Privacy Policy

1. Two roles: controller and processor

For this website, the console accounts of our customers and our own marketing, Optavius decides how and why personal data is processed. We are the controller under the GDPR and the responsible business under US state privacy laws.

When an Optavius agent answers calls, chats or messages for a practice, the practice decides how and why patient data is processed. The practice is the controller and, in the United States, the covered entity. Optavius acts as processor and business associate under a data processing agreement and, where HIPAA applies, a business associate agreement. The practice's own privacy notice applies to that data. We are not responsible for the privacy practices of our customers.

2. Information you give us

We collect the information you choose to provide.

• Contact and demo requests: name, work email, practice name, specialty, phone number and anything you write in a message or book through our scheduling tool.
• Demo line: when you call the demo number, the call is answered by an Optavius agent and recorded and transcribed so you can hear how it works. The recording is deleted within 30 days unless you ask us to keep it.
• Console accounts: name, email address, role, practice and the settings you change. The console logs who changed what, so your practice has an audit trail.
• Careers: the details in your application and CV, including anything you share through a third-party service such as LinkedIn.
• Correspondence: the content of emails and messages you send us, and whether you opened our emails or clicked a link in them.

3. Information we collect automatically

When you use the website or console we receive technical information from your device.

• Device information: IP address, from which we can infer a general location, device type, browser and operating system.
• Usage information: pages viewed, the site you came from, dates and times of visits, and interactions with the console.
• Cookies and similar technologies: see section 7. We ask for your consent before setting analytics or marketing cookies in the EU and UK.

4. Patient information handled for practices

Calls, transcripts, bookings, order status and messages that an Optavius agent handles for a practice contain personal data about patients, including health information. We process this data only on the practice's documented instructions and only to deliver the agreed service: answering, booking, escalating and reporting.

Callers are informed at the start of a call that they are speaking with an AI assistant and that the call is recorded, in line with the practice's policy and local law. Recordings and transcripts are stored for the retention period agreed with the practice and are then deleted or returned.

We do not sell patient data. We do not use identifiable patient data to train general-purpose models. Where a practice agrees, we may use de-identified, aggregated data to improve pathways and measure quality. De-identified data never contains names, contact details, dates of birth or other identifiers.

5. How we use information

We use the information described in sections 2 and 3 to:

• provide, maintain and improve the website, the console and our services;
• respond to demo requests, schedule meetings and provide support;
• send administrative messages, and marketing messages you can opt out of at any time;
• understand how the website and console are used and develop new features;
• detect and prevent fraud, abuse and security incidents;
• comply with legal obligations, enforce our terms and protect our rights and those of others;
• produce aggregated, de-identified statistics that no longer identify anyone.

6. How we share information

We share personal data only as described here.

• Service providers that host, transmit or process data on our behalf: cloud hosting in the EU and US, telephony carriers, speech and language model providers under contracts that prohibit training on your data, email and scheduling tools, analytics and customer support software. Each is bound by a data processing agreement.
• Our customers: information about calls and bookings is visible to the practice the agent works for.
• Professional advisers such as lawyers, auditors and insurers, under confidentiality.
• Authorities, when required by law, a court order or a lawful request, or to protect the safety of a person.
• A buyer or successor in a merger, acquisition or sale of assets, under this policy.
• Anyone else, with your consent.

7. Cookies and analytics

The website uses strictly necessary cookies to work. With your consent we use analytics cookies to understand how the site is used and marketing cookies to measure campaigns. You can change your choice at any time through the cookie settings link in the footer. Blocking cookies in your browser also works but may affect how the console behaves.

Our analytics and advertising partners may use cookies and similar technologies across services. You can opt out of personalised advertising through your browser settings and through industry opt-out pages such as youronlinechoices.eu and optout.aboutads.info.

8. Security

We protect data with encryption in transit and at rest, role-based access, multi-factor authentication for staff, logging of access to patient data, regular backups and independent testing. Patient data is hosted in the region of the practice: the EU for European practices, the US for American practices.

No system is completely secure. If we become aware of a breach that affects your data we will inform you and, where required, the supervisory authority without undue delay.

9. Retention

We keep contact and demo information for as long as we have a business relationship or a legitimate interest in staying in touch, and at most three years after our last contact. Console account data is kept for the life of the customer contract and deleted within 90 days after it ends, unless the law requires longer. Application data is deleted one year after a vacancy closes unless you ask us to keep it. Patient data is kept for the period agreed with the practice.

10. Your rights

If you are in the EU, the UK or Switzerland you can ask us to access, correct, delete or restrict your personal data, to receive a copy in a portable format, and to object to processing based on our legitimate interests, including direct marketing. You can withdraw consent at any time. You can also complain to your supervisory authority; in the Netherlands that is the Autoriteit Persoonsgegevens.

If you are in a US state with a consumer privacy law, such as California or Texas, you have similar rights to know, access, correct and delete your personal data and to opt out of the sale or sharing of personal data. We do not sell personal data. We will not discriminate against you for exercising your rights.

For patient data handled on behalf of a practice, please contact the practice. We will help the practice respond within the legal deadlines.

To exercise a right, email privacy@optavius.com. We may ask you to verify your identity first.

11. International transfers

Optavius operates from Amsterdam and Houston. Data may be processed in the EU and the US. Where personal data leaves the EU, the UK or Switzerland we rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses with additional safeguards.

12. Children

Our website and console are for professionals and are not directed to children. We do not knowingly collect personal data from anyone under 16 through the website. Patient data about children is handled for practices under section 4.

13. Changes to this policy

We post changes on this page with a new date at the top. If a change materially affects how we use personal data we already hold about you, we will tell you by email or in the console before it takes effect.

14. Contact

Optavius B.V., Amsterdam, the Netherlands, and Optavius Inc., Houston, Texas. Questions, requests and complaints: privacy@optavius.com.