Your health data is being bought and sold.
Right now.

Every time you see a doctor, fill a prescription, or check in at a clinic, companies you've never heard of buy, resell, and match your medical records. Optava finds them and files the legal requests to make them stop.

Stop the sale of my data
Records from a browser, a database, and a folder converging into one secured, locked file
16
of the largest data brokers & platforms we're actively tracking
45
days: the legal deadline for a company to respond once we file a request
100%
of requests reviewed by a real human before they go out
Who's selling it

The companies holding and trading your medical records.

Logos are trademarks of their respective owners, shown for identification only. Optava is not affiliated with or endorsed by these companies.

Never heard of them? They know a lot about you. These are (some) of the companies buying and selling your medical records. It's the current list we actively file against, and it grows every month.

Also on our current list
HealthVerity Phreesia Privia Health LexisNexis Risk Solutions Acxiom Symphony Health eClinicalWorks CRISP Manifest MedEx Solv Health
The evidence

Data brokers have years, if not decades, of your medical history.

This is what these companies say about themselves, in their own marketing, and what federal regulators have already caught some of them doing.

1.2B+
de-identified patient records, globally
Source: IQVIA, in its own marketing materials
330M
U.S. patients tracked
Source: Komodo Health's "Healthcare Map"
100B+
records processed every month, across 80,000+ hospitals and clinics
Source: Datavant's own network claims
340M+
individuals covered, from 75+ data sources
Source: HealthVerity Marketplace

Company-reported figures, current as of 2026. Some overlap: the same person's records can sit with several of these companies at once.

The FTC is already taking these companies to court.

National enforcement is real, and it's growing. But a settlement doesn't erase what's already been sold, and it doesn't cover every company doing this. Filing your own opt-out request is still the fastest, most direct way to get your specific records out of circulation.

  • FTC v. Mobilewalla & Gravy Analytics (Dec. 2024) Both companies were selling location data from visits to health clinics. One had built a sellable "pregnant women" audience segment from the tracking data. Both are now banned from selling that data.
  • FTC v. BetterHelp ($7.8M settlement) Shared users' mental-health data with Facebook and Snapchat for ad targeting, after promising not to.
  • FTC v. GoodRx ($1.5M penalty) The first-ever fine under the FTC's Health Breach Notification Rule, for passing prescription data to Facebook and Google.
  • FTC v. Premom A fertility-tracking app shared users' sensitive health data with third-party advertisers without permission.
Your rights depend on where you live We file for every consumer everywhere, but what a company is legally required to do about it currently depends on your state. We're upfront about exactly which states have the strongest legal footing today: see full coverage on Where We Stand →
How it works

Four steps. We do the paperwork; you get your data back.

  1. Tell us who you are

    The identifiers companies actually match records on: name, address history, date of birth.

    Only what's needed to match your records. Never sold, never shared, and you see exactly what's sent before anything goes out.

  2. Authorize us to act

    A signed authorization lets us file on your behalf under laws like California's Consumer Privacy Act (CCPA), Washington's My Health My Data Act (MHMDA), and HIPAA's rules on health information exchange.

  3. We file, correctly

    We contact each company via portal, email, and/or certified mail, then track the legally required 45-day response window.

  4. We hold them to it

    Confirmation, statutory deadlines tracked to the day, and continued filing after that. New visits and new prescriptions create new records, so we keep re-filing on your behalf and keep you posted as the privacy laws covering you change.

SAMPLE RECORD — DATA MARKETPLACE PATIENT ID X7F29A-19 DATE OF BIRTH 03/14/1987 ZIP CODE 98105 VISIT DATE 06/02/2026 DIAGNOSIS CODE E11.9 Type 2 diabetes DRUG (NDC) 00069-2587-10 Date of birth, ZIP code, and a specific diagnosis — together, that's often enough to re-identify you. Illustrative example. Not a real patient or company record.
01

"De-identified" doesn't mean anonymous

Companies call this data "de-identified," meaning your name is stripped out. But a birth date, a diagnosis, and a ZIP code are often enough to identify you again, especially for less common conditions. That claim doesn't stop us from filing anyway.

02

We dig through the noise

Some companies bury their opt-out behind a portal that quietly starts a legal deadline; others only respond to a written letter. We find whichever one actually works, company by company.

03

Never automated

Nothing goes out on autopilot. A person reviews and clears every request before it's filed, and every response is tracked against its statutory deadline.

Make them stop.

Sign up in a couple of minutes. We'll review your case and start filing. You don't lift a finger after that.

Stop the sale of my data
Where things stand today Optava is currently in a self-testing phase and is not yet accepting requests on behalf of other consumers. Legal counsel is engaged before that expands. Nothing you submit here is sent to any company without a person reviewing it first.