EyeGoal is a multi-tenant optical practice-management platform operated by Caribbean Ophthalmics Corp. ("EyeGoal", "we", "us"). This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to eyegoal.com and the EyeGoal applications.
We collect information needed to provide the service:
To deliver, secure, and improve the platform; to process orders and payments; to provide support; to meet legal, billing, and audit obligations. We do not sell personal information or PHI.
For patient PHI, EyeGoal acts as a Business Associate to the eye-care practice (the Covered Entity) under HIPAA. We process PHI only as permitted by our Business Associate Agreement and applicable law. See our HIPAA Compliance Policy.
We use trusted infrastructure and service providers, including Amazon Web Services (hosting, storage, email), Stripe and Clover (payments), and error/operational monitoring. Each is bound by contractual confidentiality and, where PHI is involved, a Business Associate Agreement.
We use strictly-necessary cookies for authentication and session security, and privacy-respecting analytics to understand usage. We do not place PHI in URLs, cookies, or third-party analytics.
We retain account and transactional data for as long as your practice maintains an account and as required by law. PHI and audit logs are retained per HIPAA requirements (audit logs for at least six years). On termination, data is returned or destroyed per the Business Associate Agreement.
We protect data with encryption in transit and at rest, role-based access control, tenant isolation, audit logging, and least-privilege practices. No system is perfectly secure; we maintain an incident-response and breach-notification process (see the HIPAA policy).
Depending on your jurisdiction (including GDPR/CCPA where applicable), you may have rights to access, correct, delete, or port your information, and to object to certain processing. Patients should direct PHI requests to their eye-care practice (the Covered Entity); we support practices in fulfilling them.
Questions or requests: privacy@eyegoal.com. We will respond within a reasonable timeframe and within any period required by law.