Privacy Policy
Last Updated: August 13, 2026
1. WHO WE ARE AND WHAT THIS POLICY COVERS
OneVillage, PBC (“OneVillage”, “we”, “our”, or “us”) provides a personalized navigation and coaching platform that supports people through life and health events — including one-to-one coaching, group support, expert seminars, medical and insurance navigation, and concierge support, typically offered through an employer or other sponsoring organization (a “Sponsor”). This Privacy Policy explains what personal information we collect through our websites, mobile applications, and services (together, the “Service”), how we use and share it, and the rights and choices you have.
Some of the information we handle may also be protected health information governed by HIPAA when it is received from or on behalf of a covered entity. Our HIPAA Notice of Privacy Practices describes your rights with respect to that information and controls in the event of any conflict with this Policy. This Policy is incorporated into our Terms of Use.
2. INFORMATION WE COLLECT
We collect the following categories of personal information, depending on how you use the Service: identifiers and contact details (such as name, email address, phone number, and postal address); account credentials; eligibility information provided by you or your Sponsor (such as employer name and work email) so we can confirm your access to a sponsored program; health and wellness information you choose to share with us (such as the life or health event you are navigating, session notes, goals, and insurance and benefits details you ask us to help with); payment and transaction information when you purchase services directly; communications with our coaches, navigators, and support team; survey responses and reviews; device and usage information collected automatically (such as IP address, browser and device type, pages viewed, and interactions with our emails, collected through cookies, pixels, and similar technologies); and approximate location information from your device when your settings permit it.
We collect this information when you provide it directly, when it is provided by your Sponsor for eligibility purposes, automatically through your use of the Service, and, in limited cases, from service providers and publicly available sources. If you provide us information about another person — for example, a family member or someone you care for — you confirm that you have their permission to do so.
3. HOW WE USE YOUR INFORMATION
We use personal information to: provide and personalize the Service, including matching you with coaches, navigators, and content relevant to your situation; schedule and deliver sessions and send related reminders; help you understand and
use your insurance and benefits; respond to your questions and provide support; process payments; administer Sponsor programs and verify eligibility; send service communications and, with your consent where required, marketing communications; maintain safety and security, prevent fraud, and enforce our Terms of Use; comply with legal obligations; and improve the Service, including through analytics performed on de-identified or aggregated information that can no longer reasonably be linked to you. We commit to maintaining de-identified data in de-identified form and not attempting to re-identify it.
Some features of the Service use artificial intelligence to help generate content, summaries, or recommendations. Where they do, we use your information to operate those features, and human review may be applied to improve their quality and safety. AI output is informational only, as described in our Terms of Use.
We collect, use, and retain personal information only as reasonably necessary to provide the Service you request, consistent with data-minimization requirements under applicable law, including the Maryland Online Data Privacy Act. We do not collect, use, or share sensitive data — including health data — except as strictly necessary to provide the Service you have requested or with your consent, and we do not sell sensitive data.
4. EMPLOYER-SPONSORED PROGRAMS
If you access OneVillage through a Sponsor, we want to be direct about what your Sponsor can and cannot see. Your Sponsor does not receive your individual coaching conversations, session content, health information, or the reasons you use the Service. Sponsors receive only aggregated, de-identified reporting — such as overall enrollment, engagement, and satisfaction metrics — that does not identify you, unless you separately and expressly authorize more or disclosure is required by law. Eligibility information flows from your Sponsor to us, not the other way around.
5. HOW WE SHARE INFORMATION
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share personal information only: with our coaches, navigators, and clinicians so they can support you; with service providers who process information on our behalf under contractual confidentiality and use restrictions (such as hosting, payment processing, scheduling, communications, and analytics providers); with your Sponsor, solely in the aggregated, de-identified form described above; at your direction, when you ask us to share information with a third party; as part of a corporate transaction such as a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this Policy; and when required by law, legal process, or to protect the rights, safety, or property of OneVillage, our members, or others. Wherever this Policy says we do not do something, that commitment binds our service providers as well.
6. COOKIES, ANALYTICS, AND YOUR TRACKING CHOICES
We use cookies, pixels, and similar technologies to keep you signed in, remember your preferences, measure how the Service is used, and improve it. We do not use third-party advertising cookies to target you with ads across other websites, and we do not track your activity on sites we do not own.
You can control cookies through your browser settings, though some features may not work properly without them. We honor the Global Privacy Control (GPC) browser signal as a valid opt-out of any sale, sharing, or targeted-advertising use of personal information in states where that right applies. Because there is no common industry standard for legacy “Do Not Track” signals, we treat GPC as the operative signal. You can also limit your mobile advertising identifier in your device settings, and manage preferences through tools like the Digital Advertising Alliance (optout.aboutads.info) and Network Advertising Initiative (optout.networkadvertising.org).
7. TEXT MESSAGES AND EMAIL
If your Sponsor’s program includes text messaging and you individually opt in, we will send you approximately one text message per month with information about your health plan benefits and wellness resources, along with any service texts you request (such as session reminders). Your Sponsor’s participation enables the program, but we text you only with your own prior express written consent — enrolling through your employer alone never signs you up. Message and data rates may apply. Reply STOP at any time to stop receiving texts and HELP for assistance. Consent to marketing texts is never a condition of using the Service, and mobile opt-in data is not shared with third parties for their own marketing. You can opt out of marketing emails using the unsubscribe link in any message; service and account emails continue while you have an account.
8. YOUR PRIVACY RIGHTS AND CHOICES
Wherever you live, you may: request access to the personal information we hold about you, including in a portable format; request correction of inaccurate information; request deletion of your personal information; and opt out of marketing communications. Residents of states with comprehensive privacy laws — including Maryland, California, Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Jersey, and others — may also have rights to opt out of targeted advertising, sales, and certain profiling, and to limit the use of sensitive personal information. We extend the core access, correction, and deletion rights to all members regardless of state.
How to exercise your rights
Email support@onevillage.io or write to OneVillage, PBC, 3206 Rolling Road, Chevy Chase, MD 20815. We will verify your request using information associated with your account, respond within 45 days (with one 45-day extension where permitted, in which case we will tell you), and will not discriminate against you for exercising any right. An authorized agent may submit a request on your behalf with proof of authorization. If we decline a request, we will explain why, and you may appeal by replying to our decision; if we deny it, you may contact your state Attorney General.
9. CONSUMER HEALTH DATA
Because OneVillage supports people through health events, some information we collect is “consumer health data” under laws such as the Washington My Health My Data Act (“MHMDA”), the Maryland Online Data Privacy Act, and similar laws in Nevada and Connecticut. This section serves as our Consumer Health Data Privacy Policy under those laws. Where information is protected health information governed by HIPAA and received from or on behalf of a covered entity, our HIPAA Notice of Privacy Practices governs instead.
What we collect
Depending on how you use the Service, we collect these categories of consumer health data: the life or health event you are navigating (such as a diagnosis, treatment journey, or caregiving situation); information you share in coaching and navigation sessions, including session notes, goals, and progress; health conditions, symptoms, or treatments you describe to us; insurance, benefits, claims, and pre authorization details tied to your health; appointment and session scheduling information that reveals you are seeking health-related support; communications with our coaches, navigators, and support team about your health; and inferences we draw from the above in order to personalize your support.
Where it comes from
We collect consumer health data directly from you, from your use of the Service (for example, sessions you book and content you engage with), and from third parties you ask us to work with on your behalf, such as your health plan or providers when you request navigation help. Your Sponsor provides only eligibility information; it does not provide us your health data.
How we use it
We collect and use consumer health data only with your consent or as strictly necessary to provide services you have requested: to deliver coaching, navigation, and concierge support; to help you understand and use your insurance and benefits; to schedule sessions and send related communications; to maintain safety, security, and legal compliance; and, in de-identified or aggregated form that can no longer be linked to you, to improve the Service. We do not sell consumer health data, we do not use it for advertising, and we do not share it for any form of targeted marketing.
Who we share it with
We share consumer health data only with: our coaches, navigators, and clinicians so they can support you; service providers acting on our behalf under contracts that restrict their use of the data to providing services to us — currently in the categories of cloud hosting, scheduling, communications and telehealth infrastructure, payment processing, and analytics; parties you direct us to share with, such as your health plan when you ask for navigation help; and authorities where disclosure is required by law. We have no affiliates and share no consumer health data with any affiliate, and your Sponsor receives only the aggregated, de-identified reporting described in Section 4. Every person with access to consumer health data is bound by confidentiality obligations.
Your health-data rights
You have the right to: confirm whether we collect, share, or sell your consumer health data and access it, including a list of the third parties and affiliates with whom we have shared it and a way to contact them; withdraw any consent you have given; and have your consumer health data deleted, including from our archives and backups and by our service providers, subject to the timelines allowed by law. Exercise these rights as described in Section 8; the same verification, non-discrimination, and appeal commitments apply.
No geofencing
We do not use geofencing around any facility that provides in-person health care services to identify, track, collect data from, or send notifications to consumers.
10. STATE-SPECIFIC DISCLOSURES
California
In the last 12 months we collected the categories of personal information described in Section 2 for the purposes described in Section 3, and disclosed them to the service providers described in Section 5. We do not sell personal information and have not done so in the preceding 12 months, and we do not share personal information for cross-context behavioral advertising. You have the rights to know, access, correct, delete, and port your personal information; to limit use of sensitive personal information; and to be free from discrimination — exercisable as described in Section 8, including through an authorized agent. We honor GPC signals as a valid opt-out. California’s “Shine the Light” law (Civil Code § 1798.83) lets you request information about disclosures to third parties for their direct marketing; we make none.
Maryland
Under the Maryland Online Data Privacy Act, we limit collection to what is reasonably necessary for the services you request, we do not sell sensitive data, and we process consumer health data with the safeguards described in Section 9. Maryland residents may exercise all rights in Section 8, including appeal.
Other states
Residents of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Utah, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Indiana, Kentucky, Rhode Island, Tennessee, and Minnesota have similar rights of access, correction, deletion, portability, and opt-out under their state laws, exercisable as described in Section 8. Nevada residents may direct us not to sell covered information; we do not.
11. CHILDREN’S PRIVACY
The Service is intended for adults and is available only to users 18 or older. We do not knowingly collect personal information from children under 13, and we do not direct any part of the Service to children. If you believe a child has provided us personal information, contact support@onevillage.io and we will delete it as required by COPPA and applicable state law.
12. HOW WE PROTECT YOUR DATA
We use technical, organizational, and physical safeguards designed to protect personal information — including encryption in transit, access controls that limit information to the people who need it to serve you, and workforce confidentiality obligations. No security program is failsafe, and we cannot guarantee absolute security; if a breach affecting your information occurs, we will notify you and regulators as required by law.
13. HOW LONG WE KEEP YOUR DATA
We keep personal information only as long as reasonably necessary to provide the Service, support you through your care journey, and meet legal, accounting, and reporting obligations. The criteria we use include whether you maintain an account, whether your Sponsor’s program remains active, whether retention is required by law, and whether information is needed to resolve disputes or prevent fraud. When you close your account or ask us to delete your information, we delete or de-identify it within the period required by applicable law, keeping only what the law permits or requires us to retain. We may retain de-identified or aggregated information that can no longer be linked to you.
14. INTERNATIONAL USERS
OneVillage operates from the United States, and your information is processed and stored in the United States, where privacy laws may differ from those of your country. Where the GDPR or UK GDPR applies, we process personal data on the legal bases of contract performance, consent (which you may withdraw at any time), and legitimate interests; you additionally have rights to object to and restrict processing and to lodge a complaint with your supervisory authority, and we rely on appropriate safeguards such as Standard Contractual Clauses for transfers.
15. CHANGES TO THIS POLICY
We may update this Policy from time to time. If we make material changes, we will notify you by email or through the Service before they take effect, and we will update the “Last Updated” date above to the date the revised Policy is actually published. Changes that materially expand how we use previously collected personal information will be made only with your consent where the law requires it.
16. CONTACT US
Questions, concerns, or requests about privacy should go to support@onevillage.io, or by mail to OneVillage, PBC, 3206 Rolling Road, Chevy Chase, MD 20815.