Privacy policy.
Effective Date: August 29th, 2024
Table of Contents
Introduction
Data Protection Officer
How we collect and use (process) your personal information
Use of heyopal.com website
Cookies and tracking technologies
Use of the Opal services
When and how we share information with third parties
Transferring personal data to the U.S.
Data Subject rights
Security of your information
Data storage and retention
Questions, concerns, or complaints
Introduction
Opal is a platform for mental health professionals that automatically writes your progress notes. Instead of writing notes yourself, you can quickly dictate the important parts of your session, and Opal formats this into a structured (ie, SOAP) note that can be easily copied into your EHR. You don’t need to switch your telehealth platform or EHR system.
We understand that you are aware of and care about your own personal privacy interests, and we take that seriously. This Privacy Notice describes Opal’s policies and practices regarding its collection and use of your personal data, and sets forth your privacy rights. We recognize that information privacy is an ongoing responsibility, and so we will from time to time update this Privacy Notice as we undertake new personal data practices or adopt new privacy policies.
Data Protection Officer
Opal is headquartered in the United States. Opal has appointed an internal data protection officer for you to contact if you have any questions or concerns about Opal’ personal data policies or practices. If you would like to exercise your privacy rights, please direct your query to Opal’ data protection officer. Opal’ data protection officer’s name and contact information are as follows:
Cole Smith
cole@heyopal.com
How we collect and use (process) your personal information
Opal collects personal information about its website visitors and customers. With a few exceptions, this information is generally limited to:
name
job title
employer name
work address
work email
work phone number
We use this information to provide prospects and customers with services.
We do not sell personal information to anyone and only share it with third parties who are facilitating the delivery of our services.
From time to time, Opal receives personal information about individuals from third parties. Typically, information collected from third parties will include further details on your employer or industry. We may also collect your personal data from a third party website (e.g. LinkedIn)
Use of the Opal Website
As is true of most other websites, Opal’ website collects certain information automatically and stores it in log files. The information may include internet protocol (IP) addresses, the region or general location where your computer or device is accessing the internet, browser type, operating system and other usage information about the use of Opal’ website, including a history of the pages you view. We use this information to help us design our site to better suit our users’ needs. We may also use your IP address to help diagnose problems with our server and to administer our website, analyze trends, track visitor movements, and gather broad demographic information that assists us in identifying visitor preferences.
Opal has a legitimate interest in understanding how members, customers and potential customers use its website. This assists Opal with providing more relevant products and services, with communicating value to our sponsors and corporate members, and with providing appropriate staffing to meet member and customer needs.
Cookies and tracking technologies
Opal uses cookies to enhance your experience. We primarily use cookies to enable and support your log-in functionality. This helps us recognize you as a returning user and maintain your logged-in state. We do not use cookies for tracking or any other purpose. You can manage your cookie preferences in your browser settings. Please note that disabling cookies may affect your ability to use certain features of our website, including log-in functionalities. Any changes to our cookie policy will be posted on this page.
Sharing information with third parties
The personal information Opal collects from you is stored in one or more databases hosted by third parties located in the United States. These third parties do not use or have access to your personal information for any purpose other than cloud storage and retrieval. On occasion, Opal engages third parties to send information to you, including information about our products, services, and events.
A list of our third party sub processors can be found here:
We do not otherwise reveal your personal data to non-Opal persons or businesses for their independent use unless: (1) you request or authorize it; (2) it’s in connection with Opal-hosted and Opal co-sponsored conferences as described above; (3) the information is provided to comply with the law (for example, compelled by law enforcement to comply with a search warrant, subpoena, or court order), enforce an agreement we have with you, or to protect our rights, property or safety, or the rights, property or safety of our employees or others; (4) the information is provided to our agents, vendors or service providers who perform functions on our behalf; (5) to address emergencies or acts of God; or (6) to address disputes, claims, or to persons demonstrating legal authority to act on your behalf. We may also gather aggregated data about our services and website visitors and disclose the results of such aggregated (but not personally identifiable) information to our partners, service providers, advertisers, and/or other third parties for marketing or promotional purposes.
Transferring personal data to the U.S.
Opal has its headquarters in the United States. Information we collect about you will be processed in the United States. By using Opal’ services, you acknowledge that your personal information will be processed in the United States. The United States has not sought nor received a finding of “adequacy” from the European Union under Article 45 of the GDPR. Pursuant to Article 46 of the GDPR, Opal is providing for appropriate safeguards by entering binding, standard data protection clauses, enforceable by data subjects in the EEA and the UK. These clauses have been enhanced based on the guidance of the European Data Protection Board and will be updated when the new draft model clauses are approved.
Depending on the circumstance, Opal also collects and transfers to the U.S. personal data with consent; to perform a contract with you; or to fulfill a compelling legitimate interest of Opal in a manner that does not outweigh your rights and freedoms. Opal endeavors to apply suitable safeguards to protect the privacy and security of your personal data and to use it only consistent with your relationship with Opal and the practices described in this Privacy Statement. Opal also enters into data processing agreements and model clauses with its vendors whenever feasible and appropriate. Since it was founded, Opal has received zero government requests for information.
For more information or if you have any questions, please contact us at support@heyopal.com
Data Subject rights
The European Union’s General Data Protection Regulation (GDPR) and other countries’ privacy laws provide certain rights for data subjects. Data Subject rights under GDPR include the following:
Right to be informed
Right of access
Right to rectification
Right to erasure
Right to restrict processing
Right of data portability
Right to object
Rights related to automated decision making including profiling
This Privacy Notice is intended to provide you with information about what personal data Opal collects about you and how it is used.
If you wish to confirm that Opal is processing your personal data, or to have access to the personal data Opal may have about you, please contact us.
You may also request information about: the purpose of the processing; the categories of personal data concerned; who else outside Opal might have received the data from Opal; what the source of the information was (if you didn’t provide it directly to Opal); and how long it will be stored. You have a right to correct (rectify) the record of your personal data maintained by Opal if it is inaccurate. You may request that Opal erase that data or cease processing it, subject to certain exceptions. You may also request that Opal cease using your data for direct marketing purposes. In many countries, you have a right to lodge a complaint with the appropriate data protection authority if you have concerns about how Opal processes your personal data. When technically feasible, Opal will—at your request—provide your personal data to you.
Reasonable access to your personal data will be provided at no cost. If access cannot be provided within a reasonable time frame, Opal will provide you with a date when the information will be provided. If for some reason access is denied, Opal will provide an explanation as to why access has been denied.
For questions or complaints concerning the processing of your personal data, you can email us at support@heyopal.com. Alternatively, if you are located in the European Union, you can also have recourse to the European Data Protection Supervisor or with your nation’s data protection authority.
Data storage and retention
Your personal data is stored by Opal on its servers, and on the servers of the cloud-based database management services Opal engages, located in the United States. Opal retains service data for the duration of the customer’s business relationship with Opal and for a period of time thereafter, to analyze the data for Opal’ own operations, and for historical and archiving purposes associated with Opal’ services. Opal retains prospect data until such time as it no longer has business value and is purged from Opal systems. All personal data that Opal controls may be deleted upon verified request from Data Subjects or their authorized agents. For more information on where and how long your personal data is stored, and for more information on your rights of erasure and portability, please contact us at: support@heyopal.com
Data storage and retention of Personal Health Information
Opal processes Personal Health Information (PHI), and requires entering with us a Business Associate Agreement. Opal collects the following information on your behalf, but is not limited to:
Recordings of your client and/or yourself
Text regarding your client
Information regarding your client, including their full name
Opal stores and processes the following information on your behalf, but is not limited to:
Transcripts, summaries, and other contextualized information generated automatically
Opal retains recordings until its text transcript is generated. The recording is then immediately and irrecoverably deleted after 30 days.
Opal stores PHI for a given Note or generation request, including the transcript summaries, and other contextualized information generated automatically, for as long as the user holds an account with Opal, after which it is immediately deleted. The Covered Entity is fully responsible for abiding by all data retention requirements required by law, and does not hold Opal responsible for failing to retain client records as required.
Disclaimer
Opal uses generative artificial intelligence algorithms for creating inferred summaries, transcripts, and other related information. While Opal validates its models for safety, we provide no guarantee that outputs are truthful or accurate. Opal models are not guaranteed against producing output considered harmful, hurtful, or inaccurate.
Opal is not an Electronic Health Record (EHR) service, nor should the information contained on the Opal platform be considered official record for any legal, criminal, or insurance-related purposes. The Covered Entity is responsible for reviewing the information provided by Opal, approving, amending, and storing the required information as official record.
Children’s data
We do not knowingly attempt to solicit or receive information from children.
Questions, concerns or complaints
If you have questions, concerns, complaints, or would like to exercise your rights, please contact us at:
Numa Notes
228 Park Ave S
PMB 64181
New York, New York 10003-1502 US
support@heyopal.com