1. Introduction
CNCF Consulting ("we," "our," or "us") operates the SuccessfulSight application ("Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. We are committed to protecting your privacy and maintaining compliance with the Health Insurance Portability and Accountability Act (HIPAA) and other applicable privacy laws.
2. Information We Collect
2.1 Personal Information
We collect information that identifies, relates to, describes, or could reasonably be linked to you, including:
- Name and contact information (email address, phone number)
- Date of birth and demographic information
- Healthcare provider information
- Insurance information (if applicable)
- Account credentials
2.2 Health Information
As a healthcare-related application, we collect Protected Health Information (PHI) including:
- Vision assessment results
- Therapy progress data
- Clinical notes and observations
- Treatment plans and goals
- Activity performance metrics
- Attention tracking data (with consent)
2.3 Technical Information
We automatically collect certain technical information:
- Device information (iPad model, iOS version)
- App usage analytics
- Performance metrics
- Error logs and crash reports
- IP address (for security purposes)
3. How We Use Your Information
We use the collected information for:
- Providing vision therapy services
- Tracking and reporting therapy progress
- Communicating with healthcare providers
- Improving our Service
- Ensuring security and preventing fraud
- Complying with legal obligations
- Research and development (with de-identified data)
4. Data Sharing and Disclosure
4.1 Healthcare Providers
We share PHI with authorized healthcare providers involved in your care, including:
- Your vision therapist
- Supervising optometrists
- Other healthcare professionals as authorized
4.2 Authorized Users
Information may be shared with users you authorize:
- Household members (for minors)
- Designated caregivers
- Practice administrators
4.3 Service Providers
We work with trusted third-party services:
- Firebase (Google) for data storage and authentication
- Google Cloud Platform for infrastructure
- Apple for app distribution and notifications
4.4 Legal Requirements
We may disclose information when required by law, court order, or to protect rights and safety.
5. Data Security
We implement comprehensive security measures:
- End-to-end encryption for data transmission
- Encryption at rest for stored data
- Multi-factor authentication options
- Regular security audits and updates
- Access controls and audit logs
- HIPAA-compliant infrastructure
6. Data Retention
We retain your information for:
- Active accounts: Duration of service use
- Health records: As required by healthcare regulations (typically 7 years)
- Technical logs: 90 days
- De-identified research data: Indefinitely
7. Your Rights
Under HIPAA and applicable privacy laws, you have the right to:
- Access your personal and health information
- Request corrections to your information
- Request deletion (subject to legal requirements)
- Obtain a copy of your data
- Restrict certain uses of your information
- Opt-out of non-essential communications
- File a complaint with regulatory authorities
8. Children's Privacy
SuccessfulSight may be used by minors under supervision. We require:
- Parental/guardian consent for users under 18
- Healthcare provider oversight for all minor patients
- Limited data collection for minors
- Additional safeguards for minor accounts
9. International Data Transfers
Your data is stored in the United States. By using our Service, you consent to the transfer and processing of your information in the United States.
10. Analytics and Cookies
Our mobile application uses:
- Firebase Analytics for usage insights
- Crashlytics for error reporting
- Performance monitoring tools
You can opt-out of analytics in the app settings.
11. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of material changes via:
- In-app notifications
- Email to registered users
- Update notices on our website
12. Contact Information
For privacy-related questions or to exercise your rights:
13. HIPAA Notice
This application is designed to be HIPAA-compliant. Healthcare providers using SuccessfulSight must ensure they have appropriate Business Associate Agreements (BAAs) in place. For BAA requests, please contact: compliance@successfulsight.com
14. California Privacy Rights
California residents have additional rights under the California Consumer Privacy Act (CCPA). For more information or to exercise these rights, please contact us using the information above.
15. Dispute Resolution
Any disputes relating to this Privacy Policy will be resolved through binding arbitration in accordance with the Terms of Service.