Privacy Policy

This policy covers everyone who uses Ondoc: visitors, patients, parents and guardians, providers, practices and provider applicants. When Ondoc's clinicians provide your care, your medical information is protected health information and Ondoc's use of it is governed by the HIPAA Notice of Privacy Practices, which controls if anything here conflicts with it. This policy also covers information that is not protected health information, such as website use, provider business records and Google account connections.

Independent Marketplace providers and practices you choose directly keep their own clinical records and follow their own privacy notices for care they provide.

We collect only what the Services use. Depending on how you use Ondoc:

Patients

• Identity and contact: name, email, phone number, and sign-in information.
• Date of birth and demographics, such as sex, when a service needs them.
• Location and address: the state you are in for care, and an address when a document, order or pharmacy requires it.
• Health information: symptoms, concerns, how long they have lasted, medical history, medications, allergies, and answers to service questions.
• Clinical records: clinician notes, diagnoses, prescriptions, lab and imaging orders, referrals, letters and other documents, and clinical messages.
• Uploaded images and files, such as insurance cards, prior records or photos you choose to send to a clinician.
• Skin Checker submissions: the photo and description you provide are sent for automated analysis to return a result to you. Skin Checker images are not written to Ondoc's storage or logs by the analysis service.
• Insurance information: plan, member ID and related details.
• Payment and transaction data: amounts, payment status and processor references. Card details are collected and held by Stripe, not stored by Ondoc.
• Appointments: times, care windows, assigned clinician, video links and outcomes.
• Pharmacy preferences.
• Membership and program enrollment, including entitlements used.
• Communications: support tickets, emails, reminders and feedback.

Providers, practices and applicants

• Professional identity: name, credentials, NPI, licenses, specialties, practice name and contact information, and profile content you author.
• Applications and supporting documents.
• Availability and scheduling preferences, including time zone.
• Operational and financial records: assignments, Marketplace conversions, collections, adjustments, statements and settlement information.
• Google account connection information if you connect Google Calendar (Section 6).

Everyone

• Security and authentication information: sign-in events, IP address and device or browser information used to secure accounts and prevent abuse.
• Limited conversion attribution: when you submit a request, booking, payment or other conversion, we may store the page you came from and campaign tags associated with that conversion.

What we do not store or permit. Ondoc does not store raw page-visit histories, browsing trails or bot traffic for marketing analytics, and does not store events for visits that do not convert. Ondoc prohibits selling personal information and sharing it for unrelated third-party advertising or commercial purposes. We do not use health information for targeted advertising. Necessary service processing and lawful disclosures described below are not permission for recipients to sell information or use it for unrelated advertising.

• Clinical care: to let clinicians evaluate, diagnose, treat, prescribe, document and follow up.
• Scheduling: to show availability, book and remind you of appointments, and create video visits.
• Treatment coordination: to send prescriptions to pharmacies, orders to laboratories and imaging centers, and referrals to specialists.
• Insurance and payments: to verify coverage, submit claims, collect copays and self-pay amounts, and handle refunds and disputes.
• Memberships and programs: to track entitlements and administer program rules.
• Support: to answer questions and resolve problems.
• Provider administration: to review applications, verify credentials, operate the Provider Portal, and calculate assignments, fees, collections and statements.
• Security, fraud prevention and compliance with law, licensing and payer requirements.
• Operating and improving the Services, using conversion records and operational data — not stored browsing histories.

We share information only as needed for these purposes:

• Treating clinicians who provide or review your care.
• Participating Marketplace providers and practices you choose, who receive the information needed to deliver and bill for your care and then control their own clinical record.
• Pharmacies you select, to fill prescriptions.
• Laboratories and imaging facilities that perform ordered tests.
• Specialists and referral recipients.
• Insurance companies and their agents, for eligibility, claims and payment.
• Stripe, to process payments, refunds and disputes under its applicable services terms and Privacy Policy. Stripe receives the payment and transaction information necessary for that processing; this is not unrelated advertising or commercial data sharing.
• Communications providers that deliver email and fax messages on our behalf.
• Google Calendar and Google Meet, for appointment events and video links (Section 6).
• Operational vendors that host our application, database, file storage and automated tools, under agreements limiting their use of the data.
• Government and regulatory recipients when required by law, such as public-health reporting, court orders, licensing boards and law enforcement as permitted.
• A successor in a merger or transfer of the Services, subject to this policy and applicable law.

Recipients have different legal roles. Some, such as pharmacies, laboratories, insurers and other treating providers, are independent healthcare entities with their own obligations; some vendors act as business associates under HIPAA; others are not covered by HIPAA. We do not represent that every recipient has the same contractual or HIPAA role. Disclosures must have a necessary service purpose or other lawful basis; Ondoc does not authorize sale or unrelated third-party advertising or commercial use. This policy does not claim that independent recipients' practices or every external system are controlled by Ondoc.

When Ondoc's clinicians care for you, Ondoc maintains your medical record. When you deliberately book an independent Marketplace provider or practice, that provider or practice delivers your care and controls its clinical and billing records; Ondoc keeps the booking, payment and operational records needed to run the Marketplace. Ask that provider or practice directly for access to their clinical records.

Why providers connect Google

Participating providers may connect their own Google account from the Provider Portal (Availability → Connect Google Calendar) so that Ondoc appointments assigned to them appear on their personal calendar with a Google Meet video link. Only the individual provider can authorize their own Google account. Ondoc administrators do not receive access to a provider's personal calendar by connecting it, and one provider's appointments are never placed on another provider's calendar. Dr. Ikechukwu Ogbu's appointments continue to use his own separately connected Google account.

What Ondoc requests

Ondoc requests only two Google permissions:

• Your Google account email address (userinfo.email), to identify and display which Google account is connected.
• Calendar events (calendar.events), to create, update, reschedule and remove the calendar events for Ondoc appointments assigned to you, and to create a Google Meet link for each.

Ondoc does not request access to your contacts, Gmail, Drive or calendar sharing settings.

How Ondoc uses calendar access

• When an Ondoc appointment is booked with or assigned to you, Ondoc creates an event on your primary calendar with a Google Meet link generated through your account.
• If the appointment is rescheduled or reassigned, Ondoc updates or moves the event; if it is cancelled, Ondoc removes or updates it.
• The calendar used is determined by the assigned performing provider for the appointment.
• Ondoc works only with events it created for Ondoc appointments. Ondoc does not read, analyze, copy or store your other calendar events.

What appears in an event

An Ondoc calendar event contains a generic appointment title, the scheduled start and end time and time zone, and a Google Meet link. If the patient provides an email address, it is used to invite the patient as an attendee. Ondoc does not include the patient's name, phone number, service details or free-text clinical or scheduling notes in newly created events. Events created before this update may retain the information originally included until updated or removed through the existing scheduling process. Providers should secure their connected Google account and handle appointment information consistently with their professional privacy obligations.

Credentials and retention

Google authorization is completed with Google directly; Ondoc never sees your Google password. Authorization tokens are held by Ondoc's secure connection service and are not stored in Ondoc's application database or exposed to the browser. Ondoc retains, with the appointment, the event identifier, Meet link and which calendar owns the event, so it can update the event and reconcile scheduling.

Disconnecting

You can disconnect at any time in the Provider Portal (Availability → Disconnect) or from your Google Account's third-party access settings. After you disconnect, Ondoc stops creating or changing events on your calendar; new appointments assigned to you will not appear there until you reconnect. Events already on your calendar remain there unless you delete them, and Ondoc's own appointment records, including the saved event identifier and Meet link, remain part of Ondoc's scheduling and clinical records.

Google API Services User Data Policy

Ondoc's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Ondoc uses Google user data only to provide the appointment calendar and Meet features described above; does not transfer it except as necessary to provide those features, for security, or to comply with law; does not use it for advertising; does not sell it; and does not allow humans to read it except with the provider's consent, for security or abuse investigation, to comply with law, or as necessary for internal operations that are aggregated and anonymized.

• Patients have the rights described in the HIPAA Notice, including to access, obtain copies of and request amendment of your medical record, request confidential communications, request restrictions and receive an accounting of certain disclosures.
• Everyone may ask to access or correct personal information in their account, update communication preferences, or ask us to delete information that we are not required to keep.
• State privacy rights. Residents of some states have additional rights, such as to know, access, correct or delete personal information, or to opt out of sale or targeted advertising (Ondoc does neither). Some state health-data laws give further rights over consumer health data. Contact us to exercise any right; we will verify your request and respond as the law requires. You will not be discriminated against for exercising your rights.
• Email. Non-essential emails can be stopped by contacting us or using the unsubscribe link where provided. Care, billing and legal messages may still be sent.

We keep information for as long as needed for the purposes above and as required by law. Medical records, prescription records, billing and claims records, and provider financial records must be retained for legally required periods and cannot be deleted on request. Financial ledgers and invoices are kept as unaltered historical records. When information is no longer needed, we delete or de-identify it.

Ondoc uses administrative, technical and organizational safeguards, including encrypted connections (HTTPS), access controls that limit records to the patient, the assigned or selected clinician and authorized staff, database row-level security, role-based permissions, private storage for uploaded files with time-limited access links, one-time sign-in links, and audit and operational logs that avoid recording clinical content. No system is perfectly secure, and Ondoc does not claim any security certification. We will notify you of a breach as required by law.

Ondoc's services are for adults and for minors whose care is requested and authorized by a parent or legal guardian, as allowed by law. We do not knowingly collect information from children under 13 except as part of guardian-authorized care.

We will post updates here with a new effective date. Material changes will be highlighted on this page and, where appropriate, sent by email.

Questions or requests: care@ondoc.com · +1-817-668-0320