1. Who we are and scope
OneCare is a healthcare operations platform operated by MD Management Holdings, LLC and provided by its affiliates, MD Biologix, LLC and MD MedRx LLC, collectively ("OneCare", "we", "us", or "our"). OneCare helps healthcare facilities, practices, and distributors manage product orders, benefit verification, insurance verification requests, invoicing, inventory, and related communications.
This Privacy Policy explains how we collect, use, share, and protect information when you use:
- the OneCare web application at onecarehealth.ai;
- the OneCare mobile application for iOS and Android (the "App"); and
- any related services, emails, or support we provide (together, the "Services").
By using the Services you agree to this Privacy Policy. If you use the Services on behalf of a healthcare provider or other organization, that organization is our customer, and its agreement with us (including any Business Associate Agreement) controls how we handle the data it entrusts to us.
2. Information we collect
2.1 Information you provide to us
- Account information. Your name, work email address, username, password, phone number, job role, and the facility or organization you belong to. Accounts are created by your organization's administrator; the App does not support self-service sign-up.
- Organization information. Practice or company name, addresses, tax and billing details, provider identifiers, and the contacts you designate to receive orders, invoices, and notifications.
- Patient and clinical information. When your organization uses the Services to place orders, verify benefits, or submit insurance verification requests, you may enter patient names, dates of birth, insurance details, diagnosis and procedure codes, wound or treatment information, and supporting documents. This information is Protected Health Information ("PHI") and is handled as described in Section 4.
- Documents and attachments. Files, images, and photos you upload or capture in the App, such as insurance cards, clinical documents, and signed forms.
- Payment information. When you pay an invoice, your card or bank details are collected directly by our payment processor. We receive a confirmation, the last four digits, and a transaction reference, but we do not store full card numbers.
- Communications. Messages you send through in-app chat, comments you add to records, and any correspondence with our support team.
- Electronic signatures you provide when accepting agreements within the Services.
2.2 Information collected automatically
- Device and technical data. Device type and model, operating system and version, App version, browser type, IP address, language, and time zone.
- Usage and activity data. Pages and features you use, actions you take on records (for example, creating, editing, approving, or deleting a record), the date and time of those actions, and login history. We keep this activity history as an audit trail, which is required for healthcare compliance.
- Log data. Server logs, error reports, and crash diagnostics used to keep the Services secure and working correctly.
- Cookies and similar technologies. The web application uses strictly necessary cookies to keep you signed in and protect against cross-site request forgery. We do not use advertising cookies or third-party ad trackers.
2.3 Information we receive from others
- Insurance eligibility partners. When your organization requests benefit or eligibility verification, we receive coverage and benefit responses from insurance clearinghouses or eligibility services.
- Shipping carriers. Tracking status for shipped orders.
- Accounting and payment providers. Payment status and invoice synchronization confirmations.
3. How we use information
We use the information we collect to:
- create and manage your account and verify your identity;
- process orders, benefit verifications, insurance verification requests, invoices, and payments;
- send transactional emails and notifications about orders, shipments, invoices, and account activity;
- enable communication between your organization and our team through in-app chat and comments;
- maintain audit logs, detect fraud or misuse, and protect the security of the Services;
- provide customer support and respond to your requests;
- comply with legal, regulatory, and contractual obligations, including HIPAA; and
- analyze usage in aggregate to improve and maintain the Services.
4. Protected Health Information and HIPAA
Much of the patient information processed through the Services is Protected Health Information under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"). This section explains how PHI is handled.
4.1 Our role
Healthcare providers that use the Services are HIPAA "Covered Entities" (or Business Associates of Covered Entities). When we handle PHI on their behalf, we act as a Business Associate. We enter into a Business Associate Agreement ("BAA") with each customer that submits PHI through the Services. Where this Privacy Policy and a BAA conflict with respect to PHI, the BAA controls.
4.2 How PHI is used and disclosed
- We use and disclose PHI only as permitted by the applicable BAA and HIPAA, to perform the services your organization has requested, for our own proper management and administration, and as required by law.
- We do not use PHI for marketing, advertising, or sale, and we do not combine PHI across customers to build profiles.
- We apply the "minimum necessary" standard, so staff and systems access only the PHI needed for a given task.
- Subcontractors that may access PHI (for example, our cloud hosting provider) are bound by written agreements that require HIPAA-compliant safeguards.
4.3 Safeguards
- PHI is encrypted in transit using TLS and encrypted at rest.
- Access is restricted by role and permission, and every access to or change of a record is logged with the user, action, and time.
- Sessions time out after inactivity, and administrative accounts are subject to additional controls.
- We maintain policies for workforce training, incident response, and breach notification consistent with HIPAA.
4.4 Patient rights
If you are a patient whose information was entered into the Services by your healthcare provider, your rights to access, amend, or restrict that information are exercised through your provider, who is the Covered Entity responsible for your records. Your provider's Notice of Privacy Practices describes those rights. We will assist your provider in fulfilling such requests as required by our BAA.
5. How we share information
We share information only in the following circumstances:
- Within your organization. Users at your facility or organization can see the records and activity their role permits, and designated contacts receive order, shipment, and invoice notifications.
- With our internal team. OneCare staff who process orders, verifications, invoices, and support requests.
- Service providers. Companies that host and run the Services for us, including cloud infrastructure and storage, transactional email delivery, SMS or one-time-passcode delivery, payment processing, accounting synchronization, and insurance eligibility verification. These providers may access information only to perform services for us and are bound by confidentiality and, where PHI is involved, HIPAA obligations.
- Shipping carriers receive the delivery address and contact details needed to deliver an order.
- Distributors and manufacturers. If your facility orders products fulfilled by a distributor or manufacturer partner, order details needed to fulfill and invoice that order are shared with them.
- Legal and safety. When required by law, subpoena, or legal process, or to protect the rights, property, or safety of OneCare, our customers, or others.
- Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy and any applicable BAA.
- With your direction or consent, such as when you add an external email address to receive a document.
6. Mobile application
The App provides access to the same Services as the web application. In addition to the information described above, the App may request the following device permissions. Each is optional and requested only when you use the related feature:
- Camera and photo library, to capture or attach documents such as insurance cards, clinical paperwork, or product photos. Images are uploaded to your organization's records and are not accessed for any other purpose.
- Notifications, to alert you when a download or export completes.
The App does not collect precise location data, does not access your contacts, and does not use advertising identifiers or third-party advertising SDKs.
Account deletion. Accounts are created and managed by your organization's administrator. To request deletion of your account or data, contact your administrator or reach us using the details in Section 13.
7. Data security
We use administrative, technical, and physical safeguards designed to protect information against unauthorized access, loss, misuse, or alteration. These include encryption in transit and at rest, role-based access controls, audit logging, network firewalls, regular backups, and secure hosting in data centers located in the United States. No system is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential and for notifying us promptly if you suspect unauthorized access to your account.
8. Data retention
- Account and organization information is retained for as long as your account or your organization's relationship with us is active, and for a reasonable period afterward to resolve disputes and meet legal obligations.
- PHI is retained for the period required by the applicable BAA and by law, and is returned or destroyed at the end of the customer relationship in accordance with the BAA, where feasible.
- Orders, invoices, payment records, and audit logs are retained for at least the period required by tax, accounting, and healthcare record-keeping laws, which is typically six years or longer.
- When you delete your account, we deactivate your login and remove personal information that is not required for the purposes above. Records that must be retained (for example, orders and invoices you created, and audit history) are kept but are no longer associated with an active user account.
9. Your rights and choices
- Access and correction. You can review and update your account information in the Services or by contacting us.
- Deletion. You can request deletion of your account as described in Section 6.
- Email notifications. Your organization can control which notification emails are sent and to whom. Transactional emails required to operate the Services (for example, password resets and security alerts) cannot be disabled.
- Push notifications can be disabled in your device settings.
- Marketing. We do not send marketing email to users of the Services. If that changes, every marketing email will include an unsubscribe link.
State privacy rights
Depending on where you live, you may have additional rights under state law, such as the right to know what personal information we hold about you, to request deletion, and to not be discriminated against for exercising those rights. Information that is PHI under HIPAA, or that we process on behalf of a healthcare provider, is generally exempt from these state laws and is governed by HIPAA and our BAA instead. To exercise any right, contact us using the details in Section 13. We will verify your identity before responding.
10. Children's privacy
The Services are intended for use by healthcare professionals and business users and are not directed to children under 13. We do not knowingly collect personal information directly from children. Patient information about minors may be entered by a healthcare provider and is treated as PHI under Section 4.
11. United States users
The Services are operated from, and information is stored in, the United States. The Services are intended for users located in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. If the changes are material, we will notify you by email or through a notice in the Services before they take effect. Your continued use of the Services after the effective date means you accept the updated policy.
13. Contact us
If you have questions about this Privacy Policy, want to exercise a privacy right, or need to report a security concern, contact us at:
MD Management Holdings, LLC
Attn: Privacy Officer
1750 Briercroft Court, Suite 228
Carrollton, Texas 75006
Email: operations@mdmanagement.health
Phone: (972) 848-3595
If you are a patient, please direct requests about your medical records to your healthcare provider.