Kady v. Opencare

Background

Opencare connects patients with local dental providers through its website. According to the first amended complaint, users provide information such as their location, email address, internet-protocol address, device and account identifiers, dental history, insurance information, emergency status, and dental problems. Plaintiffs alleged that Opencare used invisible third-party tracking tools to collect and transmit this information to other entities, which connected it to user profiles or “shadow profiles” and used it for targeted advertising.

Plaintiff Annabel Kady allegedly used the website beginning in July 2023, and Plaintiff Taylor allegedly began using it in or around March 2025. Plaintiffs alleged that they received advertisements related to their disclosed medical conditions after using the website. They also relied on Opencare’s privacy policy, which stated that protected health information would not be sold to third parties.

Legal Standard

Opencare moved to dismiss under Federal Rule of Civil Procedure 12(b)(6), arguing that the complaint did not state legally sufficient claims. At this stage, the court accepted the complaint’s factual allegations as true and considered whether they stated plausible legal claims. Opencare also challenged Plaintiffs’ standing, meaning their ability to bring the lawsuit in federal court.

Standing and Health-Information Allegations

The court rejected Opencare’s standing challenge. It found that Plaintiffs sufficiently alleged an actual privacy injury from the disclosure of their information and alleged ongoing harm supporting their request for an injunction.

The court also declined to dismiss based on Opencare’s argument that the information was not individually identifiable health information or protected health information. At the pleading stage, Plaintiffs sufficiently alleged that Opencare qualified as a business associate under federal health-privacy law and that the information transmitted by the tracking tools could qualify as protected or individually identifiable health information.

The court also rejected Opencare’s argument that Plaintiffs consented through the privacy policies of Opencare and the third-party entities. The complaint alleged that users were shown the relevant notice only after providing sensitive information and that the notice was inconspicuous. The court stated that whether users could have taken additional steps to prevent tracking was a fact-based defense not suitable for resolution at this stage.

Individual Claims

Negligence. The court denied the motion as to negligence. Plaintiffs adequately alleged that Opencare owed them a common-law duty to reasonably safeguard sensitive private information, breached that duty, and caused harm. The court rejected Opencare’s arguments that federal health-privacy law could not support the claim and that the alleged harm was too speculative.

Invasion of privacy. The court denied the motion as to the invasion-of-privacy claim. Plaintiffs adequately alleged that they had a reasonable expectation that their sensitive information would remain private and that the tracking tools’ alleged disclosure of that information was highly offensive. The court granted Plaintiffs leave to amend so they could separately allege invasion-of-privacy claims under common law and the California Constitution.

Breach of confidence. The court denied the motion as to this claim. Plaintiffs adequately alleged that they gave Opencare confidential health information, reasonably expected it to remain confidential, received express promises of confidentiality, and alleged that Opencare disclosed the information through tracking tools.

Unjust enrichment. The court dismissed this claim with leave to amend. Although Plaintiffs alleged that Opencare received and used their private information without providing the promised confidentiality or compensation, the allegations under the claim itself were too conclusory and did not satisfy the pleading requirements.

Electronic Communications Privacy Act and California Invasion of Privacy Act. The court dismissed the wiretapping claims under both statutes with leave to amend. The court found that Plaintiffs adequately alleged that the information could constitute communication “contents,” but held that Opencare, as a party to communications with its own website, could not intercept its own communications. Plaintiffs would need to allege that a third party intercepted their communications; mere tracking was insufficient.

Pen-register claim. The court dismissed this claim with leave to amend. It rejected the consent argument but found that the statute-of-limitations argument appeared valid as to Kady because she allegedly visited the website in July 2023 and received unwanted advertisements almost immediately, while the lawsuit was not filed until June 2025. The court allowed amendment to allege facts supporting delayed discovery as to Kady. If Plaintiffs could not do so, the amended claim was to apply only to Taylor, who used the website within the statutory period.

California Confidentiality of Medical Information Act. The court dismissed this claim with leave to amend because Plaintiffs had not adequately alleged that Opencare was a covered health-care provider under the statute. The court stated that arguments about whether Plaintiffs were patients or whether the information was medical information would be addressed after amendment.

California Customer Records Act. Plaintiffs abandoned this claim in their opposition. The court dismissed it with prejudice and without leave to amend.

Disposition

The court granted in part and denied in part Opencare’s motion to dismiss. The fourth, fifth, sixth, seventh, and eighth causes of action were dismissed with leave to amend. The ninth cause of action was dismissed without leave to amend. The motion was denied in all other respects, and Plaintiffs were granted leave to separately allege common-law and California constitutional invasion-of-privacy claims. Plaintiffs were ordered to file a second amended class action complaint within 21 days of the order.