Privacy Policy

Who we are

Ophthalmic Academy is operated by Ophthalmic Academy LLC ("we"). Most accounts are created by a practice or health system that subscribes to the platform ("your organization"). For those accounts, your organization decides who is invited and what they are assigned, and we process your information to provide the service to them.

What we collect

Your account

Name, username, email address, job title, role, organization and location or team.
The day you started with your organization, which your administrator or supervisor can correct. Until somebody does, it is the day your account was made.
Your password, stored only as a one-way hash.
If you turn on two-step sign-in, the key your authenticator app uses, stored encrypted, and your recovery codes, stored only as hashes.
If you sign in with Google Workspace or Microsoft Entra ID, the provider, your account identifier with that provider, and the name and email address it shares.
If your organization turns on exclusion screening, your date of birth and National Provider Identifier (NPI), used only to check the federal exclusion lists (the OIG exclusion list and SAM.gov).
Licenses, certifications and registrations your organization records for you: the type, number, issuing body and state, issue, expiry and continuing-education dates, any notes, and who recorded and verified each one.

Your learning

Lesson progress, answers to practice questions and exams, scores and when each activity happened.
During a timed practice exam, how many times the exam window lost focus or you left the exam screen, and for how long. It is shown on your result and to your supervisor beside the score. Nothing about what you did elsewhere is recorded.
For compliance courses, how far into each course video you have watched, reported every few seconds while it plays, and each quiz attempt: the questions you were given, your answers, the score and when. The video pauses when its window is hidden; that is not recorded.
For Video Library videos that play inside the app (videos that open on YouTube are not tracked), which parts of each video you have played, reported every few seconds while it plays, and when you finished it. Your supervisor sees how many you have finished. The video pauses when its window is hidden; that is not recorded.
Points, badges and certificates of completion.
Competency ratings and sign-offs recorded by your supervisors, the sign-off requests you make, and any note a supervisor adds when closing one. If a supervisor uses the chairside checklist while observing you, it is kept with the sign-off: which steps were done, missed or not applicable, how long the observation took, and any note.
Your progress toward working a lane on your own: the milestones your organization sets, which of them you have reached and who checked one off, and when a supervisor clears you, who cleared you, in what role, on what day and any note they add. A clearance that is later undone stays on record with who undid it and why.
Results of certification exams (COA, COT or COMT) that you report from your dashboard or that your supervisor or administrator records: the exam date, whether you passed, the score and a note if one is entered, the readiness forecast the platform showed for you when the result was first entered, and who verified it, or returned it to you and why.
Policy acknowledgments and signed attestations. The IP address and browser type at the moment of signing are kept with each one, as a record of the signature.

Requests and reports

Requests sent from the sign-in page or this website: your name, email, organization and message, with the IP address and browser type they came from.
If you are hurt or exposed to blood or body fluids at work and your organization records it: what happened, the injury and the part of the body, your job title, treatment, days away from work or on restricted duty, and the dates of any follow-up after a needlestick or splash. This is health information about you. Only your organization's administrators and the people they name to investigate the incident can see it, and the OSHA log your organization keeps shows "Privacy case" in place of your name where federal rules call for it. Test results and medical opinions are not stored here.
Reports filed without signing in are not linked to any account. Their IP address is not stored. A one-way code made from it, which changes every day, is kept only to stop floods of spam, along with any contact details you choose to give.
Incident reports filed while signed in: what you write, the people and location you name, and any photos or documents you attach, along with your name unless you choose to report anonymously. An anonymous report is not linked to your account at all, so it cannot be shown back to you later. A report you file under your name is listed for you under My reports, with its status and any message the people looking into it leave for you.
Files attached to an incident report or to a note on one are stored with Cloudinary. The platform shows the link to a file only to the people who can open that incident, and to you on a report you filed under your name; anyone given the link itself can open the file.

Your organization's vendors and contracts

If your organization uses Compliance, Third parties, the companies and contracted providers it works with: their names, NPI, what they do, whether they see patient information, and a contact name, email address and phone number, which may be a person outside your organization.
The contracts your organization holds with them, such as Business Associate Agreements, provider agreements and service contracts: their dates, renewal and notice terms, value and notes, the PDFs uploaded, and who uploaded, changed or ended each one. The PDFs are kept in our database, not with Cloudinary, and open only inside the platform. Policy PDFs your organization publishes are kept the same way.
If your organization turns on exclusion screening, the result of checking each vendor against the federal exclusion lists, and who confirmed or cleared a potential match and why.

Technical information

The IP address and browser type of each signed-in session, and the IP address behind each administrative action in the audit log.
Error reports when something breaks, so we can fix it.
If you turn on notifications for a device, the address your browser gives us for delivering them, with the device's encryption key and browser type. Turning them off, or removing the app, deletes it.

Cookies and browser storage

One session cookie keeps you signed in. It cannot be read by scripts, is sent only over secure connections, and ends when you close the browser. You are signed out after 30 minutes without activity.
Browser storage keeps a copy of your progress and settings on your device so the app works smoothly, and an exercise in progress for half an hour so that refreshing the page returns you to it.
If you install the app on a phone or computer, the browser keeps one more page, shown when you have no connection. It contains no information about you, and nothing else of the app is stored.

We do not record sessions, we do not use advertising cookies or advertising trackers, and we do not sell personal information.

Services we use

NFOservers hosts the platform and its database.
Sentry for error reports.
Google and Microsoft when you use single sign-on.
Brevo and Google Workspace send the platform's email: invitations, password resets and notifications. They receive the name and email address of the person it is sent to, and the message. An organization that sets up its own mail server sends its people's notifications through that server instead.
Google Fonts serves the typefaces on this website, the sign-in page and the Control Panel, and jsDelivr serves a few open-source code libraries the app and the Control Panel use. Your browser fetches these directly, so those services see your IP address and browser type, as any website you load does.
Your browser's push service (Google, Apple, Mozilla or Microsoft, depending on the device) delivers notifications if you turn them on. Each notification is encrypted for your device before it leaves us, so the push service passes it on without being able to read it.
Cloudinary stores images and uploaded videos, as well as files attached to incident reports, and some lessons embed YouTube or Vimeo videos, which load from those services when you play them.

Who can see your information

Your organization's administrators, and supervisors for the teams they supervise. Supervisors do not see people outside their teams, and one organization never sees another's data. Vendor and contract records are seen by your organization's administrators only.
Our staff, to provide support. Support staff can view the platform as you see it to fix a problem; when they do, it is recorded.
The services listed above, only as needed to do their job for us.
Anyone the law requires us to share with.

Patient information

The platform is built for training. There is one place it may hold information about a patient: an incident report about a patient safety event or a privacy problem can name the patient involved, in protected patient fields (the patient's name or chart number, and a date of birth if given).

Those fields are kept apart from the rest of the report and encrypted where they are stored. They are never put in an email, a notification, the audit log, an export or a printout, and they are never kept in a saved draft.
Only your organization's administrators and the investigators named on that incident can see them. The person who filed the report cannot see them again afterward.
Every time someone opens, enters or changes them, who did it and when is logged, and your organization's administrators can see that log on the incident.

A patient privacy incident's breach assessment records the kinds of information involved and how many people were affected, never the information itself.

Anywhere else, please do not type patient health information: not in an incident's description, notes or support requests, and do not attach photos or documents that show it.

How long we keep it

When an account is deleted, it is removed permanently after 14 days, with its study history (practice exams, quiz answers, video progress and similar). Its compliance course passes and competency sign-offs are kept, with the person's name and email, as described below.
Records of a workplace injury or exposure are kept until five years after the end of the year it happened, and records of a patient privacy incident for six years, as federal rules require. They cannot be deleted sooner, even when the account or the organization is.
A vendor contract that has ended is kept for six years after the last day it was in effect, the period federal rules set for HIPAA documentation such as Business Associate Agreements, and cannot be deleted sooner.
Signed attestations, policy acknowledgments, certificates, compliance course passes and competency sign-offs are kept as your organization's records until your organization's data is removed, including after the person has left, because they are evidence of training that was completed. Your organization's administrators can download them.
When an organization leaves the platform, its data is removed as its agreement with us sets out.

Your choices

To see, correct or delete your information, ask your organization's administrator, or contact us at info@ophthalmicacademy.com. If the law where you live gives you further rights over your information, we will honor them.

Children

The platform is for working adults and is not intended for children.

Changes

If we change this policy in a way that matters, we will say so in the platform before the change takes effect.

Contact

Ophthalmic Academy LLC, info@ophthalmicacademy.com