Privacy Policy

“Osara Health” is the trading name of CancerAid Pty Ltd (ABN 75 607 610 257) and its subsidiaries, including Osara Health, Inc. and Osara Health Canada Inc (“we”, “us”, “our”).

At Osara Health, we understand that protecting your personal information is important. This Privacy Policy applies to Participants, Patients, Organization Personnel, Website Visitors, and other Users (defined below) (“you”, “your”) and sets out our commitment to protecting the privacy of personal information provided to us, or otherwise collected by us when providing:

(together, our Services).

This Privacy Policy takes into account the requirements of the Privacy Act 1988 (Cth) (the Australian Privacy Act) and the Australian Privacy Principles in Schedule 1 of the Privacy Act and the New Zealand Privacy Act 2020 (NZ Privacy Act), Canada’s Personal Information Protection and Electronic Documents Act, and substantially similar provincial privacy laws, as applicable. The handling of your personal information, such as your health information, may also be subject to other Canadian, United States, Australian or New Zealand privacy laws, such as state and territory health record laws in New South Wales, Victoria and the Australian Capital Territory or the Health Information Privacy Code 2020 in New Zealand, or Canadian provincial health legislation (together, Health Privacy Laws).

By using our Services, you agree to the collection, use, disclosure, and procedures this Privacy Policy describes. Beyond the Privacy Policy, your use of our Services is also subject to our Terms of Service, and may also be subject to any program Terms and Conditions (collectively, “Terms”).

Categories of Personal Information We Collect

We collect the following categories of personal information. (You can learn more about the specific types of personal Information that we collect below.)

Personal information: is information or an opinion, whether true or not and whether recorded in a material form or not, about an individual who is identified or reasonably identifiable.

Sensitive information: is a sub-set of personal information that is given a higher level of protection. Sensitive information means information relating to your racial or ethnic origin, political opinions, religion, trade union or other professional associations or memberships, philosophical beliefs, sexual orientation or practices, criminal records, health information or biometric information.

Health information: is a sub-set of sensitive information under the Australian Privacy Act and is also used under Health Privacy Laws. For the purposes of our Services, health information is information or an opinion about your health, your expressed wishes about the future provision of health services to you, a health service provided, or to be provided, to you that is also personal information; as well as any other personal information collected to provide, or in providing, a health service to you.

Throughout this Privacy Policy, where we refer to “personal information” this includes sensitive information and health information. However, we also specifically refer to sensitive information and health information where relevant.

The People We Collect Personal Information About

We may collect personal information about the following types of people:

How We Collect Personal Information

We collect personal information in a variety of ways, including:

(1) Directly through sign-up for the Osara Health App: During the sign-up process for the Osara Health App you may provide personal information directly to us.

(2) Directly through a self-referral for an Osara Health Program: When you self-refer as a Participant for an Osara Health Program you will provide personal information directly to us.

(3) Directly through communication with you: When you request our assistance, such as via email or over the telephone you may provide personal information directly to us. When we send you emails, we may track whether you open them to learn how to deliver a better customer experience and improve our Services.

(4) Directly through our careers page: When you apply for a job with us, you may submit your contact information and your resume online. We will collect the information you choose to provide on your resume, such as your education and employment experience. You may also apply through LinkedIn. If you do so, we will collect the information you make available to us on LinkedIn.

(5) Through your use of our website, App or program booking system: When you use our website, in your enquiries, when you are using the Osara Health App or an Osara Health Program booking system we may directly or indirectly collect personal information about you.

(6) From Organizations: (1) When you are referred to us by an Organization as a Participant for an Osara Health Program we will collect personal information about you from the Organization, and (2) When you, as Organization Personnel, have your contact details shared with us by your Organization for the purpose of communicating with you about the Osara Health Program(s) and/or the Organization Services.

(7) From cookies: We and our third-party partners collect information using cookies, pixel tags, or similar technologies. Our third-party partners, such as analytics providers, may use these technologies to collect information about your online activities over time and across different services. Cookies are small text files containing a string of alphanumeric characters. We may use both session cookies and persistent cookies. A session cookie disappears after you close your browser. A persistent cookie remains after you close your browser and may be used by your browser on subsequent visits to our Services. Please review your web browser’s “Help” file to learn the proper way to modify your cookie settings. Please note that if you delete or choose not to accept cookies from the Service, you may not be able to utilize the features of the Service to their fullest potential.

(8) From your device: We receive information about the device and software you use to access our Services.

(9) From your usage of our Services: To help us understand how you use our Services and to help us improve them, we automatically receive information about your interactions with our Services.

(10) From your participation in our Services: When you participate in our Services, including our coaching sessions, you may provide personal information to us. With your consent, we also record coaching sessions. Please see the “Call Recording” section of this Privacy Policy for full details of how we collect, use, store and protect call recordings, and your rights in relation to them.

Note: If we collect personal information about you from a third party, we will use and share it as set out in this Privacy Policy. If you are a third party providing personal information about somebody else, you represent and warrant that you have the required authority (i.e. you are their parent or legal guardian) or such person’s consent to provide the personal information to us, in accordance with applicable laws or regulations (including notifying the individual concerned of all the information required for collection under the applicable Health Privacy Law), and that our use in accordance with this Privacy Policy of the personal information provided by you will not infringe any rights of the relevant individual or violate any applicable laws or regulations.

The Personal Information We Collect

Personal information: We collect personal information for the purposes described below that are connected with a function of our business or the performance of our Services. The types of personal information we may collect about you include:

As an Osara Health App User:

(1) your email address;

(2) as a Patient, any health information you enter into the Osara Health App such as symptom data, cancer type or stage, medication information, progress towards goals;

(3) details of any technical support requests made by you, and the assistance provided by us;

(4) details of products and services we have provided to you and/or that you have enquired about, and our response to you;

(5) your browser session and geo-location data, device and network information, statistics on page views and sessions, acquisition sources, search queries and/or browsing behavior;

(6) information about your access and use of our Services, including through the use of Internet cookies, your communications with our online Services, the type of browser you are using, the type of operating system you are using and the domain name of your Internet service provider;

(7) additional personal information that you provide to us, directly or indirectly, through your use of our Services, associated applications, associated social media platforms and/or accounts from which you permit us to collect information; and

(8) any other personal information provided by you or by a third party on your behalf.

As an Osara Health Program Participant:

(1) your full name;

(2) your contact details, including your email addresses (personal and work) and telephone number;

(3) your date of birth;

(4) your state or region;

(5) your date of illness or injury;

(6) your insurance claim number;

(7) information about your health whether provided to us by you or provided by the relevant Organization, including any health information you provide to us such as symptom data, cancer type or stage, or medication information;

(8) the dates and times of bookings with our coaches;

(9) records of your Osara Health Program sessions, including notes about what was discussed;

(10) details of any technical support requests made by you, and the assistance provided by us;

(11) your preferences and/or opinions with respect to our Services;

(12) information you provide to us through feedback, enquiries or customer surveys;

(13) details of products and services we have provided to you and/or that you have enquired about, and our response to you;

(14) when you use an online aspect of an Osara Health Program,

(15) any other personal information provided by you or by a third party or on your behalf.

Please be advised that your phone call with our health coach may be monitored or listened to by another health coach for training and quality assurance purposes. This is done solely to ensure the highest level of service and support for our clients. Your privacy and confidentiality remain of utmost importance to us, and any personal information shared during the call will be treated with the strictest confidence in accordance with our privacy policy.

As Organization Personnel:

(1) your name;

(2) your contact details, including email address and/or telephone number;

(3) the Organization you work for;

(4) your job title;

(5) your preferences and/or opinions about our Services;

(6) information you provide to us through feedback, enquires or customer surveys;

(7) details of products and services we have provided to you (including things like training or workshops) and/or that you have enquired about, and our response to you; and

(8) any other personal information provided by you or by a third party on your behalf.

As a Website Visitor:

(1) your browser session and geo-location data, device and network information, statistics on page views and sessions, acquisition sources, search queries and/or browsing behavior;

(2) information about your access and use of our Services, including through the use of Internet cookies, your communications with our online Services, the type of browser you are using, the type of operating system you are using and the domain name of your Internet service provider;

(3) additional personal information that you provide to us, directly or indirectly, through your use of our Services, associated applications, associated social media platforms and/or accounts from which you permit us to collect information; and

(4) any other personal information provided by you or by a third party on your behalf.

As a user of Aware (limited to persons residing in Australia):

(1) we do not collect any personal information when you use our Aware questionnaire. All information provided by you when participating in the Aware questionnaire is only utilized to prepare the Aware questionnaire response, and is immediately deleted. In any event, the information collected is not identifiable.

(2) once you leave the Aware webpage to book an appointment with SwiftDoc, you acknowledge you will be subject to SwiftDoc’s Privacy Policy, available on their website: https://swiftdoc.com/.

Purposes for the Collection, Use and Disclosure of Personal Information

If we are providing the Services on behalf of an Organization (such as your employer, health plan, or health care provider) who has paid (in whole or in part) for you to use the Services, we will abide by the terms of our agreement with that third-party partner related to the use of the personal information we collect. Otherwise, we may collect, hold, use and disclose personal information for the following purposes:

(1) to companies in the Osara Health Group (CancerAid Pty Ltd, Osara Health Inc and Osara Health Canada Inc), for the purposes of delivering the program.

(2) to provide our Services to you, including to:

(3) to contact and communicate with you about our Services, including to

(4) To send you text messages and push notifications;

(5) To personalize your experience on our Services such as by providing tailored content, health coaching and recommendations;

(6) for internal record keeping, administrative, invoicing and billing purposes;

(7) for analytics, market research and business development, including to operate and improve our Services and associated applications and to develop new products, services, features, and functionality;

(8) to generate anonymized, aggregate data containing only de-identified, non-personal information that we may use to publish reports;

(9) at your request, to refer you to a third party provider;

(10) to comply with our legal obligations and resolve any disputes that we may have, including enforcing our Terms or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency;

(11) to find and prevent fraud, and respond to trust and safety issues that may arise;

(12) if you have applied for employment with us, to consider your employment application;

(13) if otherwise required or authorized by law; and

(14) for other purposes for which we provide specific notice at the time the information is collected.

(15) where you are an Osara Health Participant and your insurer, employer or health system (“Provider”) funds your participation in the Osara Health Program, they may require that we provide information back to them about your participation in the Osara Health Program so that they can assess your engagement in the program and identify additional services that may be of benefit to you. This information may include:

(16) We may create and give the Provider anonymized and aggregated analytics (i.e. all reasonably identifiable information has been removed so that you cannot be identified) about your use of the program and our technology, and the information you share with us as part of the program. For example, we may provide the Provider an insight into the median age of participants in the program, or aggregated and deidentified feedback on how the program can be improved.

(17) Throughout the program, we may recommend additional programs not managed by Osara Health, but available to you through your Provider. By participating in the program, you consent to us sharing your name and contact information with these providers for the purposes of those providers contacting you by phone, SMS and email about their services.

Sensitive information + Health Information: We only collect, hold, use and disclose sensitive information, including health information, for the following purposes:

(1) where you are an Osara Health Participant and your Provider funds your participation in the Osara Health Program, they may require that we provide information back to them about your participation in the Osara Health Program so that they can assess your engagement in the program and identify additional services that may be of benefit to you. Please check the privacy collection notice provided to you and/or the terms and conditions for your particular Osara Health Program to see if we are required to disclose your information to the Provider. This information may include:

(2) any purpose you consent to, for example where you as an Osara Health Program Participant consent to us disclosing your personal information or outcomes from your Osara Health Program sessions with the relevant Organization funding your participation in the Osara Health Program;

(3) the primary purpose for which it is collected, which may be as follows:

(4) secondary purposes that are directly related to the primary purpose for which it was collected, including disclosure to the below listed third parties as reasonably necessary for or directly related to the purpose for which it was collected;

(5) to contact emergency services, or to speak with relevant authorities, employers, providers, your family, partner or support person where we reasonably believe there is a serious risk to the life, health or safety of you or another person and it is impracticable for us to obtain your consent; and

(6) if otherwise required or authorized by law.

(7) We may create and give the Provider anonymized and aggregated analytics (i.e. all reasonably identifiable information has been removed so that you cannot be identified) about your use of the program and our technology, and the information you share with us as part of the program. For example, we may provide the Provider an insight into the median age of participants in the program, or aggregated and deidentified feedback on how the program can be improved.

(8) Throughout the program, we may recommend additional programs not managed by Osara Health, but available to you through your Provider. By participating in the program, you consent to us sharing your name and contact information with these providers for the purposes of those providers contacting you by phone, SMS and email about their services.

Disclosure of Personal Information to Third Parties

Exclusion: No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We will only disclose personal information to a third party where we are permitted or required to do so by law or you have consented. The types of third parties that we may disclose personal information to, include:

(1) third party service providers for the purpose of providing the Services to you, including (without limitation):

(2) third party service providers for the purpose of obtaining medical opinions, only at your request;

(3) Research: Including your Data in research is optional and is not a condition of participating in an Osara Health Program. If you enroll in an Osara Health Program and do not tell us you wish to opt out, as set out in the Research part of your program terms, you consent to the following:

a) we may collect and use the following information we obtain from you to improve our programs and for research purposes: demographic data, program progress, symptom data, survey responses, call notes, insurance claim data, medical records and medical utilization data (“Data”);

b) we may share Data for research purposes with companies in the Osara Health group and with our research partners, such as universities, hospitals, other research institutions and insurers, which may include your Provider where your program is funded by one. Anyone we share Data with is required to keep it confidential and to use it only for the research we have agreed with them;

c) the results of our research may be published in scientific journals, presented at conferences or otherwise made publicly available. Published or presented results will only ever include deidentified or aggregated Data. We will take reasonable steps to ensure you cannot reasonably be identified from them, including by not reporting results about groups small enough that an individual could be identified;

d) you may withdraw from research at any time by letting your coach know or emailing us at contact@osarahealth.com. Once you withdraw, we will not use your Data in any new research. We cannot remove Data that has already been deidentified, included in a completed analysis, or published; and

e) we retain Data in accordance with the “Retention of Personal and Health Information” section of this Privacy Policy.

(4) our employees and contractors (including but not limited to our health coaching, customer success, engineering or other Osara Health team members),and/or related entities;

(5) our existing agents or business partners;

(6) sponsors or promoters of any promotions or competition we run (this does not include health information);

(7) service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets. The use of your information following any of these events will be governed by the provisions of this Privacy Policy in effect at the time the applicable information was collected;

(8) courts, tribunals, regulatory authorities and law enforcement officers, as required or authorized by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights, including any right to payment;

(9) third parties to collect and process data, such as Google Analytics (please see below for further information), and/or other relevant analytics businesses;

(10) third parties, with your consent; and

(11) any other third parties as required or permitted by law, such as where we receive a subpoena.

Marketing: We do not rent, sell, or share information about you with nonaffiliated companies for their direct marketing purposes.

Overseas disclosure (for Australia, United States, or New Zealand participants): Where we disclose your personal information to third parties listed above, these third parties may store, transfer or access personal information outside of the country in which you are residing.

We can only disclose your personal information to countries with laws which protect your personal information in a way which is substantially similar to the privacy laws we are obliged to comply with or we will take such steps as are reasonable in the circumstances to ensure that those third parties protect and handle the personal information in a manner that is consistent with the principles contained in the Australian or New Zealand privacy laws applicable to our handling of your personal information.

Overseas disclosure (for Canada participants): We do not disclose your personal information to third parties outside of Canada.

Analytics Partners: We use analytics services such as Google Analytics to collect and process certain analytics data. These services may also collect information about your use of other websites, apps, and online resources. You can learn more about Google’s practices by visiting https://www.google.com/policies/privacy/partners/. To help us understand how you use our Services and to help us improve them, we automatically receive information about your interactions with our Services, like the pages or other content you view, the searches you conduct, purchases you make, your comments, any content you post, and the dates and times of your visits.

Google Analytics Advertising Features: We have enabled Google Analytics Advertising Features. We and third-party vendors use first-party cookies (such as the Google Analytics cookie) or other first-party identifiers, and third-party cookies (such as Google advertising cookies) or other third-party identifiers together.

You can opt-out of Google Analytics Advertising Features including using a Google Analytics Opt-out Browser add-on found here. To opt-out of personalized ad delivery on the Google content network, please visit Google’s Ads Preferences Manager here or if you wish to opt-out permanently even when all cookies are deleted from your browser you can install their plugin here. To opt out of interest-based ads on mobile devices, please follow these instructions for your mobile device: On android open the Google Settings app on your device and select “ads” to control the settings. On iOS devices with iOS 6 and above use Apple’s advertising identifier. To learn more about limiting ad tracking using this identifier, visit the settings menu on your device.

Use of ZoomInfo WebSights

Osara Health uses a third-party analytics service called WebSights by ZoomInfo to gather insights about visits to our website. This tool collects only firmographic information – meaning business-related data about your visit, such as your company or organization name, industry, company size, office location, and similar organizational details. No personal data (e.g., your name, email, contact information, or any data that can identify you as an individual) is collected through WebSights. WebSights identifies the company associated with a visitor’s IP address by matching it against ZoomInfo’s business database, allowing us to understand what companies are interacting with our site without identifying individual visitors. We use these firmographic insights to analyze our website traffic and improve our services for businesses, while upholding our commitment to individual privacy. The firmographic data collected via WebSights is used in accordance with this Privacy Policy and applicable privacy laws in each of the jurisdictions in which we operate.

Opt-Out Mechanism for WebSights: We respect your choice to control data collection. If you do not want your website visits to be included in our WebSights analytics, you have the right to opt out. You may request exclusion from WebSights tracking at any time by emailing our Privacy Officer at contact@osarahealth.com. Please include in your request the subject line “WebSights Opt-Out” and provide information necessary to identify your visits (for example, your company name or IP address, if known). Once we receive your opt-out request, we will work to exclude your future visits from being tracked by ZoomInfo WebSights on our site. Alternatively, you can manage your preferences by adjusting your browser settings to block the ZoomInfo WebSights cookie. Opting out or disabling this tracking will not affect your access to our website or services.

Cookies and WebSights Tracking: ZoomInfo WebSights uses cookies to collect firmographic information about your visit. A “cookie” is a small text file placed on your browser when you visit our site. The WebSights cookie allows ZoomInfo to recognize repeated visits from the same browser and to retrieve company-related details linked to your IP address. This cookie does not collect personal information about you; it only facilitates the gathering of company data for analytics purposes. You can control or disable cookies at any time through your browser settings – for example, you may refuse all third-party cookies or delete cookies whenever you wish. Note: If you disable the WebSights cookie (or cookies in general), ZoomInfo will not be able to track your organization’s visits to our site.

Your Rights and Controlling Your Personal Information

Depending on jurisdiction, and subject to legal or contractual requirements, you may have the following privacy rights:

Your choice: Please read this Privacy Policy carefully. If you provide personal information to us, you understand we will collect, hold, use and disclose your personal information in accordance with this Privacy Policy. You do not have to provide personal information to us, however, if you do not, it may affect our ability to provide our Services to you and your use of our Services.

Anonymity: Where practicable we will give you the option of not identifying yourself or using a pseudonym in your dealings with us.

Restrict and unsubscribe: To object to processing for direct marketing/unsubscribe from our email database or opt-out of communications (including marketing communications), please contact us using the contact details provided below or opt-out using the opt-out facilities provided in the communication.

Access: You may request access to, or a copy of, the personal information that we hold about you. A reasonable administrative fee may be payable for the provision of such information. Please note, in some situations, we may be legally permitted to charge a fee for access or to withhold access to your personal information, as permitted or required under applicable privacy laws.

Correction: If you believe that any information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please contact us using the details below. We will take reasonable steps to promptly correct any information found to be inaccurate, out of date, incomplete, irrelevant or misleading. Please note, in some situations, we may be legally permitted to not correct your personal information.

Consent withdrawal: You may also exercise your right to withdraw your consent to the collection, use and disclosure of personal information in accordance with this Privacy Policy at any time upon reasonable written notice. Please note that the withdrawal of your consent may affect our ability to continue to provide you with the Services that you have or would like to receive because the continued use and disclosure of your personal information is a necessary part of making the Services available

Complaints: If you wish to make a complaint, please contact us using the details below and provide us with full details of the complaint. We will promptly investigate your complaint and respond to you, in writing, setting out the outcome of our investigation and the steps we will take in response to your complaint. You also have the right to contact the relevant privacy authority.

Exercising your Rights: Unless otherwise noted above, to exercise any of your rights described in this Privacy Policy, please contact us using the contact details provided below.

Call Recording

When We Record Calls

With your consent, we record all coaching calls and other calls with our team, unless you tell us otherwise.

We will ask for your verbal consent to call recording at the start of your first coaching call. By giving your consent, you agree to the recording of your calls for the remainder of your program. We will remind you before each later call that it will be recorded, and you can tell us then if you do not want that call recorded. We will not record your calls if you do not agree.

Call recording is not a condition of your program. Whether or not you agree, you can continue to take part in the program and the care you receive will not be affected.

Why We Record Calls

We record calls to:

Who Can Access Recordings

Only authorized Osara Health staff can access recordings. Recordings are not shared with, sold to, or disclosed to any third party, except where required by law or as expressly agreed in a customer agreement (such as a Business Associate Agreement with your employer or insurer).

How We Store Recordings

All recordings are stored on Amazon Web Services (AWS) infrastructure in the region that corresponds to your location:

How Long We Keep Recordings

We keep recordings for the periods set out in the “Retention of Personal and Health Information” section of this Privacy Policy. When a recording is no longer required, we securely destroy it.

Your Rights and Choices

You can ask us not to record a call, or to stop recording during a call, by telling the person you are speaking with or by emailing contact@osarahealth.com. You can also withdraw your consent to call recording at any time in the same way. After you withdraw, no further calls will be recorded. Recordings made before you withdrew will be kept in line with our retention periods, unless you ask us to delete them.

Subject to the law, you can ask to access or receive a copy of a recording of your call, to correct your information, or to have a recording deleted. Please see the “Your rights and controlling your personal information” section of this Privacy Policy for how to make a request or a complaint.

Call Recording and AI-Assisted Summaries Are Separate

Recording a call is separate from AI-assisted call summarization, described in the next section. You can agree to one without the other.

Country-Specific Information

Australia. We obtain the consent of everyone on the call before recording.

New Zealand. We tell you before recording and record only with your agreement. Recordings of New Zealand calls are stored in Australia. For New Zealand residents, Osara adopts security safeguards comparable to those required under New Zealand law.

Canada. We tell you at the start of each call that it is being recorded and why, as Canadian privacy law requires.

United States. We obtain the consent of everyone on the call before recording, including in states that require all parties to consent. Recordings of calls provided on behalf of a health plan are protected health information (PHI) and are protected as described in the “United States” paragraph of the AI-Assisted Call Summarisation section below.

AI-Assisted Call Summarisation

How We Use AI on Coaching Calls

With your consent, our coaches use Heidi, an AI medical scribe tool provided by Heidi Health Trading Pty Ltd (ABN 84 649 783 871) (Heidi Health), during coaching calls, unless you tell us otherwise. Heidi listens to the call in real time and produces a transcript and a draft summary of what was discussed. Your coach reviews, edits and approves the summary before it is saved to your program record. Heidi does not provide coaching, advice or treatment, and it does not make decisions about you.

What Information Is Involved

Heidi processes the content of your call. This may include your name, contact details, health information (such as your diagnosis, treatment, symptoms and well-being), information about your work and daily life, and information about other people you mention.

Why We Use It

We use Heidi so coaches can give you their full attention, and so your program record is accurate and complete. We do not use Heidi for any other purpose.

How Heidi Health Handles Your Information

Heidi Health is our service provider. Under our written agreement with Heidi Health, it:

Heidi Health applies de-identification to the transcripts and notes held on its platform and encrypts information in transit and at rest. Any access by Heidi Health staff is logged and audited. Heidi Health holds ISO 27001, ISO 42001 and SOC 2 Type 2 certifications. More information is available at Heidi Health’s Trust Center (trust.heidihealth.com).

Your coach copies the approved summary into our own systems before Heidi Health deletes its copy. We keep the approved summary as part of your program record for the periods set out in the “Retention of Personal and Health Information” section of this Privacy Policy.

Your Choices

Using Heidi is optional. Your coach will ask for your consent at the start of your first coaching call and remind you before each later call. You can refuse, or withdraw your consent at any time, by telling your coach or emailing contact@osarahealth.com. If you refuse or withdraw, your coach will take notes manually and you can continue the program as normal. Withdrawing consent does not affect summaries already created, but you can ask us to review or correct them.

Automated Decisions

We do not use Heidi, or any other computer program, to make decisions about you that could significantly affect your rights or interests, such as your eligibility for the program or any insurance benefit. All decisions are made by people.

Country-Specific Information

Australia. Heidi stores information from Australian calls in Australia. We collect health information only with your consent, as required by the Australian Privacy Principles. If you have a concern about our use of AI, you can complain to us, and then to the Office of the Australian Information Commissioner (oaic.gov.au).

New Zealand. Heidi stores information from New Zealand calls in Australia. Before sending your information overseas, we make sure Heidi Health is required by contract to protect it in a way comparable to the New Zealand Privacy Act 2020 and the Health Information Privacy Code 2020. You can complain to us, and then to the Office of the Privacy Commissioner (privacy.org.nz).

Canada. Heidi stores information from Canadian calls in Canada, in the province of Québec. If you live outside Québec, this means your information is stored in a different province from yours.

United States. When we provide the program on behalf of a health plan or other HIPAA covered entity, the information discussed on your calls is protected health information (PHI). We handle it as a business associate under our agreement with that organization, and Heidi Health handles it as our subcontractor under a business associate agreement. We only use and disclose PHI as those agreements and HIPAA allow. Your rights about PHI are described in your health plan’s Notice of Privacy Practices. Heidi stores information from US calls in the United States.

Storage and Security

We are committed to ensuring that the personal information we collect is secure. In order to prevent unauthorized access or disclosure, we have put in place suitable physical, electronic and managerial procedures, to safeguard and secure personal information and protect it from misuse, interference, loss and unauthorized access, modification and disclosure and maintain governance policies and practices which ensure the protection of your personal information. Depending on the volume and sensitivity of the information, the purposes for which it is used and the format in which it is stored, we implement a combination of measures to protect your personal information, including:

While we are committed to security, to the fullest extent permitted by law we do not guarantee the security of any information that is transmitted to or by us over the Internet, and the transmission and exchange of information is carried out at your own risk.

Retention of Personal and Health Information

1. General Approach

We keep personal information, including health information, only for as long as we need it to provide our services, meet our contractual obligations to our partners, and comply with applicable laws, regulations and professional standards. The retention periods below are minimums. We may keep information for longer where required by law, by a contract with an insurance partner, or where the information is needed for an actual or anticipated legal claim, complaint, investigation or audit.

2. Australia

We retain health information for at least 7 years from the date of the last service provided to the individual, in accordance with applicable state and territory health records legislation and the Australian Privacy Principles.

3. New Zealand

We retain health information for at least 10 years from the day after the last date on which we provided services to the individual, in accordance with the Health (Retention of Health Information) Regulations 1996 and the Health Information Privacy Code 2020.

4. Canada

We retain health information for at least 10 years from the date of the last service provided to the individual, or longer where required by applicable provincial legislation or professional regulatory standards. We meet the requirements of applicable federal and provincial privacy legislation.

5. United States

Where we act as a business associate. Where we provide services as a business associate under the Health Insurance Portability and Accountability Act (HIPAA), we retain protected health information in accordance with our business associate agreements and applicable law. When a business associate agreement ends, we return or destroy protected health information as required by that agreement. Where return or destruction is not feasible, or where we are required by law to retain information, we continue to protect it under our HIPAA privacy and security safeguards and limit its further use and disclosure to the purposes that make return or destruction infeasible. We retain HIPAA compliance documentation, including our policies and procedures, for at least 6 years from the date of creation or the date it was last in effect, whichever is later.

Where HIPAA does not apply. Where we provide services in circumstances where HIPAA does not apply, we retain health information for at least 7 years from the date of the last service provided to the individual, or longer where required by our agreements with partners or applicable state law. When the information is no longer needed for these purposes, we securely destroy or de-identify it in accordance with section 7.

6. Non-Health Personal Information

We retain other personal information, such as contact details and account information, for as long as needed for the purpose it was collected, and financial and transaction records for as long as required by applicable tax and corporate laws.

7. Destruction and De-Identification

When information is no longer required, we securely destroy it or permanently de-identify it. Where information is held in backup systems, it is deleted in line with our standard backup cycles and remains protected until deletion.

8. Partner Arrangements

Where we provide services on behalf of an insurance partner, the partner’s contractual requirements may set a different retention period, or require us to return or destroy information at the end of the arrangement. In those cases, we follow the requirements of that contract, subject to applicable law.

9. Your Rights and Retention

You may request access to, or correction of, your personal and health information as described in the “Your rights and controlling your personal information” section of this Privacy Policy. Where applicable law gives you a right to request deletion, we will delete your information unless we are required to keep it by law, by a professional or regulatory standard, or by an agreement with a partner, or where it is needed for an actual or anticipated legal claim. If we cannot delete your information for one of these reasons, we will tell you and continue to protect it in accordance with this Privacy Policy. Where we provide services as a business associate under HIPAA, we will handle requests in accordance with our business associate agreements, which may involve referring your request to the relevant partner.

Children’s Privacy

We do not knowingly collect, maintain, or use personal information from children under 18 years of age, and no part of our Service(s) is directed to children. If you learn that a child has provided us with personal information in violation of this Privacy Policy, then you may alert us at contact@osarahealth.com.

Our Services may contain links to other websites, products, and services that we do not own or operate. We do not have any control over those websites and we are not responsible for the protection and privacy of any personal information which you provide whilst visiting those websites. Those websites are not governed by this Privacy Policy. We encourage you to read their privacy policies before providing any information to them.

Update Your Information

Osara Health App Users and Osara Health Program Participants can update their account and profile information or close their account through their profile settings or via their health coach.

Amendments

We may, at any time and at our discretion, vary this Privacy Policy by publishing the amended Privacy Policy on our website at www.osarahealth.com. We recommend you check our website regularly to ensure you are aware of our current Privacy Policy. If we materially change the ways in which we use or share personal information previously collected from you through the Services, we will notify you through the Services, by email, or other communication.

For any questions or notices, please contact our Privacy Officer at:

Address:

Email: contact@osarahealth.com
Last updated: 13 October 2026