---
description: Legal - Data Protection Policy
---

# Legal - Data Protection Policy

Octo Health LLC (“Administrator”) is committed to protecting all users’ data and works to keep users’ data private and safe. This Data Protection Policy (the “Policy”) applies to Octo Health (the “Site”) and complements Administrator’s Privacy Policy and HIPAA Notice (the “Privacy Policy and Notice”). This Policy is also incorporated into Administrator’s Terms and Conditions, and use of the Site will be conclusively deemed an acceptance of this Policy and the Terms and Conditions. Please read this page carefully before using the Site, and if you do not accept the Policy stated here, do not use the Site. Administrator is the owner to all right, title, and interest to the Site and may revise the Policy at any time by updating this posting. You should visit this page periodically to review the Policy, as it is binding on you.

SECTION 1. DEFINITIONS.

1.1. “Data” means all personal and/or identifiable information supplied to or collected by Administrator through or in connection with the Site. This does not include anonymous data (data that does not identify individuals or provide any private information).

1.2. “Affiliates” means Administrator’s affiliated entities, including but not limited to subsidiary entities, predecessor and successor entities, officers, directors, employees, representatives, agents, and licensees.

1.3. “Users” means all parties, including but not limited to users, customers, suppliers, external entities, and Affiliates, that supply any amount of Data to Administrator.

1.4.  “Security Incident” means any unlawful or unauthorized breach of security that leads to the unlawful or accidental loss, destruction, alteration, disclosure of, or access to Data.

SECTION 2. DATA USE AND INTEGRITY.

2.1. Purposes for Use. Any Data that Administrator obtains may be used by Administrator for the purposes indicated in Administrator’s Privacy Policy and Notice or as otherwise provided to Users. Administrator will not process Data in a way that is incompatible with these purposes. The types of Data generally collected by Administrator are set out in the accompanying Privacy Policy and Notice.

2.2. Relevance and Accuracy. Administrator takes reasonable steps to limit the collection and usage of Data to that which is relevant for the purposes herein indicated for which it is collected. Administrator also takes reasonable steps to ensure that such Data is reliable, accurate, complete, and current.

2.3. Retention. Administrator will retain Data in an identifiable form only for the period necessary to fulfil the purposes herein indicated, unless a longer retention period is required or permitted by law or by the Privacy Policy and Notice. Administrator will adhere to the Privacy Policy and Notice for as long as Administrator retains Data collected under this Policy.

SECTION 3. DATA DISCLOSURES.

Administrator discloses Data as described in the Privacy Policy and Notice. If Administrator discloses Data to an Affiliate, Administrator will do so in compliance with this Policy and the Privacy Policy and Notice. Administrator will remain responsible for any Data transferred to an Affiliate, unless Administrator proves that it is not responsible for any event giving rise to any inconsistent use or processing of Data. Administrator may also disclose Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

SECTION 4. DATA SECURITY.

4.1. Reasonable Measures. Administrator uses reasonable and appropriate measures to protect Data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. This includes the development of control processes and security protections to help ensure the security of User information. See the Privacy Policy and Notice for further information.

4.2. Affiliates. Administrator offers guidance to ensure that its Affiliates are aware of the requirements set by applicable law, and any of Administrator’s Affiliates dealing with Data must abide by this Policy and the Privacy Policy and Notice.

4.3. Security Incidents. If Administrator becomes aware of a Security Incident regarding any Data, Administrator will notify all relevant parties in keeping with the Privacy Policy and Notice. If Users are aware of any breach of security or suspicious activity, Users agree to contact Administrator at start@octo.health and inform them of such.

SECTION 5. MISCELLANEOUS.

5.1. Policy Application. This Policy applies to all Users. This Policy is incorporated into Administrator’s Terms and Conditions, complements Administrator’s Privacy Policy and Notice, and use of the Site will be conclusively deemed an acceptance of this Policy, the Privacy Policy and Notice, and the Terms and Conditions. Please reference the Privacy Policy and Notice and Terms and Conditions to understand all terms and conditions binding on User.

5.2. Effective Date. Use of the Site will be conclusively deemed an acceptance of the Terms and Conditions, including this Policy. This Policy is effective and binding on User as of User’s first date of use of the Site.

5.3. Changes to the Policy. Administrator may revise this Policy from time to time. Administrator will post any adjustments to the Policy on this Site, and the revised version will be effective when it is posted. If Administrator makes any material changes to this policy, Administrator will notify User of such changes by posting them on this page or by sending User an email or other notification. User’s continued use of the Site following notice and/or posting of any modification, change, or amendment to this Agreement will be conclusively deemed an acceptance of such modification, change, or amendment. If necessary, this Policy will also be adjusted to meet requirements of legislation and case law.

5.4. Concerns. If Users have any questions, concerns, or complaints regarding this Policy, the Privacy Policy and Notice, or the accompanying Terms and Conditions, please contact Administrator at start@octo-health.com.

