OffPlan Privacy Policy
Effective Date: September 1, 2026
1. Who We Are and What This Policy Covers
OffPlan Holdings, Corp. and its affiliated companies (“OffPlan,” “we,” “us”) operate a Direct Primary Care (DPC) platform that connects employers and individual members directly with independent physician practices. This Privacy Policy describes how we collect, use, and share personal information when you visit offplancare.com, enroll as a member, use the employer dashboard, use the administrative console, or otherwise interact with our services (together, the “Platform”).
This policy applies to members and their dependents, employer representatives, physicians and practice staff, and visitors to our website.
Your Medical Information Is Governed Separately
Medical care through OffPlan is delivered by independent, physician-owned professional entities (each, a “Practice”). Your medical records and other protected health information (“PHI”) are maintained by your Practice and are governed by the Health Insurance Portability and Accountability Act (HIPAA) and your Practice’s Notice of Privacy Practices, which is provided by your Practice and available on request. Where OffPlan handles PHI on behalf of a Practice — for example, in operating the technology that supports your care — it does so as a business associate under HIPAA, subject to written business associate agreements. If this Privacy Policy conflicts with the Notice of Privacy Practices with respect to PHI, the Notice of Privacy Practices controls.
2. Information We Collect
Information You Provide
- Member enrollment information — Name, date of birth, mailing address, email address, and phone number provided during enrollment; dependent and family relationship information when you enroll dependents.
- Employer account information — Company name, business contact details, plan selections, and employee roster or census information used to determine eligibility and administer enrollment.
- Practice and physician information — Professional credentials, licensure details, biography, and photograph for physicians and practice staff using the administrative console.
- Payment information — Payment card or bank account details are collected and processed by our PCI-DSS compliant payment processor. OffPlan does not store full payment card numbers on its own systems.
- Communications — Messages, support requests, and other information you choose to send us.
Information Collected Automatically
When you use the Platform, we automatically collect device and usage information such as IP address, browser type, operating system, pages viewed, and timestamps. We use cookies and similar technologies as described in Section 6. Access to systems containing personal information is recorded in audit logs that capture who accessed what information, when, and in what role.
Information from Other Sources
We may receive information about you from your employer or its benefits administrator (such as eligibility and census files), from third-party administrators (TPAs) or brokers involved in your benefit plan, and from service providers acting on our behalf.
3. How We Use Personal Information
- Enrolling members, verifying eligibility, matching members with a primary care physician, and administering memberships.
- Operating the employer dashboard and administrative console, including rosters, invoicing, and plan administration.
- Processing membership payments and maintaining financial records.
- Supporting the delivery of care by the Practices, including provisioning member records in the Practice’s electronic medical record system and enabling secure member–practice messaging.
- Communicating with you about your membership, account, and the services, and — with any legally required consent — sending marketing communications you can opt out of at any time.
- Securing the Platform, detecting and preventing fraud and abuse, and maintaining audit trails required by law.
- Complying with legal obligations and enforcing our agreements.
- Producing de-identified or aggregated analytics — for example, utilization and outcome trends reported to employers — that do not identify any individual.
4. How We Share Personal Information
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
We share personal information only as follows:
- Your Practice — The independent physician practice you are matched with receives the information needed to establish and maintain your care relationship.
- Your employer — We share enrollment status, eligibility, and aggregate utilization information with your employer as necessary to administer the benefit. We do not disclose your individual medical information, diagnoses, visit content, or clinical records to your employer.
- Service providers — We use vendors that process information on our behalf under contractual confidentiality and security obligations, including cloud hosting and infrastructure, electronic medical record systems, payment processing, secure messaging, customer relationship management, and email delivery. Vendors handling PHI do so under business associate agreements.
- Third-party administrators and brokers — Where your benefit plan involves a TPA or broker, we share the information necessary for eligibility and plan administration.
- Affiliated entities — The OffPlan corporate family, including the management services organization and platform entities that support Practice operations, subject to the same protections described in this policy.
- Legal requirements — We may disclose information to comply with law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of members, OffPlan, or others.
- Business transfers — If OffPlan is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this policy’s commitments.
5. How We Protect Personal Information
We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, role-based access controls that limit each user to the information their role requires, append-only audit logging of access to sensitive records, network and application monitoring, and vendor security requirements. No system is perfectly secure, and we cannot guarantee absolute security; if a breach affecting your information occurs, we will notify you as required by applicable law.
6. Cookies and Tracking Technologies
We use cookies and similar technologies that are necessary to operate the Platform — for example, to maintain your authenticated session — and, where enabled, analytics cookies that help us understand how the website is used. We do not use advertising trackers on enrollment or account pages. You can control cookies through your browser settings; disabling essential cookies may prevent parts of the Platform from functioning.
7. Data Retention
We retain personal information for as long as needed to provide the services and for legitimate business purposes such as financial recordkeeping, audit, and legal compliance. Medical records are retained by the Practices in accordance with state medical record retention laws, which typically require retention for a period of years after your last visit and longer for minors. When information is no longer required, we delete it or de-identify it.
8. Your Privacy Rights and Choices
You may access and update much of your account information directly through the Platform. You may also contact us using the details in Section 12 to request access to, correction of, or deletion of your personal information. We will verify your identity before acting on a request, and some information may be exempt from deletion — for example, records we must retain by law and medical records governed by HIPAA, for which rights are exercised through your Practice under its Notice of Privacy Practices.
Virginia Residents
If you are a Virginia resident, to the extent the Virginia Consumer Data Protection Act applies to our processing of your personal data, you have the right to confirm whether we process your personal data; to access, correct, or delete it; to obtain a portable copy; and to opt out of targeted advertising, sale, or certain profiling (practices we do not engage in). To exercise these rights, contact us as described in Section 12. If we decline a request, you may appeal by replying to our decision or contacting us with “Privacy Appeal” in the subject line; we will respond within 60 days. If your appeal is denied, you may contact the Virginia Attorney General.
Other States
Residents of other states may have similar rights under their state’s privacy laws. We honor verified requests as required by the law applicable to you. Note that data we process as a HIPAA business associate, and data processed by employers as part of an employment relationship, may fall outside the scope of certain state consumer privacy laws.
Marketing Choices
You can opt out of marketing emails at any time using the unsubscribe link in any message or by contacting us. We will continue to send transactional and service communications related to your membership.
9. Children’s Privacy
Dependents under 18 may be enrolled in a membership only by a parent or legal guardian, who provides the dependent’s information. We do not knowingly collect personal information directly from children under 13 online. If you believe a child has provided us personal information directly, contact us and we will delete it.
10. A Note on What OffPlan Is
OffPlan memberships are direct primary care arrangements, not health insurance. This policy describes data practices only and does not modify the terms of any membership agreement or employer contract.
11. Changes to This Policy
We may update this policy from time to time. If we make material changes, we will notify you by email or through the Platform before the changes take effect and update the effective date above. Where required by applicable law, we will obtain your consent before implementing changes to how we use or share your information.
12. Contact Us
Questions, requests, or appeals regarding this policy can be directed to:
OffPlan Holdings, Corp.
Attn: Privacy
36 Trammell St SW, Suite 200
Marietta, GA 30064
privacy@offplancare.com