Health-related information
Consumer Health Privacy Notice
Using an ostomy product can reveal something about health. We designed OstomyChoices to avoid collecting clinical records and to give people clear control over what they share.
Effective October 17, 2026 · Version 2026-10-17
Is OstomyChoices covered by HIPAA?
OstomyChoices is a community catalog and does not provide healthcare or process insurance claims. It is not intended to act as a HIPAA covered entity or business associate. That does not mean health-related information is unprotected: consumer privacy, health-data, security, and breach-notification laws may still apply.
Health-related data we may receive
Your chosen products, likes, and reviews may suggest that you or someone you know uses ostomy supplies. We do not ask for diagnoses, procedure dates, clinician names, prescriptions, medical record numbers, insurance details, precise location, or biometric data. Please do not include them in posts.
Why we use it
We use community activity only to provide the catalog, display aggregated interest, moderate contributions, prevent abuse, and improve the service. We do not use consumer health data for targeted advertising, build advertising profiles, or sell it.
Who receives it
Approved posts and public display names can be viewed by anyone. Hosting, database, security, backup, and support providers may process limited information on our behalf. We do not share consumer health data with data brokers. If this changes, we will provide the notice and obtain consent required by law.
Your control
You can choose not to create an account, avoid sharing sensitive details, edit eligible submissions, and request access, correction, or deletion. You may withdraw consent for future processing, subject to information needed for security, legal compliance, and backups. Email [email protected] with “Health data request.” You may appeal a decision by replying with “Health data appeal.”
Safety
We restrict administrative access, encrypt traffic, hash passwords, keep audit and consent records, moderate public content, and maintain backup and incident-response procedures. If a breach creates a legal notification duty, we will notify affected people and regulators as required.