Olya Privacy Policy

Last updated: August 9, 2026

The short version

Olya is operated by Cancer Connector LLC. Olya is free for patients and families, and we do not sell your information or show you ads.

To run Olya, we use outside companies for hosting, databases, AI models, and voice. They process your information only to provide Olya, under contracts that prohibit them from using it for their own purposes. That is different from selling or sharing your information, and we do not do that.

We do not use your conversations, documents, or recordings to train AI models, and we contract with our AI providers so that they do not either.

You can ask for a copy of your information, correct it, or delete it, at any time.

This summary is for orientation. The full policy below governs.

1. Who we are

Olya is a product of Cancer Connector LLC, a Delaware limited liability company (“we,” “us,” “Cancer Connector”).

Contact: hello@olya.health

1a. The Wondrlink Foundation

We work with the Wondrlink Foundation, a nonprofit that provides our clinical advisors and connects us with patients and families. Because a nonprofit is involved in bringing people to Olya, it is worth being exact about what that does and does not mean for your information.

The Foundation does not operate Olya. Cancer Connector LLC builds and runs the product and is responsible for your information.

The Foundation does not receive your information. If you heard about Olya through the Foundation, we do not tell them that you signed up, and we do not tell them anything you share with Olya.

Clinical advisors do not read your conversations. Oncologists who advise us review the library of guideline-derived connections that Olya draws on, before those connections go into the product. That review happens ahead of time and applies to everyone. No advisor sees your messages, your documents, your recordings, or your summaries.

If any of this ever changes, we will tell you before it does.

2. Olya is not covered by HIPAA

This is important and often misunderstood.

HIPAA generally applies to health plans, most health care providers, and health care clearinghouses, and to the vendors that handle protected health information on their behalf. Olya is offered directly to you, not by or on behalf of your doctor, your hospital, or your insurer. Information you put into Olya is generally not protected by HIPAA.

That does not mean it is unprotected. This policy, our contracts with service providers, and applicable federal and state privacy laws govern how we handle it. But you should understand the distinction, because it is not obvious.

If we ever offer Olya through a health care provider in a way that brings it within HIPAA, we will say so clearly before that applies to you.

3. Information we collect

Information you give us

Contact information. Your phone number when you join the waitlist. Your email address if you write to us. A name or nickname if you give one.

Health information you share in conversation. This is the core of what Olya holds, and it can include:

• Cancer type, stage, and biomarker or genetic test results
• Treatments, regimens, medications, doses, and where you are in a cycle
• Symptoms, side effects, appetite, sleep, mood, and how these change over time
• Surgeries, procedures, and hospital stays
• Appointments, and what was said at them
• Questions you want to ask, and answers you received
• Your care team: names, roles, and where they practice
• Family history, ancestry, and demographic information, where you choose to share it

Documents you upload. Pathology reports, lab results, imaging reports, discharge papers, visit summaries, insurance documents, and photographs of any of these.

Recordings and transcripts. If you use Olya to record an appointment, the audio recording and the written transcript.

Caregiver information. If someone helps you use Olya, or if you use Olya on behalf of someone you care for, information about that relationship.

Information collected automatically

Device and browser type, operating system, general location inferred from IP address, pages viewed, features used, times of access, and error and diagnostic logs. We use this to keep Olya working and to understand which parts are useful.

Information we do not collect

We do not buy information about you from data brokers. We do not connect to your electronic health record, and we do not receive information from your doctor’s office. We do not infer your race, ethnicity, or ancestry. If we ever ask about those, you tell us or we do not have it.

4. Why we process your information

• To provide Olya. Understanding what you tell us, explaining what we can, keeping track of what changes, building your summaries and question lists, and searching clinical trial registries.
• To keep continuity. Olya is useful because it remembers. Your information persists between conversations so that Olya is not starting over each time.
• To communicate with you. Waitlist notifications and responses to messages you send us.
• To keep Olya safe and working. Diagnosing errors, preventing abuse, and improving reliability.
• To meet legal obligations.

We do not process your information for advertising, profiling for marketing, or any purpose unrelated to operating Olya.

5. Service providers

Olya cannot run without infrastructure. The following categories of provider process information on our behalf:

Each of these processes information only as needed to provide Olya, under contract, and is prohibited from using it for their own purposes. We configure our AI routing to deny data collection by providers and to prevent requests being routed to providers we have not approved.

This list may change as the product develops. We will keep it current here.

This is not selling or sharing your information. The distinction matters and we want it stated plainly: a service provider processing your information so that Olya works is different from a company receiving your information to use for its own purposes. We do the first. We do not do the second.

6. We do not sell your information

We do not sell your personal information or health information. We do not share it for cross-context behavioral advertising. We have never done either and Olya carries no advertising.

7. AI model training

We do not use your conversations, documents, recordings, or transcripts to train AI models.

Our contracts and configuration with AI providers prohibit them from using your content to train their models. We use zero-retention or no-training settings where providers offer them.

If we ever want to use any user content for model development, we will ask for your specific, separate, opt-in consent first, and declining will not change what Olya does for you.

8. Recordings and consent

If you use Olya to record a medical appointment, you are responsible for the recording being lawful where you are.

Recording laws vary by state. Some states require only that one person in the conversation consents, which would be you. Other states require that everyone being recorded consents. Some medical practices have their own policies regardless of state law.

The practical advice, and what Olya will tell you, is to ask for permission before recording.

You can delete a recording and its transcript at any time.

9. Caregivers and shared access

Olya can be used by a patient, or by a family member or friend helping them.

If you are using Olya on behalf of someone else, you are responsible for having their permission. We do not verify these relationships.

We do not share information from one person’s account into another person’s account without an explicit action by the person whose information it is.

10. How long we keep information

We keep your information while your account is active, and for a limited period afterward for backups and to meet legal obligations.

When you delete specific content, we remove it from active systems promptly. Copies may persist in encrypted backups for a limited period until those backups age out on our normal schedule, after which they are gone. When you delete your account, we delete your information from active systems promptly and from backups on the same schedule, except where we are required to retain something by law.

Waitlist phone numbers are kept until we contact you or you ask us to remove them.

11. Your rights

Whatever state you live in, you can:

• Get a copy of the information Olya holds about you
• Correct anything that is wrong
• Delete specific content or your whole account
• Withdraw consent for anything you previously agreed to
• Object to a particular use

Email hello@olya.health. We will respond within 45 days, and will tell you if we need longer.

We will not treat you differently for exercising any of these rights. Olya works the same either way.

State-specific rights

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have rights including access, correction, deletion, portability, and opting out of sale or targeted advertising. We do not sell information or run targeted advertising, so those opt-outs are already the default.

Washington and Nevada consumer health data. Washington’s My Health My Data Act and Nevada’s SB 370 impose specific requirements on consumer health data, including a separate consumer health data privacy notice and a right to have that data deleted. This policy serves as that notice. We do not sell consumer health data, which under those laws requires signed authorization we have never sought.

California. The categories of personal information we collect are described in Section 3, including information categorized as sensitive under the CCPA as amended. We use sensitive personal information only to provide Olya and for the purposes listed in Section 4, not to infer characteristics about you.

12. Security

Your information is encrypted when stored and when transmitted. Access by our team is limited to what is needed to operate and support the product, and is logged.

No system is perfectly secure, and we will not tell you otherwise. If a breach affects your information, we will notify you as required by law, including under the FTC Health Breach Notification Rule where it applies.

13. Children

Olya is for adults. It is not intended for anyone under 18, and we do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it.

If you are a parent using Olya to help you care for a child with cancer, the account is yours and the information you enter is treated as yours.

14. Where information is processed

Olya is operated from the United States and your information is processed here. We offer Olya in the United States.

We do not currently block access from other countries. If you use Olya from outside the United States, your information is sent to and stored in the United States, where privacy laws differ from those where you live. We are not asking you to waive rights you hold under your own country’s law, and this policy does not attempt to.

If we begin offering Olya outside the United States, we will update this policy and put the appropriate protections in place first.

15. Changes to this policy

If we make a material change, particularly one affecting how your health information is used, we will notify you before it takes effect and give you a chance to review it. The “last updated” date at the top always reflects the current version.

16. Contact

hello@olya.health

Cancer Connector LLC
8 The Green, Ste. A
Dover, DE 19901