Privacy Policy
How Oasys collects, uses, and protects personal and protected health information.
Privacy Policy
Last updated October 2, 2026
This Privacy Policy for Oasys Health, Inc. (doing business as Oasys) ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:
Visit our Site at oasys.health, or any website of ours that links to this Privacy Policy
Engage with us in other related ways, including any sales, marketing, or events
Protected Health Information. When healthcare providers use Oasys, the health information they store in the platform is Protected Health Information ("PHI"). PHI is governed by the Health Insurance Portability and Accountability Act ("HIPAA") and by our Business Associate Agreement ("BAA") with your provider, not by this Privacy Policy. Your provider controls your health records. Requests to access, amend, or delete those records should go to your provider, and we will support them as our BAA requires. This Privacy Policy covers other personal information, such as information collected through our website, marketing, and account contact details.
Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at privacy@oasys.health.
Summary of Key Points
This summary provides key points from our Privacy Policy, but you can find detail on each topic in the full policy below.
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.
Do we process any sensitive personal information? Yes. Health information that providers store in Oasys is PHI and is governed by HIPAA and our BAAs, as described under "Protected Health Information" above.
Do we collect any information from third parties? We may receive personal information from third parties, such as service providers, integrations, Customers, or other sources, when necessary to provide, support, and improve the Services.
How do we process your information? We process your personal information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your personal information for other purposes with your consent.
In what situations and with which types of parties do we share personal information? We may share personal information in specific situations and with specific categories of third parties.
How do we keep your personal information safe? We use administrative, technical, and physical safeguards, including encryption in transit and at rest, role-based access controls, and audit logging, to protect your information.
What are your rights? Depending on where you are located geographically and to the extent that we are subject to the jurisdiction of your state, the applicable privacy law may mean you have certain rights regarding your personal information.
How do you exercise your rights? Email us at privacy@oasys.health. For health records held by your provider, contact your provider directly.
Want to learn more about what we do with any information we collect? Review the Privacy Policy in full.
Table of Contents
What information do we collect?
How do we process your information?
What legal bases do we rely on to process your personal information?
When and with whom do we share your personal information?
Do we use cookies and other tracking technologies?
Do we offer artificial intelligence-based products?
How long do we keep your information?
How do we keep your information safe?
Do we collect information from minors?
What are your privacy rights?
Controls for do-not-track features
Do United States residents have specific privacy rights?
Do we make updates to this policy?
How can you contact us about this policy?
1. What Information Do We Collect?
Personal information you disclose to us
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you create an account to receive the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.
Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include, among other information, the following:
name
gender
mailing address
phone number
email address
employer information
job title
account username
passwords
contact or authentication data
contact preferences
health care provider information
insurance and payment information
Sensitive Information. When necessary, with your consent or as otherwise permitted by applicable law, we may process the following categories of sensitive information:
health data
information revealing race or ethnic origin
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
Information automatically collected
In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.
We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.
The information we collect includes:
Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called "crash dumps"), and hardware settings).
Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
Location Data. We may collect approximate location information derived from IP address or device settings.
2. How Do We Process Your Information?
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.
We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
To provide and operate the Services. We process information to deliver the functionality of the platform, including scheduling, documentation, analytics, and other tools available through the Services.
To support AI-powered features. Some features of the Services use artificial intelligence or machine learning technologies to analyze information submitted through the platform and generate insights, summaries, or other outputs. Additional information about how AI features process data is described in Section 6, "Do we offer artificial intelligence-based products?"
To improve and maintain the Services. We may process information to understand how users interact with the Services, troubleshoot issues, improve performance, and develop new features.
To communicate with users. We may use your information to send administrative messages, service updates, and other communications related to your use of the Services.
To maintain security and prevent fraud. We process information to detect, investigate, and prevent fraudulent, unauthorized, or illegal activity and to maintain the safety and integrity of the Services.
To comply with legal obligations. We may process personal information when necessary to comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
3. What Legal Bases Do We Rely On to Process Your Information?
This section applies to personal information other than PHI. PHI is used and disclosed only as permitted by HIPAA and our BAAs.
In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.
We may process your personal information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.
In limited cases, applicable law permits us to process personal information without your consent, including:
to detect, investigate, and prevent fraud, security incidents, or illegal activity
to comply with a subpoena, warrant, court order, or other legal obligation
in connection with a merger, acquisition, or sale of assets, subject to confidentiality obligations
4. When and With Whom Do We Share Your Personal Information?
In Short: We may share information in specific situations described in this section and/or with the following categories of third parties.
Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who we utilize to provide the Services and/or perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. Any vendor that handles PHI must first sign a BAA with us. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will also not share your personal information with any organization apart from us. They also commit to protect the personal information they hold on our behalf and to retain it for the period we instruct.
We also may need to share your personal information in the following situations:
Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
Business Partners. We may share your information with our business partners to offer you certain products, services, or promotions.
5. Do We Use Cookies and Other Tracking Technologies?
In Short: We may use cookies and other tracking technologies to collect and store your information.
We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.
We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising, including to help manage and display advertisements or to tailor advertisements to your interests. The third parties and service providers use their technology to provide advertising about products and services tailored to your interests which may appear either on our Services or on other websites.
To the extent these online tracking technologies are deemed to be a "sale"/"sharing" (which includes targeted advertising, as defined under the applicable laws) under applicable US state laws, you may be able to opt out of these online tracking technologies by submitting a request as described below under section "Do United States residents have specific privacy rights?"
Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Policy.
In general, we use or may use any of the following four different types of cookies:
Strictly necessary cookies: These cookies are necessary to enable the basic features of the Site, including any of our applications, such as providing a secure login.
Functional cookies: These cookies allow our Site to remember your site preferences and choices you make on the Site. We also use functional cookies to facilitate navigation, to display content more effectively, and to personalize your experience.
Advertising cookies: Advertising cookies allow us to select which advertisements and offers you may like. We also use cookies to track online responses to advertisements and other marketing to better understand your interests so that we can present more relevant advertisements and messages to you.
Analytics cookies: Analytics cookies help us improve our website by collecting and reporting information on how you use it.
Advertising and analytics cookies are used only on our public marketing website. We do not use third-party advertising or tracking technologies within the Oasys application, client portal, or any page where PHI is entered or displayed.
6. Do We Offer Artificial Intelligence-Based Products?
In Short: Certain features of the Services use artificial intelligence or machine learning technologies to generate insights, summaries, or other outputs based on information submitted through the Services.
As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). These AI Products are designed to assist users by analyzing information submitted through the Services and generating outputs such as summaries, documentation, insights, or recommendations.
Use of AI Technologies
Certain AI Products rely on third-party service providers ("AI Service Providers"), including OpenAI, to process information and generate outputs requested by users. When you use these features, information submitted through the Services (including user inputs and related data) may be transmitted to and processed by these AI Service Providers solely for the purpose of providing the requested functionality.
These AI Service Providers process information on our behalf and are contractually restricted from using such data for their own independent purposes.
Use of Data in AI Systems
Oasys does not use identifiable customer or patient data submitted through the Services to train generalized artificial intelligence models. We may use aggregated, de-identified information to operate, maintain, and improve the Services, including the development and refinement of machine learning systems.
Human Oversight
AI-generated outputs are intended to support users and may contain errors or inaccuracies. Users are responsible for reviewing and evaluating AI-generated outputs before relying on them.
Additional Information
Additional details about how Oasys designs, deploys, and governs its AI Products are described in our AI Policy.
6.1 Use of Google Workspace API Data
In Short: We do not use any data obtained through Google Workspace APIs to train, develop, or improve generalized artificial intelligence (AI) or machine learning (ML) models.
If you choose to integrate your Google account with our Services (e.g., for calendar syncing), we will request access to certain data through Google Workspace APIs. This access is used solely to provide the intended functionality within our platform, such as allowing users to view and manage appointments via Google Calendar.
We affirm the following:
We do not use any data obtained through Google Workspace APIs to develop, improve, or train generalized AI or ML models.
We only access, use, store, or share this data as necessary to provide or improve specific user-facing features that are explicitly described in our application.
We comply with Google's Limited Use requirements, as outlined in their User Data Policy.
For questions about how we handle this data, please contact us at privacy@oasys.health.
7. How Long Do We Keep Your Information?
In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Policy unless otherwise required by law.
We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, including to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, and maintain appropriate business and security records. In some cases, we may retain information after an account is closed where required or permitted by law.
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.
8. How Do We Keep Your Information Safe?
In Short: We aim to protect your personal information through a system of organizational and technical security measures.
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. If we become aware of a security incident affecting your information, we will notify affected parties as required by law and, for PHI, as required by HIPAA and our BAAs.
9. Do We Collect Information From Minors?
In Short: We do not market to or knowingly collect personal information from children through our website. Providers may keep health records for minor patients in Oasys, and those records are PHI.
Website and accounts. We do not knowingly collect personal information from, or market to, children under 18 through our website or marketing activities. If you believe we have done so, contact privacy@oasys.health and we will delete it.
Patient records. Healthcare providers using Oasys may maintain health records for patients under 18. Those records are PHI, governed by HIPAA and the provider's BAA with us, and are managed by the provider. Parents and guardians should direct requests about a minor's records to the provider.
10. What Are Your Privacy Rights?
In Short: Depending on your state of residence, you may have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your state of residence.
In some jurisdictions, you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section "How can you contact us about this policy?" below.
We will consider and act upon any request in accordance with applicable data protection laws.
Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section "How can you contact us about this policy?" below.
However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.
Account Information
If you would at any time like to review or change the information in your account or terminate your account, you can:
Log in to your account settings and update your user account.
Upon a valid request, we will deactivate or delete your account information from active systems as appropriate, subject to any information we need to retain for legal, compliance, security, fraud prevention, backup, contractual, or recordkeeping purposes.
If you have questions or comments about your privacy rights, you may email us at privacy@oasys.health. If your information is held in Oasys by your healthcare provider, contact your provider to access, amend, or delete those records. We will support your provider in responding.
11. Controls for Do-Not-Track Features
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Policy.
12. Do United States Residents Have Specific Privacy Rights?
In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, Virginia, or any other state that has enacted privacy laws, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.
Your Rights
You have rights under certain US state data protection laws. However, these rights are not universal and are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:
Right to know whether or not we are processing your personal information
Right to access your personal information
Right to correct inaccuracies in your personal information
Right to request the deletion of your personal information
Right to obtain a copy of the personal information you previously shared with us
Right to non-discrimination for exercising your rights
Right to opt out of the processing of your personal information if it is used for targeted advertising (or sharing as defined under California's privacy law), the sale of personal information, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")
Depending upon the state where you live, you may also have the following rights:
Right to obtain a list of the categories of third parties to which we have disclosed personal information (as permitted by applicable law)
Right to obtain a list of specific third parties to which we have disclosed personal information (as permitted by applicable law)
Right to limit use and disclosure of sensitive personal information (as permitted by applicable law, including California's privacy law)
Right to opt out of the collection of sensitive data and personal information collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including Florida's privacy law)
How to Exercise Your Rights
To exercise these rights, you can contact us by submitting a data subject access request, by emailing us at privacy@oasys.health, or by referring to the contact details at the bottom of this document.
We do not sell personal information. You can opt out of targeted advertising on our marketing website by adjusting your browser's cookie settings or emailing privacy@oasys.health.
Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.
Request Verification
Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.
If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.
Appeals
If you are a resident in a US state that provides any of the rights set forth in this section and Oasys refuses to take action on your request related to any of the above specified rights or any other privacy related request, you may appeal Oasys' refusal by emailing us. We will inform you in writing of any action taken or not taken in response to your appeal within sixty (60) days of receiving your appeal. Our response will include a written explanation of the reason or reasons for our decision. If we deny your appeal, you may contact the attorney general in your state to file a complaint.
To submit an appeal, email us the basis for your appeal at privacy@oasys.health. Please include the following information in your email:
Name
Address
Email Address
What you are seeking
Basis for your appeal
California "Shine The Light" Law
California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section "How can you contact us about this policy?"
Nevada Privacy Rights
Nevada law (SB 220) permits residents of Nevada to opt-out of the sale of certain kinds of Personal Information. A sale under Nevada law is the transfer of this Personal Information to third parties for monetary consideration so these third parties can then re-sell or license the sold information. We do not sell your Personal Information to third parties as defined in Nevada law. If you are a Nevada resident and wish to opt-out of the sale of your Personal Information, should we change our practices in the future, email privacy@oasys.health or write to the address in Section 14.
13. Do We Make Updates to This Policy?
In Short: Yes, we will update this policy as necessary to stay compliant with relevant laws.
We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Policy. If we make material changes to this Privacy Policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Policy frequently to be informed of how we are protecting your information.
14. How Can You Contact Us About This Policy?
Contact Information:
Oasys Health, Inc.
10–12 East 23rd Street, New York, NY 10010
Email: privacy@oasys.health
Website: https://oasys.health