OA

Connected Health Records Notice

Effective October 11, 2026 · Version 2026-10-11 · Supplements the Privacy Policy (version 2026-11-01) and the health information notice (version 2026-09-09)

OA lets you connect the hospitals, clinics and doctor’s offices where you receive care, so that your conditions, medications and allergies come straight from your medical records instead of being typed by hand. This notice explains what happens when you connect a health system, what OA keeps and how you stay in control. You accept it before your first connection; it is the consent that authorizes the retrieval. Connecting is optional: everything else in OA works without it.

The short version

  • You sign in at your health system’s patient portal and approve the access there. OA never sees your password.
  • OA retrieves a copy of your records itself, once, right after you approve. No other company receives them.
  • OA keeps only your conditions, medications and allergies. Everything else is discarded and never stored.
  • OA keeps no password and no access to your portal. To update your records, you connect again.
  • Disconnecting a system deletes what OA read from it. You can also delete your account at any time.

1. How a connection works

  1. You search for your health system in OA and choose Connect.
  2. You are taken to that system’s patient portal (for example MyChart, or athenaPatient for many doctor’s offices) and sign in with the credentials you already use there. The sign-in happens on the portal’s pages, not on OA’s: OA never receives your password.
  3. The portal shows what you are authorizing and asks you to approve it. Approving tells your health system to send a copy of your records to the app you chose. This is your right of access under the federal health privacy law, HIPAA (45 CFR 164.524): your health system keeps its records and sends a copy where you direct it.
  4. The portal then gives OA a short-lived authorization. OA’s servers use it at once to retrieve a copy of your conditions, medications and allergies through the standard patient-access interface that certified health record systems must offer (SMART on FHIR). OA extracts the parts described in section 3 and discards the rest.
  5. The authorization is used for that single retrieval and then discarded. OA does not store it and does not ask for long-lived (“offline”) access, so OA cannot retrieve your records again on its own. To give OA the latest version, connect again; My health shows the date of the last retrieval.

2. Who is involved

OA retrieves the records itself, directly from your health system’s portal. No aggregator, data broker or other intermediary receives your records on the way. The portals are run for your health systems by their electronic health record vendors (for example Epic for MyChart and athenahealth for athenaPatient), with whom OA has registered its app; they operate the sign-in and the approval screen, and send the copy you authorize.

3. What OA keeps, and what it does not

From each copy, OA keeps only:

  • Conditions (problem-list entries): the name and medical code, whether they are active or resolved, and the month they started.
  • Medications: the name and code, the dose instructions as written by your clinician, start and end months, and whether they are current.
  • Allergies and intolerances: the substance, the category (drug, food, environmental), the reaction and its severity.

Everything else in your records — visit notes, lab and test results, imaging, immunizations, procedures, vital signs, documents, billing and insurance details — is discarded while the copy is processed and is never written to OA’s systems. OA also keeps no portal username or password and no access, refresh or identity token. Each entry taken from a connection is marked with the health system it came from and shown next to the entries you add yourself. OA does not change what your clinicians recorded; you cannot edit a connected entry, but you can delete it and you can always add your own entries.

4. How OA uses connected records

Exactly like the health information you enter yourself, and for no other purpose: to show you studies you may be eligible for, and to give a Study Team a first picture of you only after you request to join their study and agree to share your details. Connected records are never sold, never used for advertising, never used to train models, and never shared with data brokers or affiliates. Sections 2 and 3 of the Privacy Policy apply in full.

5. Your control

  • See every connection under My health, with its status and the date of the last retrieval.
  • Update: connect again at any time; the new copy replaces what OA read from that system before.
  • Disconnect a system: deletes, immediately, every entry OA read from it.
  • Delete connected data: removes every entry read from your health systems and forgets the connections, immediately.
  • Remove OA from the portal’s list: OA keeps no access after the retrieval, but you can also remove it under your portal’s linked or connected apps (in MyChart: Menu, then Security settings, then Linked apps).
  • Download a copy of everything OA holds about you, connected records included, from Profile → Account.
  • Delete your account: removes everything, including all connected records, at once.

6. The laws that apply

Your health system is bound by HIPAA. When you approve a connection, it releases a copy of your records to you, in the app you chose, under your HIPAA right of access. OA is not a healthcare provider, health plan or clearinghouse, so once the copy reaches OA it is protected by this notice, by the Privacy Policy and by state law: it is consumer health data under Washington’s My Health My Data Act and Nevada’s consumer health data law, and medical information under California’s Confidentiality of Medical Information Act. The consent you give by accepting this notice is meant to be the specific, informed authorization those laws require for the collection and the disclosures described here. Your rights under those laws (access, a list of the third parties your data was shared with, withdrawal of consent, deletion, appeal) are described in sections 4 to 7 of the Privacy Policy.

7. Withdrawing this consent

Disconnecting all your health systems, or deleting your connected data, withdraws this consent; so does deleting your account or writing to support@oa-bio.com. Because OA keeps no access to your portals, nothing is retrieved after a withdrawal. Withdrawal does not undo a disclosure you already asked for (for example to a Study Team whose study you requested to join). You can connect again later: OA will ask you to accept the current version of this notice first.

8. Changes to this notice

Each version has an effective date and a version number, and your consent record stores the version you accepted. If we change what OA retrieves, keeps or shares, you will be asked to accept the new version before your next connection.

9. Contact

Questions about connected records, this notice or your rights: support@oa-bio.com. By mail: Hypersimple Labs, Inc., Attn: Privacy, 1916 Octavia Street, San Francisco, CA 94109, United States. See also our Privacy Policy and Terms of Service.