Privacy Policy

1. Introduction

OnKommon ("we," "our," or "us") is a precision-oncology navigation service. We are committed to protecting the privacy and security of your personal and health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, or interact with us.

We operate in compliance with India's Digital Personal Data Protection Act, 2023 (DPDPA 2023), and applicable international data protection standards. Our exclusive clinical partner, KPCIRC, operates under the same strict privacy and confidentiality standards.

2. Data We Collect

We collect information that you provide directly to us, as well as information generated through your use of our services.

Personal Information:

• Name, date of birth, contact details (email, phone, address)
• Language preference
• Relationship to patient (if you are a caregiver)

Health Information:

• Cancer diagnosis and treatment history
• Genomic test results and reports
• Medical records, scans, and pathology reports
• Family medical history (for Heritage testing)
• Pharmacogenomic data

Usage Information:

• Website browsing activity and interactions
• Communication history (WhatsApp, email, phone)
• Appointment and consultation records
• Test and monitoring results over time

3. How We Use Your Data

We use your data to provide, improve, and personalise our services:

• Delivering Care: To generate your Blueprint Care report, match you to therapies and trials, and coordinate your care through KPCIRC.
• Communication: To respond to your inquiries, schedule consultations, and provide updates about your care.
• Service Improvement: To enhance our interpretation engine, intelligence layers, and clinical decision-support tools.
• Research (with separate consent): De-identified data may be used for approved research to improve oncology outcomes for all patients.
• Legal Compliance: To comply with applicable laws, regulations, and regulatory requests.

4. Legal Basis for Processing

Under DPDPA 2023 and applicable law, we rely on the following legal bases to process your data:

• Consent: You have given explicit consent for the processing of your health data for specific purposes.
• Contractual Necessity: Processing is necessary for the performance of our service agreement with you.
• Legal Obligation: Processing is required to comply with applicable laws and regulations.
• Legitimate Interests: Processing is necessary for our legitimate interests in improving our services, provided these interests do not override your rights.

5. Data Sharing & Disclosure

We share your data only as necessary to deliver your care and services:

• KPCIRC: Our exclusive clinical partner, which provides molecular tumour board reviews, sign-offs, second opinions, genetic counselling, and patient navigation.
• Accredited Laboratory Partners: For sequencing and variant calling, under strict confidentiality agreements.
• Your Treating Oncologist: With your consent, we share reports and findings with your doctor.
• Service Providers: We may share data with trusted vendors who help us deliver our services (e.g., secure data storage, communication platforms), under strict data-protection agreements.

6. Data Security

We implement robust security measures to protect your data:

• Encryption: Data is encrypted in transit (TLS/SSL) and at rest.
• Access Controls: Strict role-based access to personal and health data.
• Audit Trails: Comprehensive logging of data access and modifications.
• Regular Assessments: Ongoing security reviews and vulnerability assessments.
• Staff Training: All team members are trained on data protection and privacy best practices.

7. Data Retention

We retain your data only as long as necessary for the purposes for which it was collected:

• Active Care: Data is retained while you are receiving care from OnKommon.
• Legal Obligations: We may retain data as required by law or regulatory requirements.
• Research: De-identified data may be retained for research purposes under separate consent.
• Request for Deletion: You may request deletion of your data, subject to legal and regulatory retention requirements.

8. Your Rights

Under DPDPA 2023, you have the following rights regarding your personal and health data:

• Right to Access: Request a copy of the data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Deletion: Request deletion of your data, subject to legal retention requirements.
• Right to Withdraw Consent: Withdraw consent for processing at any time.
• Right to Restriction: Request restriction of processing in certain circumstances.
• Right to Data Portability: Request transfer of your data to another service.
• Right to Object: Object to processing based on legitimate interests.

9. Cookies & Tracking

We use cookies and similar technologies to improve your experience on our website:

• Essential Cookies: Necessary for the functioning of the website.
• Analytics Cookies: Help us understand how visitors interact with our site.
• Preference Cookies: Remember your settings and preferences.

You can manage your cookie preferences through your browser settings. We do not use cookies for targeted advertising or third-party marketing.

10. Children's Privacy

Our services are not directed at children under the age of 18. We do not knowingly collect personal or health data from children without parental consent. If you believe we have collected data from a child without appropriate consent, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of any material changes through our website or by direct communication. The "Last Updated" date at the top of this policy indicates when it was last revised.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us: