Ondar Consumer Health Data Privacy Notice

Last updated: October 6, 2026
Effective date: September 3, 2026

This Notice supplements the Ondar Privacy Policy where Waystar Communications LLC d/b/a Ondar (“Ondar,” “we,” “us,” or “our”) processes information defined as consumer health data under the Washington My Health My Data Act, Nevada consumer health privacy law or another applicable law.

Ondar is a plans-and-community app, not a healthcare provider. We do not provide diagnosis, treatment or medical advice, and this Notice does not mean Ondar is governed by HIPAA.

1. Information and sources

Ondar does not ask for structured HIV status, STI status, PrEP use, medications, diagnoses, health records or medical treatment. Users can nevertheless voluntarily include health, sexual-health, mental-health, substance-use or safety information in:

• profile biographies and other free text;
• plan notes and descriptions;
• one-to-one or group messages;
• photos, video or voice messages; and
• reports, evidence and support tickets.

Depending on context and applicable law, consumer health data can also include sexual-health or intimate information; precise location associated with seeking health services; information about sexual assault, coercion, self-harm or treatment; and inferences derived from covered data. Ethnicity and use of a gay community app are sensitive, but neither by itself establishes a medical condition.

Sources are you; other participants in a communication; people submitting reports; your device when you activate a location or media feature; Service activity; and providers operating the requested, safety or security function.

2. Purposes

We process covered data only as needed to:

• provide a profile, plan, message, media, location, check-in or support feature you request;
• display information to the audience you select;
• transmit a communication to its chosen recipient;
• investigate reports and prevent underage use, exploitation, nonconsensual imagery, threats, coercion, fraud, impersonation and other abuse;
• protect accounts, the Service and users;
• respond to your request or appeal; and
• comply with law, valid legal process and legal claims.

We do not create medical diagnoses or health-risk scores. We do not use consumer health data for targeted advertising, data-broker products, sale, eligibility decisions in employment, housing, credit, insurance or healthcare, or training general-purpose generative AI.

3. Collection, consent and user direction

When covered information is necessary to provide a feature you deliberately request—for example, transmitting text you write to the recipient you select—we process the minimum needed for that request. If collection is not necessary to provide a requested feature and applicable law requires consent, we obtain a clear, specific, informed opt-in before collection. Acceptance of general Terms is not consent for an unrelated health-data use.

Do not place medical or health details in public fields. If we later add a structured health field or a materially new covered purpose, we will first update this Notice and obtain the consent required by law.

Where law requires consent to share covered data with a third party, that choice will be separate from collection consent and will identify the data, purpose, recipients and withdrawal method.

4. Categories disclosed and recipients

At your direction, another user may receive health-related or intimate information you put in a profile, plan, message, media share or location feature. Recipients can retain or disclose information despite our rules.

Service providers acting on our behalf may process covered information only as necessary for their contracted function, subject to our instructions and applicable confidentiality, security and use restrictions:

• Hosting and storage: content, communications, location and related records needed to provide the feature you request.
• Safety and content moderation: submitted media, reports, relevant communications and evidence needed to review content and address harm.
• Communications and support: contact details and the covered information included in messages, notifications or requests that must be delivered or resolved.
• Account security and abuse prevention: relevant account activity, connection information and reported content necessary to secure the Service and investigate incidents.
• Mapping and location support: map requests, location-related information and associated connection information necessary for the requested map feature, to the extent this constitutes consumer health data.

These categories do not mean every provider receives all covered information. We do not disclose private health-related content to purchase-administration providers merely because you make a purchase. Website analytics providers do not receive app content, form answers or consumer health data from Ondar. The app records usage events, such as which screens and features are used, to understand and improve the product; these events do not include message content, location or health information, and are not used for advertising.

When a mapping, security or other service acts as an independent recipient rather than our processor, applicable notice and consent requirements apply to that disclosure. Recipient categories, information and purposes are described here and in the Privacy Policy; specific recipient information is available where applicable law requires it. Independent recipients' own privacy notices govern their processing; Ondar remains responsible for disclosures it makes.

Authorized Ondar personnel may review covered information when necessary for content moderation, a report, appeal, support request, security incident or legal obligation. Access is limited to those purposes and authorized reviews are recorded.

We may disclose covered information to courts, regulators, law enforcement, NCMEC, emergency services or an affected person only when permitted or required for valid legal process, child safety, security, prevention of serious harm or legal claims.

Specific affiliates receiving consumer health data: none.
Sale of consumer health data: none.
Sharing for third-party targeted advertising: none.

We will update this Notice and obtain any separate authorization legally required before a sale or new sharing practice.

5. Location protections

Ondar receives device location while in use for requested location features. It shows your location on the map only by general area unless you choose your exact spot, does not publicly expose raw device coordinates and suppresses display below the minimum local-density threshold.

We do not use a geofence around a healthcare facility to identify or track a person, collect covered data from them, or send health-related messages or advertising. Users may not use Ondar to expose another person’s visit to a clinic, shelter or other sensitive place.

6. Retention and deletion

Covered information follows the periods in the Privacy Policy for its feature: place chats expire after 12 hours without messages; ephemeral camera media ordinarily lasts 24 hours; eligible photo-library ephemeral media lasts 48 hours; past plans ordinarily last 48 hours; and outdated map presence is removed on an approximately 15-minute cycle. Chats have an ordinary ceiling of two years. A user-controlled media library remains until deletion.

Reports, moderation evidence and relevant content may be retained beyond ordinary expiration while reasonably necessary for an open investigation, repeat-abuse prevention, appeal, legal obligation or claim. Access is restricted and information is deleted or deidentified when that purpose ends.

Account deletion starts a 30-day deactivation period. After it ends, active account data is deleted, subject to the limited evidence and legal exceptions above. See Account Deletion and Privacy Requests to request final deletion without the recovery period. Applicable deletion requests extend to processors and backups as law requires.

7. Your rights

Where applicable, you may:

• confirm whether we collect, share or sell your consumer health data;
• access it and receive required information about recipients;
• request correction or deletion;
• withdraw consent for future collection or sharing;
• request a portable copy;
• appeal a denied request; and
• exercise rights without unlawful discrimination.

Email privacy@ondar.co with “Consumer Health Data Request.” Our privacy team will help you exercise your rights; you do not need an in-app export tool. We authenticate proportionately, respond within applicable deadlines and notify relevant processors of a valid deletion request as required.

To appeal, reply to the decision or use the same address with “Consumer Health Data Appeal.” We will explain the outcome and applicable regulator complaint route.

8. Security and incidents

We maintain safeguards designed for sensitive location, profile and communications data, including restricted access, security monitoring and accountability for authorized reviews. No system is perfectly secure. If an incident triggers a state breach law or the FTC Health Breach Notification Rule, we will make the notifications required for that incident.

9. Changes and contact

We will update this Notice before collecting a new category of covered data or using or sharing it for a materially new purpose, and obtain affirmative consent where required. Continued use is not consent where law requires an opt-in.

Waystar Communications LLC d/b/a Ondar
Privacy: privacy@ondar.co
Safety: safety@ondar.co
2100 Ponce de Leon Blvd, 111M
Coral Gables, FL 33134, United States