On this page9 sections
Plain-language summary
HWCharts is a B2B platform sold to healthcare organizations. The data inside the platform — patient records, study data, audit logs — belongs to the organization that operates the tenant, not to us. We process it as their service provider under a Business Associate Agreement (BAA) and a Data Processing Agreement (DPA), and we never sell or share it.
For our public marketing site, we collect only the minimum we need to run it: page views (no third-party ad networks), the form submissions you intentionally send us, and basic server logs for security and uptime. That's it.
1. Who we are
Oncominder, Inc. is a Delaware corporation headquartered in San Francisco, California, with EU operations in Berlin, Germany. For privacy questions, write to privacy@hwcharts.com. EU residents may also contact our Data Protection Officer at the same address.
2. What we collect — and why
2.1 Inside the platform (you are a customer's user)
We process the data your organization stores in HWCharts strictly under their instructions and the BAA/DPA between us and them. We do not use this data for any other purpose. If you want a copy of your record, a correction, or deletion, contact your organization first — they control it.
2.2 Marketing site (you are a visitor)
- Page views for aggregate traffic stats, retained 90 days. No third-party ad pixels.
- Form submissions (demo requests, contact) so we can reply. Kept in our own database and emailed to our team.
- Server logs (IP, user-agent, referrer) for security and uptime, retained 30 days.
- Cookies: a single first-party session cookie; no advertising cookies.
3. Legal bases (GDPR)
- Customer data inside the platform: Processed under contract with the customer (Art. 28).
- Form submissions: Legitimate interest in responding to your inquiry and contractual necessity if you become a customer.
- Server logs: Legitimate interest in operating the service securely.
4. Sharing
We share data only with subprocessors that need it to run the service (hosting, email delivery, CRM). Ask us for the current list and their roles at privacy@hwcharts.com; we give 30 days' notice for any change.
5. Your rights
You have the right to access, correct, port, and delete your personal data. For EU residents, you also have the right to object to processing and to lodge a complaint with your supervisory authority. Email privacy@hwcharts.com and we'll respond within 30 days.
6. International transfers
Ask us where your organization's data is stored. Where we transfer data across borders, we rely on the Standard Contractual Clauses.
7. Security
Sensitive fields in patient records are encrypted when stored and data is sent over HTTPS. Each hospital's data is kept apart from every other hospital's, and we record who opened a patient's records and when. We have not yet had an independent security audit. See the security page for what is in place today and what is not.
8. Changes to this policy
Material changes will be announced at least 30 days before they take effect, both on this page and via email to designated tenant admins.