Privacy Policy

This Privacy Policy describes how Oben (“Oben,” “we,” “us”) handles information collected through this website, oben.care (the “Site”), and data a clinic chooses to connect from Meta Ads or WhatsApp to the Oben product. The clinical product is offered to clinics under separate agreements, including Business Associate Agreements where required by law. Meta is not a HIPAA Business Associate of Oben for these connectors.

Information we collect

• Information you send us. If you email us (for example, to request early access), we receive your email address and whatever you choose to include in your message.
• Technical information. Our hosting infrastructure (Amazon Web Services) may log standard technical data such as IP address, browser type, pages requested, and timestamps for security and operational purposes.

The Site does not require an account, does not include tracking pixels from advertising networks, and does not sell personal information.

How we use information

• To respond to your inquiries and early-access requests.
• To operate, secure, and improve the Site.
• To comply with legal obligations.

Protected health information

This Site is a marketing site and is not intended to collect health information. Please do not include patient information or any protected health information (PHI) in messages sent through the Site. Within the Oben product, PHI is handled under the applicable clinic’s agreements, HIPAA requirements, and Business Associate Agreements with our infrastructure providers.

Clinic-connected advertising accounts

A clinic may authorize the Oben product to connect to its Meta advertising account. Oben receives the authorized Meta user identifier, granted permission names, accessible ad-account metadata, campaign structure and status, and aggregate advertising performance metrics. The OAuth bearer credential is encrypted in a tenant-scoped secret store and is not exposed to the clinic browser.

Oben uses this information to show the clinic its paid-acquisition performance, prepare governed recommendations, and, only after an authorized human approval, carry out a supported advertising action. Patient-level data and PHI are prohibited from the Meta connector. We do not use one clinic's advertising data for another clinic.

Clinic-connected WhatsApp accounts

A clinic may connect its own WhatsApp Business Account and phone number to Oben. We receive and store the connected business and phone-number identifiers, display and quality information, template names and review status, granted permission names, and security and delivery event metadata. To display a clinic's conversations in Oben, we also process inbound and outbound business messages, timestamps, delivery status, permitted attachments, and replies sent from the WhatsApp Business app when Coexistence is enabled.

The short-lived Embedded Signup exchange token is not retained. Ongoing credentials stay server-side. Oben verifies Meta's webhook signature before processing an event and uses provider message/event identifiers to prevent duplicate records.

Oben uses the connected WhatsApp data only to provide the clinic's messaging, template, consent, delivery, audit, and support workflows. Oben-originated WhatsApp messages are restricted to non-clinical notifications and direct clinical detail to the secure portal. A sender may still include sensitive information in an inbound message; when that occurs, Oben handles the received record under the clinic's agreement and applicable retention and access controls. Clinics should not use WhatsApp to send PHI or clinical care content.

Sharing

We do not sell or rent personal information. We disclose information to service providers that help us operate the Site and product, to Meta when a clinic directs Oben to use its connected Ads or WhatsApp account, when required by law, or in connection with a corporate transaction. Each clinic's connected data remains tenant-separated.

Data retention

We keep correspondence for as long as needed to handle your inquiry and maintain our records, then delete or anonymize it.

Connected advertising and WhatsApp data is retained according to the clinic's agreement, applicable record-retention requirements, and Oben's security and audit obligations. Disconnecting a connector stops future use in Oben but does not automatically erase every retained message, business record, or required audit record. See the data deletion instructions to disconnect either connector and request deletion of eligible Meta-connected data.

Your choices

You may request access to, correction of, or deletion of the personal information we hold about you by emailing pilot@oben.care. Depending on where you live, you may have additional rights under applicable law.

Children

The Site is not directed to children under 13, and we do not knowingly collect information from them.

Changes

We may update this policy from time to time. We will post the revised version here with an updated date.

Contact

Questions about this policy: pilot@oben.care.