Privacy Policy

For account and business information about our users, we decide how that information is used. For clinical information that customers submit about their patients, we act as a service provider and business associate: we process it on the customer’s behalf, under the customer’s instructions and our Business Associate Agreement. See our HIPAA & Business Associate Notice.

• Account information: name, work email, role, professional credentials, license and NPI details for specialists, and authentication data such as password hashes and multi-factor settings.
• Organization information: organization name, locations, fax destinations, plan and billing contacts.
• Clinical content: retinal images, clinical questions, context, messages and reports submitted through the Service. This is protected health information handled as described above.
• Usage and device information: log data such as IP address, browser type, timestamps and actions taken, used for security, auditing and reliability.
• Payment information: handled by our payment processor. We receive limited details such as the card brand, last four digits and billing status, not full card numbers.

• To provide the Service, including routing consultations to eligible specialists and delivering reports.
• To verify specialist credentials and state eligibility.
• To secure accounts, prevent misuse, keep audit records and meet legal obligations.
• To bill for subscriptions and credits and to provide support.
• To send service notifications. These are written to avoid including patient information.
• To maintain and improve the Service using aggregated, de-identified operational metrics.

We do not sell personal information or protected health information, and we do not share it for cross-context behavioral advertising. We do not load advertising pixels or third-party analytics trackers inside the signed-in application.

The signed-in application uses only essential cookies, such as the session cookie that keeps you signed in. See our Cookie Notice for details.

We share information only as needed to operate the Service:

• With the specialists and destinations a customer chooses, such as the accepting retina specialist or a configured fax number.
• With subprocessors that provide hosting, databases, file storage, email delivery, payment processing and fax delivery. Subprocessors that handle protected health information are bound by appropriate agreements.
• When required by law, legal process or to protect the rights, safety and security of patients, users or the Service.
• As part of a merger, acquisition or similar transaction, subject to continued protection of the information.

We use administrative, technical and physical safeguards designed to protect information, including encryption in transit and at rest, role-based access controls, multi-factor authentication, short-lived signed links for images and reports, and audit logging of access to clinical content. No system is perfectly secure, and we cannot guarantee absolute security.

We keep information for as long as needed to provide the Service and as required by our customer agreements, medical record retention rules and other legal obligations. Audit records are retained for compliance purposes. When information is no longer needed, we delete or de-identify it.

You can review and update your account information in the Service. To request access, correction or deletion of personal information we control, contact privacy@retinadirect.com. Depending on where you live, state privacy laws may give you additional rights, and we will respond as those laws require.

Patients who want access to or correction of their health information should contact their healthcare provider, who controls those records. We will assist our customers in responding as required by our agreements and HIPAA.

The Service is intended for healthcare professionals and is not directed to children. We do not knowingly collect personal information from children through accounts.

The Service is hosted in the United States, and information is processed and stored in the United States.

We may update this Privacy Policy. If a change is material, we will provide notice through the Service or by email before it takes effect.

Helios Med LLC. Privacy questions and requests: privacy@retinadirect.com.