record of the share itself is kept as a consent record.
Consent records: for as long as needed to demonstrate compliance, up to 6 years, even after account deletion, in a form that no longer includes your profile.
Server logs and security records: up to 90 days.
Support messages: up to 2 years.

9. Security

Your information is stored in the United States with encryption in transit and at rest, protected by row-level access rules so that your data is readable only by you and by OA staff who need it to run the Service, and by access logging. No system is perfectly secure; if a breach affects your information we will notify you and the authorities as the law requires.

10. HIPAA

OA is not a healthcare provider, health plan or clearinghouse, so the information you give us directly is not protected by HIPAA; it is protected by this policy and by the state laws described above. A Study Team that is a HIPAA covered entity will handle information it collects under its own HIPAA notice and consent form. When you connect a patient portal, your hospital releases a copy of your records to the app you chose under your HIPAA right of access (45 CFR 164.524); OA retrieves it directly, and once it reaches OA it is protected by this policy, by the Connected Health Records Notice and by state law.

11. Children

The Service is for adults 18 and over. We do not knowingly collect information from anyone under 18; if we learn we have, we delete it. Contact us if you believe a minor has an account.

12. Other states and locations

Residents of states with comprehensive privacy laws (for example Colorado, Connecticut, Virginia and others) have rights similar to those in section 7 and can use the same channels. We operate only in the United States and do not offer the Service elsewhere.

13. Changes to this policy

We will update this policy as the Service grows, for example when we add new ways to connect your records or new service providers. Each version has an effective date and a version number, and your consent record stores the version you accepted. For material changes, especially any new use or sharing of consumer health data, we will ask for your consent again before the change applies to you.

14. Contact

Privacy questions, requests and appeals: support@oa-bio.com. By mail: Hypersimple Labs, Inc., Attn: Privacy, 1916 Octavia Street, San Francisco, CA 94109, United States. See also our Terms of Service, the Connected Health Records Notice and the Apple Health Notice.