This policy describes how IDR Solutions LLC d/b/a OON Systems ("OON Systems," "we," "us") treats information collected from visitors to www.oonsystems.com and from holders of OON Systems platform accounts. It does not apply to information we collect through other means. Health and claims information processed on the platform on behalf of healthcare provider clients is governed by HIPAA and our agreements with those providers, not by this policy.

• •IP address, browser and device type, pages viewed, and timestamps, collected automatically in server logs for security and operations.
• •Strictly necessary cookies for login sessions. We use no advertising cookies, run no third-party ad trackers, and do not sell information.
• •Anything you choose to submit to us (for example, a contact request).

Name, work email, role, professional identifiers (such as NPI), authentication data, and activity logs associated with your use of the platform. We use this to operate and secure the platform, communicate with you about your account, and meet legal obligations.

We use the information above to operate, secure, and improve the Services and to comply with law. We share it only with service providers under contract who need it to perform their functions (cloud hosting, email delivery), with authorities where law requires, or in connection with a corporate transaction. We do not sell personal information.

We maintain administrative, technical, and physical safeguards, including encryption in transit and at rest, access controls, and audit logging. No method is completely secure. We retain information as long as needed for the purposes above and our legal obligations.

Depending on your state of residence, you may have the right to confirm whether we process your personal information, access a copy of it, correct inaccuracies, or request deletion, subject to legal exceptions. To exercise these rights, or to appeal a decision on a request, contact us using the information below. Where required by law, we honor Global Privacy Control browser signals for applicable opt-outs. New York users: we maintain a data security program consistent with the NY SHIELD Act.

The Services are for business use by adults and are not directed to anyone under 18.

The Services are operated and information is stored in the United States.

We may update this policy and will post the revised version with an updated date.