Privacy Policy

This Privacy Policy explains how Omnisales, Inc. ("we," "us," or "our") collects, uses, protects, and retains information in connection with our dental insurance verification services operated under the name Azops Dental (the "Services").

The Services are operated by Omnisales, Inc., a Delaware corporation providing AI-assisted dental insurance verification for dental practices.

1. Who This Policy Applies To

This policy applies to:

• Our customers, including dental practices and organizations, and their authorized users;
• Individuals whose information we process to perform insurance verifications, such as patients and policyholders, on behalf of and under the instructions of our customers; and
• Prospective customers who submit information through our public intake process before creating an account.

2. Information We Collect

We collect the following categories of information.

Information provided to us

• Contact and account details, such as name, email address, phone number, and company or practice name;
• Provider and practice identifiers, such as provider NPI, Tax ID, state license number, and clinic name and address;
• Pre-trial intake information submitted by prospective customers through our public intake process before signup, including practice information and Business Associate Agreement (BAA) e-signature records; and
• Payment information, such as credit card and related payment details, used to process payments for the Services.

Account and authentication data

• Login credentials and multi-factor authentication data;
• Insurance-portal credentials, along with two-factor authentication codes and forwarding details required to complete portal logins; and
• Where a customer chooses to connect an email mailbox under a separate authorization, associated access credentials.

Passwords are hashed and salted. Tokens, credentials, and similar secrets are stored using encryption.

Health and insurance information

We process the following information on behalf of, and under the instructions of, our customers. Some of this information may constitute Protected Health Information (PHI) under HIPAA:

• Patient names, dates of birth, and addresses;
• Insurance policy and member numbers, group numbers, and plan and coverage information;
• Insurance card images;
• Call audio recordings and transcripts of verification calls;
• Fax documents received from insurance companies;
• Provider-portal screenshots captured during verification; and
• Eligibility responses received from insurers and clearinghouses.

Usage information

We collect service usage data, such as the number of verifications performed, to operate, support, secure, and improve the Services.

3. How We Use Information

We use the information we collect to:

• Provide and operate the Services, including performing insurance verifications;
• Process verification results using automated systems, including AI systems operated on infrastructure designed to support HIPAA-compliant processing, to interpret call transcripts and documents and extract benefit information;
• Transcribe verification call recordings to produce a usable record of the verification;
• Synchronize with a customer's practice management system to identify patients relevant to a verification;
• Process payments for the Services;
• Track service usage, such as verification volume, to operate, support, secure, and improve the Services;
• Maintain security and prevent misuse;
• Communicate with customers; and
• Comply with legal and regulatory obligations.

4. HIPAA and Healthcare Compliance

We operate as a Business Associate under HIPAA when we process PHI on behalf of our customers. We sign Business Associate Agreements with our customers as part of standard onboarding, and we maintain administrative, technical, and physical safeguards designed to protect PHI.

When a vendor or subcontractor requires access to PHI to help us provide the Services, we require appropriate contractual protections, including a Business Associate Agreement where required.

We process health information only as a service provider or Business Associate and according to our customers' instructions.

5. Data Storage, Retention, and De-Identification

We retain personal information for as long as necessary to provide the Services and to meet legal, contractual, and operational obligations.

Specific practices include:

• Verification data that contains PHI, including call recordings, transcripts, eligibility responses, insurance card images, fax documents, and provider-portal screenshots, is retained in identifiable form only as necessary to provide the Services and is de-identified after three months.
• We de-identify PHI using the HIPAA Safe Harbor method.
• After de-identification, we may retain de-identified benefit-verification information for up to two years. This may include plan and coverage information, extracted benefit details, and de-identified transcripts or verification records without direct identifiers.
• We do not attempt to re-identify de-identified information and do not use de-identified information to identify, contact, profile, or make decisions about a specific patient.
• Patient records synchronized from a customer's practice management system that are not relevant to a verification are deleted within one month.
• Compliance records, such as BAA and e-signature records, are retained as required for legal and regulatory purposes.
• Data may be deleted earlier upon request, subject to applicable legal, contractual, operational, and security requirements.

6. Opt-Out and Deletion Requests

Customers may request to opt out of future processing, request deletion of credentials, revoke mailbox access, or request deletion of PHI where applicable.

Patients may also request deletion or opt out of future processing where applicable. Because we process patient information on behalf of our customers, we may need to coordinate patient requests with the relevant dental practice or organization.

We process verified opt-out and deletion requests within 72 hours, subject to applicable legal, contractual, operational, and security requirements.

7. Third-Party Service Providers

We work with trusted third-party service providers to operate our platform, including providers that support hosting and infrastructure, communications, and payment processing.

All such providers are contractually required to protect information, maintain appropriate security safeguards, and process information only according to our instructions. When a provider requires access to PHI, we require a Business Associate Agreement where required.

We do not sell personal data.

8. Cookies and Tracking

We use cookies and similar technologies. Some are strictly necessary for security, bot protection on our public forms, and core site functionality, and these are always on.

We also use advertising pixels from OpenAI, from Meta (the company behind Facebook and Instagram), and from Google. These pixels share limited information about the pages you visit on our site with those companies. We use them to measure which visits lead to a booked demo, and to show Azops Dental ads to people who have already visited our site. They load only if you have not opted out.

You can opt out at any time using the "Your Privacy Choices" link in our site footer, and we automatically honor Global Privacy Control browser signals. If you opt out, we do not load these advertising pixels on your browser.

9. Data Subject Rights

Subject to applicable law, you may request to:

• Access your personal data;
• Correct inaccurate data;
• Delete your data;
• Revoke mailbox access;
• Request deletion of credentials; and
• Opt out of future processing where applicable.

Requests can be submitted to sezer@azops.ai. We will respond in accordance with applicable data protection laws and, where relevant, our obligations to our customers under applicable agreements.

10. Security Measures

We maintain safeguards designed to protect personal and health information, including:

• Encrypted data transmission and storage;
• Hashing and salting of passwords;
• Encryption of stored credentials, tokens, and similar secrets;
• Access controls;
• Monitoring and logging; and
• SOC 2 controls.

11. Children's Privacy

The Services are intended for use by dental practices, organizations, and authorized users who are 18 or older. We do not knowingly collect account registration information from users under 18.

Because our customers may use the Services to verify insurance benefits for minor patients, we may temporarily process PHI relating to children on behalf of and under the instructions of our customers.

PHI relating to minor patients is subject to the same retention and de-identification practices described in this policy. We de-identify such PHI after three months using the HIPAA Safe Harbor method, delete direct identifiers and identifiable source data, and may retain de-identified benefit-verification information for up to two years. We do not attempt to re-identify de-identified information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be communicated as appropriate.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Omnisales, Inc.
455 Market St Ste 1940 PMB 530276
San Francisco, CA 94105-2448
United States
sezer@azops.ai