VisionPath Privacy Policy

1. Who we are

VisionPath LLC ("VisionPath", "we", "us") makes practice management software for optical stores in Canada and the United States. This policy explains what personal information we handle, why, where it is kept and what choices you have.

Our Privacy Officer is Ibrahim Salam, who can be reached at info@visionpath.app.

2. Two different roles

For people who visit our website, contact us, or work at a store that uses VisionPath, we decide how their information is used, and this policy describes it.

For patients of the optical stores that use VisionPath, the store is responsible for their information. VisionPath holds and processes it only on the store's behalf and on its instructions, under our service agreement with that store. If you are a patient, the store's own privacy practices apply, and requests about your records should go to the store; we help the store answer them.

3. What we collect

Website visitors: what you choose to send us, such as your name, store and email when you ask for a demo, and the technical information any website receives, such as your IP address and browser type, in our hosting provider's logs. Our website loads its fonts from Google Fonts, so your browser also sends your IP address to Google when you view it. We do not use analytics, advertising or tracking scripts.

Store staff: your name, email address, role and permissions, and a record of your sign-ins and of the changes you make in the software, kept so the store can see who did what.

Patients, on behalf of their store: contact details, date of birth, health card or insurance details, prescriptions, eye examination records, purchases and payments, orders sent to labs, appointments, messages sent to you, forms you complete in the patient portal, and files the store attaches to your record.

4. How we use it

To provide the software to stores and let them serve their patients: record visits and sales, send lab orders, check insurance where the store turns this on, book appointments, and send the reminders and messages the store chooses to send.

To sign people in securely, keep an audit log, support stores, fix problems, and protect the service against misuse.

We do not sell personal information. We do not use patients' information to market to them ourselves, and we do not use anyone's information to train artificial intelligence models.

5. The AI features

Some optional features use artificial intelligence provided by Anthropic: reading a photographed work order or printout, the assistant staff can ask to look things up or carry out tasks, and the exam scribe that drafts a record from a doctor's dictation. When staff use these features, the information needed for the task is sent to Anthropic to produce the result. Anthropic processes it on our behalf under its commercial terms and does not use it to train its models.

Everything these features produce is a draft for a person at the store to check before it is used.

6. Where information is kept

For stores in Canada, patient records and attached files are stored in Canada. Some features process information in the United States through the providers listed in section 7: email, text messages and the AI features. Information processed outside Canada may be accessible to the authorities of that country under its laws.

Before any store in the United States starts using VisionPath, its patient records will be stored in the United States.

7. Service providers

We use these providers to run the service, each bound by its own data protection terms: Supabase (database and file storage, Canada); Fly.io (application hosting, Canada); Postmark (email, United States); Twilio (text messages, United States); Anthropic (the artificial intelligence features, United States); and, for United States stores that turn it on, Stedi (insurance eligibility checks, United States).

We share personal information only with these providers, with the store it belongs to, or when the law requires us to. If VisionPath is sold or merged, the information would pass to the new owner under the same commitments.

8. How we protect it

Information is encrypted in transit. Each business's information is kept separate from every other business's, and each staff member has only the permissions their role allows. Sign-in uses a one-time code sent by email. The software logs who opens a patient's record or exam, who opens their attached files, and every change made to their records. Access by VisionPath is limited to what is needed to run and support the service.

If a breach affects a store's patients, we tell the store promptly and help it notify the people affected, as our service agreement requires.

9. How long we keep it

Patient information is kept for as long as the store keeps its account, since the store decides its own retention under the rules for health records. When a store leaves, we return its information on request and then delete it, as described in our service agreement.

Information about website visitors and people who contact us is kept for as long as it is useful for that conversation, and deleted on request.

10. Your choices and rights

Patients can ask their store to see or correct their records, and can tell the store to stop sending them text messages or email; the software stops messaging anyone who opts out on that channel.

Anyone can ask us what information we hold about them, ask us to correct it, or complain about how we handled it, by writing to info@visionpath.app. If you are not satisfied with our answer, you may contact the Office of the Privacy Commissioner of Canada, the Information and Privacy Commissioner of Ontario, or the regulator where you live.

11. Cookies

VisionPath uses only the cookies it needs to work: oc_session and oc_store keep store staff signed in and remember which location they are working in; vp_patient and vp_patient_pick keep a patient signed in to the portal; and vp_setup_hidden remembers that an owner hid the setup checklist. We use no advertising or tracking cookies.

12. Changes to this policy

We will post any change here with a new date, and tell stores directly about significant changes.