Privacy Policy
OncAlly, LLC
Effective Date: October 29, 2026
OncAlly, LLC (OncAlly, we, us, or our) provides personal, independent cancer education and navigation. This policy explains how we handle personal information when you visit OncAlly.com or OncAlly.net, contact us, schedule a consultation, purchase services, or participate as a client, authorized supporter, or payer.
1. Information We Collect
Information you or an authorized person provide
Contact and account information may include your name, email, telephone number, mailing address, state of residence, login information, communication preferences, and scheduling details. We collect service selections, agreements, authorizations, billing records, and correspondence needed to administer your relationship with us.
For requested services, you may provide diagnosis and pathology reports, treatment history, medication information, clinical trial materials, and other relevant records. We also collect the questions, goals, priorities, preferences, and support needs you choose to share. Records may include sensitive information such as genetic or family history, disability, mental health, or reproductive health information. Provide only information relevant to the service you request.
We create consultation notes, working summaries, educational materials, comparison tables, question lists, and other service documents. These may contain or reflect personal and health information. When needed, we collect limited information to verify identity, a representative’s authority, or a request involving a deceased client.
Payments and website information
Our payment provider processes payment credentials. We receive the transaction, billing, payment-status, and limited payment-method details needed to administer charges, refunds, and disputes.
Our website and technology providers may receive IP addresses, browser and device information, pages visited, referral information, timestamps, and security or error logs. Information about seeking cancer-related services can itself reveal health interests. Cookies and similar technologies are addressed in Section 6.
2. Where Information Comes From
We receive information directly from you, from supporters or legal representatives acting with appropriate authority, from documents you or they provide, and during healthcare appointments we attend with your permission. Our service providers supply scheduling, communications, payment, and technical information. We do not independently obtain records from your healthcare team or contact providers outside an appointment; our work relies on information you provide or authorize within our service boundaries.
3. How We Use Information
We use information to respond to inquiries; assess service fit; schedule and deliver requested education and navigation; understand your priorities; prepare individualized materials; communicate with you and authorized supporters; and administer agreements, payments, refunds, and subscriptions. We also use information as reasonably necessary to secure our systems, prevent fraud, address complaints, comply with law, and establish or defend legal claims, where permitted by applicable law.
We limit collection and use to information reasonably needed for these purposes. Internal service improvement uses information only as permitted by law; it is not permission for unrelated research, advertising, or new uses of health information. We do not sell personal information or use or disclose it for targeted advertising or cross-context behavioral advertising.
We do not use client-identifiable information in public case examples, testimonials, or marketing without a separate, specific written authorization. Purchasing services does not authorize publicity. Optional marketing communications require your choice to receive them, and you may unsubscribe without stopping necessary service or billing messages.
4. When Information Is Disclosed
Technology and business service providers
Providers supporting website hosting, scheduling, secure forms and file exchange, email and video communications, document storage, electronic signatures, payment processing, accounting, and security may process information needed for their role. We limit the information supplied to the purpose, use appropriate contractual restrictions where required, and evaluate whether a provider’s own uses are compatible with our obligations. We do not provide clinical records to a payment processor merely to collect payment.
People you authorize and appointment participants
We disclose information to a supporter, caregiver, or legal representative only within a valid authorization or other legally sufficient authority. You may change or revoke a supporter authorization prospectively by contacting us. We do not assume that a family relationship or payment for services grants access to health information.
A third-party payer receives information reasonably needed to authorize and administer payment, such as charges, receipts, or refunds. Even billing details may reveal use of cancer-related services; we minimize those details. Broader access to client information requires separate authority. During an appointment you ask us to attend, information may be heard or shared among the participants you and your healthcare team permit.
Legal obligations and business continuity
We may disclose limited information in response to binding legal requirements, to protect rights or address a serious safety or security issue, or to obtain confidential legal, insurance, or professional advice, but only where the disclosure is permitted by applicable law. A general business interest does not override restrictions on health information.
If ownership changes or OncAlly must wind down, information may be transferred only as law permits, with appropriate confidentiality protections and any required notice or consent. A successor must preserve applicable privacy obligations. Designation as a successor owner does not itself authorize unrestricted access to client records.
5. Artificial Intelligence and Recordings
We may use technology-assisted tools for general, non-client-specific research, administrative work, and preparation of general educational materials, with human review. We do not enter client-identifiable information into third-party generative AI systems, use client information to train generative AI models, or allow AI to independently make medical decisions or give individualized medical advice. We do not treat removal of a name alone as sufficient protection for a distinctive cancer history.
OncAlly does not routinely record consultations or use automated transcription or meeting-capture tools. Any exception requires advance, specific consent from all persons whose consent is legally required and a separate explanation of purpose, access, and retention. Clients and other participants must obtain OncAlly’s express prior written consent before recording or using meeting-capture tools, as described in the Client Services Agreement. Manual consultation notes are part of our service records.
6. Cookies and Website Tools
We use cookies and similar technologies to operate and secure our website, understand how visitors find and use our services, evaluate website performance, and improve the visitor experience.
Essential cookies and technologies support basic website functionality and security. With your permission, we also use non-essential cookies for website analytics and related improvements. You may accept, decline, or manage non-essential cookies through our cookie banner and change your preferences at any time using the Cookie Preferences control on our website.
Our website analytics tools may collect information such as IP addresses, approximate geographic location, browser and device information, referral sources, pages visited, and dates and times of visits. This information may be used to evaluate website traffic, navigation patterns, and engagement with our content. Certain technical information may also be processed as necessary to operate and secure the website, independently of your cookie preferences.
We do not use advertising pixels, session-replay technologies, or tools intended to disclose identifiable health interests to advertising networks. We do not permit third parties to collect consumer health data through our website for tracking across unrelated websites or services.
You may also delete or restrict cookies through your browser settings, although doing so may affect certain website functions.
7. Communication and Security
Please use OncAlly's designated secure client portal to submit medical records and detailed health information. Public contact and scheduling forms should be used only for basic contact and appointment information. Do not send Social Security numbers, payment credentials, or detailed medical records through general inquiry forms or ordinary email.
We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information. Access is limited to authorized persons and providers with a legitimate need. No electronic system or transmission is completely secure. Choosing email does not waive your privacy rights or our legal obligations; contact us if you prefer another available communication method.
If a security incident occurs, we investigate, take appropriate protective steps, and provide notices required by applicable law. We do not promise that all information is stored exclusively in the United States.
8. Retention and Deletion
Retention depends on record type, disclosed purpose, active services, legal duties, and legally permitted dispute needs. We retain information only as long as needed or legally required. Subscription cancellation does not automatically delete records.
Health-data deletion rights may override ordinary business or insurance retention preferences. We apply only legally available exceptions, explain refusals, and notify relevant providers and recipients as required. Backup deletion follows applicable deadlines; backups are not categorically exempt.
9. Your Choices and Requests
Contact us for access, correction, deletion, preference changes, or withdrawal of authorization or consent. Applicable law determines legal rights and exceptions. Our Consumer Health Data Privacy Policy explains health-data procedures. We do not unlawfully discriminate for exercising rights.
Email privacy@oncally.com or write to Section 12’s address. Describe your request without attaching medical records or sensitive identification. We provide a secure verification method, request only reasonably necessary identity or authority information, and do not require a new account.
We respond without undue delay within the applicable legal deadline. If we cannot honor a request, we explain why. Send appeals to privacy@oncally.com with the subject Privacy Appeal. Where applicable, we respond within the legal deadline and provide the regulator’s complaint method if an appeal is denied.
Withdrawal or deletion may prevent services requiring that information; we explain the effect. Privacy requests do not themselves change payment or cancellation terms. Those terms do not limit nonwaivable rights or permit unlawful processing.
10. Additional Privacy Considerations
OncAlly provides independent education and navigation rather than clinical care. This policy is not a HIPAA Notice of Privacy Practices. HIPAA coverage depends on the recipient’s role and activities, not simply receipt of medical records. Our privacy commitments and applicable laws govern regardless of HIPAA status.
Our website is for adults; we do not knowingly collect directly from children under 13. Contact us about a child’s submission. Accepting minors’ records through representatives requires appropriate authority, consent, and confidentiality protections.
Third-party websites and services may have their own privacy policies governing their independent activities. When service providers process personal information on OncAlly's behalf, we remain responsible for meeting our applicable privacy obligations concerning that processing.
11. Changes to This Policy
We may update this Privacy Policy periodically. We will identify the effective date of the current version and publish revisions on our website. Website visitors are encouraged to review the current Privacy Policy, which describes our privacy practices as of its stated effective date. We do not routinely provide individual notifications of Privacy Policy changes to website visitors.
For established clients, we will provide direct notification of material changes that affect the collection, use, disclosure, or protection of their personal information, as required by applicable law and our commitments to clients.
Where applicable law requires additional notice or consent before implementing changes to how personal information, including consumer health data, is processed, we will provide that notice or obtain that consent. Continued use of our website or services does not replace consent where separate consent is legally required.
12. Contact OncAlly
Email: privacy@oncally.com
Mail:
OncAlly, LLC
Attn: Privacy Contact
23710 Schooler Plaza, Suite 275, PMB #17
Brambleton, VA 20148