Privacy Notice

1. What this notice covers

This Notice covers the OMMPO website, web application, mobile applications, and related services. It does not apply to the privacy practices of third-party platforms, including Meta, which may process a form submission before delivering it to OMMPO.

The Services are intended for individuals located in the United States and are not directed to or marketed outside it. OMMPO makes no representation that the Services or their content are accurate, appropriate, or lawful outside the United States. If you access the Services from elsewhere, you do so on your own initiative and at your own risk and are solely responsible for compliance with local law. OMMPO may restrict or refuse access from any location at its discretion.

OMMPO is not a healthcare provider, health plan, or healthcare clearinghouse, and is not subject to HIPAA in the ordinary operation of the Services. Using OMMPO does not create a physician-patient, attorney-client, or other professional relationship, and the Services are not a substitute for professional medical, legal, financial, or emergency services.

2. Personal information we collect

"Personal information" means information that identifies, relates to, or could reasonably be linked with an individual. Through the Services we collect:

Some of this may be sensitive personal information or consumer health data under applicable state privacy laws. OMMPO collects and uses it to provide the Services and as otherwise described in this Notice, and collects only what is reasonably necessary for those purposes.

We may create aggregated, anonymized, or de-identified data derived from your use of the Services — for example statistics about navigation or general trends in feature usage. That data cannot reasonably be used to identify you; we own it and may use it for any lawful purpose, including improving the Services, research, and publishing general statistics about aging and caregiving. Our use of de-identified data is subject to the de-identification standards and re-identification prohibitions of applicable law, including the CCPA and state consumer health data laws.

3. Information about other people

If you enter information about another person — a family member's health conditions, medications, provider contacts, or insurance details — we collect and process it as part of the Services. You represent that you have obtained any affirmative consent required by applicable law or have legal authority to provide it, such as a power of attorney or legal guardianship. Information about a person who is not a registered user, including a care recipient, receives the same privacy protections and data-handling practices described in this Notice.

If you are a person about whom another user has entered information, you have an independent right to request access to, correction of, or deletion of that information, or to object to its further collection, use, or sharing, whether or not you are a registered user. Submit your request using the contact details in section 17. OMMPO will honour these requests to the extent required by applicable law, subject to reasonable verification of your identity and your relationship to the information. This corresponds to the third-party information rights described in the OMMPO Subscriber Agreement.

4. Technical information we collect automatically

Device and browser information (IP address, device type and identifier, operating system, browser type and settings); usage information (pages visited, features used, dates and times, time on page, referring and exit pages); and approximate geographic location derived from your IP address.

Mobile app permissions: on iOS we request access to your camera and photo library so you can capture and upload photos and documents, and to Face ID so you can secure app access with your device biometrics. On Android we request access to device storage. Both apps collect a device identifier and, if you enable notifications, a push notification token.

Cookies and similar technologies: we may use cookies, pixel tags, web beacons, and similar technologies to recognise you, remember preferences, and understand use. Some are session cookies that expire when you close your browser; others persist until deleted or expired. Most browsers allow you to refuse or delete cookies, though disabling them may affect certain features.

Analytics: our public marketing website may use Google Analytics; it is not used within the authenticated application. Where used, Google sets cookies and your browser sends information to Google, which provides us reports about how visitors interact with the site. See Google's Privacy Policy and its page on how Google uses data from partner sites, and note that a Google Analytics opt-out browser add-on is available for each browser you use.

Server and authentication logs: DigitalOcean application and server logs such as IP address, request headers, and timestamps, and Supabase authentication logs such as login timestamps and session and device metadata.

5. How we collect information and our sources

We collect information when you give it to us directly — creating an account, using the Services, filling in a form on our website, interacting with Ask a Care Navigator, sharing information with your household, or submitting an inquiry or privacy request.

If you submit information through a form in an advertisement on a platform such as Instagram or Facebook, that platform processes the submission under its own privacy policy before delivering it to OMMPO, governed by its terms rather than this Notice.

OMMPO also receives personal information from Meta lead forms on Instagram and Facebook advertising; referral partners including elder law firms and aging services organizations under pilot and Design Partner arrangements; enterprise and channel partners; event and conference signups; and household invitations, where an existing member supplies an invitee's name and email before that person has an account.

6. How we use information

To provide, maintain, and improve the Services, including Ask a Care Navigator, the provider directory, and related features; to create and manage your account and subscription; and to generate AI-assisted responses, summaries, recommendations, and guidance.

To enable the household sharing you turn on with the family members and caregivers you invite; to personalize your experience based on your information, state, and preferences; and to process payments and administer billing.

To send occasional OMMPO updates, each with a one-click unsubscribe; and to send reminders and notifications by SMS, push, or in-app message about medications, appointments, care tasks, wellness activities, payments, subscriptions, or household updates where you have opted in. You can manage notification preferences in your account settings, and standard message and data rates may apply to SMS.

To understand in aggregate who OMMPO is serving so we can prioritise the right features; to conduct research and product development using de-identified and aggregated data; to prepare grant reporting and program evaluation using aggregate information; to surface emergency resources when you describe a safety concern; to review Ask a Care Navigator responses for accuracy and safety; to answer your questions, support requests, and privacy requests; and to protect the Services, maintain security, prevent misuse, and comply with law.

Our support team may access your account information where reasonably necessary to assist you, subject to the limits in section 13. We do not use your information for purposes unrelated to those described here unless we first give any notice or obtain any consent applicable law requires.

7. Disclosures and service providers

We do not sell or rent your personal information and do not share it with third parties for their marketing. We disclose personal information to service providers that process it on our behalf to operate the Services and communicate with you. Our current providers are:

If you join through a Meta form, Meta processes the submission before OMMPO receives it, as described in section 5. Service providers may access personal information only as reasonably necessary to provide services to OMMPO, under our agreements with them and applicable law.

We may also disclose personal information where reasonably necessary to comply with law, legal process, or a government request; to protect OMMPO, our users, or others; to investigate or prevent fraud, security incidents, or misuse; or to support a merger, acquisition, financing, reorganization, or sale of assets. We may disclose aggregate information that does not reasonably identify you without restriction.

8. Sales, targeted advertising, Do Not Track, and Global Privacy Control

OMMPO does not sell or rent personal information, does not share it with third parties for their marketing, and does not use it for targeted advertising. The OMMPO application uses no advertising trackers. Our public marketing website may use third-party advertising or analytics technologies in connection with paid social media advertising; we are confirming the specific technologies in use and will update this Notice accordingly. OMMPO does not send spam.

Do Not Track: we do not currently respond to DNT signals sent by browsers, mobile devices, or other mechanisms. Per industry standards, third parties may be able to collect information about your online activities over time and across different websites when you use the Services.

Global Privacy Control: you can use GPC through a supported browser to signal certain opt-out preferences. We will process the request for that browser only — it does not extend to your whole device, you need to use GPC in each browser, and if you clear your cookies you will need to use it again.

9. Your choices and privacy rights

Unsubscribe from updates using the one-click link in any OMMPO update email. Cancel your account at any time in account settings or by emailing info@ommpo.com. Manage household sharing permissions to control what each invited member can see, and review those settings whenever you like.

Review, correct, or delete: email info@ommpo.com to ask what personal information OMMPO holds about you, to correct inaccurate information, or to delete your information entirely. Export: before closing your account you may request an export in a portable format through account settings or by emailing support@ommpo.com; where available we make the data downloadable for a reasonable period, and export options may not include every feature, format, or item.

Depending on where you live you may also have the right to access or receive a copy of your personal information, correct it, delete it, receive it in a portable format, or opt out of certain processing such as sales, targeted advertising, or profiling. OMMPO does not currently sell or rent personal information or use it for targeted advertising.

To exercise a right, email info@ommpo.com. We may ask for information reasonably necessary to verify your identity and guard against unauthorized requests, and we respond as applicable law requires. In some states you may designate an authorized agent; we may ask for proof of authorization and may also require you to verify your identity directly with us.

Appeals: if we deny a request we will explain why, and you may have the right to appeal under state law. Email info@ommpo.com with the subject line "Privacy Request Appeal", including your original request and our response. We respond within the time required by law, generally 45 to 60 days, and if we deny the appeal we will tell you how to contact your state attorney general or other regulator.

Sensitive personal information: we collect it, including health and wellbeing information, only as necessary to provide the Services and for the purposes in this Notice, and we do not use it to infer characteristics about you for unrelated purposes. Non-discrimination: we will not deny you services, charge different prices, or provide a lower quality of service because you exercised a privacy right, except where permitted by law.

10. State-specific rights

Nevada residents: Nevada law lets consumers opt out of the sale of certain covered information. Email info@ommpo.com with the subject line "Nevada Opt-Out Request". OMMPO does not currently sell covered information as defined by Nevada law.

Consumer health data: the Services are available nationwide, including in Washington, Nevada, and Connecticut. Those states' consumer health data laws — including Washington's My Health My Data Act — require a separate, conspicuously linked consumer health data privacy policy, heightened consent before collection, a distinct set of rights, and geofencing restrictions near healthcare facilities. Our Consumer Health Data Privacy Policy is a standalone document addressing those requirements, including consent for consumer health data about a person who is not a registered user.

11. California residents

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") you have the right to: know what personal information we collect, use, disclose, and sell or share; request deletion; correct inaccurate information; opt out of sale or sharing (OMMPO does neither); limit the use and disclosure of sensitive personal information to what is necessary to provide the Services; and not be discriminated against for exercising these rights. Email info@ommpo.com or use the methods in section 9.

Categories collected in the preceding 12 months: (A) identifiers such as name, email, phone, IP address, account name; (B) information described in Cal. Civ. Code § 1798.80(e) including address and financial information; (C) characteristics of protected classifications such as age and date of birth; (D) commercial information such as subscription and billing records; (E) internet or network activity including interactions with the Services; (F) geolocation data (approximate, from IP address); (G) sensory data such as photos and documents you upload; (H) professional or employment-related information if you provide it; (I) education information if you provide it; (J) inferences drawn from the above; and (K) sensitive personal information including health information, precise geolocation if enabled, and account credentials.

Sources are you directly, automatic collection as you use the Services, and service providers that help us operate them. Purposes are the business and commercial purposes in section 6. In the preceding 12 months we disclosed identifiers, § 1798.80(e) information, internet or network activity information, and sensitive personal information to service providers for those business purposes. We have not sold or shared personal information for cross-context behavioural advertising in the preceding 12 months, and we do not use sensitive personal information to infer characteristics about you.

Minors: OMMPO is intended for adults and does not knowingly collect personal information from anyone under 18. We do not sell or share the personal information of consumers we know to be under 16, and onboarding is designed to prevent household invitations to anyone under 18. Financial incentives: we offer none for the collection, sale, or deletion of personal information. Shine the Light: Cal. Civ. Code § 1798.83 lets California residents request information about disclosures to third parties for direct marketing — OMMPO makes none.

12. Children

OMMPO is intended for adults and we do not knowingly collect personal information from anyone under 18. If we learn we have received such information we will take reasonable steps to delete it. If you believe a person under 18 has submitted information, contact info@ommpo.com.

13. Security

We use commercially reasonable administrative, physical, and technical safeguards designed to protect personal information from accidental loss and from unauthorized access, use, alteration, or disclosure.

OMMPO support staff do not have standing access to your health data, care logs, or Ask a Care Navigator conversations. When support access is needed to help you, it is granted just-in-time, scoped to the specific issue, requires your approval, and is logged.

No website, service, storage system, or transmission method is completely secure. Unauthenticated website forms and email may not be secure and we cannot guarantee the security of information sent through them — please do not submit health records, financial information, passwords, or other sensitive information through public website forms. Inside the authenticated application, where our features are designed to hold this kind of information, we use encryption in transit and at rest, U.S. data residency, role-based access controls, and consent-gated sharing.

Photos you share with your household are stored at web addresses that are not indexed for public search but are not otherwise access-restricted: someone who obtains the address could view the photo without logging in. Do not share a photo you would not want viewable by anyone who obtains its address.

14. Retention

We retain personal information for as long as reasonably necessary to fulfil the purposes in this Notice, maintain your account, comply with legal obligations, resolve disputes, and protect the security of OMMPO and its users. Active account data is retained for the duration of your account plus a reasonable period for backup, archival, audit, and legal compliance. Billing and tax records are retained for the period applicable law requires.

When you request deletion or close your account we delete the information from our active production systems, though copies may persist for a time in encrypted backups until those backups are overwritten in the ordinary course. Ask a Care Navigator transcripts and waitlist and marketing contacts are retained until you request deletion or until we implement an automated retention schedule for those categories; we are working to define those periods and will update this Notice once they are implemented and verified.

OMMPO is not a backup service or the sole place to keep important information. Keep independent copies of important legal, health, insurance, medication, financial, account, and credential information — especially anything time-sensitive or legally important.

15. Death or incapacity of a user

OMMPO does not currently offer an online tool for designating a legacy contact. If we are notified of a user's death we require a death certificate and documentation of legal authority to act for the estate, such as letters testamentary or a court order. For an incapacitated user we require a court order or a valid power of attorney that by its terms remains in effect during incapacity, before granting access to the account.

If family members or other parties dispute access, we preserve the account in a locked state and release nothing until we receive a court order or a written agreement signed by all documented parties. We do not automatically delete an account or its content on a user's death. We may introduce a legacy contact tool in future and will update this Notice before it becomes available.

16. Future features and AI training

We may add features over time. If we materially expand the types of information we collect or materially change how we use personal information, we will update this Notice and give any notice or obtain any consent applicable law requires before using information in a new way.

OMMPO does not use your personal information, User Content, health information, uploaded documents, Ask a Care Navigator conversations, prompts, or feedback to train or fine-tune AI models, and we do not permit our AI providers to do so.

17. Changes to this notice, and contact

We may update this Notice as our practices or legal obligations change. When we do, we post the revised Notice on the OMMPO website and update the Last Modified date at the top. If we make meaningful changes we may notify you by email or through the Services. Please check this page periodically for the current version.

Questions, privacy requests, or requests to see, correct, or delete information: OMMPO LLC, New York City, New York — info@ommpo.com. You can also contact us through the website.