Privacy Policy

Privacy Policy

This Privacy Policy was last updated July 17, 2023.

Welcome. Onco360 (“Onco360,” “we,” “us,” or “our”) values our relationship with you and takes your privacy seriously. The purpose of this Privacy Policy is to identify how we may process, collect, store, disclose and use the data that we collect from you in connection with your access to and use of our website https://www.onco360.com/ (the “Site”), our web-based provider information management platform (the “Provider Portal”), and our patient information management platform and mobile application as downloaded on your smartphone (the “Patient Portal,” and together with the Site and the Provider Portal, the “Onco360 Services”). This Privacy Policy also describes your rights with respect to your Personal Information, all as described in more detail below.

Please review this Privacy Policy from time to time; by providing information to us or accessing and/or using the Onco360 Services, you accept and agree to the terms of this Privacy Policy and the use of your data and Personal Information as described in this Privacy Policy. If you do not agree to the terms of this Privacy Policy or any subsequent modifications, you should not access or use the Onco360 Services or provide any information or data to Onco360.

We may update or modify this Privacy Policy at any time, by posting the amended version, including the effective date of the amended version, to the Onco360 Services. We will announce any material changes to this Privacy Policy through an alert on the Onco360 Services.

For state-specific privacy rights or for California, Connecticut, Virginia, or Colorado residents, click here for additional terms and protections.

1. How to Contact Us.

You can update your preferences with respect to your information by contacting us at the email address or phone number below. Additionally, if you have any questions or concerns about this Privacy Policy or our use of your Personal Information, please do not hesitate to contact us through any of the methods listed below.

Mail:    13410 Eastpoint Centre Drive, Suite 101
               Louisville, KY 40223

Phone: (877) 662-6633

Email:   [email protected]

To make a request under a state privacy law described below, you may visit our rights request web form: Privacy Rights Request

2. Personal Information.

While using the Onco360 Services, we may ask you to provide us with certain personally identifiable information (“Personal Information”).  Personal Information is information that identifies, relates to, describes, can reasonably be associated with, or can reasonably be linked to a particular individual or household.

We collect information from you both when you provide it voluntarily and also automatically when you access or use the Onco360 Services, as described below.  We collect Personal Information from you and any devices (including mobile devices) you use when you: use the Onco360 Services, register for an account with us, apply for a job with Onco360, sign up for the Onco360 Mobile Text Program, update or add information to your account, make a payment, provide us with information on a web form, over the telephone, or via email, or otherwise correspond with us.

In order to provide the Onco360 Services to you, the Onco360 Services may also access and process Protected Health Information (“PHI”) as defined by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Our use of PHI is governed by separate terms and conditions between Onco360 and our customers. For information about how Onco360 handles PHI, please see our Notice of Privacy Practices. PHI should only be submitted through the Onco360 Services as permitted or required for use of the Onco360 Services.

3. The Information We Collect.

We may collect the following categories of Personal Information from you, from the following sources, depending on your interactions with the Onco360 Services and the choices you make, as further described in the chart below. The information we gather enables us to provide the Onco360 Services to you and personalize, improve, and continue to operate the Onco360 Services. We will only use your information for the purposes identified below, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose, as further described in the chart below.

We disclose non-Personal Information with third parties at our discretion.  We do not sell your Personal Information or share your Personal Information for purposes of cross-contextual advertising. We do not sell or share the Personal Information of minors under 16 years of age and have no actual knowledge of any such sales or disclosures. In connection with the Onco360 Services, we may disclose your Personal Information with certain third parties who we engage to help us run our business and perform the services, including under the following circumstances:

• Software and service providers we use to manage and process your information, for example, providers of payment processing software.
• Healthcare-related service providers, such as pharmacies, physicians, and other healthcare providers.
• Product-related service providers, such as our vendors and manufacturers.
• Business partners, including those who provide a product or service in partnership or collaboration with us.
• Web analytics providers who monitor and analyze the use of the Onco360 Services (including Google Analytics).
• Other third parties with whom you expressly request that we disclose your Personal Information.

Additionally, we will disclose your Personal Information with third parties where required by law, where it is necessary in connection with the Onco360 Services, to protect the safety or property of Onco360, our users, or employees, or where we have another legitimate interest in doing so.

Most of the third parties with whom we disclose your Personal Information are located and store your information in the United States, although some may be located or store your information outside of the United States. These third parties are only permitted to use your Personal Information to the extent necessary to enable them to provide services to us.

If we are subject to a merger or acquisition with/by another company, we may disclose information with them in connection with the transaction, and your Personal Information may be transferred to such company upon completion of the transaction. Such acquiring company’s right to use your Personal Information shall be limited to the terms of this Privacy Policy unless additional notice is provided to you.

4. How We Safeguard Your Personal Information.

We have put in place commercially reasonable security measures to reduce the risks of loss, misuse, unauthorized access, disclosure and alteration of your Personal Information. Third parties we engage who may have access to your Personal Information as provided for above will only process your Personal Information on our instructions, and they are required to only use your data as necessary to perform their contract with us.

While we are committed to protecting your Personal Information, please understand that information communicated over the Internet is never 100% safe and secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security. Any transmission of Personal Information is at your own risk.

5. How Long We Store Your Personal Information.

We will retain your Personal Information only for as long as is necessary for the legitimate business purposes set out in this Privacy Policy. We will retain and use your Personal Information to the extent necessary to comply with our legal, accounting, or reporting obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes and enforce our legal agreements and policies. We will also retain and use your Personal Information for as long as you use the Onco360 Services and/or as necessary to provide the Onco360 Services. Additionally, we may continue to store your Personal Information contained in our standard back-ups. Generally, Onco360 will not retain any Personal Information for longer than ten (10) years, unless otherwise required by applicable law. 

We will also retain your information that does not constitute Personal Information for internal analysis purposes. Such information is generally retained for a shorter period of time, except when it is used to strengthen the security or to improve the functionality of the Onco360 Services, or we are legally obligated to retain such information for longer periods of time.

6. Your Rights and Options Regarding Your Personal Information.

Onco360 Mobile Text Program. We may collect certain Personal Information if you register for our Mobile Text Program to receive information regarding the services we provide to you. By providing your telephone number to Onco360 or your physician and agreeing to participate in the Onco360 Mobile Text Program, you consent to receive text messages and/or push notifications from or on behalf of us and/or our partners and suppliers. You may opt-out at any time by texting STOP to 70144 or contacting us through one of the methods listed under How to Contact Us above. For more information about the Onco360 Mobile Text Program, please click here.

Marketing Preferences. You can opt out from receiving future marketing communications from us at any time by using the unsubscribe function in the email you receive from us, or contacting us as set forth under How to Contact Us above. Please allow sufficient time for your preferences to be processed. Even if you opt out of receiving marketing messages, we may still contact you for transactional purposes like confirming or following up on an order or service request, asking you to review a product or service you have ordered, or notifying you of product recalls. If you later opt back into getting marketing communications from us, we will remove your information from our opt-out databases.

Google Analytics. As noted in The Information We Collect above, we may use third-party service providers to monitor and analyze the use of the Onco360 Services, including Google Analytics. Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor your use of the Onco360 Services on our behalf and will compile reports on your activity for us.

For more information about how Google collects, uses, and shares your information collected through Google Analytics and the privacy practices of Google generally, please visit: https://www.google.com/policies/privacy/partners and https://policies.google.com/privacy.

Cookies. As noted in The Information We Collect above, you can choose whether to accept cookies by changing the settings on your browser or device. However, if you choose to disable cookies, your experience with the Onco360 Services may be impaired and some features may not work as they were intended.

Additionally, Do Not Track is a preference you can set in your web browser to inform websites that you do not want to be tracked. You can enable or disable Do Not Track by visiting the preferences or settings page of your web browser. However, these features are not yet uniform, so we do not currently respond to such features or signals. Therefore, if you select or turn on a “do not track” feature in your web browser, we and our third-party providers may continue collecting information about your online activities as described in this Privacy Policy.

7. State-Specific Privacy Rights.

Depending on where you live, you may have certain rights with respect to Personal Information that we have collected and used under certain circumstances, which may include the rights outlined in this “State-Specific Privacy Rights” section. If you are a resident of a jurisdiction where one or more of these rights are granted to you under applicable law, and you wish to exercise any such rights listed above, please contact us by either:

• Phone: (877) 662-6633
• Email: [email protected]
• Web: https://www.onco360.com/privacy-rights-request/

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. Please understand that we are required to verify your request and may require you to provide some information to enable us to carry out such verification. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.

Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

i. The Right to Know About Personal Information Collected, Disclosed, or Sold.

Residents of certain U.S. states have the right to request that Onco360 disclose what Personal Information it collects, uses, discloses, and sells. This is called the “Right to Know”. Under the Right to Know, you can request a listing of the types of Personal Information we have collected about you, the sources of that information, how we use the information (e.g., our business or commercial purposes for collecting or selling Personal Information), other individuals and businesses with whom we disclose Personal Information, and the specific pieces of Personal Information that we have collected about you. For further details about this information, please visit The Information We Collect section above.

If you would like additional information under your Right to Know, you may contact us as set forth in the How to Contact Us section above. Details on how to make a request to access this information in each state are listed below.

• California
• Colorado
• Connecticut
• Virginia

ii. The Right to Access and Receive a Copy of Your Specific Personal Information.

Residents of certain U.S. states have the right to request that Onco360 provide a portable copy of the Personal Information it collects, uses, discloses, and sells. You can request that Onco360 provide a listing of the types of Personal Information we have collected about you, the sources of that information, how we use the information (e.g., our business or commercial purposes for collecting or selling Personal Information), other individuals and business with whom we disclose Personal Information, and the specific pieces of Personal Information that we have collected about you. For further details about this information, please visit The Information We Collect section above.

If you are a resident of a state that confers this right and would like to request a portable copy of your information, you may visit your state’s section below.

• California
• Colorado
• Connecticut
• Virginia

iii. The Right to Correct Personal Information Collected, Disclosed, or Sold.

Residents of certain U.S. states have the right to request that Onco360 correct the Personal Information it collects, uses, discloses, and sells. This is called the “Right to Correct”. Under the Right to Correct, you can request a correction of any inaccurate Personal Information, and Onco360 will use commercially reasonable efforts to correct this information.

If you would like additional information under your Right to Correct, you may contact us as set forth in the How to Contact Us section above. Details on how to make a request in each state are listed below.

• California
• Colorado
• Connecticut
• Virginia

iv. The Right to Request Deletion of Personal Information about You.

Residents of certain U.S. states have a right to request the deletion of their Personal Information collected or maintained by Onco360. Certain Personal Information may not be subject to deletion, however. For example, we may not delete information needed to perform an ongoing service or carry out a contract. If you would like information about you to be deleted, you may contact us as set forth in the How to Contact Us section above. Details on how to make a request in each state are listed in each state’s section below.

• California
• Colorado
• Connecticut
• Virginia

v. The Right to Opt-Out of the Sale or Cross-Context Behavioral Advertising of Personal Information.

Residents of certain U.S. states have a right to opt-out of the sale and/or cross-context behavioral advertising. Onco360 uses cookies that allow third parties to collect certain Personal Information, such as device identifiers and page view information about visitors to our websites, and these third parties use this information for several purposes, including to provide visitors with personalized content, and to deliver ads to you. For more information about your right to opt-out of such cross-context behavioral advertising, please see your state’s section below.

• California
• Colorado
• Connecticut
• Virginia

Note that if you opt out, you may continue to see advertising, including ads that may be based on Personal Information, processed before you opted out. Please also keep in mind that we may continue to disclose your Personal Information for other purposes as described in this Privacy Policy where necessary to provide you services or if you direct us to disclose it.

vi. The Right to Appeal a Refusal to Take Action.

Residents of certain U.S. states have a right to appeal if the consumer’s privacy rights-related request is denied in whole or in part. For more information about your right to appeal, please see your state’s section below.

• Colorado
• Connecticut
• Virginia

vii. The Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights.

You have a right not to receive discriminatory treatment by Onco360 for exercising any of your privacy rights conferred by your state’s consumer privacy laws. Onco360 will not discriminate against any consumer because such person exercised any of the consumer’s rights under these privacy laws, including, but not limited to:

• denying goods or services;
• charging different prices or rates for goods and services, including through the use of discounts or other benefits or imposing penalties;
• providing a different level or quality of goods or services; or
• suggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services.

Onco360 may, however, charge a different price or rate, or provide a different level or quality of goods or services, if that difference is related to the value provided to you by your data.

CALIFORNIA RESIDENTS’ PRIVACY RIGHTS

California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)

The California Consumer Privacy Act (CCPA), which has been amended by the California Privacy Rights Act (CPRA), is a law intended to enhance privacy rights and consumer protection for residents of the state of California. The CCPA and CPRA apply to certain business entities that do business in California. For further details on the types of Personal Information we have collected about you, the sources of that information, how we use the information (e.g., our business or commercial purposes for collecting or selling Personal Information), other individuals and business with whom we disclose Personal Information, and the specific pieces of Personal Information that we have collected about you, please visit The Information We Collect section above.

The following rights, as described in detail in this State-Specific Privacy Rights section, apply to all California residents (but not including legal entities, such as companies):

• The Right to Know
• The right to receive (“access”) a copy of your Personal Information
• The Right to Correct
• The right to request deletion of your Personal Information
• The right to opt out of sales or certain disclosures (“sharing”) of your Personal Information (and you or your authorized representative may submit a request to opt-out of the sharing of your Personal Information by visiting the following Internet web page link:  https://www.onco360.com/privacy-rights-request/ or you can call our CPRA toll free number: (877) 662-6633. For clarity, however, Onco360 does not sell your Personal Information for purposes of the CCPA or CPRA.

These rights will not apply, however, if Onco360 does not collect any Personal Information about you or if all of the information we collect is exempt from the statute (for example, the CCPA and CPRA do not protect information that is already protected by certain other privacy laws such as HIPAA and do not protect information that is already publicly available).

Requests under CCPA and CPRA

To make a request under the CCPA and CPRA you may call (877) 662-6633 for more information or visit our rights request web form: Privacy Rights Request.

As stated above, the CPRA also gives California residents the right to request that businesses opt them out of the sale or sharing of their Personal Information.

Our practices for how we sell Personal Information or disclose Personal Information for targeted advertising are set forth in the chart above. Like most websites, our websites use cookies and other technologies to interact with third parties and service providers for things like website analytics and advertising. Some of this website interaction with third parties is viewed as a “sale” under the CCPA and CPRA and you can opt-out of that selling or sharing of Personal Information.

COLORADO RESIDENTS’ PRIVACY RIGHTS

Colorado Privacy Act (CPA)

The Colorado Privacy Act (CPA) is a law intended to enhance privacy rights and consumer protection for residents of the state of Colorado. For further details on the types of Personal Information we have collected about you, the sources of that information, how we use the information (e.g., our business or commercial purposes for collecting or selling Personal Information), other individuals and business with whom we share personal information, and the specific pieces of Personal Information that we have collected about you, please visit The Information We Collect section above.

The following rights, as described in detail in this State-Specific Privacy Rights section, apply to all Colorado residents (but not including legal entities, such as companies):

• The Right to Know
• The right to receive (“access”) a copy of your Personal Information
• The Right to Correct
• The right to request deletion of your Personal Information
• The right to opt out of sales or certain disclosures of your Personal Information (for more information about your right to opt-out, please see the following Internet web page link: Do Not Sell or Share My Personal Information
• The right to appeal a controller’s refusal to take action regarding a privacy rights request

The rights will not apply, however, if Onco360 does not collect any Personal Information about you or if all of the information we collect is exempt from the statute (for example, the CPA does not protect information that is already protected by certain other privacy laws, and does not protect information that is already publicly available).

Requests under CPA

To make a request under the CPA you may call (877) 662-6633 for more information or visit our form: Privacy Rights Request.

CONNECTICUT RESIDENTS’ PRIVACY RIGHTS

The Connecticut Data Privacy Act (CTDPA) is a law intended to enhance privacy rights and consumer protection for residents of the state of Connecticut. The CTDPA apples to certain business entities that do business in Connecticut. For further details on the types of Personal Information we have collected about you, the sources of that information, how we use the information (e.g., our business or commercial purposes for collecting or selling Personal Information), other individuals and business with whom we share Personal Information, and the specific pieces of Personal Information that we have collected about you, please visit The Information We Collect section above.

The following rights as described in detail in this State-Specific Privacy Rights section, apply to all Connecticut residents (but not including legal entities, such as companies):

• The Right to Know
• The right to receive (“access”) a copy of your Personal Information
• The Right to Correct
• The right to request deletion of your Personal Information
• The right to opt out of sales or certain disclosures of your Personal Information (for more information about your right to opt-out, please see the following Internet web page link: Do Not Sell or Share My Personal Information
• The right to appeal a controller’s refusal to take action regarding a privacy rights request

These rights will not apply, however, if Onco360 does not collect any Personal Information about you or if all of the information we collect is exempt from the statute (for example, the CTDPA does not protect information that is already protected by certain other privacy laws, and does not protect information that is already publicly available).

Requests under CTDPA

To make a request under the CTDPA you may call (877) 662-6633 for more information or visit our Privacy Rights Request

VIRGINIA RESIDENTS’ PRIVACY RIGHTS

Virginia Consumer Data Protection Act (VCDPA)

The Virginia Consumer Data Protection Act (VCDPA) is a law intended to enhance privacy rights and consumer protection for residents of the commonwealth of Virginia. The VCDPA applies to certain business entities that do business in Virginia. For further details on the types of Personal Information we have collected about you, the sources of that information, how we use the information (e.g., our business or commercial purposes for collecting or selling Personal Information), other individuals and business with whom we share Personal Information, and the specific pieces of Personal Information that we have collected about you, please visit The Information We Collect section above.

The following rights as described in detail in this State-Specific Privacy Rights section, apply to all Virginia residents (but not including legal entities, such as companies):

• The Right to Know
• The right to receive (“access”) a copy of your Personal Information
• The Right to Correct
• The right to request deletion of your Personal Information
• The right to opt out of sales or certain disclosures of your Personal Information (and you or your authorized representative may submit a request to opt-out of the sharing of your Personal Information by visiting the following Internet web page link: Privacy Rights Request; for clarity, however, Onco360 does not sell your Personal Information for purposes of the VCDPA
• The right to appeal a controller’s refusal to take action regarding a privacy rights request.

These rights will not apply, however, if Onco360 does not collect any Personal Information about you or if all of the information we collect is exempt from the statute (for example, the VCDPA does not protect information that is already protected by certain other privacy laws, and does not protect information that is already publicly available).

To make a request under the VCDPA may call (877) 662-6633 for more information or visit our rights request web form: Privacy Rights Request.

8. Transfer of Data; Special Notice to Non-U.S. Users.

Your information, including Personal Information, may be transferred to – and maintained on – computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction. If you are located outside United States and choose to provide information to us, please note that we transfer the data, including Personal Information, to the United States and process it there. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to such transfer.

We will take steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and that no transfer of your Personal Information will take place to an organization or a country unless there are adequate controls in place including the security of your data and other Personal Information.

If you are located in a country outside the U.S. and submit Personal Information to us, you consent to the general use and disclosure of such information as provided in this Privacy Policy and to the transfer and/or storage of that information to the U.S. and other countries outside your home country.

9. Sensitive Personal Information.

Subject to the following paragraph, we ask that you not send us, and you not disclose, any sensitive Personal Information as this term is defined under applicable data protection and privacy laws (for example, Social Security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or trade union membership) on or through the Onco360 Services or otherwise to us.

If you send or disclose any sensitive Personal Information to us, you consent to our processing and use of such sensitive personal data in accordance with this Privacy Policy. If you do not consent to our processing and use of such sensitive Personal Information, you must not submit such content to the Onco360 Services.

10. Children’s Information.

The Onco360 Services are not intended for use by children under the age of 13. By using the Onco360 Services, you represent that you are at least 13. If you do not meet this age requirement, please do not access or use the Onco360 Services. We do not knowingly collect Personal Information from children under the age of 13, and we do not target the Onco360 Services to such children. For more information about the Children’s Online Privacy Protection Act (COPPA), which applies to websites that direct their services to children under the age of 13, please visit the Federal Trade Commission’s website: https://www.ftc.gov/tips-advice/business-center/guidance/complying-coppa-frequently-asked-questions. You acknowledge that we do not verify the age of our visitors and do not have any liability to do so.

If we learn that we have collected Personal Information from a child under the age of 13, we will take reasonable steps to delete it, unless we are legally obligated to retain such information. If you believe that we have collected information from a child under the age of 13, please contact us through one of the methods listed under How to Contact Us above.

11. Links to Other Websites.

The Onco360 Services may contain links to third-party websites or tools for third-party functionality such as for payment through a third-party payment processor. We have no control over how these websites collect your information and are not responsible for the content, privacy policies, actions, or security of these websites. Please make sure to read the privacy statements of these other websites that collect your Personal Information. You acknowledge that your use and access of these other websites is solely at your own risk.

12. Governing Law and Jurisdiction.

This Privacy Policy shall be construed and governed under the laws of the United States and State of Kentucky (without regard to rules governing conflicts of laws provisions). You agree that venue for all actions, arising out of or relating in any way to your use of the Onco360 Services, shall be in federal or state court of competent jurisdiction located in Jefferson County, Kentucky, within one (1) year after the claim arises. Each party waives any objections based on forum non conveniens and waives any objection to venue of any action instituted hereunder to the extent that an action is brought in the courts identified above. Each party consents to personal jurisdiction in the courts identified above.