On Duty Health Privacy Policy
Effective date: September 24, 2026
This Privacy Policy explains how On Duty Health, LLC ("On Duty Health," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit our websites, contact us, receive communications from us, apply for a position, interact with us as a customer, agency representative, vendor, contractor, donor, or program participant, or otherwise use a service that links to this Policy.
This Policy does not govern protected health information ("PHI") maintained by a clinical practice under the Health Insurance Portability and Accountability Act ("HIPAA"). The clinical practices' use and disclosure of PHI is described in their Notice of Privacy Practices, available at https://onduty.health/privacy-practices.
If you have questions or want to exercise a privacy right, contact us at privacy@ondutyhealth.com, use our request form at https://onduty.health/privacy-request-form, or use the contact information in Section 19.
1. About This Policy
On Duty Health, LLC operates the On Duty Health website and provides technology, marketing, and administrative support services. It also provides services under written agreements to separately owned and operated clinical practices. Those practices, and not On Duty Health, LLC, employ or contract with licensed clinicians and are responsible for clinical care, medical judgment, and clinical records.
The organizations in the On Duty Health family include:
On Duty Health, LLC — Website, technology, marketing, and administrative support.
Information covered by this Policy: Website, inquiry, business, marketing, personnel, vendor, and other non-PHI information.
On Duty Health, PLLC — Texas clinical practice.
Information covered by this Policy: Non-PHI interactions only; its PHI is governed by its Notice of Privacy Practices.
On Duty Health, PC — California clinical practice.
Information covered by this Policy: Non-PHI interactions only; its PHI is governed by its Notice of Privacy Practices.
On Duty Health Physician Assistant Corporation — California clinical practice.
Information covered by this Policy: Non-PHI interactions only; its PHI is governed by its Notice of Privacy Practices.
On Duty Health Foundation — Nonprofit programs and fundraising.
Information covered by this Policy: Donor, supporter, event, and program information that is not PHI.
References in this Policy to our "affiliates" include the organizations listed above. This Policy is published by On Duty Health, LLC for the nonclinical information systems and activities it operates. Where another listed organization collects non-PHI through a service that links to this Policy, this Policy also describes that organization's practices for that information.
On Duty Health, LLC does not practice medicine. It does not direct or control diagnosis, treatment, clinical staffing decisions, referrals, or any other professional medical judgment. It does not own or control a clinical practice's medical records, although it may maintain or process PHI on behalf of a clinical practice as a HIPAA business associate under a written agreement. When it does so, the applicable Notice of Privacy Practices and HIPAA documents, not this Policy, govern that PHI.
2. Two Categories of Information
The purpose of this authorization is to allow On Duty Health to share your testimonial for public education, outreach, advertising, marketing, and promotional purposes. Your story may help explain the value of preventive health screenings and On Duty Health services.
A. Information governed by this Policy
This Policy applies to personal information that is not PHI, including information about:
visits to our public websites;
requests for information, demonstrations, proposals, or support;
agency, employer, customer, and vendor contacts;
event registrations, educational programs, and community programs;
email, text-message, and telephone communications;
marketing preferences and mailing lists that are not created from PHI;
job applicants, personnel, independent contractors, and professional contacts;
donors, Foundation supporters, and volunteers; and
other business and administrative interactions that do not involve PHI.
B. Health information governed by a Notice of Privacy Practices
Information may become PHI when it is created, received, maintained, or transmitted by a clinical practice—or by On Duty Health, LLC on that practice's behalf—in connection with health care. PHI may include intake information, medical histories, examination findings, test results, diagnoses, treatment information, occupational-health records, appointment information, billing records, and communications about care.
PHI is governed by the applicable clinical practice's Notice of Privacy Practices. If there is a conflict between this Policy and a Notice of Privacy Practices concerning PHI, the Notice of Privacy Practices controls.
We do not use PHI for On Duty Health, LLC's own marketing. A clinical practice or its business associate will use PHI for a marketing communication only as permitted by HIPAA, including obtaining an authorization when one is required.
3. Information We Collect
Depending on how you interact with us, we may collect the following categories of personal information.
Information you provide
Identifiers and contact information, such as name, postal address, email address, telephone number, account or customer number, signature, and online identifiers.
Business and professional information, such as employer or agency, title, department, professional license, credentials, work location, and business contact information.
Inquiry and transaction information, such as services requested, appointment or event requests, proposal details, communications, customer-service records, and payment or billing information.
Account information, such as username, password, authentication information, and account preferences.
Communications preferences, including email and text-message consent, subscription choices, and opt-out records.
Program and event information, such as registration details, attendance, volunteer interests, photographs or recordings when notice and any required consent are provided, and accessibility or accommodation requests.
Donation information, such as donation amount, campaign, payment details, tribute information, and communication preferences. Payment-card details may be collected directly by our payment processor rather than stored by us.
Applicant and workforce information, as described in Section 14.
Other information you choose to provide, including information submitted in open-text fields. Please do not submit medical information through a general website contact form unless the form specifically states that it is intended for that purpose.
Information collected automatically
When you use our public websites, we and our service providers may automatically collect:
IP address and approximate location derived from it;
device, browser, and operating-system information;
referring and exit pages;
pages viewed, links clicked, and dates and times of visits;
cookie and similar-technology identifiers; and
information about website performance, errors, and engagement.
See Section 7 for more information about cookies and analytics.
Information from other sources
We may receive information from:
your employer, department, agency, association, or another organization arranging services or programs;
our affiliates and clinical practices, where permitted by law and consistent with the HIPAA boundary described above;
vendors that help us operate our websites, communications, recruiting, events, payments, security, and business systems;
references, recruiters, background-check providers, and professional networks in connection with recruiting or contracting; and
public records, government sources, professional directories, and information you have made publicly available.
We may combine information from these sources with information we collect directly.
Sensitive personal information
Some information we collect may be considered sensitive under applicable law, such as account credentials, precise geolocation if a service requires it, government identifiers, financial account information, racial or ethnic origin, religious beliefs, union membership, disability or accommodation information, and health information. We collect, use, and disclose sensitive personal information only for lawful and reasonably necessary purposes, with consent where required. We do not use sensitive personal information to infer characteristics about you for advertising.
4. Why We Collect and Use Information
We may collect and use personal information to:
operate, maintain, secure, troubleshoot, and improve our websites, systems, and services;
respond to inquiries and provide requested information, proposals, services, or support;
create and administer accounts, registrations, appointments, events, programs, and business relationships;
communicate about services, scheduling, transactions, safety matters, policy changes, and customer support;
send newsletters or promotional communications when permitted by law and consistent with your choices;
process donations and provide tax acknowledgments;
evaluate job applicants and manage personnel, contractor, and professional relationships;
authenticate users, prevent fraud, protect safety, and investigate suspected misuse or security incidents;
measure public-website performance and understand how visitors use our content;
comply with law, legal process, contractual requirements, professional obligations, and recordkeeping duties;
establish, exercise, or defend legal claims; and
carry out another purpose disclosed when the information is collected or that you direct or authorize.
Where a law requires a legal basis for processing, we rely as applicable on your consent, performance of a contract, compliance with legal obligations, protection of vital interests, and our legitimate interests in operating, securing, and improving our organization and services.
5. We Do Not Sell Your Personal Information
We do not sell personal information for money. We also do not share personal information for cross-context behavioral advertising or process it for targeted advertising as those terms are defined by applicable state privacy laws.
We do not sell or rent donor lists. We do not knowingly sell or share the personal information of anyone under 18.
We honor legally recognized opt-out preference signals, including Global Privacy Control, where required. Because we do not currently sell or share personal information or use targeted advertising, an opt-out signal should not change the advertising behavior of our website. We will record and honor the signal if our practices or applicable requirements change.
If we later introduce advertising technology, retargeting, conversion tracking, or another practice that constitutes selling, sharing, or targeted advertising, we will update this Policy and implement any required notice and choice mechanisms before that practice begins.
6. How and With Whom We Disclose Information
We may disclose personal information in the following circumstances:
Service providers and contractors. We use vendors for website hosting, analytics, communications, information technology, cybersecurity, payment processing, recruiting, document management, professional services, and similar functions. They may process information only for agreed purposes and subject to appropriate contractual restrictions.
Affiliates and clinical practices. We may disclose information within the On Duty Health family for legitimate administrative purposes, to route a request, or to provide a service you requested. PHI is disclosed only as permitted by HIPAA and the applicable Notice of Privacy Practices.
Employers, departments, agencies, and organizational customers. We may disclose administrative information such as scheduling status, attendance, invoicing, program participation, or account contacts as necessary to provide contracted services. A clinical practice may separately disclose a limited occupational-health result as permitted by law or your authorization. We do not disclose a participant's underlying medical record merely because an organization sponsors or pays for services.
Professional advisers. We may disclose information to attorneys, accountants, auditors, insurers, and consultants who need it to provide services and are subject to confidentiality duties.
Legal, compliance, and safety recipients. We may disclose information when we reasonably believe disclosure is required by law or legal process; necessary to protect rights, safety, or property; necessary to investigate fraud, abuse, or a security incident; or appropriate to cooperate with regulators or law enforcement.
Business transactions. Information may be reviewed or transferred in connection with a merger, financing, reorganization, sale of assets, bankruptcy, or similar transaction, subject to appropriate safeguards and applicable law.
At your direction or with your consent. We may disclose information to a recipient you identify or for another purpose disclosed to you when you provide the information.
We may use and disclose aggregated or deidentified information where permitted by law. We will not attempt to reidentify information that we maintain as deidentified unless permitted to test our deidentification methods.
7. Cookies, Analytics, and Advertising Technology
Our public website uses cookies and similar technologies needed to operate the site and understand its performance. As of the effective date, those technologies include:
Squarespace technologies used to host, secure, and measure the website;
Google Analytics 4 used to understand aggregate public-site traffic and engagement; and
Adobe Typekit/Adobe Fonts used to display website fonts.
We configure analytics for measurement rather than advertising and do not enable Google's advertising data-sharing features for our analytics property. We do not currently use Meta/Facebook Pixel, Google Ads conversion tags, LinkedIn Insight Tag, TikTok Pixel, or other advertising, retargeting, or conversion-tracking pixels.
We do not intentionally place analytics or marketing tags on authenticated member pages, results pages, clinical intake forms, or appointment-detail pages. A third-party patient portal or clinical platform may use technologies necessary to provide and secure its service; its notices and the applicable Notice of Privacy Practices govern those interactions.
You can control cookies through your browser settings. Blocking some cookies may affect website functionality. We also honor Global Privacy Control as described in Section 5.
8. Text Messages, Calls, and Email
Text messages
If you provide consent to receive text messages, we may send messages about scheduling, services, programs, account activity, or promotions, consistent with the consent you gave. Message frequency varies. Message and data rates may apply. Consent to marketing texts is not a condition of receiving health care or making a purchase.
You may revoke consent at any time by replying STOP. A STOP request applies to all text-message categories from that sender to that telephone number, except a one-time confirmation of the opt-out or messages required by law. You may reply HELP for assistance. You may also contact us using Section 19. Mobile carriers are not liable for delayed or undelivered messages.
Calls
We may call you at a number you provide for service, scheduling, support, or other purposes permitted by law. We will obtain any consent required for automated or prerecorded calls. If a call may be recorded or monitored, we will provide notice and obtain consent when required.
You may unsubscribe from promotional email using the link in the message or by contacting us. Even if you opt out of marketing, we may send non-promotional messages about an existing transaction, service, account, security issue, donation, or legal notice.
Please do not use ordinary email or text messaging to send sensitive medical information. Use the secure method specified by the clinical practice.
9. How We Protect Information
We use administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. Measures may include access controls, authentication, encryption where appropriate, logging, workforce training, vendor review, backups, incident-response procedures, and secure disposal.
No system or transmission method is completely secure. You are responsible for protecting your account credentials and notifying us if you believe an account or communication has been compromised.
10. How Long We Keep Information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide services, maintain business and compliance records, resolve disputes, enforce agreements, and satisfy legal, accounting, insurance, and security obligations. Retention depends on the nature and sensitivity of the information, the relationship involved, the risk of harm, and applicable law.
For example:
website and security logs are kept for the period reasonably needed for operations, analysis, fraud prevention, and security;
inquiry, customer, vendor, contract, transaction, and donation records are kept for the relationship and an appropriate period afterward for business, tax, audit, and legal purposes;
marketing contact information is kept until you opt out or it is no longer needed, while suppression records may be retained to honor your choice;
applicant and personnel records are retained for the period required by employment and recordkeeping laws and legitimate business needs; and
where applicable, occupational employee medical records subject to 29 C.F.R. § 1910.1020 may need to be preserved for the duration of employment plus 30 years, while covered exposure records generally must be preserved for at least 30 years.
Clinical records are retained by or for the applicable clinical practice according to medical-record, occupational-health, and other laws and are governed by the Notice of Privacy Practices. When information is no longer required, we delete it, deidentify it, or securely dispose of it, subject to technical limitations such as backup cycles and legal holds.
11. Children's Privacy
Our public website and services are not directed to children under 13, and we do not knowingly collect personal information online from a child under 13 without legally valid parental consent. If you believe a child under 13 submitted personal information to us through a public website, contact us so we can investigate and take appropriate action.
Some Foundation, cadet, explorer, educational, or community programs may include participants under 18. For those programs, we collect only information reasonably needed to administer the program and obtain consent from a parent or legal guardian when required. We do not sell, share for cross-context behavioral advertising, or use for targeted advertising the personal information of anyone we know or reasonably should know is under 18.
12. Your Privacy Rights
We extend the following privacy choices to individuals in the United States, even when a state law may not require every right. Subject to legal exceptions and our ability to verify a request, you may ask us to:
confirm whether we process your personal information;
provide access to or a copy of personal information we maintain about you;
correct inaccurate personal information;
delete personal information;
provide certain information in a portable format;
identify categories of information collected, sources, purposes, and categories of recipients;
opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, or qualifying profiling;
limit certain uses or disclosures of sensitive personal information;
withdraw consent where processing is based on consent; or
appeal our denial of a request where applicable.
We do not discriminate against you for exercising a privacy right. Exercising a right may affect a service if the information is necessary to provide it.
How to submit a request
Email privacy@ondutyhealth.com or use https://onduty.health/privacy-request-form. Describe your request and the relationship through which you interacted with us. You may also use an authorized agent where permitted by law. We may ask for information reasonably necessary to verify identity, authority, and the scope of the request. We will not ask for more information than necessary, and we will use verification information only for verification and fraud prevention.
We generally respond within 45 days, subject to a permitted extension. For California requests to know, access, correct, or delete, we will confirm receipt within 10 business days. We process legally recognized requests to opt out of sale or sharing as soon as feasibly possible and no later than 15 business days where California law applies. Other state laws may provide different timing or procedures, which we will follow when applicable.
Some information and activities are exempt from state consumer privacy laws, including PHI governed by HIPAA and certain employment, business-to-business, nonprofit, and regulated information. If this Policy voluntarily offers a right beyond what a law requires, we may apply reasonable identity-verification and security procedures and may deny a request when fulfilling it would violate law, compromise another person's privacy, interfere with legal obligations, or be technically infeasible.
Requests concerning PHI or a medical record must be directed to the applicable clinical practice using the process in its Notice of Privacy Practices.
13. State-Specific Disclosures
California
The categories of personal information we may have collected during the preceding 12 months are described in Section 3 and may include identifiers; customer-record information; commercial information; internet or other electronic-network activity; geolocation at an approximate level; audio, electronic, visual, or similar information; professional or employment-related information; education information; sensitive personal information; and inferences drawn from other information. We collect this information from the sources described in Section 3, use it for the purposes in Section 4, and disclose it to the categories of recipients in Section 6. Section 10 explains our retention criteria.
We have not sold personal information or shared it for cross-context behavioral advertising during the preceding 12 months. We have not knowingly sold or shared the personal information of consumers under 16. We do not offer a financial incentive or price or service difference in exchange for personal information.
California residents may exercise the rights described in Section 12, including the rights to know, access, correct, delete, receive portable information, limit certain uses of sensitive personal information, and opt out of sale or sharing. Because we do not sell or share personal information, we do not currently provide a "Do Not Sell or Share My Personal Information" link. We honor applicable opt-out preference signals.
California's "Shine the Light" law may allow residents to request certain information about disclosure of personal information to third parties for their own direct-marketing purposes. We do not disclose personal information to third parties for their own direct marketing as contemplated by that law.
Texas
Texas residents may have rights to confirm processing, access, correct, delete, obtain portable data, opt out of sale, targeted advertising, or certain profiling, and appeal a denial. Submit a request or appeal using Section 12 and state that it is a Texas privacy appeal if applicable. We do not sell personal data and do not sell sensitive personal data. We process sensitive personal data only as permitted by law, including obtaining consent when required.
Other U.S. states
Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Utah, Virginia, and other states with applicable comprehensive privacy laws may have additional or differently defined rights. We will process requests under the law that applies to the requester and the relevant information, including any right to appeal and, where required, to contact the applicable state attorney general if an appeal is denied.
We do not currently operate in or direct services to residents of Washington or Nevada in a manner intended to trigger a consumer-health-data notice. Before entering a market or beginning an activity that requires a separate consumer health data privacy policy under Washington's My Health My Data Act, Nevada's consumer health data law, or a similar law, we will publish the required notice and obtain any required consent.
14. Job Applicants, Personnel, and Contractors
When you apply for a job or work with us, we may collect contact and identifying information; employment and education history; licenses and credentials; references; application and interview materials; compensation expectations; work authorization; background-check information where permitted; voluntary demographic information; accommodation information; payroll, tax, benefits, banking, emergency-contact, and performance information; and activity on company-managed systems.
We use this information to recruit and evaluate candidates; verify identity, qualifications, and eligibility; conduct lawful checks; communicate with you; provide accommodations; manage compensation, benefits, scheduling, training, security, performance, and the working relationship; comply with law; and establish or defend legal claims. We may disclose it to service providers, benefits providers, advisers, government authorities, and others as necessary for those purposes.
Personnel and applicant information is kept separate from patient medical records. Information from an occupational-health examination is handled by the applicable clinical practice and is not placed in an ordinary recruiting file except for a limited result or documentation lawfully provided for an employment purpose.
15. Donors and Foundation Supporters
On Duty Health Foundation may collect donor and supporter names, contact information, donation amount and history, payment details, event participation, affiliations, communication preferences, and tribute information. It uses this information to process and acknowledge gifts, provide tax receipts, communicate about Foundation activities, maintain accurate records, prevent fraud, and comply with legal and accounting requirements.
We do not sell or rent donor lists. We may recognize donors publicly only with permission or when the recognition opportunity was clearly disclosed. A donor may request anonymity for public-recognition purposes and may opt out of fundraising communications at any time.
16. Third-Party Websites and Services
Our public website may link to websites or services operated by others. This Policy does not govern a third party's independent website or service merely because we link to it. Review that third party's privacy notice before providing information.
This limitation applies to outbound third-party destinations. We remain responsible for the technologies and service providers we choose to operate on our own websites as required by applicable law.
17. Visitors Outside the United States
Our websites and services are intended for the United States. If you access them from another country, your information may be transferred to, stored in, and processed in the United States, where privacy laws may differ from those in your location. Where applicable law requires a transfer mechanism or additional rights, we will provide them.
18. Changes to This Policy
We may update this Policy to reflect changes in our services, technology, legal obligations, or information practices. We will post the revised Policy with a new effective date. If a change is material, we will provide additional notice or obtain consent when required by law.
This Policy replaces any prior website privacy policy identified as effective March 1, 2020. It does not replace or amend a clinical practice's Notice of Privacy Practices.
19. How to Reach Us
On Duty Health, LLC
Attn: Privacy Officer
1752 E. Lugonia Ave STE 117-4949
Redlands, CA 92374
Email: privacy@ondutyhealth.com
Privacy request form: https://onduty.health/privacy-request-form
Website: https://onduty.health
For questions or requests involving PHI or a medical record, contact the applicable clinical practice using the information in its Notice of Privacy Practices: https://onduty.health/privacy-practices.