Privacy Policy

Effective September 10, 2026 · Version 2026-09-10 · Health information notice version 2026-09-09

This policy explains what information OA [legal entity name to be confirmed] (“OA”, “we”, “us”) collects through the participant platform at app.oa-bio.com (the “Service”), why, who we share it with, and the choices and rights you have. It also serves as our Consumer Health Data Privacy Policy under Washington’s My Health My Data Act, Nevada’s consumer health data law and similar state laws (see section 4). Plain language is intentional: if anything is unclear, write to support@oa-bio.com.

The short version

You decide what health information to share, and you can edit or delete it at any time.
We use your information to show you studies you may be eligible for and to connect you with a Study Team only when you ask to join their study.
We never sell your information and never use it for advertising. We do not use geofencing.
You can download everything we hold about you and delete your account yourself, immediately.

1. What we collect

Information you give us

Account: email address, password (stored hashed), invitation code, sign-in activity.
Profile: first and last name, date of birth, sex at birth, ethnicity (optional, with a “prefer not to answer” choice), mobile phone (optional), ZIP code, city and state, how you want to be contacted, and the kinds of studies you are interested in.
Health information (consumer health data): the conditions, medications and allergies you choose to enter, with any details you add (status, dates, dose, reaction). This is optional and requires your separate consent.
Consents: each consent decision you make, with the document version, the time, a hashed (irreversible) form of your IP address and your browser type, so we can prove what you agreed to.
Study activity: the studies you request to join, the status of each request, and notes a Study Team or OA adds about it.
Messages you send us, for example to support.

Information collected automatically

Technical data needed to run the Service securely: IP address, browser and device type, pages viewed and timestamps, held in server logs for a limited time.
Cookies: only the strictly necessary cookies that keep you signed in. We do not use advertising or cross-site tracking cookies. During the closed beta we use no analytics beyond aggregate page views.

Information from others

Study Teams may update the status of your request (for example “enrolled” or “completed”).
We do not buy data about you and, in this version of the Service, do not connect to medical records, pharmacies, insurers or wearable devices. If we add a way to connect your medical records in the future, it will be optional, explained separately and require a new consent.

2. How we use it

Matching: comparing your profile and health information with each study’s eligibility rules to show you studies you may qualify for. Matching runs inside OA; Study Teams do not see your information at this stage.
Connecting you with a study: when you request to join a study, sharing your profile and relevant health information with that Study Team so they can screen and contact you.
Running the Service: creating and securing your account, sending the emails the Service needs (sign-in links, confirmations, updates about your requests), answering support questions.
Safety, security and legal: preventing fraud and abuse, keeping consent records, complying with law and enforcing our Terms.
Improving OA using aggregate, de-identified statistics (for example how many participants live in a state). We do not use your identifiable information to train models or for research of our own without asking you first.

We do not use your information for advertising, do not sell it, do not “share” it for cross-context behavioral advertising, and do not make decisions with legal or similarly significant effects about you by automated means.

Study Teams you choose. Only for the study you requested to join, and only what that study needs: your name, contact details you allowed, date of birth, sex at birth, location, and the health information relevant to eligibility. Once you are in contact with a Study Team, their handling of your information is governed by their own study consent form and privacy practices, which may include HIPAA.
Service providers that process information on our behalf under contracts that restrict them to our instructions: cloud hosting, database and account emails (Supabase, United States) and web hosting and delivery (Vercel, United States). Two lookups leave OA without any account information attached: when you type a medication name we query the National Library of Medicine’s RxNorm service with the text you typed, and when you enter a ZIP code we look up its city and state (Zippopotam.us). Neither receives your name, email, account or any other data.
Legal reasons: when required by law, subpoena or court order, or to protect the rights, safety or property of participants, OA or others. Where the law allows, we will tell you first.
Business transfers: if OA is involved in a merger, acquisition or sale of assets, your information may be transferred with it, under this policy and with notice to you.

We do not share your information with data brokers, advertisers or affiliates for their own purposes.

4. Consumer health data notice

The health information you enter, and any other information that identifies your past, present or future health status, is consumer health data under the Washington My Health My Data Act (RCW 19.373), the Nevada consumer health data law (SB 370) and comparable laws. This section is our notice under those laws.

Categories collected: self-reported conditions (with status and onset date), medications (with dose, frequency and dates), allergies (with reaction and severity), and, in the future, records you may choose to connect. Study requests can also reveal health status, for example applying to a study about a specific condition.
Sources: you. Study Teams may add the status of a request.
Purposes: study matching and connecting you with Study Teams you choose, running and securing the Service, keeping consent records, and complying with law. No other purpose without a new consent.
Sharing: with the Study Team of a study you request to join, and with the service providers listed in section 3 in their role as processors. We do not sell consumer health data, and we do not share it with affiliates for their own use. A full list of the third parties and affiliates with whom we share consumer health data is available on request at support@oa-bio.com.
Consent: we collect health information only after you give a specific, versioned consent in the app (“health information notice”, version 2026-09-09). You can withdraw it by deleting your health entries or your account, or by writing to us.
Geofencing: we do not use geofences around any facility that provides health services.
Your rights: to confirm whether we collect, share or sell consumer health data about you; to access it, including a list of third parties it was shared with; to withdraw consent; and to have it deleted. See section 7 for how to exercise them and appeal.

5. California residents

Under the Confidentiality of Medical Information Act (CMIA), we treat the health information you give us as medical information: we do not disclose it without your authorization except as the law permits, and the consent you give in the app is meant to be that authorization for the disclosures described here. Under the California Consumer Privacy Act (as amended by the CPRA), you have the right to know what personal information we collect, use and disclose; to correct it; to delete it; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined by the CCPA, and we use sensitive personal information (health information, sex at birth, ethnicity) only for the purposes you would reasonably expect from a research-matching service, so no “Do Not Sell or Share” or “Limit the Use” link is required. [Counsel to confirm and add the required “notice at collection” details, categories table and retention periods.]

6. Washington and Nevada residents

Section 4 is the consumer health data privacy policy required by Washington’s My Health My Data Act and by Nevada SB 370. Your rights under those laws (access, withdrawal of consent, deletion, and a list of third parties) are described there. If we deny a request, you can appeal by replying to our decision; we will answer the appeal within the time the law requires and tell you how to contact the Washington Attorney General (or the Nevada Attorney General) if you are not satisfied.

7. Your choices and rights, and how to use them

Everyone who uses OA, whatever their state, can:

Access and export: Profile → Account → “Download my data” gives you everything we hold about you as a file, instantly.
Correct: edit your profile and health entries directly in the app.
Delete: remove individual health entries, or delete your whole account (Profile → Account). Deletion is immediate. We keep only what the law requires us to keep, for example consent records needed to demonstrate compliance, and then only for as long as required.
Withdraw consent: deleting your health entries withdraws your health information consent; deleting your account withdraws everything. You can also write to us to withdraw.
Pause: “Opt out of studies” under Preferences stops matching and contact without deleting anything.
Control contact: choose whether Study Teams may email, text or call you. Reply STOP to any text to stop texts from that sender.

For anything you cannot do in the app, or to appeal a decision, email support@oa-bio.com from the address on your account. We may ask you to confirm your identity through that address. We respond within 45 days, and we never treat you differently for exercising a right. An authorized agent may act for you with your written permission.

8. How long we keep information

Profile and health information: while your account exists. Deleted immediately when you delete your account.
Consent records: for as long as needed to demonstrate compliance, [up to 6 years — to be confirmed], even after account deletion, in a form that no longer includes your profile.
Server logs and security records: [30 to 90 days — to be confirmed].
Support messages: [2 years — to be confirmed].

9. Security

Your information is stored in the United States with encryption in transit and at rest, protected by row-level access rules so that your data is readable only by you and by OA staff who need it to run the Service, and by access logging. No system is perfectly secure; if a breach affects your information we will notify you and the authorities as the law requires.

10. HIPAA

OA is not a healthcare provider, health plan or clearinghouse, so the information you give us directly is not protected by HIPAA; it is protected by this policy and by the state laws described above. A Study Team that is a HIPAA covered entity will handle information it collects under its own HIPAA notice and consent form. If we later offer a way to connect your medical records, we will do so under the agreements HIPAA requires.

11. Children

The Service is for adults 18 and over. We do not knowingly collect information from anyone under 18; if we learn we have, we delete it. Contact us if you believe a minor has an account.

12. Other states and locations

Residents of states with comprehensive privacy laws (for example Colorado, Connecticut, Virginia and others) have rights similar to those in section 7 and can use the same channels. We operate only in the United States and do not offer the Service elsewhere.

13. Changes to this policy

We will update this policy as the Service grows, for example when we add medical-record connections or new service providers. Each version has an effective date and a version number, and your consent record stores the version you accepted. For material changes, especially any new use or sharing of consumer health data, we will ask for your consent again before the change applies to you.

14. Contact

Privacy questions, requests and appeals: support@oa-bio.com. [Postal address and, if appointed, privacy officer to be added.] See also our Terms of Service.