2026. Something's different.

Openwell, Inc. ("Openwell," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our website, products, and services. It applies to information we collect through www.openwellhealth.com and any associated applications, integrations, and offerings.

1. Updates to this privacy notice

We may update this notice from time to time at our discretion. When we do, we will notify you by posting the updated notice on our website or through other communications where legally required.

2. Personal information we collect

A. Personal information you provide directly

• Account details (name, date of birth, gender, email, phone, payment information)
• Purchase and commerce information
• Connected device and wearable health data
• Health information exchange records you share with us
• Survey participation responses
• User-generated content
• Event registration details
• Business development and partnership information

B. Personal information collected automatically

• Device information (IP address, cookies, device identifiers, approximate location)
• Usage analytics
• Cookie and pixel tag data
• Biometric information from connected wearables, retained for a maximum of three years

C. Personal information from third parties

• Third-party service integrations
• Diagnostic results and health records
• Wearable device data uploads

3. How we use personal information

A. Provide the services

• Account management and access
• AI-powered personalized recommendations
• Generating AI Insights including patient record summaries, health trend analyses, and clinical decision-support outputs
• Laboratory and medication ordering
• Payment processing
• Job application handling

B. Administrative purposes

• Security and fraud prevention
• Analytics and service improvement
• De-identified data analysis for benchmarks and research
• Product development
• Legal compliance

C. Marketing

We may use your information to tailor content to you. California Shine the Light provisions apply where required.

D. With your consent or direction

• Research study participation
• Other user-directed activities

E. Automated decision making

Where we use AI profiling, we require human review before any clinical action is taken.

4. Artificial intelligence and data processing

A. What AI tools do

AI generates health insights, trend analyses, risk flags, record summaries, and outcome analytics for informational purposes only. AI outputs are not medical diagnoses.

B. How we process data with AI

Processing complies with HIPAA minimum-necessary standards and uses health information, device data, laboratory results, and care team communications.

C. No training on identifiable health data

Openwell does not use your individually identifiable Protected Health Information (PHI) for the purpose of training, fine-tuning, or improving AI or machine learning models.

C-1. De-identified and aggregated data

• Safe Harbor method: removal of 18 specified identifiers
• Expert Determination method: statistical expert validation
• Permitted uses: platform improvement, product development, research, benchmarking
• Commitment: no re-identification attempts, no patient data sale

C-2. Data ownership

Healthcare practices retain full ownership of patient records and PHI. Openwell owns the platform technology and derivative works produced from de-identified data.

D. Human review

Licensed healthcare professionals review AI Insights before clinical implementation.

E. Third-party AI providers

Partners execute Business Associate Agreements when handling PHI.

5. How we disclose personal information

A. Disclosures to provide services

• Service providers (hosting, analytics, customer service)
• Network vendors for order fulfillment
• Analytics services
• Other platform users where you have directed sharing
• Third-party integrations
• Business partners and affiliates
• Healthcare practice providers and staff

Important note. Openwell does not sell your individually identifiable health information to advertisers. Your health data is not used for targeted advertising purposes.

B. Disclosures to protect us or others

Legal compliance, law enforcement cooperation, rights protection, policy enforcement, and fraud investigation.

C. Disclosure in merger, sale, or asset transfer

Personal information may transfer in connection with a corporate transaction.

6. Your privacy choices and rights

A. Your privacy choices

• Email unsubscribe functionality
• SMS and text message opt-out via instructions
• Mobile push notification settings
• Global Privacy Control (GPC) signal recognition for U.S. state-required compliance
• Cookie management and adjustment

B. Your privacy rights

• Confirm processing status
• Request access and portability
• Request correction
• Request deletion
• Request processing restrictions or objections
• Opt-out of targeted advertising, sales, or profiling
• Withdraw consent

7. Data portability

Data export is available in standard formats (CSV, JSON, HL7 FHIR) within 72 hours at no cost upon written request. Complete data export and PHI deletion are provided within 72 hours upon account termination.

8. International transfers of personal information

Personal information may be transferred to and processed in jurisdictions globally, including jurisdictions with different data protection standards than your own.

9. Retention of personal data

Data is retained for the duration of the services, the purposes for which it was collected, dispute resolution, legal defense, auditing, legitimate business interests, and legal compliance, unless you request deletion.

10. Children's personal information

Our services are not directed to individuals under 16, or the applicable local minimum age. We do not intentionally collect information from minors, though employer-provided information about employees of all ages may be collected for eligibility determination.

11. Third-party websites and applications

Third-party services operate independently under their own privacy policies. Openwell disclaims responsibility for external service practices.

12. Contact us

Openwell, Inc.
145 S Glenoaks Blvd PMB 2012
Burbank, California 91502
hello@openwellhealth.com
(323) 689-5348

Annex A. Supplemental consumer health data privacy statement

This annex applies to Connecticut, Washington, and Nevada residents regarding consumer health data processing.

Consumer health data collected

Includes search queries, health conditions, symptoms, diagnoses, vital signs, wearable data, reproductive and sexual health information, gender-affirming care data, biometric and genetic information, healthcare access patterns, and derived AI Insights.

Why collected and used

Primarily for requested services including delivery, features, AI Insights generation, commerce facilitation, personalization, security, troubleshooting, and business operations.

Sharing of consumer health data

Shared only as necessary with service providers, network vendors, healthcare practices, emergency personnel, authorized representatives, and legal entities.

How to exercise rights

Submit requests via the contact information above. We provide a 45-day response window. Washington residents may file complaints with the State Attorney General.

Annex B. Consumer health data authorization

This annex applies to state consumer health data privacy law compliance regarding "personalized marketing" opt-in.

Specific consumer health data for "sale"

Browsing activity collected via cookies and tracking technologies on www.openwellhealth.com.

Purpose

Delivery of personalized advertisements.

Purchasers

Google, Microsoft, Snapchat, X Advertising, Facebook/Meta, Reddit.

Revocation

You may revoke authorization through the cookie banner by unchecking "Personalize marketing" or selecting "Decline all." Revocation is effective prospectively; previously completed sales are unaffected. Authorization expires one year after acceptance.

Key notes

• Service provision cannot be conditioned on acceptance.
• Purchasers may redisclose data outside regulatory protections.
• Separate choices are required per browser and device.