Shares with service providers and contractors working on Ovia’s behalf: AWS, Helpshift, Salesforce.com, Alchemer, Zoom
The recipients table states Ovia’s data is processed and stored by service providers and contractors acting on Ovia’s behalf, naming Amazon Web Services (cloud), Helpshift (support), Salesforce.com (coaching platform), Alchemer (surveys) and Zoom Video Communications (coaching communications).
Details not recorded for this card
Supporting quotations
When We Share Personal Information, What Categories of Recipients Do We Share With?
Categories of Recipients
Ovia’s data is processed and stored by service providers and contractors working on Ovia’s behalf, including our cloud services provider Amazon Web Services, Helpshift (support services platform), Salesforce.com (coaching platform), Alchemer (survey platform) and Zoom Video Communications (coaching communications).
Qualifications & exceptions
Named as working “on Ovia’s behalf” — processer/service role, not recipients for their own purposes.
Sharing & Disclosure · Restriction or exception
Ovia+ sharing: may share with insurer, plan, employer, or their business associates; employer with express consent
For Ovia+ users, data may reach the health insurer, health plan, employer or their business associates and benefits management providers, as detailed under the “Ovia+ Data Sharing” heading (carded beside). The employer leg carries a double condition: sharing with the employer is limited to specific uses and requires express consent.
Details not recorded for this card
Supporting quotations
If you are an Ovia+ user, we may share data with your health insurer, health plan, employer, or their business associates and benefits management providers, as described below under the heading “Ovia+ Data Sharing”, provided that we share information with your employer only for specific uses and only if you expressly consent.
Qualifications & exceptions
Applies if you are an Ovia+ user.
Employer sharing: specific uses only + express consumer consent (see Ovia+ Data Sharing cards).
Sharing & Disclosure · Restriction or exception
Shares Ovia data with Apple Health, Google Health Connect or other devices only if you opt in, and only what you select
Outbound device sharing is opt-in and limited to the information the user selects to share; no automatic device sharing is stated.
Details not recorded for this card
Supporting quotations
If you opt-in to share your Ovia data with Apple Health, Google Health Connect or your other devices, we share the information you select to share.
Qualifications & exceptions
Requires user opt-in.
Only the data the user selects is shared.
Sharing & Disclosure · Company practice
People you invite see all of your personal data and can add others; every follower sees added content
Inviting someone gives them visibility of all of the user’s personal data in the Ovia apps, and invitees can add others to the account. Content added to an account is visible to everyone following that account — all-or-nothing, not selective.
Details not recorded for this card
Supporting quotations
The Ovia apps may allow you to invite others, such as your partner, to share your Ovia journey. If you invite someone, they will be able to see all of your personal data in the Ovia apps.
The people you invite are also able to add others to your account. If you add personal data or other content to an Ovia account, everyone who is following that Ovia account will see it.
Qualifications & exceptions
Scope is “all of your personal data” for invitees, not selected data.
Invitees can further add others to the account.
Sharing & Disclosure · Company practice
Profile image and name go in emails to invited followers, visible before acceptance; opt-in emails by law
A profile image or name entered — including for a child in the user’s care — is shared in journey emails to all invited followers of the account and is visible even before the invitation is accepted. The stated control is not to enter a profile picture or name at all; regular email updates themselves are subject to opt-in consent where required by law.
Details not recorded for this card
Supporting quotations
If you include a profile image or name for yourself or a child in your care, this profile image and name will be shared in emails to you and everyone who has been invited to follow your account.
The name and image will be visible even before the invitation is accepted. If you do not want the image or name to be shared, you should not enter a profile picture or a profile name.
Qualifications & exceptions
Visibility precedes invitation acceptance.
Profile image/name applies to the user or a child in their care.
Stated control: do not enter a profile picture or name.
Sharing & Disclosure · Company practice
May share data with parent Labcorp, common-control companies, and successors in merger/acquisition/asset sale
Ovia “may” share data with its parent Labcorp, companies under common control, and transactional successors in a merger, acquisition, asset sale or similar transaction.
Details not recorded for this card
Supporting quotations
We may share data with our parent company Labcorp and with companies under common control, and with any successors in the event of merger, acquisition, asset sale, or similar transaction.
Qualifications & exceptions
Expressed as “may share” — a permission, not a guarantee.
Sharing & Disclosure · Company practice
Ovia+ via insurer/employer/plan includes data sharing with insurer, plan, employer, or their vendors per HIPAA
Where Ovia+ is received as a premium benefit through a health insurer, employer or employer health plan, the services include data sharing with the insurer, employer health plan, employer or their vendors — stated as in accordance with HIPAA and other privacy laws. Underlying condition: this matches Ovia+ procurement, not the free Consumer version.
Details not recorded for this card
Supporting quotations
Ovia+ Data Sharing
your Ovia+ services include data sharing with your insurer, employer health plan, employer, or vendors working on their behalf in accordance with HIPAA and other privacy laws.
Qualifications & exceptions
Applies to premium Ovia+ received through insurer/employer/employer health plan.
Sharing & Disclosure · Company practice
Data sharing does not occur for all Ovia+ clients; definitive account-level information via support email
Whether sharing occurs varies by Ovia+ client arrangement: the policy states sharing does not occur for all Ovia+ clients and directs users to support@oviahealth.com for account-specific facts.
Details not recorded for this card
Supporting quotations
Data sharing does not occur for all Ovia+ clients. If you would like definitive information on the data sharing for your account, please contact support@oviahealth.com.
Qualifications & exceptions
Account-specific variation acknowledged in the policy itself.
Sharing & Disclosure · Company practice
Ovia+ via insurer/provider: personal data shared with insurer/provider or business associates under HIPAA
For insurer/provider-provided Ovia+, personal data is shared with the health insurer/provider or their business associates under HIPAA for care and benefits management.
Details not recorded for this card
Supporting quotations
If you receive Ovia as a benefit from your health insurer or health care provider, Ovia is part of your care package and we share your personal data with your health insurer or provider, or their business associates, under HIPAA, for care and benefits management.
Qualifications & exceptions
Condition: Ovia received as a benefit from a health insurer or health care provider.
Sharing & Disclosure · Restriction or exception
Employer benefit: no health data to employer without express consent; plan/associates/vendors may be shared
For employer-provided Ovia+, Ovia’s stated rule is no sharing of health data with the employer absent express consent for a specific purpose (example given: an in-house care management team), limited to that purpose. “However”, personal data may still be shared with the employer health plan, its business associates (including the health insurer) and employee-benefits management vendors consistent with HIPAA or other privacy laws. The consent gate protects the employer entity, not the employer’s health plan.
Details not recorded for this card
Supporting quotations
If you receive Ovia as a benefit from your employer or your employer health plan:
we do not share your health data with your employer unless you expressly consent for a specific purpose;
this may occur, for example, if your employer offers you access to an in-house care management team.
If this occurs, we limit the sharing as necessary for the specific purpose to which you have given consent.
However, we may share personal data with your employer health plan and their business associates (including your health insurer), and with employee benefits management vendors, consistent with HIPAA or other privacy laws.
Qualifications & exceptions
Health data to the employer entity: requires express consent for a specific purpose.
Employer health plan, its business associates and benefits vendors: sharing permitted without that consent.
Consented sharing is limited to the consented purpose.
Not stated here
The linked page “Why do we ask for this?” (oviahealth.com) is not supplied by this source; this card cannot say what consent details that page explains.
Sharing & Disclosure · Company practice
Nurse care managers from your health plan may access personal data and may contact you for care management
Sharing with a health insurer can expose personal data to that plan’s nurse care managers, who “may” access the data and “may” contact the user for care management purposes.
Details not recorded for this card
Supporting quotations
When we share your data with your health insurer, nurse care managers from your health plan may also have access to your personal data and may contact you as a result for care management purposes.
Qualifications & exceptions
Expressed as “may” for both access and outreach.
Sharing & Disclosure · Company practice
May share limited identity info (name, DOB) with plan/employer to confirm Ovia+ benefit eligibility
At Ovia+ registration, limited identity information (such as name and date of birth) may be shared with the health plan or employer to confirm eligibility. This is narrower than the health-data rules above.
Details not recorded for this card
Supporting quotations
If you seek to register for Ovia+ premium services provided by a health plan or employer, we may share limited identity information (such as name and date of birth) with the health plan or employer to confirm your eligibility for Ovia+ benefits.
Qualifications & exceptions
Limited identity information only; purpose is eligibility confirmation.
Sharing & Disclosure · Restriction or exception
Care/benefits sharing passes a summary health snapshot; never sexual activity, MyQ answers, Community submissions
Care-and-benefits-management sharing described in the Ovia+ section is a “summary snapshot” of health data, and three categories are excluded outright: in-app sexual activity records, MyQ question answers, and Community feature submissions.
Details not recorded for this card
Supporting quotations
When we share health data for care and benefits management as described in this section, we share a summary snapshot of your health data.
We do not share any information you have recorded in the Ovia apps about sexual activity, any answers you have given to MyQ questions, or any submissions you make to our Community feature.
Qualifications & exceptions
Applies to the Ovia+ care/benefits-management sharing described in this section.
Hard exclusions: sexual-activity records, MyQ answers, Community submissions.
Sharing & Disclosure · Company commitment
As of June 2025: no advertising shown to Consumer users and no selling or sharing of personal data for advertising
The sell/share-for-advertising section states a June-2025 cutoff: Ovia no longer shows advertising to Consumer users and does not sell or share any personal data for advertising. A separately carded legacy block (ovia-legacy-ads-pre-2025) covers what happened before that business ended.
Details not recorded for this card
Supporting quotations
What Categories of Personal Information Do We Sell or Share for Advertising or AI Training?
As of June 2025, Ovia no longer shows advertising to our Consumer users and does not sell or share any personal data for advertising.
Qualifications & exceptions
Time-scoped: as of June 2025.
Stated for “our Consumer users” (the free version).
Cross-references
contrast (model-proposed): Historical: pre-June 2025, shared identifiers, app-activity data and inferred purchase interests with ad platforms — Both statements are time-scoped: the legacy ad-sharing card describes practice before the June 2025 advertising-business termination, while the no-advertising/no-sale commitment takes effect as of June 2025. They pull in different directions on the surface but do not conflict once the dates are read separately; neither is a contradiction.
No sale of personal data to third parties for training AI; but AI-tool vendors may use personal data to improve services
The no-sale commitment covers selling to third parties for AI training. Beside it, Ovia may — to the extent permitted by law — allow vendors that provide AI tools to Ovia to use personal data to improve their own services to Ovia. The commitment and the vendor-use permission are distinct statements and must not be merged.
Details not recorded for this card
Supporting quotations
Ovia does not sell personal data to third parties for the purpose of training AI.
We may, to the extent permitted by law, allow vendors who provide us with AI tools to use personal data to improve the services they provide to us.
Qualifications & exceptions
The commitment is limited to “sell” — not use per se.
AI-vendor use is subject to “to the extent permitted by law”.
To its knowledge, Ovia does not sell or share personal data of users under 16 and no longer shows advertising
For users under 16 the statement is knowledge-qualified: “to its knowledge”, Ovia does not sell or share their personal data — not an absolute guarantee — and Ovia no longer shows advertising.
Details not recorded for this card
Supporting quotations
No Selling or Sharing for Advertising of Personal Data of Consumers Under 16
To its knowledge, Ovia does not sell or share any personal data of Ovia users under 16. Ovia no longer shows advertising.
Qualifications & exceptions
Qualified by “to its knowledge”.
Sharing & Disclosure · Company practice
Purposes table: identifiers, geolocation, employment to cloud/analytics/vendors; audio/visual cloud-only
In the business-purposes table, identifiers, geolocation and professional/employment rows go to cloud computing providers, data analytics providers, and vendors providing email, support, admin, marketing, survey and scheduling systems, for internal operations (hosting, support, admin, marketing, analytics). The audio/visual row is narrower: cloud computing providers only, purpose hosting and support.
Details not recorded for this card
Supporting quotations
Categories of Personal Information Disclosed for Business Purposes
Business Purpose for Sharing
For internal operations (hosting, support, admin, marketing, analytics).
Geolocation
For internal operations (hosting, support, admin, marketing, analytics).
Cloud computing providers.
For internal operations (hosting and support).
Professional and employment related
For internal operations (hosting, support, admin, marketing, analytics).
Qualifications & exceptions
Audio/visual recipients are limited to cloud computing providers; purpose hosting and support only.
This table describes disclosure for business purposes (a specific narrower purpose set), not all sharing.
The health-information, protected-classification, internet/app-activity, inferences and sensitive-information rows of the business-purposes table add a second recipient group — Ovia+ customers and their vendors as described under the “Ovia+ Data Sharing” heading — and a second purpose: providing Ovia’s digital health solutions to Ovia+ customers, alongside internal operations.
Details not recorded for this card
Supporting quotations
General personal information including health information
Ovia+ customers and their vendors as described under the “Ovia+ Data Sharing” heading above.
To provide our digital health solutions to Ovia+ customers.
Legally protected classifications including race, gender, pregnancy status
Internet and app activity information
Inferences
Sensitive information
For internal operations (hosting, support, admin, marketing, analytics). To provide our digital health solutions to Ovia+ customers.
Biometric information
Qualifications & exceptions
The Ovia+ leg of these rows depends on Ovia+ membership; see the Ovia+ Data Sharing cards for its limits (e.g. employer consent gate and snapshot exclusions).
Sharing & Disclosure · Company practice
Historical: pre-June 2025, shared identifiers, app-activity data and inferred purchase interests with ad platforms
A time-limited legacy statement: prior to June 2025, Ovia shared identifiers, internet and app activity information and inferred purchase interests with its ad sales platform, advertising networks, platforms or ad-tech providers, to sell, administer, serve and purchase ads. This describes past practice; the current no-advertising commitment is carded separately.
Details not recorded for this card
Supporting quotations
Prior to the termination of our advertising business in June 2025, we shared identifiers, internet and app activity information and inferred purchase interests with our ad sales platform, advertising networks, advertising platforms or advertising technology providers to sell, administer, serve and purchase ads.
Qualifications & exceptions
Applies “prior to” the June 2025 termination of the advertising business — past practice only.
Cross-references
contrast (model-proposed): As of June 2025: no advertising shown to Consumer users and no selling or sharing of personal data for advertising — Both statements are time-scoped: the legacy ad-sharing card describes practice before the June 2025 advertising-business termination, while the no-advertising/no-sale commitment takes effect as of June 2025. They pull in different directions on the surface but do not conflict once the dates are read separately; neither is a contradiction.
Sharing & Disclosure · Company practice
May also share for business purposes with the recipients-table categories: invitees, followers, affiliates, authorities
The business-purposes section cross-references the recipients table: those recipient categories also apply — People You Invite, You and Your Requested Followers, Affiliates and Successors, and Government Authorities and Recipients of Compelled Disclosures. Those categories’ detailed rules are carded in the sharing-recipients packet; read with the qualifiers carried there (e.g. invitees see all personal data).
Details not recorded for this card
Supporting quotations
Ovia may also share personal data for business purposes in all of the above categories, as described in the table “When We Share Personal Information, What Categories of Recipients Do We Share With?”, with the following categories listed in that table: People You Invite, You and Your Requested Followers, Affiliates and Successors, and Government Authorities and Recipients of Compelled Disclosures.
Sharing & Disclosure · Company practice
Discloses personal data to processors acting for Ovia; Appsflyer may act as controller for its own security/compliance
Beyond the business-purpose disclosures, Ovia discloses personal data to processors acting on Ovia’s behalf; principal processors appear on a linked Subprocessors Page. Named exception: analytics vendor Appsflyer normally acts as processor but may act as a controller when using personal data for its internal security, error correction and compliance purposes.
Details not recorded for this card
Supporting quotations
Third Parties Receiving Personal Information for Their Own Business Purposes
Ovia discloses personal data to processors who act on Ovia’s behalf
Our analytics vendor Appsflyer provides its services to Ovia as a processor, but may act as a controller when using personal data for its internal security, error correction and compliance purposes.
Not stated here
The linked Subprocessors Page is not supplied by this source; the card cannot say which processors it lists beyond the named ones elsewhere in this policy.
Sharing & Disclosure · Company practice
Deidentified data detail: unlinked, not re-identified, may reach research partners, CCPA-patient rule, compensation
The full linked detail: deidentified data is for research and development, is not personal data (no longer linked or linkable), and if a deidentified dataset is created it is maintained as such and will not be re-identified. Ovia may provide it to research partners such as universities and medical research institutions, and to other businesses that engaged Ovia to provide research services on deidentified or aggregated data. Ovia may even disclose or sell deidentified data derived from CCPA-defined patient information, with that patient information first deidentified per HIPAA safe harbor or expert-determination methods, and may receive compensation for sharing deidentified or aggregated data. Aggregated analytic data and statistics may be used internally or shared with third parties.
Details not recorded for this card
Supporting quotations
Deidentified Data and Aggregated Data: Ovia may use personal data to create deidentified data for research and development purposes. Deidentified data is not personal data as it is no longer linked or linkable to you.
If we create a deidentified dataset we maintain it as such and will not re-identify it.
We may provide deidentified data to our research partners, such as universities and medical research institutions for research, and to other businesses who have engaged us to provide research services on deidentified or aggregated data.
Ovia may disclose or sell deidentified data derived from patient information (as defined by the California Consumer Privacy Act); if so, such patient information is deidentified in accordance with HIPAA safe harbor or expert determination deidentification requirements.
We may use personal data to create aggregated analytic data and statistics, which we may use for Ovia’s internal purposes or share with third parties.
Ovia may receive compensation for sharing deidentified or aggregate data.
Qualifications & exceptions
Re-identification is excluded by commitment for deidentified datasets Ovia itself creates.
“Patient information” here is as defined by the California Consumer Privacy Act — the Act’s text is not supplied.
Named external laws (CCPA, HIPAA) are classified by name/syntax only; their contents are not supplied evidence.
Not stated here
This card treats CCPA and HIPAA deidentification methods as named external standards; the standards’ texts are not supplied by this source, so the card cannot verify what they require.